diff --git a/.agents/skills/update-sqlx/SKILL.md b/.agents/skills/update-sqlx/SKILL.md
index ce4eaa5ff7..ccbd7baf3d 100644
--- a/.agents/skills/update-sqlx/SKILL.md
+++ b/.agents/skills/update-sqlx/SKILL.md
@@ -9,11 +9,75 @@ Windmill uses `SQLX_OFFLINE=true` in CI, which requires all `sqlx::query!` / `sq
 
 ## When to Run
 
-Run after any change to SQL queries in Rust source files. Without it, CI will fail with:
+Run after **adding or editing** a SQL query in Rust source. Without it, CI fails with:
 ```
 error: `SQLX_OFFLINE=true` but there is no cached data for this query
 ```
 
+**Do NOT run it when a change only *removes* queries.** The cache is already complete for
+CI; all that is left are orphaned entries, which are cosmetic and never break a build.
+Running `prepare` to tidy them risks destroying the cache for no gain. Delete them
+offline instead: for each `.sqlx/query-*.json`, normalize its `query` field (strip `\`
+line-continuations, collapse whitespace) and check whether it still appears in any `.rs`
+file. That detector reports ~48 false positives in a CE checkout — EE queries live in
+`*_ee.rs` symlinks it cannot read — so **filter to the tables your change touched** and
+delete only those.
+
+## Before You Run Anything
+
+1. **Back the cache up.** `prepare` deletes `.sqlx/` *before* regenerating, so any compile
+   failure leaves it gutted (observed: 2350 → 142 entries).
+   ```bash
+   cp -r backend/.sqlx /tmp/sqlx_backup    # restore with: rm -rf backend/.sqlx && cp -r /tmp/sqlx_backup backend/.sqlx
+   ```
+2. **Point `DATABASE_URL` at THIS worktree's database.** `prepare` compiles every
+   `sqlx::query!` against the **live** database. Another worktree's DB lacks your
+   migrations, so every new-table query fails and takes the cache down with it. The
+   symptom is `relation "<your_new_table>" does not exist` — that is a wrong
+   `DATABASE_URL`, not a broken query. See AGENTS.md → "Per-worktree ports and database".
+
+## Queries Inside Tests Need `--all-targets`, Which Fails In A CE Checkout
+
+`prepare` only caches queries in code it compiles, and `--workspace` alone does **not**
+compile test targets. A `sqlx::query!` inside `tests/*.rs` therefore gets no entry, and CI
+fails on the test target with the usual "no cached data" error even though the lib built
+clean. `SQLX_OFFLINE=true cargo check --workspace --all-targets` is what reproduces it.
+
+Adding `--all-targets` caches them — and, in a CE checkout, **aborts partway through**:
+`backend/tests/otel.rs` imports `windmill_common::otel_ee`, which exists only behind the
+`private` feature, so the compile dies after `prepare` has already emptied `.sqlx/`.
+Observed: 2435 → 4 entries, `error: cargo check failed with status: exit status: 101`.
+
+Do not fight it — the abort is a pre-existing EE gap, not something your change caused.
+Take the entries you need and put the backup back:
+
+```bash
+cd backend
+cp -r .sqlx /tmp/sqlx_backup
+ls /tmp/sqlx_backup | sort > /tmp/before.txt
+
+DATABASE_URL=<this worktree's db> \
+  cargo sqlx prepare --workspace -- --workspace --features all_sqlx_features --all-targets
+# expected to fail; it still wrote the entries it got to before dying
+
+ls .sqlx | sort > /tmp/after.txt
+mkdir -p /tmp/newq
+comm -13 /tmp/before.txt /tmp/after.txt | while read f; do cp ".sqlx/$f" /tmp/newq/; done
+
+rm -rf .sqlx && cp -r /tmp/sqlx_backup .sqlx && cp /tmp/newq/*.json .sqlx/
+```
+
+**Read every file in `/tmp/newq` before copying it in** — print each one's `query` field and
+confirm it is one of yours. The set is small (one per new test query), and anything else in
+there means the run got further than you think.
+
+Then verify both targets, since the lib passing says nothing about the tests:
+
+```bash
+SQLX_OFFLINE=true cargo check --workspace --features all_sqlx_features   # lib
+SQLX_OFFLINE=true cargo check -p <your-crate> --all-targets              # tests
+```
+
 ## The Problem
 
 `cargo sqlx prepare --workspace` **deletes all existing cache files** and regenerates only the ones found in the current compilation. If you don't compile with every feature flag (especially `private` for EE files), you will **silently delete EE query caches**, breaking CI for enterprise tests.
@@ -68,7 +132,16 @@ But if it fails with EE compilation errors, use the safe procedure above.
 
 - **Never** run `cargo sqlx prepare --workspace` with only OSS features and commit the result — it will delete EE caches.
 - **Never** set `SQLX_OFFLINE=true` for local `cargo sqlx prepare` — use a live database per CLAUDE.md. (CI runs with `SQLX_OFFLINE=true`, which is why the cache must be complete.)
+- **Never** run `prepare` without a `.sqlx` backup, or against a `DATABASE_URL` you have not confirmed belongs to this worktree.
+- **Never** run `prepare` at all for a removal-only change.
 - **Never** skip the verification step (step 4 above).
+- **Never** leave a `--all-targets` run's output in place after it aborts — it is a
+  near-empty cache. Restore the backup and graft on only the entries you verified.
+
+Step 4 compares against `origin/main` because step 1 restored from it, so the two agree.
+If you did **not** run step 1 — auditing a branch's cache on its own, say — compare
+against `git merge-base HEAD origin/main` instead: `origin/main` advances, so its newer
+entries would read as losses on your branch.
 
 ## Verification
 
diff --git a/.claude/hooks/allow-fileops-in-tmp.sh b/.claude/hooks/allow-fileops-in-tmp.sh
new file mode 100755
index 0000000000..ce2ce81831
--- /dev/null
+++ b/.claude/hooks/allow-fileops-in-tmp.sh
@@ -0,0 +1,179 @@
+#!/usr/bin/env bash
+# PreToolUse allowance for scratch file ops: auto-allow a single, plain, single-line
+# `mkdir` / `cp` / `mv` / `touch` / `chmod` / `tar` / `unzip` whose every path operand
+# resolves under /tmp. Anything else makes no decision (exit 0) and falls back to the normal
+# permission flow — where `Bash(mv:*)` and `Bash(chmod:*)` in the `ask` list prompt. A
+# PreToolUse `allow` overrides those ask rules, which is why this is a hook and not an allow
+# rule: permission rules match a command prefix, so they can only constrain the FIRST operand.
+# `cp /tmp/x ~/.zshrc` matches a `cp /tmp/` prefix, and requiring every operand is the point.
+#
+# Requiring the sources under /tmp too (not just the destination) keeps this from becoming a
+# read-exfiltration path around the `Read(**/.env)` / `Read(**/secrets/**)` deny rules: a copy
+# out of the project into /tmp would land the content somewhere `Read(/tmp/**)` allows.
+#
+# Deny-by-default tokenizing, in the same spirit as guard-rm-outside-tmp.sh: every path token
+# must consist only of alphanumerics and `. _ / -`. That set contains none of the characters
+# bash uses for quoting, expansion, or command separation ($ ` ~ { } ( ) ' " \ ; & | < >), nor
+# any glob character, so all of those forms fail by construction. `realpath -m` then resolves
+# `..` and existing symlinks, so `/tmp/link` pointing at /etc/passwd is caught.
+#
+# `tar` and `unzip` get their own parser: their write destination arrives as a flag VALUE
+# (`-C`, `-d`) rather than a positional, and a bundle like `-xzf` consumes the token after it.
+# Flags are an allowlist, not a denylist, so `-P` / `--absolute-names` — which turn off tar's
+# refusal to extract `..` and absolute member paths — defer rather than needing enumeration.
+# Extraction additionally requires an explicit destination under /tmp, or a cwd already under
+# /tmp, since otherwise members land in the project checkout.
+#
+# Residual risk accepted: an archive whose members include a symlink pointing out of /tmp
+# followed by a write through it can still escape, because tar applies member symlinks as it
+# extracts. The archive itself must be under /tmp to get here, so this is a hazard only for
+# archives fetched from an untrusted source into the scratch dir.
+#
+# Assumes GNU `realpath` (-m) and `jq`, both present in this repo's Linux dev env.
+set -uo pipefail
+
+input=$(cat)
+command -v jq >/dev/null 2>&1 || exit 0
+cmd=$(printf '%s' "$input" | jq -r '.tool_input.command // empty' 2>/dev/null)
+[ -z "$cmd" ] && exit 0
+cwd=$(printf '%s' "$input" | jq -r '.cwd // empty' 2>/dev/null)
+
+# A newline separates commands, and the tokenizer below only reads the first line — defer.
+case "$cmd" in *$'\n'*) exit 0 ;; esac
+
+read -r -a toks <<< "$cmd"
+
+# 0 iff the token is charset-safe and resolves to a path strictly inside /tmp.
+under_tmp() {
+  local t="$1" canon
+  # Globs never auto-allow. Bash expands them only after this hook has decided, so realpath
+  # sees the unexpanded pattern: `/tmp/link*` canonicalizes to itself and passes, then
+  # expands onto a symlink whose target is outside /tmp. chmod and cp follow command-line
+  # symlinks, so that is a write to the target. guard-rm-outside-tmp.sh can allow globs
+  # because `rm` unlinks the symlink itself rather than following it.
+  case "$t" in *[*?[]*) return 1 ;; esac
+  [ -n "$(printf '%s' "$t" | tr -d 'A-Za-z0-9._/-')" ] && return 1
+  # Absolute only. Resolving a relative operand against the cwd makes any bare word look like
+  # a safe path whenever the cwd is under /tmp, while the tool itself reads it as an option:
+  # `tar P -xf ...` is --absolute-names, not ./P, and `cp /tmp/t -RL /tmp/o` is a
+  # dereferencing recursive copy, not a file named -RL.
+  case "$t" in /*) ;; *) return 1 ;; esac
+  canon=$(realpath -m -- "$t" 2>/dev/null)
+  [ -n "$canon" ] || return 1
+  # /tmp itself is never a target — only paths strictly inside it.
+  case "$canon" in /tmp/?*) return 0 ;; esac
+  return 1
+}
+
+allow() {
+  jq -nc --arg r "$1" '{hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"allow",permissionDecisionReason:$r}}'
+  exit 0
+}
+
+# Bare command word only; wrappers (`timeout cp`), env prefixes, and `/bin/cp` defer.
+# Options are an allowlist per command, so anything that changes how symlinks are followed
+# defers instead of needing enumeration. `cp -L` / `-H` matter most: they dereference while
+# recursing, which copies the CONTENT of a symlink target from outside /tmp into a scratch
+# dir that `Read(/tmp/**)` then exposes. Plain `-r` and `-a` (which implies `-d`) recreate
+# such a symlink as a symlink instead, so no outside content is materialized.
+case "${toks[0]:-}" in
+  mkdir) takes_mode=0; ok_opts='pv' ;;
+  cp)    takes_mode=0; ok_opts='rRvfnpa' ;;
+  mv)    takes_mode=0; ok_opts='vfn' ;;
+  touch) takes_mode=0; ok_opts='acmv' ;;
+  chmod) takes_mode=1; ok_opts='Rvfc' ;;   # chmod's first operand is a mode, not a path
+  tar)   ok_flags='xctzjJavfC'; val_flags='fC' ;;
+  unzip) ok_flags='oqnljvd';    val_flags='d'  ;;
+  *) exit 0 ;;
+esac
+
+# ---------------------------------------------------------------- tar / unzip
+if [ -n "${ok_flags:-}" ]; then
+  saw_archive=0 saw_dest=0 extracting=0 listing=0 end_opts=0
+  i=1
+  while [ "$i" -lt "${#toks[@]}" ]; do
+    t="${toks[$i]}"
+    i=$((i + 1))
+    if [ "$end_opts" = 0 ]; then
+      [ "$t" = "--" ] && { end_opts=1; continue; }
+      case "$t" in
+        -?*)
+          flags="${t#-}"
+          # Allowlist: a long option, -P/--absolute-names, --transform, -I and friends all
+          # leave a residue here and defer rather than being enumerated as denials.
+          [ -n "$(printf '%s' "$flags" | tr -d "$ok_flags")" ] && exit 0
+          case "$flags" in *x*) extracting=1 ;; esac
+          case "${toks[0]}$flags" in unzip*[lv]*) listing=1 ;; esac
+          # A flag consuming the next token must be alone in its bundle's final position
+          # (`-xzf a.tar`), else the token it eats is ambiguous.
+          case "${flags%?}" in *[$val_flags]*) exit 0 ;; esac
+          case "${flags: -1}" in
+            [$val_flags])
+              val="${toks[$i]:-}"
+              i=$((i + 1))
+              [ -n "$val" ] || exit 0
+              under_tmp "$val" || exit 0
+              case "${flags: -1}" in
+                f) saw_archive=1 ;;
+                C | d) saw_dest=1 ;;
+              esac
+              ;;
+          esac
+          continue
+          ;;
+      esac
+    fi
+    # Positional. For tar these are sources (create) or member names (extract); for unzip the
+    # first is the archive. Requiring every one under /tmp is conservative for member names,
+    # which are not filesystem paths — those defer rather than being wrongly allowed.
+    under_tmp "$t" || exit 0
+    [ "${toks[0]}" = "unzip" ] && saw_archive=1
+  done
+
+  [ "$saw_archive" = 1 ] || exit 0   # tar without -f reads a tape/stdin; unzip needs an archive
+  # Writes land relative to the working directory unless a destination was given. `unzip -l`
+  # and `-v` only list, so they need no destination.
+  if [ "$extracting" = 1 ] || { [ "${toks[0]}" = "unzip" ] && [ "$listing" = 0 ]; }; then
+    [ "$saw_dest" = 1 ] || under_tmp "${cwd:-$PWD}" || exit 0
+  fi
+  allow "archive paths and extraction target are under /tmp"
+fi
+
+# ------------------------------------------- mkdir / cp / mv / touch / chmod
+path_operand=0
+seen_mode=0
+end_opts=0
+i=1
+while [ "$i" -lt "${#toks[@]}" ]; do
+  t="${toks[$i]}"
+  i=$((i + 1))
+
+  if [ "$end_opts" = 0 ]; then
+    [ "$t" = "--" ] && { end_opts=1; continue; }
+    # Checked at any position, not just before the first operand: GNU utils permute, so
+    # `cp /tmp/tree -RL /tmp/out` still enables dereferencing recursion.
+    case "$t" in
+      -?*)
+        # Allowlist: long options and the dereferencing flags leave a residue and defer.
+        [ -n "$(printf '%s' "${t#-}" | tr -d "$ok_opts")" ] && exit 0
+        continue
+        ;;
+    esac
+  fi
+
+  # chmod: consume the mode operand without a path check. Octal, or symbolic clauses.
+  if [ "$takes_mode" = 1 ] && [ "$seen_mode" = 0 ]; then
+    case "$t" in
+      [0-7] | [0-7][0-7] | [0-7][0-7][0-7] | [0-7][0-7][0-7][0-7]) ;;
+      *) printf '%s' "$t" | grep -Eq '^[ugoa]*[+=-][rwxXst]*(,[ugoa]*[+=-][rwxXst]*)*$' || exit 0 ;;
+    esac
+    seen_mode=1
+    continue
+  fi
+
+  under_tmp "$t" || exit 0
+  path_operand=1
+done
+
+[ "$path_operand" = 1 ] || exit 0
+allow "every path operand is under /tmp"
diff --git a/.claude/hooks/format-frontend.sh b/.claude/hooks/format-frontend.sh
index 37c3f8d4ec..14b2c2d97c 100755
--- a/.claude/hooks/format-frontend.sh
+++ b/.claude/hooks/format-frontend.sh
@@ -10,8 +10,12 @@ if [ -z "$FILE_PATH" ]; then
     exit 0
 fi
 
-# Check if the file is in the frontend directory
-if [[ "$FILE_PATH" == *"/frontend/"* ]]; then
+# Only the frontend app itself, i.e. a "frontend" directory sitting at a repo root.
+# A bare */frontend/* substring also matches ai_evals/adapters/frontend and the
+# ai_evals app fixtures, which no prettier config governs — prettier then falls back
+# to its defaults and rewrites the whole file. Anchoring to $CLAUDE_PROJECT_DIR
+# instead would skip worktrees edited from a session rooted elsewhere.
+if [[ "$FILE_PATH" == *"/frontend/"* ]] && [[ -e "${FILE_PATH%%/frontend/*}/.git" ]]; then
     # Check if it's a formattable file type
     if [[ "$FILE_PATH" =~ \.(ts|js|svelte|json|css|html|md)$ ]]; then
         cd "$CLAUDE_PROJECT_DIR/frontend" || exit 0
diff --git a/.claude/settings.json b/.claude/settings.json
index eeb3683842..641ea70b53 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -48,18 +48,6 @@
       "Read(/tmp/**)",
       "Write(/tmp/**)",
       "Edit(/tmp/**)",
-      "Bash(mkdir:/tmp/*)",
-      "Bash(mkdir:/tmp/**)",
-      "Bash(cp:/tmp/*)",
-      "Bash(cp:/tmp/**)",
-      "Bash(mv:/tmp/*)",
-      "Bash(mv:/tmp/**)",
-      "Bash(touch:/tmp/*)",
-      "Bash(touch:/tmp/**)",
-      "Bash(chmod:/tmp/*)",
-      "Bash(chmod:/tmp/**)",
-      "Bash(tar * /tmp/*)",
-      "Bash(unzip * /tmp/*)",
       "mcp__claude_ai_Gmail__search_threads",
       "mcp__claude_ai_Gmail__get_thread",
       "mcp__claude_ai_Gmail__get_message",
@@ -124,6 +112,11 @@
             "type": "command",
             "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/guard-rm-outside-tmp.sh",
             "timeout": 5
+          },
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/allow-fileops-in-tmp.sh",
+            "timeout": 5
           }
         ]
       }
diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000000..8ceb8e722a
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,3 @@
+# Files a generator owns. Collapsed in review diffs and left out of language
+# stats: reviewing them means reviewing the generator instead.
+*.gen.ts linguist-generated=true
diff --git a/.github/scripts/check-docs-links.mjs b/.github/scripts/check-docs-links.mjs
index 122d098197..f03b956d9f 100644
--- a/.github/scripts/check-docs-links.mjs
+++ b/.github/scripts/check-docs-links.mjs
@@ -15,6 +15,11 @@ const CONCURRENCY = 24
 const TIMEOUT_MS = 20000
 const RETRIES = 2
 
+// Links whose target page is written but not yet deployed on windmill.dev: the app
+// link is already the final slug, so a 404 is expected until the docs side ships.
+// The value is why the entry exists, for whoever has to judge whether it still should.
+const PENDING_DEPLOY = new Map()
+
 async function walk(dir) {
 	const out = []
 	for (const entry of await readdir(dir, { withFileTypes: true })) {
@@ -111,16 +116,45 @@ async function worker() {
 }
 await Promise.all(Array.from({ length: CONCURRENCY }, worker))
 
-const failures = results.filter((r) => !r.ok)
-if (failures.length === 0) {
-	console.log(`\n✅ All ${allUrls.length} docs links are reachable.`)
+// An entry claims one thing — the page is not published yet — and 404 is the only
+// answer that means it. A timeout, 403 or 5xx on the same URL is a real fault, and
+// suppressing it would also read as "still waiting" and defer the staleness check.
+const isPendingDeploy = (r) => PENDING_DEPLOY.has(r.url) && r.status === 404
+
+const pending = results.filter((r) => PENDING_DEPLOY.has(r.url))
+const waiting = results.filter(isPendingDeploy)
+if (waiting.length) {
+	console.log(`\n⏳ ${waiting.length} link(s) waiting on a docs deploy:`)
+	for (const p of waiting.sort((a, b) => a.url.localeCompare(b.url))) {
+		console.log(`   ${p.url}\n     ${PENDING_DEPLOY.get(p.url)} — not live yet (${p.status})`)
+	}
+}
+
+// An entry that outlived its reason exempts a URL from the check forever, so a stale
+// one has to fail the job: a line in a green log is not read at release time.
+const stale = [
+	...pending.filter((p) => p.ok).map((p) => [p.url, 'the page is live']),
+	...[...PENDING_DEPLOY.keys()].filter((u) => !urls.has(u)).map((u) => [u, 'nothing references it'])
+]
+
+const failures = results.filter((r) => !r.ok && !isPendingDeploy(r))
+if (failures.length === 0 && stale.length === 0) {
+	console.log(`\n✅ No broken docs links (${allUrls.length} checked).`)
 	process.exit(0)
 }
 
-console.log(`\n❌ ${failures.length} broken docs link(s):`)
-for (const f of failures.sort((a, b) => a.url.localeCompare(b.url))) {
-	console.log(`\n  ${f.url}`)
-	console.log(`    status: ${f.error ? `error (${f.error})` : f.status}`)
-	for (const file of urls.get(f.url)) console.log(`    ↳ ${file}`)
+if (failures.length) {
+	console.log(`\n❌ ${failures.length} broken docs link(s):`)
+	for (const f of failures.sort((a, b) => a.url.localeCompare(b.url))) {
+		console.log(`\n  ${f.url}`)
+		console.log(`    status: ${f.error ? `error (${f.error})` : f.status}`)
+		for (const file of urls.get(f.url)) console.log(`    ↳ ${file}`)
+	}
+}
+if (stale.length) {
+	console.log(`\n❌ ${stale.length} PENDING_DEPLOY entr(ies) to delete from this script:`)
+	for (const [url, why] of stale.sort((a, b) => a[0].localeCompare(b[0]))) {
+		console.log(`\n  ${url}\n    ${why}`)
+	}
 }
 process.exit(1)
diff --git a/.github/workflows/ai-evals-test.yml b/.github/workflows/ai-evals-test.yml
index 6bf7e50f3c..3ee7aed876 100644
--- a/.github/workflows/ai-evals-test.yml
+++ b/.github/workflows/ai-evals-test.yml
@@ -77,9 +77,11 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          # Node 22.19+ is required by the frontend's undici 8.x, which the
+          # Node 24 ships npm 11, which frontend/package-lock.json is authored
+          # with; npm 10 rejects it ("Missing: picomatch@4.0.5 from lock file").
+          # Node must also stay >= 22.19 for the frontend's undici 8.x, which the
           # Vitest bridge loads; Node 20 fails with markAsUncloneable.
-          node-version: "22"
+          node-version: "24"
 
       # CE build used only as the AI proxy (login, workspace, provider resource,
       # /ai/proxy). No worker execution or MCP needed — global tools/drafts run
@@ -116,6 +118,12 @@ jobs:
           npm ci
           npm run generate-backend-client
 
+      - name: Run harness unit tests
+        working-directory: ./ai_evals
+        run: |
+          bun install
+          bun test adapters/
+
       - name: Run global AI evals
         timeout-minutes: 20
         working-directory: ./ai_evals
diff --git a/.github/workflows/check-write-access.yml b/.github/workflows/check-write-access.yml
index 5e9494e74a..097fc3b3dd 100644
--- a/.github/workflows/check-write-access.yml
+++ b/.github/workflows/check-write-access.yml
@@ -30,8 +30,14 @@ jobs:
     outputs:
       authorized: ${{ steps.check.outputs.authorized }}
     steps:
+      # This check is purely additive: callers OR it with author_association, so it must
+      # never fail the job. Failing here would block every dependent reviewer job through
+      # `needs`, turning an unconfigured or misconfigured app into a total review outage
+      # rather than a fallback to the author_association path.
       - name: Mint internal app token
         id: app
+        if: vars.INTERNAL_APP_ID != ''
+        continue-on-error: true
         uses: actions/create-github-app-token@v2
         with:
           app-id: ${{ vars.INTERNAL_APP_ID }}
@@ -41,7 +47,9 @@ jobs:
       - name: Resolve authorization
         id: check
         env:
-          GH_TOKEN: ${{ steps.app.outputs.token }}
+          # Without the app token, the default token still resolves public members and
+          # repo collaborators; private members simply fall through to author_association.
+          GH_TOKEN: ${{ steps.app.outputs.token || github.token }}
           USERNAME: ${{ inputs.username }}
           TRUSTED_BOT: ${{ inputs.trusted_bot }}
           REPO: ${{ github.repository }}
diff --git a/.github/workflows/frontend-check.yml b/.github/workflows/frontend-check.yml
index 90d839aca5..a675c17444 100644
--- a/.github/workflows/frontend-check.yml
+++ b/.github/workflows/frontend-check.yml
@@ -23,5 +23,8 @@ jobs:
           cache-dependency-path: "frontend/package-lock.json"
       - name: "npm check"
         timeout-minutes: 5
+        env:
+          # svelte-check peaks past node's ~4GB default ceiling on this runner and aborts.
+          NODE_OPTIONS: --max-old-space-size=8192
         run: cd frontend && npm ci && npm run generate-backend-client && npm run
           check
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 110baacda3..2f7dcde204 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -8,8 +8,10 @@ jobs:
     name: "Release please"
     runs-on: ubicloud
     steps:
-      - uses: GoogleCloudPlatform/release-please-action@v3
+      # Config lives in release-please-config.json / .release-please-manifest.json:
+      # a `release-type` input instead re-derives the last released version by
+      # paginating every GitHub release, which on a repo this size is slow enough
+      # to fail intermittently.
+      - uses: googleapis/release-please-action@v5
         with:
-          release-type: simple
-          package-name: windmill
           token: ${{ secrets.PAT_TOKEN }}
diff --git a/.mcp.json b/.mcp.json
index f6929bbd71..f2a745614b 100644
--- a/.mcp.json
+++ b/.mcp.json
@@ -7,12 +7,12 @@
     "playwright": {
       "type": "stdio",
       "command": "npx",
-      "args": ["-y", "@playwright/mcp@latest", "--browser", "chromium", "--headless"]
+      "args": ["-y", "@playwright/mcp@latest", "--browser", "chromium", "--headless", "--output-dir", "/tmp/playwright-mcp-${USER:-shared}"]
     },
     "playwright-headed": {
       "type": "stdio",
       "command": "npx",
-      "args": ["-y", "@playwright/mcp@latest", "--browser", "chromium"]
+      "args": ["-y", "@playwright/mcp@latest", "--browser", "chromium", "--output-dir", "/tmp/playwright-mcp-${USER:-shared}"]
     }
   }
 }
\ No newline at end of file
diff --git a/.release-please-manifest.json b/.release-please-manifest.json
new file mode 100644
index 0000000000..9a978495de
--- /dev/null
+++ b/.release-please-manifest.json
@@ -0,0 +1,3 @@
+{
+  ".": "1.783.0"
+}
diff --git a/AGENTS.md b/AGENTS.md
index 90c0060ae2..e39d4ebede 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -13,6 +13,9 @@ Open-source platform for internal tools, workflows, API integrations, background
 
 - **Validation**: `docs/validation.md` — what checks to run based on what you changed
 - **Unreleased SDK changes**: `docs/wac-sdk-e2e.md` — exercising a client change on a real worker
+- **Agent workers**: `docs/agent-worker-e2e.md` — building and running one locally. An agent
+  reaches the DB only through the API, so `Connection::Http` paths are never taken by a plain
+  `cargo run`; a normal build cannot start one at all.
 - **Enterprise**: `docs/enterprise.md` — EE file conventions and PR workflow
 - **Backend patterns**: use the `rust-backend` skill when writing Rust code
 - **Frontend patterns**: use the `svelte-frontend` skill when writing Svelte code. Do NOT edit svelte files unless you have read that skill.
@@ -20,10 +23,17 @@ Open-source platform for internal tools, workflows, API integrations, background
 - **Code review**: review the current PR or branch against the shared review policy in `REVIEW.md` (severity triage, public-surface checklist, AGENTS.md compliance, test-coverage assessment). The skill at `.agents/skills/local-review/SKILL.md` orchestrates it. All three CLIs auto-discover the same SKILL — Claude reads `.claude/skills/` (symlinked to the canonical `.agents/skills/` file), Codex and Pi read `.agents/skills/` directly. Invoke with `/local-review` in Claude Code, `$local-review` (or `/skills` selector) in Codex, or `pi --skill local-review` / `/skill:local-review` in Pi. For a Codex-driven pass that mirrors the `codex-pr-review` GitHub action against your unpushed work (committed + uncommitted) before you push, use `/local-review-codex` (`.agents/skills/local-review-codex/`) — same `REVIEW.md` policy, `gpt-5.6-sol`, `xhigh` reasoning; requires the `codex` CLI >= 0.144.1.
 - **Domain guides**: `.claude/skills/native-trigger/` and `frontend/tutorial-system-guide.mdc`
 - **Brand/UI guidelines**: `frontend/brand-guidelines.md`
+- **Domain vocabulary**: `CONTEXT.md` — the words this codebase uses for its own concepts (step, step setting, trigger step, …). Name things the way it does.
 - **CLI commands**: when adding/modifying/removing a command, subcommand, option, or description in `cli/src/commands/`, run `python system_prompts/generate.py` to refresh `system_prompts/auto-generated/` and `cli/src/guidance/skills.gen.ts`. The CLI docs the agents use to operate `wmill` are derived from the source — stale generated files give agents the wrong flags.
+- **Session recorder**: `frontend/src/lib/components/recording/` is also the recorder `wmill app dev --recording` serves, vendored into the CLI as `cli/src/commands/app/devRecorderBundle.gen.ts`. After changing `rawAppSnapshot.ts` or `rawAppRecording.svelte.ts`, run `bun run gen:dev-recorder` from `cli/` (`cli/test/dev_recorder_bundle_unit.test.ts` fails otherwise).
 
 ## Dev Environment
 
+> **In a git worktree, the ports and database below are NOT the ones to use.** Each
+> worktree gets its own backend port, frontend port and Postgres database, so the
+> defaults in this section apply only to a plain single checkout. **Discover the real
+> values before running anything** — see "Per-worktree ports and database" below.
+
 - **Backend**: `cargo run` from `backend/` (API at http://localhost:8000)
 - **DuckDB local jobs**: before running DuckDB scripts locally, build the FFI shared library with `cd backend/windmill-duckdb-ffi-internal && ./build_dev.sh`. Re-run it after clean builds or when `backend/target/debug/libwindmill_duckdb_ffi_internal.*` is missing. The bundled DuckDB compile (~2min) is cached in a per-user dir shared across worktrees, so a fresh worktree reuses it and the build is near-instant.
 - **Data pipelines (DuckLake) from source**: a plain `cargo run` (even `--features quickjs`) advertises a `duckdb` worker tag but **cannot** execute DuckDB scripts and has **no** working S3 proxy (DuckLake writes 404). Build CE DuckLake with `cargo run --features quickjs,duckdb,parquet,private` (add `,python` for Python scripts, `,enterprise,license` for EE) **and** build the FFI (bullet above). See `backend/CLAUDE.md` → "Running data pipelines (DuckLake) from source" for the exact feature sets and the two feature-gate gotchas.
@@ -33,6 +43,37 @@ Open-source platform for internal tools, workflows, API integrations, background
 - **Instance settings**: navigate to `/#superadmin-settings`
 - **Migrations**: use `cargo sqlx migrate add -r <name>` from `backend/` to create new migrations (never generate timestamps manually)
 
+### Per-worktree ports and database
+
+A worktree's `.env` / `.env.local` (repo root) and `backend/.env` hold its own
+`DATABASE_URL` and `PORT`; the database is typically `windmill_<branch_with_underscores>`
+(branch `dbt-runtime` → `windmill_dbt_runtime`). Read them, or discover from what is
+already running:
+
+```bash
+psql postgres://postgres:changeme@localhost:5432/postgres -tAc \
+  "select datname from pg_database where datname like 'windmill%'" | grep "$(git branch --show-current | tr - _)"
+# the port the frontend actually proxies to (REMOTE of this worktree's vite):
+for p in $(pgrep -f vite); do case "$(readlink /proc/$p/cwd)" in *"$(basename "$(git rev-parse --show-toplevel)")"*)
+  tr '\0' '\n' < /proc/$p/environ | grep -E '^REMOTE=|^PORT=';; esac; done
+```
+
+Getting these wrong is not a cheap mistake:
+
+- **`DATABASE_URL` pointed at another worktree's database silently destroys the sqlx
+  cache.** `cargo run` and `cargo sqlx prepare` both compile `sqlx::query!` against the
+  **live** database, so the wrong one fails with `relation "<your_new_table>" does not
+  exist` — and `prepare` deletes the whole `.sqlx/` directory *before* it fails, leaving
+  it gutted. Always `cp -r backend/.sqlx <tmp>/sqlx_backup` first (see the `update-sqlx`
+  skill).
+- **The frontend proxies to its own worktree's backend port, not 8000.** Starting a
+  backend on the wrong port leaves the UI up but every API call 502s, which reads like an
+  application bug rather than a misconfiguration.
+- **Kill backends by pid scoped to this worktree's cwd** (`readlink /proc/<pid>/cwd`),
+  never `pkill -f target/debug/windmill` — that kills every sibling worktree's backend.
+  Beware that a `pgrep -f "<pattern>"` in a shell whose own command line contains
+  `<pattern>` matches the shell itself.
+
 ## Verifying Frontend Changes
 
 After modifying frontend code, drive the running dev server with the **Playwright MCP** to verify the change in a real browser — don't claim a UI change works without exercising it.
@@ -51,10 +92,34 @@ Typical flow:
 5. `mcp__playwright__browser_take_screenshot` for visual confirmation
 6. `mcp__playwright__browser_console_messages` / `browser_network_requests` to surface errors
 
+Write screenshots to an absolute path under `/tmp` (the MCP servers already do; standalone
+Playwright scripts must be told): moving a PNG out of the checkout afterwards needs a `mv` the
+permission hooks always prompt on. Same reason to run `rm`/`mv`/`cp` as one plain command per Bash
+call: those hooks defer on `&&`, `;`, redirects, quotes and `$VAR`.
+
 **Attach the screenshots to the PR.** For any change under `frontend/`, embed screenshots of the affected UI in the PR body — the `pr` skill requires this and carries the upload recipe.
 
 If you cannot exercise a UI change (no dev server, etc.), say so explicitly rather than claiming success.
 
+## Verifying Backend Changes
+
+`cargo check` and the unit tests do not exercise a worker code path. **If you changed how
+a job runs — an executor, `handle_child`, anything spawning or reading from a
+subprocess — run an actual job of that kind** and confirm it completed, then say so.
+Whole classes of defect compile and unit-test clean:
+
+- **Stack overflow from a large buffer in an async block.** An array declared across an
+  `.await` is baked into the future's state; once that future is boxed a few layers deep
+  by the job poller, two 16 KB arrays abort the worker *process* (`thread
+  'tokio-runtime-worker' has overflowed its stack`). Heap-allocate read buffers
+  (`vec![0u8; N]`, not `[0u8; N]`).
+- Deadlocks from draining only one of a child's pipes, missed cancellation or timeout
+  propagation, and anything depending on the real engine's output format.
+
+A crash like this takes down every job on that worker, not just yours, so check the
+backend log after the run rather than only the job's own status. If you cannot run one,
+say which path went unexercised instead of implying it was verified.
+
 ## Banned Patterns
 
 ### `$bindable(default_value)` on optional props
diff --git a/CHANGELOG.md b/CHANGELOG.md
index a69d7b0389..1b3283588c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,221 @@
 # Changelog
 
+## [1.783.0](https://github.com/windmill-labs/windmill/compare/v1.782.0...v1.783.0) (2026-08-07)
+
+
+### Features
+
+* add public sharing option for job pages ([#10573](https://github.com/windmill-labs/windmill/issues/10573)) ([5ce29b3](https://github.com/windmill-labs/windmill/commit/5ce29b34364d6429411621752c64e306426aa2dd))
+* offer more dev workspace environment labels ([#10570](https://github.com/windmill-labs/windmill/issues/10570)) ([8c6211c](https://github.com/windmill-labs/windmill/commit/8c6211c27718912ad1e1a29f770747ea07fdb161))
+* open a session edit in the preview panel from the edits list ([#10486](https://github.com/windmill-labs/windmill/issues/10486)) ([d008975](https://github.com/windmill-labs/windmill/commit/d0089758e6091b07009dee5b8387f3f4b6d97455))
+* preview merge result in git-sync PR diff check ([#10542](https://github.com/windmill-labs/windmill/issues/10542)) ([c61404a](https://github.com/windmill-labs/windmill/commit/c61404a0f4008cd1de3c977c653c712ef3d9e0a3))
+
+
+### Bug Fixes
+
+* **frontend:** collapse the dev-workspace edit notice into a badge ([#10576](https://github.com/windmill-labs/windmill/issues/10576)) ([fdd76a6](https://github.com/windmill-labs/windmill/commit/fdd76a6f1358404b13326c68eed1eac14097bd88))
+* **frontend:** hide the fork workspace banner from operators ([#10575](https://github.com/windmill-labs/windmill/issues/10575)) ([57ed0f7](https://github.com/windmill-labs/windmill/commit/57ed0f77e1f83751ea04820b365fb53f098d38bf))
+* scope a fork's cloned app policy and custom path to its creator ([#10589](https://github.com/windmill-labs/windmill/issues/10589)) ([8e95bfe](https://github.com/windmill-labs/windmill/commit/8e95bfe6157ebe4f8fc5f6e13c36a6f0bdb9969d))
+
+## [1.782.0](https://github.com/windmill-labs/windmill/compare/v1.781.3...v1.782.0) (2026-08-06)
+
+
+### Features
+
+* improve duckdb isolation ([#10565](https://github.com/windmill-labs/windmill/issues/10565)) ([956210e](https://github.com/windmill-labs/windmill/commit/956210ea06224f7c6cd3e5082a96d3f80039404b))
+
+
+### Bug Fixes
+
+* compact ai chat context for models with unknown context windows ([#10564](https://github.com/windmill-labs/windmill/issues/10564)) ([fc1e11c](https://github.com/windmill-labs/windmill/commit/fc1e11cb3d056af6a3779cf17b23f9bf7152d355))
+* keep the mermaid fullscreen dialog in its pane and its emoji vector ([#10541](https://github.com/windmill-labs/windmill/issues/10541)) ([c2a6936](https://github.com/windmill-labs/windmill/commit/c2a6936e7d3fe724f968b10dd689abb6ff8f75ad))
+
+## [1.781.3](https://github.com/windmill-labs/windmill/compare/v1.781.2...v1.781.3) (2026-08-06)
+
+
+### Bug Fixes
+
+* **frontend:** take the editor's post-edit content, not setCode's argument ([#10562](https://github.com/windmill-labs/windmill/issues/10562)) ([1846bd5](https://github.com/windmill-labs/windmill/commit/1846bd5ce59ee71a4262297513673d662f6a38b6))
+
+## [1.781.2](https://github.com/windmill-labs/windmill/compare/v1.781.1...v1.781.2) (2026-08-06)
+
+
+### Bug Fixes
+
+* **frontend:** reset the editor content when the script language changes ([#10560](https://github.com/windmill-labs/windmill/issues/10560)) ([56ea133](https://github.com/windmill-labs/windmill/commit/56ea133366875d8bd13347b5002f4ef351a8e4e6))
+
+## [1.781.1](https://github.com/windmill-labs/windmill/compare/v1.781.0...v1.781.1) (2026-08-06)
+
+
+### Bug Fixes
+
+* open the expression property column on demand, not from focus ([#10558](https://github.com/windmill-labs/windmill/issues/10558)) ([386c66b](https://github.com/windmill-labs/windmill/commit/386c66bef0534d4a63b3220050e98b9654ef8f34))
+* restore the flow expression editor's property side panel ([#10555](https://github.com/windmill-labs/windmill/issues/10555)) ([e4e7782](https://github.com/windmill-labs/windmill/commit/e4e7782517a9fd0fbbec020694b263a948ed1c0c))
+
+
+### Performance Improvements
+
+* keep run status out of flow graph node and edge data ([#10554](https://github.com/windmill-labs/windmill/issues/10554)) ([b2d38e0](https://github.com/windmill-labs/windmill/commit/b2d38e0391f26d92e8f9245a3db099129b6c3977))
+
+## [1.781.0](https://github.com/windmill-labs/windmill/compare/v1.780.0...v1.781.0) (2026-08-05)
+
+
+### Features
+
+* add a load all to the tree view's per-folder pager ([#10548](https://github.com/windmill-labs/windmill/issues/10548)) ([a3b79d7](https://github.com/windmill-labs/windmill/commit/a3b79d7732deba54fd6344229d5b91a80a3e0dd6))
+* allow a dev workspace to have its own dev workspace ([#10534](https://github.com/windmill-labs/windmill/issues/10534)) ([e203ab0](https://github.com/windmill-labs/windmill/commit/e203ab087a4ce885a1d424267f96db861207a0e6))
+* **debugger:** install debug session deps from the instance registry settings ([#10550](https://github.com/windmill-labs/windmill/issues/10550)) ([154f8f4](https://github.com/windmill-labs/windmill/commit/154f8f461ef01d60da73f9633d76bed45381a035))
+* **mcp:** serve the 2026-07-28 spec alongside the legacy protocol ([#10535](https://github.com/windmill-labs/windmill/issues/10535)) ([4fe4fac](https://github.com/windmill-labs/windmill/commit/4fe4fac358e67ee6e20dbff8bfa1de0e92e5f3c7))
+* redesign flow step, loop and branch settings panels ([#10026](https://github.com/windmill-labs/windmill/issues/10026)) ([09c8f3b](https://github.com/windmill-labs/windmill/commit/09c8f3b1f3eef2409e212cdb26c7bd2f830dae89))
+* register mounted CA certificates in windmill_extra at startup ([#10545](https://github.com/windmill-labs/windmill/issues/10545)) ([d9d6ec8](https://github.com/windmill-labs/windmill/commit/d9d6ec82ab7ad5279ba8ebc059f58bd663bad87f))
+
+
+### Bug Fixes
+
+* **ai:** collapse thinking to a status row with a thought-for duration ([#10515](https://github.com/windmill-labs/windmill/issues/10515)) ([d9b10e7](https://github.com/windmill-labs/windmill/commit/d9b10e7b0a1ba6702ecf05f64b80ac8bb7c79326))
+* **debugger:** confine prepare-deps under nsjail in both language paths ([#10546](https://github.com/windmill-labs/windmill/issues/10546)) ([a5423a8](https://github.com/windmill-labs/windmill/commit/a5423a81ca5d7c1e88ebed4573952e858ef1546c))
+* **debugger:** pass python index settings to prepare-deps and report failures ([#10533](https://github.com/windmill-labs/windmill/issues/10533)) ([7d153d5](https://github.com/windmill-labs/windmill/commit/7d153d5750db0ea17812d6b1f9a63ceaefddc2b9))
+* **debugger:** report python debugger dependency install failures instead of timing out ([#10531](https://github.com/windmill-labs/windmill/issues/10531)) ([29e179f](https://github.com/windmill-labs/windmill/commit/29e179f7879845f01c6813ad5dfbb19d08dc030e))
+* edit-in-dev-workspace dead-ends, wraps, and misses the tree view ([#10354](https://github.com/windmill-labs/windmill/issues/10354)) ([616d4fe](https://github.com/windmill-labs/windmill/commit/616d4fe167e1c99f8f5104c7b66dbc5fd502e0be))
+* flow step picker layout and single hover/keyboard highlight ([#10488](https://github.com/windmill-labs/windmill/issues/10488)) ([aa91619](https://github.com/windmill-labs/windmill/commit/aa91619bb67b7ae0cbd3a3848b6171d36967bd1f))
+* forward TLS trust roots to debug sessions and honor INIT_SCRIPT on windmill_extra ([#10532](https://github.com/windmill-labs/windmill/issues/10532)) ([74c4185](https://github.com/windmill-labs/windmill/commit/74c418570bb5bf1af54f367cfecae3e8b4ede764))
+* **frontend:** draw the tab strip's scroll bar instead of the native one ([#10547](https://github.com/windmill-labs/windmill/issues/10547)) ([2c189fe](https://github.com/windmill-labs/windmill/commit/2c189fea14749b8bb4604b1363eef907abc3b129))
+* **frontend:** filter the AI Sandbox entry by the flow insert search ([#10529](https://github.com/windmill-labs/windmill/issues/10529)) ([1dcb6bb](https://github.com/windmill-labs/windmill/commit/1dcb6bb9005c1e97f1fca6470eb2d2105a973918))
+* keep the same_worker pin across a flow module that spawns no job ([#10551](https://github.com/windmill-labs/windmill/issues/10551)) ([1aee222](https://github.com/windmill-labs/windmill/commit/1aee22296e228c54d4ca7251e9ae7e04229adb34))
+* keep the same_worker pin when a suspend ends without approval ([#10552](https://github.com/windmill-labs/windmill/issues/10552)) ([c59b60c](https://github.com/windmill-labs/windmill/commit/c59b60c729b03c5be66738b1f4cbf0d989a7b438))
+* point re-opened previews at the tab already showing them ([#10538](https://github.com/windmill-labs/windmill/issues/10538)) ([f11e883](https://github.com/windmill-labs/windmill/commit/f11e8835fdc762fccb521de48049ea43838d7f3c))
+* **triggers:** stop one failing trigger count from zeroing the rest ([#10549](https://github.com/windmill-labs/windmill/issues/10549)) ([0e42381](https://github.com/windmill-labs/windmill/commit/0e42381df086d4463e5914d8a194fe5141793bd1))
+
+## [1.780.0](https://github.com/windmill-labs/windmill/compare/v1.779.0...v1.780.0) (2026-08-04)
+
+
+### Features
+
+* **dbt:** reach any dbt adapter through a dbt_profile resource, and constrain the warehouse picker ([#10525](https://github.com/windmill-labs/windmill/issues/10525)) ([340d3cd](https://github.com/windmill-labs/windmill/commit/340d3cd5653fb7f23ba349517c1ab9a2a74bba58))
+
+
+### Bug Fixes
+
+* reflect custom tag add/remove in the manage-tags drawer immediately ([#10526](https://github.com/windmill-labs/windmill/issues/10526)) ([552ad9c](https://github.com/windmill-labs/windmill/commit/552ad9c859497d3b2d6d20ecf3103b06758cada7))
+
+## [1.779.0](https://github.com/windmill-labs/windmill/compare/v1.778.0...v1.779.0) (2026-08-04)
+
+
+### Features
+
+* add multi-select and bulk actions to the Home page ([#10499](https://github.com/windmill-labs/windmill/issues/10499)) ([c57045d](https://github.com/windmill-labs/windmill/commit/c57045dbb30aa40a212a9ee179f5da78c0f1a405))
+* deploy a raw app from its sources, bundling them on a worker ([#10500](https://github.com/windmill-labs/windmill/issues/10500)) ([81ba961](https://github.com/windmill-labs/windmill/commit/81ba9611eb7cdbb67a285337d2069c3909d10b69))
+* **frontend:** pick workspace members from a searchable instance user list ([#10474](https://github.com/windmill-labs/windmill/issues/10474)) ([d63315e](https://github.com/windmill-labs/windmill/commit/d63315ed356afaedc60e3fcf8427cd2c2e822ba0))
+* let the database manager run its jobs on a custom worker tag ([#10516](https://github.com/windmill-labs/windmill/issues/10516)) ([221566d](https://github.com/windmill-labs/windmill/commit/221566d2824efbb3f1ac6f3c543633a5783c085a))
+* make createApp and updateApp the full-code app tools over MCP ([#10510](https://github.com/windmill-labs/windmill/issues/10510)) ([f3e73fb](https://github.com/windmill-labs/windmill/commit/f3e73fb006ab316c422a6b318fe21946bff34d13))
+* preview and edit steps inside expanded subflows ([#10520](https://github.com/windmill-labs/windmill/issues/10520)) ([0d1cb81](https://github.com/windmill-labs/windmill/commit/0d1cb818eec35de9f1af8963b0f9138dc89b0192))
+* send prompt_cache_key on the openai responses api ([#10507](https://github.com/windmill-labs/windmill/issues/10507)) ([8364dd9](https://github.com/windmill-labs/windmill/commit/8364dd96ef355aa01516aa53aac1a9f01fadaa80))
+* show far more in the home tree view and say what is not loaded ([#10519](https://github.com/windmill-labs/windmill/issues/10519)) ([4254686](https://github.com/windmill-labs/windmill/commit/425468675808d12b71f5fefde3bccce38e74869d))
+
+
+### Bug Fixes
+
+* bound ScopeSelector badge heights and correct three scope-chip defects ([#10523](https://github.com/windmill-labs/windmill/issues/10523)) ([6d21d30](https://github.com/windmill-labs/windmill/commit/6d21d30242632549a1698b3e82ed4f55895ea51e))
+* bundle a vector emoji font so emoji scale with flow graph zoom ([#10498](https://github.com/windmill-labs/windmill/issues/10498)) ([62b2f4b](https://github.com/windmill-labs/windmill/commit/62b2f4b06768b5559b59761760899076476b1e47))
+* keep the token scope builder inside its panel when scopes get long ([#10517](https://github.com/windmill-labs/windmill/issues/10517)) ([ae2f584](https://github.com/windmill-labs/windmill/commit/ae2f584de88f0b0eb34ec270c9dfb109cab54938))
+* let admins edit the dev workspace lock ruleset ([#10512](https://github.com/windmill-labs/windmill/issues/10512)) ([ecae932](https://github.com/windmill-labs/windmill/commit/ecae9320d0f752d01af12da1834e15d741b443d0))
+* load the workspace AI config even when the docked chat is disabled ([#10493](https://github.com/windmill-labs/windmill/issues/10493)) ([99e7661](https://github.com/windmill-labs/windmill/commit/99e7661a1b1b24a148a07f7dd37d44e3ae963ba2))
+* locate coursier artifacts by coordinate so private maven registries work ([#10501](https://github.com/windmill-labs/windmill/issues/10501)) ([56d53d3](https://github.com/windmill-labs/windmill/commit/56d53d3f328cc5a7002dbc1d31e2a90821590663))
+* log the db auth mode used and hint at the ms_entraid sentinel ([#10508](https://github.com/windmill-labs/windmill/issues/10508)) ([9f3d155](https://github.com/windmill-labs/windmill/commit/9f3d15583a863c50d60925e97fe98f35f9e4c9e2))
+* match openrouter model ids by parsed vendor, not raw prefix ([#10497](https://github.com/windmill-labs/windmill/issues/10497)) ([546b8d0](https://github.com/windmill-labs/windmill/commit/546b8d076961398a40e7e53fb1e3e561a39a135b))
+* open an AI session from the editor bar's AI button, on the step ([#10504](https://github.com/windmill-labs/windmill/issues/10504)) ([ea4f3ec](https://github.com/windmill-labs/windmill/commit/ea4f3ecc6e54f24a0899470c2efb9850d3ed2d48))
+* show which MCP endpoint tools a token scope will actually expose ([#10514](https://github.com/windmill-labs/windmill/issues/10514)) ([71e68e8](https://github.com/windmill-labs/windmill/commit/71e68e87dcc34939f9262d3fdf2e0e5495332491))
+* stop app updates from silently converting an app between raw and low-code ([#10495](https://github.com/windmill-labs/windmill/issues/10495)) ([d9dd036](https://github.com/windmill-labs/windmill/commit/d9dd036edc88124f2424f13e0ed3697cf03bdf99))
+
+## [1.778.0](https://github.com/windmill-labs/windmill/compare/v1.777.1...v1.778.0) (2026-08-03)
+
+
+### Features
+
+* **apps:** use the windmill-client SDK from raw app frontend code ([#10377](https://github.com/windmill-labs/windmill/issues/10377)) ([7e1c1fa](https://github.com/windmill-labs/windmill/commit/7e1c1fa3a455b8187886692567e0045658ed7013))
+* azure workload identity auth for mssql and postgres resources ([#10470](https://github.com/windmill-labs/windmill/issues/10470)) ([beef6e2](https://github.com/windmill-labs/windmill/commit/beef6e295cb4e01af00c279f406012a82d91c8c4))
+* **fork:** merge a fork deletion on evidence, not on the counters ([#10484](https://github.com/windmill-labs/windmill/issues/10484)) ([f365929](https://github.com/windmill-labs/windmill/commit/f365929eaaebf546c58ee1641a010d5f1f8b555f))
+* label ai session preview tabs by item summary ([#10475](https://github.com/windmill-labs/windmill/issues/10475)) ([b93ee66](https://github.com/windmill-labs/windmill/commit/b93ee66bba72250c17d4c7f567436b348504c2b1))
+* lazily expand s3 explorer folders one level at a time ([#10420](https://github.com/windmill-labs/windmill/issues/10420)) ([386e115](https://github.com/windmill-labs/windmill/commit/386e115daaf850ac45d10f2240bacb5758d238e6))
+
+
+### Bug Fixes
+
+* anchor overlays to their preview tab instead of the viewport ([#10477](https://github.com/windmill-labs/windmill/issues/10477)) ([b718ea8](https://github.com/windmill-labs/windmill/commit/b718ea84956995d96f4056cdbd03bd8634883921))
+* base a new fork on the dev workspace when forking from one ([#10489](https://github.com/windmill-labs/windmill/issues/10489)) ([db46d34](https://github.com/windmill-labs/windmill/commit/db46d347272c940057dca1aa7fb4b4456eea8a9e))
+* **cli:** stop a deleted raw-app .lock from dropping the whole app push ([#10473](https://github.com/windmill-labs/windmill/issues/10473)) ([4254324](https://github.com/windmill-labs/windmill/commit/42543240e87ad232f6dffde61d47cfaced766b20))
+* confirm step delete consequences in a single dialog ([#10485](https://github.com/windmill-labs/windmill/issues/10485)) ([5aeee56](https://github.com/windmill-labs/windmill/commit/5aeee564beaab5b398b0eff1ae9db8e9ef1d9bfe))
+* normalize the pipeline folder so AI node paths aren't double-prefixed ([#10479](https://github.com/windmill-labs/windmill/issues/10479)) ([4db432f](https://github.com/windmill-labs/windmill/commit/4db432f0048c9295e93ff7da0753eef7145d3623))
+* refresh the dev-workspace pairing after attach and detach ([#10491](https://github.com/windmill-labs/windmill/issues/10491)) ([fadbe07](https://github.com/windmill-labs/windmill/commit/fadbe079e4e747147861c6df495270cf2f390700))
+* report why a native trigger service refused instead of a 500 ([#10463](https://github.com/windmill-labs/windmill/issues/10463)) ([4f03aa9](https://github.com/windmill-labs/windmill/commit/4f03aa91a714eb0132cf01a6cd4f37a1a11cfe02))
+* show the fork banner to a superadmin who is not a workspace member ([#10465](https://github.com/windmill-labs/windmill/issues/10465)) ([3cef678](https://github.com/windmill-labs/windmill/commit/3cef678b5f247ec431e89cfc2a6a97e79dce2b51))
+* stop reading a parent-only fork item as deleted in the fork ([#10467](https://github.com/windmill-labs/windmill/issues/10467)) ([689f5d7](https://github.com/windmill-labs/windmill/commit/689f5d7c751f5fd8d4ceb7a79004a22afb8263b8))
+* stop the chat deleting drafts as deployed workspace items ([#10476](https://github.com/windmill-labs/windmill/issues/10476)) ([ed9fb47](https://github.com/windmill-labs/windmill/commit/ed9fb47f5a9e05aa8380d288d892f8068eaf1d0c))
+
+
+### Performance Improvements
+
+* cut ai chat request size and cache the prefix on openrouter ([#10481](https://github.com/windmill-labs/windmill/issues/10481)) ([e15bea4](https://github.com/windmill-labs/windmill/commit/e15bea419a1a65f6d9b577e918d5e617e0345da2))
+* serve the rare schedule options on demand instead of inlining them ([#10487](https://github.com/windmill-labs/windmill/issues/10487)) ([a3c59c7](https://github.com/windmill-labs/windmill/commit/a3c59c7320be961a88b581ab06ded24b80e1d544))
+
+## [1.777.1](https://github.com/windmill-labs/windmill/compare/v1.777.0...v1.777.1) (2026-08-03)
+
+
+### Bug Fixes
+
+* return result.json and stdout results from sandboxed containers ([#10460](https://github.com/windmill-labs/windmill/issues/10460)) ([d509551](https://github.com/windmill-labs/windmill/commit/d5095515ed007d4e7fbfc1a15582c550d3293ece))
+
+## [1.777.0](https://github.com/windmill-labs/windmill/compare/v1.776.0...v1.777.0) (2026-08-03)
+
+
+### Features
+
+* add session recording to wmill app dev ([#10457](https://github.com/windmill-labs/windmill/issues/10457)) ([2105540](https://github.com/windmill-labs/windmill/commit/2105540cca7cc7bdced9e06ef3ad1ed54732feef))
+* give dbt its own editor with an explicitly refreshed model graph ([#10448](https://github.com/windmill-labs/windmill/issues/10448)) ([baefa13](https://github.com/windmill-labs/windmill/commit/baefa1345b7b7a4110257a53a417d4fc229d0149))
+* show an on-behalf-of badge on the script and flow detail pages ([#10452](https://github.com/windmill-labs/windmill/issues/10452)) ([9bafb7e](https://github.com/windmill-labs/windmill/commit/9bafb7ebd2b8571f1adf5a86b681af8d07660a50))
+
+
+### Bug Fixes
+
+* keep uri and method on request logs under RUST_LOG=error ([#10462](https://github.com/windmill-labs/windmill/issues/10462)) ([0466ea2](https://github.com/windmill-labs/windmill/commit/0466ea201952bd382d893bd973eedaa7183b597e))
+* report a missing worker tag instead of spinning in data table UIs ([#10456](https://github.com/windmill-labs/windmill/issues/10456)) ([eca24bd](https://github.com/windmill-labs/windmill/commit/eca24bdfb5c7a49c428d541ca06407d1635cc3b6))
+
+## [1.776.0](https://github.com/windmill-labs/windmill/compare/v1.775.2...v1.776.0) (2026-08-01)
+
+
+### Features
+
+* **frontend:** add missing resource type icons and show them in the resource picker ([#10407](https://github.com/windmill-labs/windmill/issues/10407)) ([705c90d](https://github.com/windmill-labs/windmill/commit/705c90debda87451fcdc32f15f086080ab7dc5f9))
+* **git-sync:** dedicated base url for GitHub webhook delivery ([#10411](https://github.com/windmill-labs/windmill/issues/10411)) ([318c9f0](https://github.com/windmill-labs/windmill/commit/318c9f00739bfd43bd5d6afed4ae12f3f1a565d1))
+* let the merge UI target an arbitrary workspace ([#10417](https://github.com/windmill-labs/windmill/issues/10417)) ([61f2d8d](https://github.com/windmill-labs/windmill/commit/61f2d8dc6ab980c1aba959b853d505f09299ed9c))
+* make job subprocess oom_score_adj configurable ([#10443](https://github.com/windmill-labs/windmill/issues/10443)) ([2508417](https://github.com/windmill-labs/windmill/commit/25084170d7449dfa06dd758bc3783580916cfa95))
+* make the fork lineage the only deploy relationship ([#10410](https://github.com/windmill-labs/windmill/issues/10410)) ([81b23a2](https://github.com/windmill-labs/windmill/commit/81b23a2ba0ee1001241e4fe6066c07526ab640f6))
+* run dbt projects as a first-class Windmill runtime ([#10326](https://github.com/windmill-labs/windmill/issues/10326)) ([032300e](https://github.com/windmill-labs/windmill/commit/032300e28eba9f8e790f16e894bb00fff22eb296))
+* stamp webhook trigger_kind on token-driven job runs ([#10431](https://github.com/windmill-labs/windmill/issues/10431)) ([dda5976](https://github.com/windmill-labs/windmill/commit/dda59767c2b997e675ffe799bc6b1dcc79c2a52d))
+* sync data table migrations to git, gated by a new object type ([#10436](https://github.com/windmill-labs/windmill/issues/10436)) ([bfc3f52](https://github.com/windmill-labs/windmill/commit/bfc3f5242a0d9a833d12859f96ea8f1aa67d362b))
+
+
+### Bug Fixes
+
+* add apps:run to the token scope picker and confine path-scoped app tokens ([#10428](https://github.com/windmill-labs/windmill/issues/10428)) ([c69f080](https://github.com/windmill-labs/windmill/commit/c69f08073a657ee6d91bfdbd19e8639a392fd77a))
+* **ai:** pass only the output of a nested agent tool to the parent ([#10416](https://github.com/windmill-labs/windmill/issues/10416)) ([7d097d2](https://github.com/windmill-labs/windmill/commit/7d097d25c3bba89d708c21a2fc3a1a8e0099a5c5))
+* **ai:** route Azure OpenAI agent steps through the Responses API ([#10404](https://github.com/windmill-labs/windmill/issues/10404)) ([94bcc00](https://github.com/windmill-labs/windmill/commit/94bcc00554423eb9e4056dd33ceff1b07263e9ec))
+* app progress bar stuck on running, and misreporting queued/canceled jobs as errors ([#10409](https://github.com/windmill-labs/windmill/issues/10409)) ([5579913](https://github.com/windmill-labs/windmill/commit/557991360a5c920909cac45e335c11b35bd2d880))
+* apply default workspace dependencies to raw app runnables ([#10427](https://github.com/windmill-labs/windmill/issues/10427)) ([38b6099](https://github.com/windmill-labs/windmill/commit/38b6099b4c5039232cf306a01ee814b3ec5dc04c))
+* carry the token label into job-run audit rows ([#10433](https://github.com/windmill-labs/windmill/issues/10433)) ([02c4a9e](https://github.com/windmill-labs/windmill/commit/02c4a9e515b3ef9c0e759211a6b7cbd874a778b0))
+* **cli:** lint against the checkout's schema, not the published validator ([#10418](https://github.com/windmill-labs/windmill/issues/10418)) ([a372ae0](https://github.com/windmill-labs/windmill/commit/a372ae0c04d0849932d83a76d38b5a9e507077af))
+* credit the token owner instead of the token label in the audit trail ([#10423](https://github.com/windmill-labs/windmill/issues/10423)) ([3716a71](https://github.com/windmill-labs/windmill/commit/3716a71fd76f66b58bc29977b4f6a10ed97cea16))
+* **flows:** mint fresh orchestration token so long steps don't expire the result-fetch JWT ([#10415](https://github.com/windmill-labs/windmill/issues/10415)) ([2e249ff](https://github.com/windmill-labs/windmill/commit/2e249ff8922c152f410cd40b88514f5dad875b85))
+* **forks:** record fork changes that never reached the diff tally ([#10403](https://github.com/windmill-labs/windmill/issues/10403)) ([f9a547b](https://github.com/windmill-labs/windmill/commit/f9a547b8b8e4982346607acae4e8e7646529c374))
+* harden flow-orchestration token refresh (mint from job_perms) ([#10419](https://github.com/windmill-labs/windmill/issues/10419)) ([e0d6dc1](https://github.com/windmill-labs/windmill/commit/e0d6dc1a1997514bfcaa8615de61daff4a2f81ca))
+* honor on-behalf-of when a workflow step dispatches a script or flow ([#10437](https://github.com/windmill-labs/windmill/issues/10437)) ([2b525d2](https://github.com/windmill-labs/windmill/commit/2b525d28dbcda4a4b0f626ad40b0c4d79cfbcd53))
+* keep native triggers attached when a runnable is renamed ([#10432](https://github.com/windmill-labs/windmill/issues/10432)) ([bd71566](https://github.com/windmill-labs/windmill/commit/bd7156682d4d4b78e01fa316580e632152cc5b62))
+* make /usr/bin/coursier self-contained so java jobs work air-gapped ([#10414](https://github.com/windmill-labs/windmill/issues/10414)) ([7e64960](https://github.com/windmill-labs/windmill/commit/7e649604db2047bf8587b46628aa74051e1b9409))
+* make on_behalf_of control permissions for scripts and flows ([#10438](https://github.com/windmill-labs/windmill/issues/10438)) ([fb82748](https://github.com/windmill-labs/windmill/commit/fb82748296cd0f81ad8d21c30c12e172a6477173))
+* pre-warm coursier bootstrap cache at the worker's cache path ([#10413](https://github.com/windmill-labs/windmill/issues/10413)) ([ed9dfc5](https://github.com/windmill-labs/windmill/commit/ed9dfc5de684197e14f3c4a3a6873c0e1a55229a))
+* run the init script before dedicated workers install dependencies ([#10412](https://github.com/windmill-labs/windmill/issues/10412)) ([43a684d](https://github.com/windmill-labs/windmill/commit/43a684d7432837fcf00a97712f28d7c474a58402))
+* sidebar workspace toggle navigates home when already in workspace mode ([#10405](https://github.com/windmill-labs/windmill/issues/10405)) ([9cd6a70](https://github.com/windmill-labs/windmill/commit/9cd6a70f6ace956f679c1ce1fb46543cda569183))
+
 ## [1.775.2](https://github.com/windmill-labs/windmill/compare/v1.775.1...v1.775.2) (2026-07-29)
 
 
diff --git a/CONTEXT.md b/CONTEXT.md
new file mode 100644
index 0000000000..6efb92b669
--- /dev/null
+++ b/CONTEXT.md
@@ -0,0 +1,38 @@
+# Windmill
+
+Open-source platform for internal tools, workflows, API integrations, background jobs and UIs. This file pins the vocabulary that is specific to Windmill's domain, so that code, docs and reviews name the same thing the same way.
+
+## Language
+
+### Flows
+
+**Step**:
+One node of a flow — the unit a user selects in the graph and configures in the right-hand panel. Typed as `FlowModule` in code.
+_Avoid_: module (ambiguous with the architectural sense), node, action
+
+**Step setting**:
+A per-step runtime option stored on the step itself: retries, error handling, timeout, concurrency limit, priority, cache, debounce, early stop, skip, suspend, sleep, lifetime. Distinct from the step's inputs and its code. The panel that edits them is the **run settings** tab; a single setting is still a step setting.
+_Avoid_: advanced setting, step config, flow option
+
+**Configured**:
+Said of a step setting whose config object is present on the step. Deliberately not the same as "would change the runtime's behaviour" — a setting can be configured and still be a no-op (`sleep` of `0`). Every surface that answers "is this setting on?" answers it this way.
+_Avoid_: enabled, active, effective
+
+**Trigger step**:
+The first step of a polling flow. It runs on a schedule and returns the items found since its last run; an empty return means there is nothing to process and the flow stops early, marked skipped rather than failed.
+_Avoid_: poll script, trigger node, schedule step
+
+**Default predicate**:
+The `stop_after_if` expression seeded onto a trigger step at creation, encoding what "nothing new" looks like. One value, owned in one place, shared by every path that creates a trigger step.
+
+**Connect**:
+Arming an input so that the next property picked fills it. A property can be picked from the prop picker or, when the panel is docked beside the graph, by clicking a step node's output. At most one input is armed per panel, so a pick always has exactly one destination.
+_Avoid_: link, bind, plug (the icon is a plug; the action is connecting)
+
+**Step input**:
+One argument of a step, edited in the step's input form. Its prop picker is a pane beside the form, always visible, so previous results can be browsed without connecting.
+_Avoid_: argument field, param
+
+**Expression input**:
+Any other place a property can be picked into: the loop iterator, skip and early-stop predicates, the retry condition, a branch predicate, timeout. Its prop picker opens in a popover from the connect button rather than taking a pane.
+_Avoid_: JS field, code input
diff --git a/ai_evals/adapters/frontend/core/global/evalArtifactHelpers.test.ts b/ai_evals/adapters/frontend/core/global/evalArtifactHelpers.test.ts
new file mode 100644
index 0000000000..c74f341735
--- /dev/null
+++ b/ai_evals/adapters/frontend/core/global/evalArtifactHelpers.test.ts
@@ -0,0 +1,22 @@
+import { describe, expect, it } from "bun:test";
+import { createEvalArtifactHelpers } from "./evalArtifactStore";
+
+// A hand-written stand-in for SessionArtifactsStore (bun has no IndexedDB), so nothing
+// makes it follow that class. A method missing from it surfaces as a tool throwing
+// part-way through an eval run, which reads as a model failure rather than a harness one.
+describe("eval artifact store", () => {
+  it("exposes every method the artifact tools call", () => {
+    const { helpers } = createEvalArtifactHelpers();
+    for (const method of [
+      "create",
+      "get",
+      "update",
+      "remove",
+      "listForSession",
+      "listVersions",
+      "getVersion",
+    ]) {
+      expect(typeof (helpers.artifacts as any)[method]).toBe("function");
+    }
+  });
+});
diff --git a/ai_evals/adapters/frontend/core/global/evalArtifactStore.ts b/ai_evals/adapters/frontend/core/global/evalArtifactStore.ts
new file mode 100644
index 0000000000..ed67cce468
--- /dev/null
+++ b/ai_evals/adapters/frontend/core/global/evalArtifactStore.ts
@@ -0,0 +1,93 @@
+// SessionArtifactsStore can't run here (bun has no IndexedDB, nor the compiled $state runes),
+// so mirror only the shape the artifact tools call, not its scoping or race handling.
+export const EVAL_SESSION_ID = "eval-session";
+export function createEvalArtifactHelpers() {
+  const items = new Map<string, Record<string, any>>();
+  // Snapshots per artifact id, oldest first — the version tools read history from here.
+  const history = new Map<string, Array<Record<string, any>>>();
+  let seq = 0;
+  const snapshotOf = (
+    artifact: Record<string, any>,
+    version: number,
+    note?: string,
+  ) => ({
+    key: `${artifact.id}:${version}`,
+    artifactId: artifact.id,
+    version,
+    name: artifact.name,
+    content: artifact.content,
+    savedAt: artifact.updatedAt,
+    note,
+  });
+  const store = {
+    create: async (sessionId: string, input: Record<string, any>) => {
+      const now = seq++;
+      const artifact = {
+        id: `eval-artifact-${now}`,
+        sessionId,
+        chatId: input.chatId,
+        kind: input.kind ?? "md",
+        name: input.name,
+        content: input.content,
+        createdAt: now,
+        updatedAt: now,
+        version: 1,
+      };
+      items.set(artifact.id, artifact);
+      history.set(artifact.id, [snapshotOf(artifact, 1)]);
+      return artifact;
+    },
+    get: async (id: string) => items.get(id),
+    update: async (
+      id: string,
+      input: Record<string, any>,
+      opts?: { sessionId?: string },
+    ) => {
+      const existing = items.get(id);
+      if (!existing) return undefined;
+      if (
+        opts?.sessionId !== undefined &&
+        existing.sessionId !== opts.sessionId
+      )
+        return undefined;
+      // Only a content change earns a version, as in SessionArtifactsStore.
+      const contentChanged =
+        input.content !== undefined && input.content !== existing.content;
+      const version = (existing.version ?? 1) + (contentChanged ? 1 : 0);
+      const updated = {
+        ...existing,
+        name: input.name ?? existing.name,
+        content: input.content ?? existing.content,
+        updatedAt: seq++,
+        version,
+      };
+      items.set(id, updated);
+      if (contentChanged) {
+        history.set(id, [
+          ...(history.get(id) ?? []),
+          snapshotOf(updated, version, input.note),
+        ]);
+      }
+      return updated;
+    },
+    remove: async (id: string) => {
+      items.delete(id);
+      history.delete(id);
+    },
+    listForSession: async (sessionId: string) =>
+      [...items.values()].filter((a) => a.sessionId === sessionId),
+    listVersions: async (id: string) =>
+      [...(history.get(id) ?? [])].sort((a, b) => b.version - a.version),
+    getVersion: async (id: string, version: number) =>
+      (history.get(id) ?? []).find((v) => v.version === version),
+  };
+  return {
+    helpers: {
+      artifacts: store,
+      sessionId: EVAL_SESSION_ID,
+      getChatId: () => "eval-chat",
+      openArtifact: () => {},
+    },
+    snapshot: () => [...items.values()],
+  };
+}
diff --git a/ai_evals/adapters/frontend/core/global/globalEvalRunner.ts b/ai_evals/adapters/frontend/core/global/globalEvalRunner.ts
index 8fe28d022a..dcd771663a 100644
--- a/ai_evals/adapters/frontend/core/global/globalEvalRunner.ts
+++ b/ai_evals/adapters/frontend/core/global/globalEvalRunner.ts
@@ -14,6 +14,7 @@ import {
 } from "../../../../../frontend/src/lib/components/copilot/chat/global/userDraftAdapter";
 import type { Tool as ProductionTool } from "../../../../../frontend/src/lib/components/copilot/chat/shared";
 import { UserDraft } from "../../../../../frontend/src/lib/userDraft.svelte";
+import { createEvalArtifactHelpers } from "./evalArtifactStore";
 import type { ModeRunContext } from "../../../../core/types";
 import type { GlobalDraftState } from "../../../../core/validators";
 import type { WindmillBackendSettings } from "../../../../core/windmillBackendSettings";
@@ -43,67 +44,6 @@ const LIVE_EDITOR_ITEM_KINDS = {
   app: "raw_app",
 } as const;
 
-// SessionArtifactsStore can't run here (bun has no IndexedDB, nor the compiled $state runes),
-// so mirror only its tool-facing shape; its own logic (scoping, race guard) is unit-tested.
-const EVAL_SESSION_ID = "eval-session";
-function createEvalArtifactHelpers() {
-  const items = new Map<string, Record<string, unknown>>();
-  let seq = 0;
-  const store = {
-    create: async (sessionId: string, input: Record<string, any>) => {
-      const now = seq++;
-      const artifact = {
-        id: `eval-artifact-${now}`,
-        sessionId,
-        chatId: input.chatId,
-        kind: input.kind ?? "md",
-        name: input.name,
-        content: input.content,
-        createdAt: now,
-        updatedAt: now,
-      };
-      items.set(artifact.id, artifact);
-      return artifact;
-    },
-    get: async (id: string) => items.get(id),
-    update: async (
-      id: string,
-      input: Record<string, any>,
-      opts?: { sessionId?: string },
-    ) => {
-      const existing = items.get(id);
-      if (!existing) return undefined;
-      if (
-        opts?.sessionId !== undefined &&
-        existing.sessionId !== opts.sessionId
-      )
-        return undefined;
-      const updated = {
-        ...existing,
-        name: input.name ?? existing.name,
-        content: input.content ?? existing.content,
-        updatedAt: seq++,
-      };
-      items.set(id, updated);
-      return updated;
-    },
-    remove: async (id: string) => {
-      items.delete(id);
-    },
-    listForSession: async (sessionId: string) =>
-      [...items.values()].filter((a) => a.sessionId === sessionId),
-  };
-  return {
-    helpers: {
-      artifacts: store,
-      sessionId: EVAL_SESSION_ID,
-      getChatId: () => "eval-chat",
-      openArtifact: () => {},
-    },
-    snapshot: () => [...items.values()],
-  };
-}
-
 export interface GlobalLiveEditorDraftFixture {
   type: keyof typeof LIVE_EDITOR_ITEM_KINDS;
   storagePath?: string;
diff --git a/ai_evals/adapters/frontend/mockBackend.ts b/ai_evals/adapters/frontend/mockBackend.ts
index 40a6dfa4ad..b0b5bbabe2 100644
--- a/ai_evals/adapters/frontend/mockBackend.ts
+++ b/ai_evals/adapters/frontend/mockBackend.ts
@@ -561,6 +561,35 @@ export function runBenchmarkScriptPreview(input: {
 	})
 }
 
+export function runBenchmarkScriptByPath(input: {
+	workspace: string
+	path: string
+	args?: Record<string, unknown>
+}): string {
+	const script = getBenchmarkScriptByPath(input.workspace, input.path)
+	return createBenchmarkCompletedJob({
+		workspace: input.workspace,
+		jobKind: 'script',
+		success: script !== null,
+		scriptPath: input.path,
+		args: input.args,
+		result:
+			script !== null
+				? {
+						path: input.path,
+						args: input.args ?? {},
+						mocked: true
+					}
+				: {
+						error: `Script "${input.path}" not found in benchmark workspace`
+					},
+		logs:
+			script !== null
+				? 'Mock benchmark script run completed successfully.'
+				: `Script "${input.path}" not found in benchmark workspace.`
+	})
+}
+
 export function runBenchmarkFlowByPath(input: {
 	workspace: string
 	path: string
@@ -747,6 +776,27 @@ const BENCHMARK_MCP_TOOLS: EndpointTool[] = [
 			required: ['workspace']
 		}
 	},
+	{
+		name: 'getJob',
+		description: 'get job',
+		instructions: '',
+		path: '/w/{workspace}/jobs_u/get/{id}',
+		method: 'GET',
+		path_params_schema: {
+			type: 'object',
+			properties: { workspace: { type: 'string' }, id: { type: 'string', format: 'uuid' } },
+			required: ['workspace', 'id']
+		},
+		query_params_schema: {
+			type: 'object',
+			properties: {
+				no_logs: { type: 'boolean' },
+				no_code: { type: 'boolean' },
+				approval_token: { type: 'string' }
+			},
+			required: []
+		}
+	},
 	{
 		name: 'runScriptByPath',
 		description: 'Run the deployed version of a script by path',
@@ -968,6 +1018,26 @@ const BENCHMARK_WORKERS = [
 	}
 ]
 
+const BENCHMARK_JOB_GET_PATH = /^\/api\/w\/([^/]+)\/jobs_u\/get\/([^/]+)$/
+const BENCHMARK_RUN_BY_PATH = /^\/api\/w\/([^/]+)\/jobs\/run\/(p|f)\/([^/]+)$/
+
+/** `executeEndpoint` sends a JSON string; anything else means no args were supplied. */
+function parseBenchmarkRequestBody(
+	body: BodyInit | null | undefined
+): Record<string, unknown> | undefined {
+	if (typeof body !== 'string') {
+		return undefined
+	}
+	try {
+		const parsed = JSON.parse(body)
+		return typeof parsed === 'object' && parsed !== null
+			? (parsed as Record<string, unknown>)
+			: undefined
+	} catch {
+		return undefined
+	}
+}
+
 /** True when `handleBenchmarkApiFetch` has an answer for this `/api/...` url.
  * Any other relative fetch must keep its normal (non-benchmark) behavior —
  * intercepting it with a synthetic 404 sends the model into retry loops. */
@@ -975,6 +1045,8 @@ export function hasBenchmarkApiHandler(url: string): boolean {
 	const path = url.split('?')[0]
 	return (
 		path === '/api/workers/list' ||
+		BENCHMARK_JOB_GET_PATH.test(path) ||
+		BENCHMARK_RUN_BY_PATH.test(path) ||
 		/^\/api\/w\/[^/]+\/jobs\/queue\/list$/.test(path) ||
 		path === '/api/embeddings/query_hub_scripts' ||
 		path.startsWith('/api/scripts/hub/get_full/')
@@ -983,7 +1055,7 @@ export function hasBenchmarkApiHandler(url: string): boolean {
 
 /** Answer a relative `/api/...` fetch — from the API catalog executor, or from the
  * chat's hub tools. */
-export function handleBenchmarkApiFetch(url: string): Response {
+export function handleBenchmarkApiFetch(url: string, init?: RequestInit): Response {
 	const path = url.split('?')[0]
 	if (path === '/api/workers/list') {
 		return Response.json(BENCHMARK_WORKERS)
@@ -991,6 +1063,36 @@ export function handleBenchmarkApiFetch(url: string): Response {
 	if (/^\/api\/w\/[^/]+\/jobs\/queue\/list$/.test(path)) {
 		return Response.json([])
 	}
+	const jobGet = BENCHMARK_JOB_GET_PATH.exec(path)
+	if (jobGet) {
+		const id = decodeURIComponent(jobGet[2])
+		const job = getBenchmarkCompletedJob(decodeURIComponent(jobGet[1]), id)
+		if (!job) {
+			return Response.json({ error: `Job not found for "${id}"` }, { status: 404 })
+		}
+		// The real endpoint lets a caller drop the bulky fields. Ignoring that here would
+		// size the model's context off a payload it explicitly asked to shrink.
+		const query = new URLSearchParams(url.split('?')[1] ?? '')
+		if (query.get('no_logs') === 'true') {
+			delete job.logs
+		}
+		if (query.get('no_code') === 'true') {
+			delete job.raw_code
+		}
+		return Response.json(job)
+	}
+	const runByPath = BENCHMARK_RUN_BY_PATH.exec(path)
+	if (runByPath) {
+		const workspace = decodeURIComponent(runByPath[1])
+		const runnablePath = decodeURIComponent(runByPath[3])
+		const args = parseBenchmarkRequestBody(init?.body)
+		// The real endpoint answers with the bare job id as text, not JSON.
+		return new Response(
+			runByPath[2] === 'f'
+				? runBenchmarkFlowByPath({ workspace, path: runnablePath, args })
+				: runBenchmarkScriptByPath({ workspace, path: runnablePath, args })
+		)
+	}
 	if (path === '/api/embeddings/query_hub_scripts') {
 		const text = new URLSearchParams(url.split('?')[1] ?? '').get('text') ?? ''
 		return Response.json(searchBenchmarkHubScripts(text))
diff --git a/ai_evals/adapters/frontend/mockBackendApi.test.ts b/ai_evals/adapters/frontend/mockBackendApi.test.ts
new file mode 100644
index 0000000000..d9cfa08bf4
--- /dev/null
+++ b/ai_evals/adapters/frontend/mockBackendApi.test.ts
@@ -0,0 +1,83 @@
+import { afterEach, beforeEach, describe, expect, it } from 'bun:test'
+import {
+	createBenchmarkCompletedJob,
+	getBenchmarkCompletedJob,
+	handleBenchmarkApiFetch,
+	hasBenchmarkApiHandler,
+	listBenchmarkMcpTools,
+	resetBenchmarkMockBackend,
+	registerBenchmarkWorkspaceRunnables
+} from './mockBackend'
+
+const WORKSPACE = 'benchmark-api-ws'
+
+// A catalog entry with no fetch handler is a dead end: the catalog executor builds a
+// relative `/api/...` url, the stub declines it, and node's fetch throws on the relative
+// url instead of returning a result the model can act on. Mutating entries are reachable
+// too — the eval runners define no `requestConfirmation`, so `call_api_endpoint` executes
+// unconfirmed.
+describe('benchmark API catalog', () => {
+	beforeEach(() => resetBenchmarkMockBackend())
+	afterEach(() => resetBenchmarkMockBackend())
+
+	it('answers every endpoint it advertises', () => {
+		const unanswered = listBenchmarkMcpTools()
+			.map((tool) =>
+				`/api${tool.path.replace('{workspace}', WORKSPACE)}`.replace(/\{[^}]+\}/g, 'x')
+			)
+			.filter((url) => !hasBenchmarkApiHandler(url))
+
+		// The draft-covered entries are refused by name before any fetch, so they are
+		// advertised without a handler on purpose.
+		expect(unanswered).toEqual([
+			`/api/w/${WORKSPACE}/scripts/get/p/x`,
+			`/api/w/${WORKSPACE}/flows/create`,
+			`/api/w/${WORKSPACE}/schedules/delete/x`,
+			`/api/w/${WORKSPACE}/variables/get/x`
+		])
+	})
+
+	it('runs a deployed script by path, the way call_api_endpoint reaches it', async () => {
+		registerBenchmarkWorkspaceRunnables(WORKSPACE, {
+			scripts: [
+				{
+					path: 'f/evals/greet',
+					summary: 'Greet',
+					language: 'bun',
+					content: 'export async function main() {}'
+				}
+			]
+		})
+
+		const res = handleBenchmarkApiFetch(
+			`/api/w/${WORKSPACE}/jobs/run/p/${encodeURIComponent('f/evals/greet')}`,
+			{ method: 'POST', body: JSON.stringify({ name: 'ada' }) }
+		)
+
+		expect(res.status).toBe(200)
+		const job = getBenchmarkCompletedJob(WORKSPACE, (await res.text()).trim())
+		expect(job).toMatchObject({ success: true, args: { name: 'ada' } })
+	})
+
+	it('serves a recorded job so a model can check the run it just started', async () => {
+		const id = createBenchmarkCompletedJob({
+			workspace: WORKSPACE,
+			jobKind: 'preview',
+			result: 'Hello, World!'
+		})
+
+		const res = handleBenchmarkApiFetch(`/api/w/${WORKSPACE}/jobs_u/get/${id}`)
+
+		expect(res.status).toBe(200)
+		expect(await res.json()).toMatchObject({
+			id,
+			success: true,
+			result: 'Hello, World!'
+		})
+	})
+
+	it('404s an unknown job id instead of letting the fetch fall through', () => {
+		expect(hasBenchmarkApiHandler(`/api/w/${WORKSPACE}/jobs_u/get/missing`)).toBe(true)
+		expect(handleBenchmarkApiFetch(`/api/w/${WORKSPACE}/jobs_u/get/missing`).status).toBe(404)
+	})
+})
diff --git a/ai_evals/adapters/frontend/vitestAdapter.test.ts b/ai_evals/adapters/frontend/vitestAdapter.test.ts
index c07d104f47..e9c33b5632 100644
--- a/ai_evals/adapters/frontend/vitestAdapter.test.ts
+++ b/ai_evals/adapters/frontend/vitestAdapter.test.ts
@@ -13,7 +13,7 @@ const ORIGINAL_FETCH = globalThis.fetch
 globalThis.fetch = (async (input: unknown, init?: RequestInit) => {
 	const url = typeof input === 'string' ? input : ((input as Request | URL | null)?.url ?? '')
 	if (typeof url === 'string' && hasBenchmarkApiHandler(url)) {
-		return handleBenchmarkApiFetch(url)
+		return handleBenchmarkApiFetch(url, init)
 	}
 	return ORIGINAL_FETCH(input as Parameters<typeof fetch>[0], init)
 }) as typeof fetch
diff --git a/ai_evals/cases/global.yaml b/ai_evals/cases/global.yaml
index 005c677e79..b2716671b1 100644
--- a/ai_evals/cases/global.yaml
+++ b/ai_evals/cases/global.yaml
@@ -567,6 +567,40 @@
     - passes dry_run as true
     - leaves only the schedule draft for review
 
+- id: global-test29-schedule-with-retry-and-error-handler
+  prompt: |-
+    The workspace already has a report digest helper.
+    Schedule it every morning at 6am UTC with `dry_run` on, and have it retry twice
+    if it fails. Run it on our `nightly` worker group.
+    Draft only, I'll review before deploying.
+  initial: ai_evals/fixtures/frontend/global/initial/report_digest_script.json
+  runtime:
+    maxTurns: 8
+  validate:
+    draftCountExactly: 1
+    requiredDrafts:
+      - type: schedule
+        pathIncludes:
+          - digest
+        valueIncludes:
+          - f/evals/global/send_report_digest
+          - attempts
+          - nightly
+  toolExpect:
+    requiredToolsUsed:
+      - write_schedule
+      - get_schedule_schema
+    forbiddenToolsUsed:
+      - write_script
+      - write_flow
+      - deploy_workspace_item
+  judgeChecklist:
+    - finds the existing report digest helper rather than creating a new script or flow
+    - creates one schedule draft for that helper running daily around 06:00 UTC
+    - configures a retry policy with two attempts
+    - routes the schedule to the nightly worker tag
+    - leaves the schedule as a draft without deploying
+
 - id: global-test18-human-slack-resource-with-secret
   prompt: |-
     I'm preparing Slack notifications for eval failures.
@@ -1106,6 +1140,38 @@
     - closes the runs preview tab in the side panel
     - does not write, deploy, or delete anything
 
+# --- Artifact version history ---
+# Every content change to an artifact is snapshotted, and update_artifact requires a
+# change_note that the user reads in the version picker. A blank note makes the history
+# unreadable, so pin that the model fills it on every edit.
+
+- id: global-artifact-note-on-each-edit
+  prompt: |-
+    Write up a short rollout plan for me as a doc I can come back to, covering a staged
+    rollout in three phases. Then add a rollback section to it, and after that tighten
+    the wording of phase 2.
+  runtime:
+    maxTurns: 12
+    sessionChat: true
+  validate:
+    draftCountExactly: 0
+  toolExpect:
+    requiredToolsUsed:
+      - create_artifact
+      - update_artifact
+    forbiddenToolsUsed:
+      - deploy_workspace_item
+      - delete_workspace_item
+    toolCallArgs:
+      # The note is what the version picker shows; a blank one makes history unreadable.
+      - tool: update_artifact
+        field: change_note
+        nonEmpty: true
+  skipJudge: true
+  judgeChecklist:
+    - creates one artifact and revises it rather than creating a second artifact
+    - each revision carries a short description of what changed
+
 # --- Documentation search (search_docs) ---
 # Pure product-knowledge questions: the assistant should consult the docs via
 # search_docs and answer conversationally, not draft or mutate anything. No
@@ -1773,6 +1839,27 @@
   judgeChecklist:
     - deletes the deployed script via delete_workspace_item rather than a raw API endpoint
 
+- id: global-undo-created-draft
+  prompt: |-
+    Create a draft Postgres resource at `u/admin/scratch_db` for host db.example.com port 5432, database `orders`, user `app`, and tell me what fields it ended up with.
+    Once you've shown me that, delete it from the workspace again — I only wanted to see the shape of it.
+  initial: ai_evals/fixtures/frontend/global/initial/user_admin_empty.json
+  runtime:
+    maxTurns: 10
+  validate:
+    draftCountExactly: 0
+  toolExpect:
+    requiredToolsUsed:
+      - write_resource
+      - discard_local_draft
+    forbiddenToolsUsed:
+      - delete_workspace_item
+      - deploy_workspace_item
+  # Undoing a draft leaves no draft behind; validate via tool use.
+  skipJudge: true
+  judgeChecklist:
+    - undoes its own never-deployed resource with discard_local_draft rather than delete_workspace_item
+
 - id: global-draft-diff-report
   prompt: |-
     Update the existing workspace script at `f/evals/global/format_greeting` so the returned message ends with an exclamation mark, keeping everything else the same.
diff --git a/ai_evals/core/types.ts b/ai_evals/core/types.ts
index 83e9a218f3..f269c5c4eb 100644
--- a/ai_evals/core/types.ts
+++ b/ai_evals/core/types.ts
@@ -166,6 +166,12 @@ export interface ToolCallArgumentRule {
    * tool — e.g. SQL where a mutation is mixed with verification SELECTs.
    */
   stringIncludesAnyOf?: string[];
+  /**
+   * Universal over calls: every recorded call to `tool` must carry `field` as a
+   * non-blank string. Use for a required argument whose value is free text, where
+   * the point is that the model filled it in at all rather than what it said.
+   */
+  nonEmpty?: boolean;
 }
 
 export interface ToolValidationSpec {
diff --git a/ai_evals/core/validators.test.ts b/ai_evals/core/validators.test.ts
index d603dae626..96107397b7 100644
--- a/ai_evals/core/validators.test.ts
+++ b/ai_evals/core/validators.test.ts
@@ -174,6 +174,52 @@ describe("validateToolExpectations", () => {
     expect(checks.every((check) => check.passed)).toBe(true);
   });
 
+  it("fails nonEmpty when any call left the field blank", () => {
+    const checks = validateToolExpectations({
+      run: {
+        success: true,
+        actual: {},
+        assistantMessageCount: 1,
+        toolCallCount: 2,
+        toolsUsed: ["update_artifact"],
+        toolCallDetails: [
+          { name: "update_artifact", arguments: { change_note: "Added a rollback section" } },
+          // A whitespace-only note is as unreadable in the picker as a missing one.
+          { name: "update_artifact", arguments: { change_note: "   " } },
+        ],
+        skillsInvoked: [],
+      },
+      toolExpect: {
+        toolCallArgs: [{ tool: "update_artifact", field: "change_note", nonEmpty: true }],
+      },
+    });
+
+    const nonEmptyCheck = checks.find((c) => c.name.includes("is filled in on every call"));
+    expect(nonEmptyCheck?.passed).toBe(false);
+    expect(nonEmptyCheck?.details).toContain("blank on 1 of 2");
+  });
+
+  it("passes nonEmpty when every call filled the field", () => {
+    const checks = validateToolExpectations({
+      run: {
+        success: true,
+        actual: {},
+        assistantMessageCount: 1,
+        toolCallCount: 1,
+        toolsUsed: ["update_artifact"],
+        toolCallDetails: [
+          { name: "update_artifact", arguments: { change_note: "Tightened phase 2" } },
+        ],
+        skillsInvoked: [],
+      },
+      toolExpect: {
+        toolCallArgs: [{ tool: "update_artifact", field: "change_note", nonEmpty: true }],
+      },
+    });
+
+    expect(checks.every((check) => check.passed)).toBe(true);
+  });
+
   it("accepts a stringIncludesAnyOf substring inside an array-valued field", () => {
     const checks = validateToolExpectations({
       run: {
diff --git a/ai_evals/core/validators.ts b/ai_evals/core/validators.ts
index 32ff225fc1..fa39d8611a 100644
--- a/ai_evals/core/validators.ts
+++ b/ai_evals/core/validators.ts
@@ -233,6 +233,19 @@ export function validateToolExpectations(input: {
       );
     }
 
+    if (rule.nonEmpty) {
+      const blankValues = values.filter(
+        (value) => typeof value !== "string" || value.trim().length === 0
+      );
+      checks.push(
+        check(
+          `${rule.tool}.${rule.field} is filled in on every call`,
+          blankValues.length === 0,
+          `blank on ${blankValues.length} of ${values.length} call(s); values: ${summarizeToolValues(values)}`
+        )
+      );
+    }
+
     if (rule.stringIncludesAnyOf && rule.stringIncludesAnyOf.length > 0) {
       // Existential: at least one call must contain one of the substrings.
       // Other calls to the same tool may do anything — this suits SQL, where a
diff --git a/backend/.sqlx/query-00a7fccde8bc2075642ba02f4015d752ba7d67966ed03c0bf3414c842c049b3a.json b/backend/.sqlx/query-00a7fccde8bc2075642ba02f4015d752ba7d67966ed03c0bf3414c842c049b3a.json
new file mode 100644
index 0000000000..2d3292c34b
--- /dev/null
+++ b/backend/.sqlx/query-00a7fccde8bc2075642ba02f4015d752ba7d67966ed03c0bf3414c842c049b3a.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO flow (workspace_id, path, summary, description, value, edited_by, edited_at, on_behalf_of, on_behalf_of_email)\n         VALUES ('test-workspace', 'u/test-user/obo_flow', '', '', $1, 'test-user', NOW(), 'u/test-user-2', 'test2@windmill.dev')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "00a7fccde8bc2075642ba02f4015d752ba7d67966ed03c0bf3414c842c049b3a"
+}
diff --git a/backend/.sqlx/query-00e9fc3fed9379264881c58df9404ab3569a0611b33c261602d62e9c847c583e.json b/backend/.sqlx/query-00e9fc3fed9379264881c58df9404ab3569a0611b33c261602d62e9c847c583e.json
deleted file mode 100644
index 13536a244e..0000000000
--- a/backend/.sqlx/query-00e9fc3fed9379264881c58df9404ab3569a0611b33c261602d62e9c847c583e.json
+++ /dev/null
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "DELETE FROM datatable_migrations WHERE workspace_id = $1 AND datatable = ANY($2::text[])",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "TextArray"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "00e9fc3fed9379264881c58df9404ab3569a0611b33c261602d62e9c847c583e"
-}
diff --git a/backend/.sqlx/query-015b63b1fbdf95fc76138fcf0aed03ac8948cfcf071c7f5df574c5f7003545cd.json b/backend/.sqlx/query-015b63b1fbdf95fc76138fcf0aed03ac8948cfcf071c7f5df574c5f7003545cd.json
new file mode 100644
index 0000000000..9d3b9e9287
--- /dev/null
+++ b/backend/.sqlx/query-015b63b1fbdf95fc76138fcf0aed03ac8948cfcf071c7f5df574c5f7003545cd.json
@@ -0,0 +1,24 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT path FROM flow WHERE on_behalf_of = $1 AND NOT path LIKE $2 AND workspace_id = $3 AND NOT archived",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "path",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "015b63b1fbdf95fc76138fcf0aed03ac8948cfcf071c7f5df574c5f7003545cd"
+}
diff --git a/backend/.sqlx/query-01732ca02b1888145c48c4e51e5b5829657224a743af9c0b2d5a140ad70e13dd.json b/backend/.sqlx/query-01732ca02b1888145c48c4e51e5b5829657224a743af9c0b2d5a140ad70e13dd.json
index a0d8b66a26..6c282c7db8 100644
--- a/backend/.sqlx/query-01732ca02b1888145c48c4e51e5b5829657224a743af9c0b2d5a140ad70e13dd.json
+++ b/backend/.sqlx/query-01732ca02b1888145c48c4e51e5b5829657224a743af9c0b2d5a140ad70e13dd.json
@@ -16,7 +16,8 @@
                 "variable",
                 "ducklake",
                 "datatable",
-                "volume"
+                "volume",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-0da2425ff8ee737104cd9f2650f1ffba1511715ac1f9270939d79fb82f8e88d0.json b/backend/.sqlx/query-024fa8a99a7967a56cd5ac9486ef728f2de0800eeb877fd29aca2fba3029aa55.json
similarity index 54%
rename from backend/.sqlx/query-0da2425ff8ee737104cd9f2650f1ffba1511715ac1f9270939d79fb82f8e88d0.json
rename to backend/.sqlx/query-024fa8a99a7967a56cd5ac9486ef728f2de0800eeb877fd29aca2fba3029aa55.json
index 36e9ac3e04..d44cd42986 100644
--- a/backend/.sqlx/query-0da2425ff8ee737104cd9f2650f1ffba1511715ac1f9270939d79fb82f8e88d0.json
+++ b/backend/.sqlx/query-024fa8a99a7967a56cd5ac9486ef728f2de0800eeb877fd29aca2fba3029aa55.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "UPDATE azure_trigger SET email = $1 WHERE email = $2",
+  "query": "UPDATE flow SET on_behalf_of = $1 WHERE on_behalf_of = $2",
   "describe": {
     "columns": [],
     "parameters": {
@@ -11,5 +11,5 @@
     },
     "nullable": []
   },
-  "hash": "0da2425ff8ee737104cd9f2650f1ffba1511715ac1f9270939d79fb82f8e88d0"
+  "hash": "024fa8a99a7967a56cd5ac9486ef728f2de0800eeb877fd29aca2fba3029aa55"
 }
diff --git a/backend/.sqlx/query-03238f44f8d4db3ed406f853b5afd945796a2657e58cf1c5086d971e652803d5.json b/backend/.sqlx/query-03238f44f8d4db3ed406f853b5afd945796a2657e58cf1c5086d971e652803d5.json
new file mode 100644
index 0000000000..f99e53856c
--- /dev/null
+++ b/backend/.sqlx/query-03238f44f8d4db3ed406f853b5afd945796a2657e58cf1c5086d971e652803d5.json
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO dbt_graph_snapshot (workspace_id, script_path, script_hash, job_id, digest)\n         VALUES ($1, $2, $3, $4, 'd2')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Int8",
+        "Uuid"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "03238f44f8d4db3ed406f853b5afd945796a2657e58cf1c5086d971e652803d5"
+}
diff --git a/backend/.sqlx/query-04896f435eee78f5ac604f5a57c8d35a313fc321df788e1c701e11f60da46480.json b/backend/.sqlx/query-04896f435eee78f5ac604f5a57c8d35a313fc321df788e1c701e11f60da46480.json
new file mode 100644
index 0000000000..4a632d868e
--- /dev/null
+++ b/backend/.sqlx/query-04896f435eee78f5ac604f5a57c8d35a313fc321df788e1c701e11f60da46480.json
@@ -0,0 +1,29 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT created_by, runnable_path FROM v2_job\n          WHERE id = $1 AND workspace_id = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "created_by",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "runnable_path",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      true
+    ]
+  },
+  "hash": "04896f435eee78f5ac604f5a57c8d35a313fc321df788e1c701e11f60da46480"
+}
diff --git a/backend/.sqlx/query-051a18ab1720ffff792a843be93e8c01515be10b2e40292d904d20e7d53bf289.json b/backend/.sqlx/query-051a18ab1720ffff792a843be93e8c01515be10b2e40292d904d20e7d53bf289.json
new file mode 100644
index 0000000000..c436cb3ed8
--- /dev/null
+++ b/backend/.sqlx/query-051a18ab1720ffff792a843be93e8c01515be10b2e40292d904d20e7d53bf289.json
@@ -0,0 +1,28 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH RECURSIVE tree AS (\n                       SELECT id, is_dev_workspace, dev_workspace_label, deleted, 0 AS depth\n                       FROM workspace WHERE id = $1\n                       UNION ALL\n                       SELECT w.id, w.is_dev_workspace, w.dev_workspace_label, w.deleted,\n                              tree.depth + 1\n                       FROM workspace w JOIN tree ON w.parent_workspace_id = tree.id\n                       WHERE tree.depth < 20\n                   )\n                   SELECT id AS \"id!\", dev_workspace_label FROM tree\n                   WHERE depth > 0 AND is_dev_workspace AND NOT deleted",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "dev_workspace_label",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      null,
+      null
+    ]
+  },
+  "hash": "051a18ab1720ffff792a843be93e8c01515be10b2e40292d904d20e7d53bf289"
+}
diff --git a/backend/.sqlx/query-058df18b148867dbb8bcf9e10c485d276b5af4b2b972fb335e41077a029c3196.json b/backend/.sqlx/query-058df18b148867dbb8bcf9e10c485d276b5af4b2b972fb335e41077a029c3196.json
new file mode 100644
index 0000000000..1dd8e03e43
--- /dev/null
+++ b/backend/.sqlx/query-058df18b148867dbb8bcf9e10c485d276b5af4b2b972fb335e41077a029c3196.json
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE usr SET email = 'group-ops@windmill.dev' WHERE email = 'test2@windmill.dev'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "058df18b148867dbb8bcf9e10c485d276b5af4b2b972fb335e41077a029c3196"
+}
diff --git a/backend/.sqlx/query-67e25a7c19ea0ffaf7ea5303fcd04af5a7eb488c76f783e690af0c2153b1d6a8.json b/backend/.sqlx/query-09ae123099f05fe3db8bd67ca2c0d778a27619dd7fad71ba656f6b54c4915d1e.json
similarity index 92%
rename from backend/.sqlx/query-67e25a7c19ea0ffaf7ea5303fcd04af5a7eb488c76f783e690af0c2153b1d6a8.json
rename to backend/.sqlx/query-09ae123099f05fe3db8bd67ca2c0d778a27619dd7fad71ba656f6b54c4915d1e.json
index 0eb26d5dc0..8840ce4958 100644
--- a/backend/.sqlx/query-67e25a7c19ea0ffaf7ea5303fcd04af5a7eb488c76f783e690af0c2153b1d6a8.json
+++ b/backend/.sqlx/query-09ae123099f05fe3db8bd67ca2c0d778a27619dd7fad71ba656f6b54c4915d1e.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT\n            j.id, j.workspace_id, j.runnable_id AS \"runnable_id: ScriptHash\", q.scheduled_for, q.started_at, j.parent_job, j.flow_innermost_root_job, j.runnable_path, j.kind as \"kind!: JobKind\", j.permissioned_as,\n            j.created_by, j.script_lang AS \"script_lang: ScriptLang\", j.permissioned_as_email, j.flow_step_id, j.trigger_kind AS \"trigger_kind: JobTriggerKind\", j.trigger, j.priority, j.concurrent_limit, j.tag, j.cache_ttl, q.cache_ignore_s3_path, q.runnable_settings_handle\n            FROM v2_job j LEFT JOIN v2_job_queue q ON j.id = q.id\n            WHERE j.id = $1 AND j.workspace_id = $2",
+  "query": "SELECT\n            j.id, j.workspace_id, j.runnable_id AS \"runnable_id: ScriptHash\", q.scheduled_for, q.started_at, j.parent_job, j.flow_innermost_root_job, j.runnable_path, j.kind as \"kind!: JobKind\", j.permissioned_as,\n            j.created_by, j.script_lang AS \"script_lang: ScriptLang\", j.permissioned_as_email, j.flow_step_id, j.trigger_kind AS \"trigger_kind: TriggerKindLabel\", j.trigger, j.priority, j.concurrent_limit, j.tag, j.cache_ttl, q.cache_ignore_s3_path, q.runnable_settings_handle\n            FROM v2_job j LEFT JOIN v2_job_queue q ON j.id = q.id\n            WHERE j.id = $1 AND j.workspace_id = $2",
   "describe": {
     "columns": [
       {
@@ -119,7 +119,8 @@
                 "java",
                 "duckdb",
                 "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
               ]
             }
           }
@@ -137,7 +138,7 @@
       },
       {
         "ordinal": 14,
-        "name": "trigger_kind: JobTriggerKind",
+        "name": "trigger_kind: TriggerKindLabel",
         "type_info": {
           "Custom": {
             "name": "job_trigger_kind",
@@ -236,5 +237,5 @@
       true
     ]
   },
-  "hash": "67e25a7c19ea0ffaf7ea5303fcd04af5a7eb488c76f783e690af0c2153b1d6a8"
+  "hash": "09ae123099f05fe3db8bd67ca2c0d778a27619dd7fad71ba656f6b54c4915d1e"
 }
diff --git a/backend/.sqlx/query-0b3754e11677390837ec7ab00ba5443dc634b8628e90cce879952c8c4319a6a6.json b/backend/.sqlx/query-0b3754e11677390837ec7ab00ba5443dc634b8628e90cce879952c8c4319a6a6.json
new file mode 100644
index 0000000000..99bf8ee009
--- /dev/null
+++ b/backend/.sqlx/query-0b3754e11677390837ec7ab00ba5443dc634b8628e90cce879952c8c4319a6a6.json
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM dbt_edge WHERE workspace_id = $1 AND script_path = $2\n           AND script_hash = $3 AND job_id = $4",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Int8",
+        "Uuid"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "0b3754e11677390837ec7ab00ba5443dc634b8628e90cce879952c8c4319a6a6"
+}
diff --git a/backend/.sqlx/query-0b9088064d2a61fd9df91269ec95cab2539a701109727f997a3e5a0f4b0f1f22.json b/backend/.sqlx/query-0b9088064d2a61fd9df91269ec95cab2539a701109727f997a3e5a0f4b0f1f22.json
new file mode 100644
index 0000000000..25bfaf16d3
--- /dev/null
+++ b/backend/.sqlx/query-0b9088064d2a61fd9df91269ec95cab2539a701109727f997a3e5a0f4b0f1f22.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT pg_advisory_xact_lock(hashtext('dev_workspace_pairing:' || $1))",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "pg_advisory_xact_lock",
+        "type_info": "Void"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "0b9088064d2a61fd9df91269ec95cab2539a701109727f997a3e5a0f4b0f1f22"
+}
diff --git a/backend/.sqlx/query-0c416eee574142b7a709a6e3e9a47d436f407781ff2bee820d3234317f46f2a6.json b/backend/.sqlx/query-0c416eee574142b7a709a6e3e9a47d436f407781ff2bee820d3234317f46f2a6.json
new file mode 100644
index 0000000000..6f1603894b
--- /dev/null
+++ b/backend/.sqlx/query-0c416eee574142b7a709a6e3e9a47d436f407781ff2bee820d3234317f46f2a6.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE draft SET value = to_json(jsonb_set(to_jsonb(value), ARRAY['on_behalf_of'], to_jsonb('u/' || $1))) WHERE value->>'on_behalf_of' = ('u/' || $2) AND workspace_id = $3",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "0c416eee574142b7a709a6e3e9a47d436f407781ff2bee820d3234317f46f2a6"
+}
diff --git a/backend/.sqlx/query-0c5b02b6b70fb8fd2ab3e6c57897038750a44a67360d342b6ef705ef2e4d3007.json b/backend/.sqlx/query-0c5b02b6b70fb8fd2ab3e6c57897038750a44a67360d342b6ef705ef2e4d3007.json
new file mode 100644
index 0000000000..e74bd5de0e
--- /dev/null
+++ b/backend/.sqlx/query-0c5b02b6b70fb8fd2ab3e6c57897038750a44a67360d342b6ef705ef2e4d3007.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_settings (workspace_id, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts) SELECT $1, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts FROM workspace_settings WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "0c5b02b6b70fb8fd2ab3e6c57897038750a44a67360d342b6ef705ef2e4d3007"
+}
diff --git a/backend/.sqlx/query-0d9c4c350db3ef8f47c0951d901e9b87a9e3ee8c157b3e9a33053d2f0eeb8069.json b/backend/.sqlx/query-0d9c4c350db3ef8f47c0951d901e9b87a9e3ee8c157b3e9a33053d2f0eeb8069.json
new file mode 100644
index 0000000000..be32bf94a2
--- /dev/null
+++ b/backend/.sqlx/query-0d9c4c350db3ef8f47c0951d901e9b87a9e3ee8c157b3e9a33053d2f0eeb8069.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT EXISTS(SELECT 1 FROM app WHERE workspace_id = $1 AND path = $2)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "exists",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "0d9c4c350db3ef8f47c0951d901e9b87a9e3ee8c157b3e9a33053d2f0eeb8069"
+}
diff --git a/backend/.sqlx/query-0dbac8411e9fdaacd11980ac548c8cb957ff989aa70dae1223630f48d9949b44.json b/backend/.sqlx/query-0dbac8411e9fdaacd11980ac548c8cb957ff989aa70dae1223630f48d9949b44.json
new file mode 100644
index 0000000000..b6e0da69eb
--- /dev/null
+++ b/backend/.sqlx/query-0dbac8411e9fdaacd11980ac548c8cb957ff989aa70dae1223630f48d9949b44.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT EXISTS(SELECT 1 FROM resource_type WHERE workspace_id = $1 AND name = $2)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "exists",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "0dbac8411e9fdaacd11980ac548c8cb957ff989aa70dae1223630f48d9949b44"
+}
diff --git a/backend/.sqlx/query-0ee4a4dc8c6f09e7027bd99f98d8d1d346f9d67056ef272314dd9b80bee9f285.json b/backend/.sqlx/query-0ee4a4dc8c6f09e7027bd99f98d8d1d346f9d67056ef272314dd9b80bee9f285.json
index 238522a3ff..a9e75189af 100644
--- a/backend/.sqlx/query-0ee4a4dc8c6f09e7027bd99f98d8d1d346f9d67056ef272314dd9b80bee9f285.json
+++ b/backend/.sqlx/query-0ee4a4dc8c6f09e7027bd99f98d8d1d346f9d67056ef272314dd9b80bee9f285.json
@@ -16,7 +16,8 @@
                 "variable",
                 "ducklake",
                 "datatable",
-                "volume"
+                "volume",
+                "dbt"
               ]
             }
           }
@@ -55,7 +56,8 @@
                       "variable",
                       "ducklake",
                       "datatable",
-                      "volume"
+                      "volume",
+                      "dbt"
                     ]
                   }
                 }
diff --git a/backend/.sqlx/query-0f58d4e7e6f3e962e8a86a2d9feb921c308b6a047530eccd8966513ffdc722d0.json b/backend/.sqlx/query-0f58d4e7e6f3e962e8a86a2d9feb921c308b6a047530eccd8966513ffdc722d0.json
index 4194e7e9cc..0bc0c3ce03 100644
--- a/backend/.sqlx/query-0f58d4e7e6f3e962e8a86a2d9feb921c308b6a047530eccd8966513ffdc722d0.json
+++ b/backend/.sqlx/query-0f58d4e7e6f3e962e8a86a2d9feb921c308b6a047530eccd8966513ffdc722d0.json
@@ -35,7 +35,8 @@
                 "java",
                 "duckdb",
                 "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-10eba371c513030f165a6c8d3a32f7e33828247ab8108ffe304d7548aab5a42d.json b/backend/.sqlx/query-10eba371c513030f165a6c8d3a32f7e33828247ab8108ffe304d7548aab5a42d.json
new file mode 100644
index 0000000000..df470bbf61
--- /dev/null
+++ b/backend/.sqlx/query-10eba371c513030f165a6c8d3a32f7e33828247ab8108ffe304d7548aab5a42d.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT path FROM resource WHERE workspace_id = $1 AND path = ANY($2)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "path",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "TextArray"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "10eba371c513030f165a6c8d3a32f7e33828247ab8108ffe304d7548aab5a42d"
+}
diff --git a/backend/.sqlx/query-117b6de99cd75e279f738226d9455c506ac1d40163b4f3c50279a93e4cded5fa.json b/backend/.sqlx/query-117b6de99cd75e279f738226d9455c506ac1d40163b4f3c50279a93e4cded5fa.json
new file mode 100644
index 0000000000..c7df8b7610
--- /dev/null
+++ b/backend/.sqlx/query-117b6de99cd75e279f738226d9455c506ac1d40163b4f3c50279a93e4cded5fa.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE draft SET value = to_json(jsonb_set(to_jsonb(value), ARRAY['on_behalf_of_email'], to_jsonb($1::text))) WHERE typ IN ('script', 'flow') AND value->>'on_behalf_of_email' = $2 AND (value->>'on_behalf_of' IS NULL OR value->>'on_behalf_of' NOT LIKE 'g/%')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "117b6de99cd75e279f738226d9455c506ac1d40163b4f3c50279a93e4cded5fa"
+}
diff --git a/backend/.sqlx/query-11813108dbf6b104eba968c3609c74ac5a589542d3e76b1e756a82fb19d49ee8.json b/backend/.sqlx/query-11813108dbf6b104eba968c3609c74ac5a589542d3e76b1e756a82fb19d49ee8.json
index cef272c219..b8e3bb8927 100644
--- a/backend/.sqlx/query-11813108dbf6b104eba968c3609c74ac5a589542d3e76b1e756a82fb19d49ee8.json
+++ b/backend/.sqlx/query-11813108dbf6b104eba968c3609c74ac5a589542d3e76b1e756a82fb19d49ee8.json
@@ -34,7 +34,8 @@
                 "java",
                 "duckdb",
                 "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-1253d0f62254b30979a1c8b41d5dc1a57a0253f9a76721e7b8965905613f2ace.json b/backend/.sqlx/query-1253d0f62254b30979a1c8b41d5dc1a57a0253f9a76721e7b8965905613f2ace.json
new file mode 100644
index 0000000000..21dbc92b79
--- /dev/null
+++ b/backend/.sqlx/query-1253d0f62254b30979a1c8b41d5dc1a57a0253f9a76721e7b8965905613f2ace.json
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO script (workspace_id, path, hash, content, summary, description, language, created_by, created_at, on_behalf_of, on_behalf_of_email)\n         VALUES ('test-workspace', 'f/shared/obo', 1099, 'def main(): pass', '', '', 'python3', 'test-user', NOW(), 'u/test-user-2', 'test2@windmill.dev')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "1253d0f62254b30979a1c8b41d5dc1a57a0253f9a76721e7b8965905613f2ace"
+}
diff --git a/backend/.sqlx/query-12912ebe5df4eda15976e7c3a2f0501ed3098f33a234f283def6932ce491eb66.json b/backend/.sqlx/query-12912ebe5df4eda15976e7c3a2f0501ed3098f33a234f283def6932ce491eb66.json
new file mode 100644
index 0000000000..a797527421
--- /dev/null
+++ b/backend/.sqlx/query-12912ebe5df4eda15976e7c3a2f0501ed3098f33a234f283def6932ce491eb66.json
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO dbt_graph_snapshot (workspace_id, script_path, script_hash, job_id, digest)\n         VALUES ($1, $2, $3, $4, 'd')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Int8",
+        "Uuid"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "12912ebe5df4eda15976e7c3a2f0501ed3098f33a234f283def6932ce491eb66"
+}
diff --git a/backend/.sqlx/query-13ab0cda87d04b9c1fb52b46e0211d02b24375643a030efdbfab331cdc248349.json b/backend/.sqlx/query-13ab0cda87d04b9c1fb52b46e0211d02b24375643a030efdbfab331cdc248349.json
new file mode 100644
index 0000000000..66432001da
--- /dev/null
+++ b/backend/.sqlx/query-13ab0cda87d04b9c1fb52b46e0211d02b24375643a030efdbfab331cdc248349.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO token(token_hash, token_prefix, token, email, label, super_admin)\n         VALUES (encode(sha256('LONG_TOKEN'::bytea), 'hex'), 'LONG_TOKEN', 'LONG_TOKEN', $1, 'long', true)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "13ab0cda87d04b9c1fb52b46e0211d02b24375643a030efdbfab331cdc248349"
+}
diff --git a/backend/.sqlx/query-14a826d794da720981368c77a4f9dac27307833fafaa0ea232819aecd4d62773.json b/backend/.sqlx/query-14a826d794da720981368c77a4f9dac27307833fafaa0ea232819aecd4d62773.json
new file mode 100644
index 0000000000..6604c44c97
--- /dev/null
+++ b/backend/.sqlx/query-14a826d794da720981368c77a4f9dac27307833fafaa0ea232819aecd4d62773.json
@@ -0,0 +1,38 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        UPDATE native_trigger\n        SET webhook_token_hash = $1, service_config = $2, error = NULL, updated_at = NOW()\n        WHERE\n            workspace_id = $3\n            AND service_name = $4\n            AND external_id = $5\n            AND updated_at = $6\n        RETURNING 1 AS \"applied!\"\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "applied!",
+        "type_info": "Int4"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Jsonb",
+        "Text",
+        {
+          "Custom": {
+            "name": "native_trigger_service",
+            "kind": {
+              "Enum": [
+                "nextcloud",
+                "google",
+                "github"
+              ]
+            }
+          }
+        },
+        "Text",
+        "Timestamptz"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "14a826d794da720981368c77a4f9dac27307833fafaa0ea232819aecd4d62773"
+}
diff --git a/backend/.sqlx/query-14f024e99b3f7129294435671eba84c3d8cd9e36ff773c0cf2843509cce4fdf9.json b/backend/.sqlx/query-14f024e99b3f7129294435671eba84c3d8cd9e36ff773c0cf2843509cce4fdf9.json
new file mode 100644
index 0000000000..fd1769a44b
--- /dev/null
+++ b/backend/.sqlx/query-14f024e99b3f7129294435671eba84c3d8cd9e36ff773c0cf2843509cce4fdf9.json
@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes, source_last_event_kind, source_last_event_origin)\n                SELECT $1, unnest($2::varchar[]), $3, $4, 0, 1, NULL, $5, $6\n                ON CONFLICT (source_workspace_id, fork_workspace_id, path, kind)\n                DO UPDATE SET\n                    behind = workspace_diff.behind + 1,\n                    has_changes = NULL,\n                    source_last_event_kind = CASE WHEN $6::varchar IS NULL OR (NOT $7 AND workspace_diff.source_last_event_origin IS NOT NULL) THEN workspace_diff.source_last_event_kind ELSE $5 END,\n                    source_last_event_origin = CASE WHEN $6::varchar IS NULL OR (NOT $7 AND workspace_diff.source_last_event_origin IS NOT NULL) THEN workspace_diff.source_last_event_origin ELSE $6 END",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "VarcharArray",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Bool"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "14f024e99b3f7129294435671eba84c3d8cd9e36ff773c0cf2843509cce4fdf9"
+}
diff --git a/backend/.sqlx/query-164d94369014ce77642984818a0e436a87a1bd1c56fcaafbfae2ee45f62fe4e1.json b/backend/.sqlx/query-164d94369014ce77642984818a0e436a87a1bd1c56fcaafbfae2ee45f62fe4e1.json
new file mode 100644
index 0000000000..875e8b823c
--- /dev/null
+++ b/backend/.sqlx/query-164d94369014ce77642984818a0e436a87a1bd1c56fcaafbfae2ee45f62fe4e1.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE app SET policy = jsonb_set(policy, ARRAY['on_behalf_of_email'], to_jsonb($1::text)) WHERE policy->>'on_behalf_of_email' = $2 AND (policy->>'on_behalf_of' IS NULL OR policy->>'on_behalf_of' NOT LIKE 'g/%')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "164d94369014ce77642984818a0e436a87a1bd1c56fcaafbfae2ee45f62fe4e1"
+}
diff --git a/backend/.sqlx/query-16e8d3f75ce4b5b18cefc25ebb670b506677681394606426964491488d64c62c.json b/backend/.sqlx/query-16e8d3f75ce4b5b18cefc25ebb670b506677681394606426964491488d64c62c.json
deleted file mode 100644
index 06a3ee417e..0000000000
--- a/backend/.sqlx/query-16e8d3f75ce4b5b18cefc25ebb670b506677681394606426964491488d64c62c.json
+++ /dev/null
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO azure_trigger (\n            azure_resource_path, azure_mode, scope_resource_id, topic_name,\n            subscription_name, event_type_filters, push_auth_config, path, script_path,\n            is_flow, workspace_id, edited_by, email, edited_at, extra_perms, server_id,\n            last_server_ping, error, mode, permissioned_as, error_handler_path,\n            error_handler_args, retry, labels\n        )\n        SELECT\n            azure_resource_path, azure_mode, scope_resource_id, topic_name,\n            subscription_name, event_type_filters, push_auth_config, path, script_path,\n            is_flow, $1, edited_by, email, edited_at, extra_perms, NULL,\n            NULL, NULL, 'disabled'::TRIGGER_MODE, permissioned_as, error_handler_path,\n            error_handler_args, retry, labels\n        FROM azure_trigger WHERE workspace_id = $2",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "16e8d3f75ce4b5b18cefc25ebb670b506677681394606426964491488d64c62c"
-}
diff --git a/backend/.sqlx/query-175a732180336a801d1c2f41854269a2ce2160349f163b714cee77b5ed4b92f5.json b/backend/.sqlx/query-175a732180336a801d1c2f41854269a2ce2160349f163b714cee77b5ed4b92f5.json
new file mode 100644
index 0000000000..a25e9afac0
--- /dev/null
+++ b/backend/.sqlx/query-175a732180336a801d1c2f41854269a2ce2160349f163b714cee77b5ed4b92f5.json
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE script SET on_behalf_of = $1, on_behalf_of_email = $4 WHERE on_behalf_of = $2 AND workspace_id = $3",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "175a732180336a801d1c2f41854269a2ce2160349f163b714cee77b5ed4b92f5"
+}
diff --git a/backend/.sqlx/query-19d19f3ed995ac68d9692c8fdf96836099dd325fa25d3660eb766a895b07c1da.json b/backend/.sqlx/query-19d19f3ed995ac68d9692c8fdf96836099dd325fa25d3660eb766a895b07c1da.json
new file mode 100644
index 0000000000..76404ffce5
--- /dev/null
+++ b/backend/.sqlx/query-19d19f3ed995ac68d9692c8fdf96836099dd325fa25d3660eb766a895b07c1da.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM dbt_run_state WHERE workspace_id = $1 AND script_path = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "19d19f3ed995ac68d9692c8fdf96836099dd325fa25d3660eb766a895b07c1da"
+}
diff --git a/backend/.sqlx/query-1a3fb9f51abd42f1ac4c7597f985a687bed32d2905a446c4e4b33f0b853e8e54.json b/backend/.sqlx/query-1a3fb9f51abd42f1ac4c7597f985a687bed32d2905a446c4e4b33f0b853e8e54.json
new file mode 100644
index 0000000000..1c37708a50
--- /dev/null
+++ b/backend/.sqlx/query-1a3fb9f51abd42f1ac4c7597f985a687bed32d2905a446c4e4b33f0b853e8e54.json
@@ -0,0 +1,25 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM dbt_graph_snapshot g\n          WHERE g.workspace_id = $1 AND g.script_path = $2 AND g.script_hash IS NULL\n            AND g.permissioned_as IS NOT DISTINCT FROM $4\n            AND g.job_id NOT IN (\n              SELECT job_id FROM dbt_graph_snapshot\n               WHERE workspace_id = $1 AND script_path = $2 AND script_hash IS NULL\n                 AND permissioned_as IS NOT DISTINCT FROM $4\n               ORDER BY ingested_at DESC LIMIT $3)\n        RETURNING g.job_id",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "job_id",
+        "type_info": "Uuid"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Int8",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "1a3fb9f51abd42f1ac4c7597f985a687bed32d2905a446c4e4b33f0b853e8e54"
+}
diff --git a/backend/.sqlx/query-1b18f9fdcc0fbc3d5a1328776a804e2943193ad7d28b67df4e80baf38fc19271.json b/backend/.sqlx/query-1b18f9fdcc0fbc3d5a1328776a804e2943193ad7d28b67df4e80baf38fc19271.json
new file mode 100644
index 0000000000..2dd66d2df6
--- /dev/null
+++ b/backend/.sqlx/query-1b18f9fdcc0fbc3d5a1328776a804e2943193ad7d28b67df4e80baf38fc19271.json
@@ -0,0 +1,26 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT path, on_behalf_of_email AS email FROM script WHERE workspace_id = 'test-workspace' AND path LIKE 'u/test-user/s%' ORDER BY path",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "email",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      false,
+      true
+    ]
+  },
+  "hash": "1b18f9fdcc0fbc3d5a1328776a804e2943193ad7d28b67df4e80baf38fc19271"
+}
diff --git a/backend/.sqlx/query-1c472a4740a41ae8985f865e15b0c4edb4d5af2281c22955121cb794428c3cde.json b/backend/.sqlx/query-1c472a4740a41ae8985f865e15b0c4edb4d5af2281c22955121cb794428c3cde.json
new file mode 100644
index 0000000000..4dbd7ef8da
--- /dev/null
+++ b/backend/.sqlx/query-1c472a4740a41ae8985f865e15b0c4edb4d5af2281c22955121cb794428c3cde.json
@@ -0,0 +1,70 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT\n            workspace.id AS \"id!\",\n            workspace.name AS \"name!\",\n            workspace.owner AS \"owner!\",\n            workspace.deleted AS \"deleted!\",\n            workspace.premium AS \"premium!\",\n            workspace_settings.color AS \"color\",\n            workspace.parent_workspace_id AS \"parent_workspace_id\",\n            workspace.is_dev_workspace AS \"is_dev_workspace!\",\n            workspace.dev_workspace_label AS \"dev_workspace_label\"\n        FROM workspace\n        LEFT JOIN workspace_settings ON workspace.id = workspace_settings.workspace_id\n        WHERE workspace.id = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "name!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "owner!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 3,
+        "name": "deleted!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 4,
+        "name": "premium!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 5,
+        "name": "color",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 6,
+        "name": "parent_workspace_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 7,
+        "name": "is_dev_workspace!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 8,
+        "name": "dev_workspace_label",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      false,
+      false,
+      true,
+      true,
+      false,
+      true
+    ]
+  },
+  "hash": "1c472a4740a41ae8985f865e15b0c4edb4d5af2281c22955121cb794428c3cde"
+}
diff --git a/backend/.sqlx/query-1d4fb43c4856679371abfa5eeea8b92697ae3640a2e680395c2958c5d8664e27.json b/backend/.sqlx/query-1d4fb43c4856679371abfa5eeea8b92697ae3640a2e680395c2958c5d8664e27.json
new file mode 100644
index 0000000000..7f1618b3ad
--- /dev/null
+++ b/backend/.sqlx/query-1d4fb43c4856679371abfa5eeea8b92697ae3640a2e680395c2958c5d8664e27.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM dbt_run_progress\n          WHERE workspace_id = $1 AND job_id = $2 AND status = 'running'\n            AND asset_path = ANY($3)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Uuid",
+        "TextArray"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "1d4fb43c4856679371abfa5eeea8b92697ae3640a2e680395c2958c5d8664e27"
+}
diff --git a/backend/.sqlx/query-1ddb83c0941de9ca80f867b57ad20c3ee0952d118d339f94d16102d9edb23ec0.json b/backend/.sqlx/query-1ddb83c0941de9ca80f867b57ad20c3ee0952d118d339f94d16102d9edb23ec0.json
new file mode 100644
index 0000000000..123c9fc89b
--- /dev/null
+++ b/backend/.sqlx/query-1ddb83c0941de9ca80f867b57ad20c3ee0952d118d339f94d16102d9edb23ec0.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT resource_type FROM resource WHERE workspace_id = $1 AND path = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "resource_type",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "1ddb83c0941de9ca80f867b57ad20c3ee0952d118d339f94d16102d9edb23ec0"
+}
diff --git a/backend/.sqlx/query-1e044b8f64184393953dfeadbeda8af703060a604e68f32e714610513aa284eb.json b/backend/.sqlx/query-1e044b8f64184393953dfeadbeda8af703060a604e68f32e714610513aa284eb.json
new file mode 100644
index 0000000000..b22608a039
--- /dev/null
+++ b/backend/.sqlx/query-1e044b8f64184393953dfeadbeda8af703060a604e68f32e714610513aa284eb.json
@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT on_behalf_of FROM flow WHERE workspace_id = 'wm-fork-obo'",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "on_behalf_of",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "1e044b8f64184393953dfeadbeda8af703060a604e68f32e714610513aa284eb"
+}
diff --git a/backend/.sqlx/query-1f1e477b27f38f410b7e6f436ced0751f77f9cb41055481bc06af6827d647041.json b/backend/.sqlx/query-1f1e477b27f38f410b7e6f436ced0751f77f9cb41055481bc06af6827d647041.json
index 9149698131..84ce6720d6 100644
--- a/backend/.sqlx/query-1f1e477b27f38f410b7e6f436ced0751f77f9cb41055481bc06af6827d647041.json
+++ b/backend/.sqlx/query-1f1e477b27f38f410b7e6f436ced0751f77f9cb41055481bc06af6827d647041.json
@@ -44,7 +44,8 @@
                 "java",
                 "duckdb",
                 "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-1f39f7ca0c04e825d3648906eed0c98c1dc8c913dc95b691cc6f92ffcd57989e.json b/backend/.sqlx/query-1f39f7ca0c04e825d3648906eed0c98c1dc8c913dc95b691cc6f92ffcd57989e.json
new file mode 100644
index 0000000000..57861d6518
--- /dev/null
+++ b/backend/.sqlx/query-1f39f7ca0c04e825d3648906eed0c98c1dc8c913dc95b691cc6f92ffcd57989e.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE script SET archived = true WHERE workspace_id = $1 AND hash = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "1f39f7ca0c04e825d3648906eed0c98c1dc8c913dc95b691cc6f92ffcd57989e"
+}
diff --git a/backend/.sqlx/query-1fb5590cb1fe706b0d2dffcd04a41bb2fce6012b812d16d37c895b2eb9aeca4c.json b/backend/.sqlx/query-1fb5590cb1fe706b0d2dffcd04a41bb2fce6012b812d16d37c895b2eb9aeca4c.json
new file mode 100644
index 0000000000..d58ac0c4e4
--- /dev/null
+++ b/backend/.sqlx/query-1fb5590cb1fe706b0d2dffcd04a41bb2fce6012b812d16d37c895b2eb9aeca4c.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO dbt_node (workspace_id, script_path, script_hash, job_id, unique_id,\n                                 resource_type, name, asset_path, raw_code, tags)\n           VALUES ($1, $2, NULL, $3, 'model.p.draft', 'model', 'draft',\n                   'u/a/wh/analytics/draft', 'select 3', '{}')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Uuid"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "1fb5590cb1fe706b0d2dffcd04a41bb2fce6012b812d16d37c895b2eb9aeca4c"
+}
diff --git a/backend/.sqlx/query-2213dc4b594d27b3788c48b19e13c600224681e11c016eea5cee3086a7bea8d0.json b/backend/.sqlx/query-2213dc4b594d27b3788c48b19e13c600224681e11c016eea5cee3086a7bea8d0.json
deleted file mode 100644
index 14f17d871e..0000000000
--- a/backend/.sqlx/query-2213dc4b594d27b3788c48b19e13c600224681e11c016eea5cee3086a7bea8d0.json
+++ /dev/null
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        UPDATE workspace_settings\n        SET\n            ai_config = source_ws.ai_config,\n            large_file_storage = source_ws.large_file_storage,\n            ducklake = source_ws.ducklake,\n            datatable = source_ws.datatable,\n            git_app_installations = source_ws.git_app_installations\n        FROM workspace_settings source_ws\n        WHERE source_ws.workspace_id = $1\n        AND workspace_settings.workspace_id = $2\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "2213dc4b594d27b3788c48b19e13c600224681e11c016eea5cee3086a7bea8d0"
-}
diff --git a/backend/.sqlx/query-229cc3975b7f579c35ac0daa9204ff3ff25fb57954dd1ba2d552c7b263696c07.json b/backend/.sqlx/query-229cc3975b7f579c35ac0daa9204ff3ff25fb57954dd1ba2d552c7b263696c07.json
new file mode 100644
index 0000000000..1e92b86bb2
--- /dev/null
+++ b/backend/.sqlx/query-229cc3975b7f579c35ac0daa9204ff3ff25fb57954dd1ba2d552c7b263696c07.json
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO dbt_node (workspace_id, script_path, script_hash, job_id, unique_id,\n                                 resource_type, name, asset_path, raw_code, tags, description,\n                                 columns, freshness)\n           VALUES ($1, $2, $3, $4, 'model.p.orders', 'model', 'orders',\n                   'u/a/wh/analytics/orders', 'select 1', '{finance}', 'daily order facts',\n                   '{\"order_id\": {\"description\": \"natural key\"}}'::jsonb,\n                   '{\"warn_after\": {\"count\": 12, \"period\": \"hour\"}}'::jsonb)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Int8",
+        "Uuid"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "229cc3975b7f579c35ac0daa9204ff3ff25fb57954dd1ba2d552c7b263696c07"
+}
diff --git a/backend/.sqlx/query-22be2359b966bd92d8327f142281ec620fc98c5fb77061ed192a6f75bea2b049.json b/backend/.sqlx/query-22be2359b966bd92d8327f142281ec620fc98c5fb77061ed192a6f75bea2b049.json
new file mode 100644
index 0000000000..baef76a508
--- /dev/null
+++ b/backend/.sqlx/query-22be2359b966bd92d8327f142281ec620fc98c5fb77061ed192a6f75bea2b049.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH keep AS (\n           SELECT hash FROM script\n            WHERE workspace_id = $2 AND path = $3 AND language = 'dbt'\n            ORDER BY created_at DESC LIMIT $1\n         )\n         DELETE FROM dbt_graph_snapshot g\n          WHERE g.workspace_id = $2 AND g.script_path = $3\n            AND g.job_id = '00000000-0000-0000-0000-000000000000'\n            AND NOT EXISTS (SELECT 1 FROM keep k WHERE k.hash = g.script_hash)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "22be2359b966bd92d8327f142281ec620fc98c5fb77061ed192a6f75bea2b049"
+}
diff --git a/backend/.sqlx/query-231475dc825518aa88f562698f8061d2562c3ac4af8d088f9eea9f0bc11d5fe7.json b/backend/.sqlx/query-231475dc825518aa88f562698f8061d2562c3ac4af8d088f9eea9f0bc11d5fe7.json
index e3f72d9c3a..cfcb14ce72 100644
--- a/backend/.sqlx/query-231475dc825518aa88f562698f8061d2562c3ac4af8d088f9eea9f0bc11d5fe7.json
+++ b/backend/.sqlx/query-231475dc825518aa88f562698f8061d2562c3ac4af8d088f9eea9f0bc11d5fe7.json
@@ -27,7 +27,8 @@
                 "variable",
                 "ducklake",
                 "datatable",
-                "volume"
+                "volume",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-2458d56c20942e9d13578dbf0e898cda51a2fc652fb008f4e57f07f0922fdcdd.json b/backend/.sqlx/query-2458d56c20942e9d13578dbf0e898cda51a2fc652fb008f4e57f07f0922fdcdd.json
new file mode 100644
index 0000000000..8f28923f19
--- /dev/null
+++ b/backend/.sqlx/query-2458d56c20942e9d13578dbf0e898cda51a2fc652fb008f4e57f07f0922fdcdd.json
@@ -0,0 +1,19 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes, fork_last_event_kind, fork_last_event_origin)\n                VALUES ($1, $2, $3, $4, 1, 0, NULL, $5, $6)\n                ON CONFLICT (source_workspace_id, fork_workspace_id, path, kind)\n                DO UPDATE SET\n                    ahead = workspace_diff.ahead + 1,\n                    has_changes = NULL,\n                    fork_last_event_kind = EXCLUDED.fork_last_event_kind,\n                    fork_last_event_origin = EXCLUDED.fork_last_event_origin",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "2458d56c20942e9d13578dbf0e898cda51a2fc652fb008f4e57f07f0922fdcdd"
+}
diff --git a/backend/.sqlx/query-24a8eba06c31e09a49ee2ced0748c6ced8664fc7f5278d0673d6134b1ab54bad.json b/backend/.sqlx/query-24a8eba06c31e09a49ee2ced0748c6ced8664fc7f5278d0673d6134b1ab54bad.json
new file mode 100644
index 0000000000..1d27f23be4
--- /dev/null
+++ b/backend/.sqlx/query-24a8eba06c31e09a49ee2ced0748c6ced8664fc7f5278d0673d6134b1ab54bad.json
@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT COUNT(*) AS \"count!\" FROM workspace_diff\n             WHERE source_workspace_id = 'test-workspace'\n               AND fork_workspace_id = 'wm-fork-removal'\n               AND kind = 'script'\n               AND fork_last_event_origin IS NOT NULL",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "count!",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "24a8eba06c31e09a49ee2ced0748c6ced8664fc7f5278d0673d6134b1ab54bad"
+}
diff --git a/backend/.sqlx/query-25763b3f6f9ef04f879a49407b65d4fa95129bd95418cf908088d9744fc22d4b.json b/backend/.sqlx/query-25763b3f6f9ef04f879a49407b65d4fa95129bd95418cf908088d9744fc22d4b.json
new file mode 100644
index 0000000000..991e8c6351
--- /dev/null
+++ b/backend/.sqlx/query-25763b3f6f9ef04f879a49407b65d4fa95129bd95418cf908088d9744fc22d4b.json
@@ -0,0 +1,32 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT ahead, fork_last_event_kind, fork_last_event_origin FROM workspace_diff\n         WHERE source_workspace_id = 'test-workspace' AND fork_workspace_id = 'wm-fork-removal'\n           AND kind = 'script' AND path = 'u/admin/dropped_by_sync'",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "ahead",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 1,
+        "name": "fork_last_event_kind",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "fork_last_event_origin",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      false,
+      true,
+      true
+    ]
+  },
+  "hash": "25763b3f6f9ef04f879a49407b65d4fa95129bd95418cf908088d9744fc22d4b"
+}
diff --git a/backend/.sqlx/query-26e63135fcd8e7d48e25de190a2f72ece70ec92c5b04baad2622639850445900.json b/backend/.sqlx/query-26e63135fcd8e7d48e25de190a2f72ece70ec92c5b04baad2622639850445900.json
index 02a419de06..16f26c4b78 100644
--- a/backend/.sqlx/query-26e63135fcd8e7d48e25de190a2f72ece70ec92c5b04baad2622639850445900.json
+++ b/backend/.sqlx/query-26e63135fcd8e7d48e25de190a2f72ece70ec92c5b04baad2622639850445900.json
@@ -21,7 +21,8 @@
                 "variable",
                 "ducklake",
                 "datatable",
-                "volume"
+                "volume",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-295325886239353a27bfb8807a59952b81141a2544fc5340e6526b8fa0fb06c5.json b/backend/.sqlx/query-295325886239353a27bfb8807a59952b81141a2544fc5340e6526b8fa0fb06c5.json
new file mode 100644
index 0000000000..1a5cb5dbce
--- /dev/null
+++ b/backend/.sqlx/query-295325886239353a27bfb8807a59952b81141a2544fc5340e6526b8fa0fb06c5.json
@@ -0,0 +1,101 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO script (workspace_id, hash, path, parent_hashes, summary, description, content, created_by, schema, is_template, extra_perms, lock, language, kind, tag, envs, concurrent_limit, concurrency_time_window_s, cache_ttl, dedicated_worker, ws_error_handler_muted, priority, restart_unless_cancelled, delete_after_use, delete_after_secs, timeout, concurrency_key, visible_to_runner_only, auto_kind, codebase, has_preprocessor, schema_validation, assets, debounce_key, debounce_delay_s, cache_ignore_s3_path, runnable_settings_handle, modules, labels, on_behalf_of, on_behalf_of_email) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9::text::json, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22, $23, $24, $25, $26, $27, $28, $29, $30, $31, $32, $33, $34, $35, $36, $37, $38, $39, $40, $41)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Int8",
+        "Varchar",
+        "Int8Array",
+        "Text",
+        "Text",
+        "Text",
+        "Varchar",
+        "Text",
+        "Bool",
+        "Jsonb",
+        "Text",
+        {
+          "Custom": {
+            "name": "script_lang",
+            "kind": {
+              "Enum": [
+                "python3",
+                "deno",
+                "go",
+                "bash",
+                "postgresql",
+                "nativets",
+                "bun",
+                "mysql",
+                "bigquery",
+                "snowflake",
+                "graphql",
+                "powershell",
+                "mssql",
+                "php",
+                "bunnative",
+                "rust",
+                "ansible",
+                "csharp",
+                "oracledb",
+                "nu",
+                "java",
+                "duckdb",
+                "ruby",
+                "rlang",
+                "dbt"
+              ]
+            }
+          }
+        },
+        {
+          "Custom": {
+            "name": "script_kind",
+            "kind": {
+              "Enum": [
+                "script",
+                "trigger",
+                "failure",
+                "command",
+                "approval",
+                "preprocessor"
+              ]
+            }
+          }
+        },
+        "Varchar",
+        "VarcharArray",
+        "Int4",
+        "Int4",
+        "Int4",
+        "Bool",
+        "Bool",
+        "Int2",
+        "Bool",
+        "Bool",
+        "Int4",
+        "Int4",
+        "Varchar",
+        "Bool",
+        "Varchar",
+        "Varchar",
+        "Bool",
+        "Bool",
+        "Jsonb",
+        "Varchar",
+        "Int4",
+        "Bool",
+        "Int8",
+        "Jsonb",
+        "TextArray",
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "295325886239353a27bfb8807a59952b81141a2544fc5340e6526b8fa0fb06c5"
+}
diff --git a/backend/.sqlx/query-2a28f13c1f06a77bc9a164393cccf0d8d2a3d7e8552d8ad09512d2d6bf27c3fb.json b/backend/.sqlx/query-2a28f13c1f06a77bc9a164393cccf0d8d2a3d7e8552d8ad09512d2d6bf27c3fb.json
index f940f25b4a..99850586d3 100644
--- a/backend/.sqlx/query-2a28f13c1f06a77bc9a164393cccf0d8d2a3d7e8552d8ad09512d2d6bf27c3fb.json
+++ b/backend/.sqlx/query-2a28f13c1f06a77bc9a164393cccf0d8d2a3d7e8552d8ad09512d2d6bf27c3fb.json
@@ -42,7 +42,8 @@
                 "variable",
                 "ducklake",
                 "datatable",
-                "volume"
+                "volume",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-2a89648b28c40dfb9ebd4aa0b5ffa772d88c5cf97de840b5147deaeb95c98209.json b/backend/.sqlx/query-2a89648b28c40dfb9ebd4aa0b5ffa772d88c5cf97de840b5147deaeb95c98209.json
new file mode 100644
index 0000000000..3ef757423e
--- /dev/null
+++ b/backend/.sqlx/query-2a89648b28c40dfb9ebd4aa0b5ffa772d88c5cf97de840b5147deaeb95c98209.json
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE flow SET on_behalf_of = $1, on_behalf_of_email = $4 WHERE on_behalf_of = $2 AND workspace_id = $3",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "2a89648b28c40dfb9ebd4aa0b5ffa772d88c5cf97de840b5147deaeb95c98209"
+}
diff --git a/backend/.sqlx/query-2a8b9b199a6d383ed39a64dad54014f869ade4a139956dcb082f0524779f7680.json b/backend/.sqlx/query-2a8b9b199a6d383ed39a64dad54014f869ade4a139956dcb082f0524779f7680.json
new file mode 100644
index 0000000000..f770ee58df
--- /dev/null
+++ b/backend/.sqlx/query-2a8b9b199a6d383ed39a64dad54014f869ade4a139956dcb082f0524779f7680.json
@@ -0,0 +1,24 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT relation_root_at_last_ingest FROM dbt_graph_snapshot\n                  WHERE workspace_id = $1 AND script_path = $2 AND script_hash = $3\n                    AND job_id = '00000000-0000-0000-0000-000000000000'",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "relation_root_at_last_ingest",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Int8"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "2a8b9b199a6d383ed39a64dad54014f869ade4a139956dcb082f0524779f7680"
+}
diff --git a/backend/.sqlx/query-2c125b9655cf3d61bee135b8efbfad1d2a395d15f34cfaa4e1438b36afdd4043.json b/backend/.sqlx/query-2c125b9655cf3d61bee135b8efbfad1d2a395d15f34cfaa4e1438b36afdd4043.json
new file mode 100644
index 0000000000..4694af020e
--- /dev/null
+++ b/backend/.sqlx/query-2c125b9655cf3d61bee135b8efbfad1d2a395d15f34cfaa4e1438b36afdd4043.json
@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE workspace_diff SET fork_last_event_kind = 'delete', fork_last_event_origin = 'sync'\n         WHERE fork_workspace_id = 'wm-fork-deferred' AND kind = 'flow'\n           AND path = 'u/admin/moved_by_user' RETURNING 1 AS \"one!\"",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "one!",
+        "type_info": "Int4"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "2c125b9655cf3d61bee135b8efbfad1d2a395d15f34cfaa4e1438b36afdd4043"
+}
diff --git a/backend/.sqlx/query-2c56da59ac2d7b410235a3181cf2db835776ff3928236dc26033a9f577ddad61.json b/backend/.sqlx/query-2c56da59ac2d7b410235a3181cf2db835776ff3928236dc26033a9f577ddad61.json
new file mode 100644
index 0000000000..76c8a429fc
--- /dev/null
+++ b/backend/.sqlx/query-2c56da59ac2d7b410235a3181cf2db835776ff3928236dc26033a9f577ddad61.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT pg_try_advisory_lock(hashtextextended($1, 0)) AS \"acquired!\"",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "acquired!",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "2c56da59ac2d7b410235a3181cf2db835776ff3928236dc26033a9f577ddad61"
+}
diff --git a/backend/.sqlx/query-2d943b22eb69010f3c2388b9443dc8c5729cb2b828cae94c047b896ebff37fd3.json b/backend/.sqlx/query-2d943b22eb69010f3c2388b9443dc8c5729cb2b828cae94c047b896ebff37fd3.json
new file mode 100644
index 0000000000..558e5e466e
--- /dev/null
+++ b/backend/.sqlx/query-2d943b22eb69010f3c2388b9443dc8c5729cb2b828cae94c047b896ebff37fd3.json
@@ -0,0 +1,24 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT job_id FROM dbt_run_state\n          WHERE workspace_id = $1 AND script_path = $2 AND permissioned_as = $3 AND retryable",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "job_id",
+        "type_info": "Uuid"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "2d943b22eb69010f3c2388b9443dc8c5729cb2b828cae94c047b896ebff37fd3"
+}
diff --git a/backend/.sqlx/query-2db7e748ce92c8f300c1d7519900dbfa39304167e58c096186c7f9ee47207a05.json b/backend/.sqlx/query-2db7e748ce92c8f300c1d7519900dbfa39304167e58c096186c7f9ee47207a05.json
new file mode 100644
index 0000000000..00725cc52f
--- /dev/null
+++ b/backend/.sqlx/query-2db7e748ce92c8f300c1d7519900dbfa39304167e58c096186c7f9ee47207a05.json
@@ -0,0 +1,19 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes, fork_last_event_kind, fork_last_event_origin)\n                VALUES ($1, $2, $3, $4, 1, 0, NULL, $5, $6)\n                ON CONFLICT (source_workspace_id, fork_workspace_id, path, kind)\n                DO UPDATE SET\n                    ahead = workspace_diff.ahead + 1,\n                    has_changes = NULL,\n                    fork_last_event_kind = CASE WHEN $6::varchar IS NULL THEN workspace_diff.fork_last_event_kind ELSE $5 END,\n                    fork_last_event_origin = COALESCE($6, workspace_diff.fork_last_event_origin)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "2db7e748ce92c8f300c1d7519900dbfa39304167e58c096186c7f9ee47207a05"
+}
diff --git a/backend/.sqlx/query-31bbd03932912df069cfc97fd1ca8c69a3151266e2bf475da10feb4916e436e9.json b/backend/.sqlx/query-31bbd03932912df069cfc97fd1ca8c69a3151266e2bf475da10feb4916e436e9.json
index ded7b65a83..346a46d150 100644
--- a/backend/.sqlx/query-31bbd03932912df069cfc97fd1ca8c69a3151266e2bf475da10feb4916e436e9.json
+++ b/backend/.sqlx/query-31bbd03932912df069cfc97fd1ca8c69a3151266e2bf475da10feb4916e436e9.json
@@ -21,7 +21,8 @@
                       "variable",
                       "ducklake",
                       "datatable",
-                      "volume"
+                      "volume",
+                      "dbt"
                     ]
                   }
                 }
diff --git a/backend/.sqlx/query-31f38820514b1d51459ad93dd0e59d96d4e8cc79c8f3d3c4228f3bc7585c1839.json b/backend/.sqlx/query-31f38820514b1d51459ad93dd0e59d96d4e8cc79c8f3d3c4228f3bc7585c1839.json
new file mode 100644
index 0000000000..69c34a9bc3
--- /dev/null
+++ b/backend/.sqlx/query-31f38820514b1d51459ad93dd0e59d96d4e8cc79c8f3d3c4228f3bc7585c1839.json
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO script (workspace_id, path, hash, content, summary, description, language, created_by, created_at, on_behalf_of)\n         VALUES ('test-workspace', 'u/test-user/s', 93001, 'def main(): pass', '', '', 'python3', 'test-user', NOW(), 'ext@windmill.dev')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "31f38820514b1d51459ad93dd0e59d96d4e8cc79c8f3d3c4228f3bc7585c1839"
+}
diff --git a/backend/.sqlx/query-3200de51b6fedd925ab3e9e471a6719b7b6de68976e9f90d18c5b74f43763ece.json b/backend/.sqlx/query-3200de51b6fedd925ab3e9e471a6719b7b6de68976e9f90d18c5b74f43763ece.json
new file mode 100644
index 0000000000..adbdc13ea5
--- /dev/null
+++ b/backend/.sqlx/query-3200de51b6fedd925ab3e9e471a6719b7b6de68976e9f90d18c5b74f43763ece.json
@@ -0,0 +1,30 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT req.id AS \"id!\",\n                (CASE\n                    WHEN workspace.id IS NULL THEN 'deleted'\n                    WHEN usr.email IS NULL AND NOT $3 THEN 'deleted'\n                    WHEN workspace.deleted THEN 'archived'\n                    ELSE 'active'\n                END) AS \"status!\"\n         FROM unnest($1::text[]) AS req(id)\n         LEFT JOIN workspace ON workspace.id = req.id\n         LEFT JOIN usr ON usr.workspace_id = workspace.id AND usr.email = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id!",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 1,
+        "name": "status!",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "TextArray",
+        "Text",
+        "Bool"
+      ]
+    },
+    "nullable": [
+      null,
+      null
+    ]
+  },
+  "hash": "3200de51b6fedd925ab3e9e471a6719b7b6de68976e9f90d18c5b74f43763ece"
+}
diff --git a/backend/.sqlx/query-33740249a429a5dcbb399459e6b92e865838992c21da78264b8f5d1fe71bc2bf.json b/backend/.sqlx/query-33740249a429a5dcbb399459e6b92e865838992c21da78264b8f5d1fe71bc2bf.json
new file mode 100644
index 0000000000..fa90e5300c
--- /dev/null
+++ b/backend/.sqlx/query-33740249a429a5dcbb399459e6b92e865838992c21da78264b8f5d1fe71bc2bf.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM resource_version rv\n         WHERE rv.workspace_id = $1 AND rv.path = $2\n           AND rv.id != (\n               SELECT max(id) FROM resource_version l\n               WHERE l.workspace_id = rv.workspace_id AND l.path = rv.path\n           )",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "33740249a429a5dcbb399459e6b92e865838992c21da78264b8f5d1fe71bc2bf"
+}
diff --git a/backend/.sqlx/query-33b9ef6fabbb5f0de64246b51f0ce702603b7ae170054cda7ed5f6f0a9f44a28.json b/backend/.sqlx/query-33b9ef6fabbb5f0de64246b51f0ce702603b7ae170054cda7ed5f6f0a9f44a28.json
new file mode 100644
index 0000000000..8316ec5fab
--- /dev/null
+++ b/backend/.sqlx/query-33b9ef6fabbb5f0de64246b51f0ce702603b7ae170054cda7ed5f6f0a9f44a28.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM dbt_node WHERE workspace_id = $1 AND script_path = $2 AND script_hash = $3",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "33b9ef6fabbb5f0de64246b51f0ce702603b7ae170054cda7ed5f6f0a9f44a28"
+}
diff --git a/backend/.sqlx/query-34a0dd9de9495f80a07e568323c5b94e33dfcacba9466bd870152b130d400794.json b/backend/.sqlx/query-34a0dd9de9495f80a07e568323c5b94e33dfcacba9466bd870152b130d400794.json
new file mode 100644
index 0000000000..706486c23c
--- /dev/null
+++ b/backend/.sqlx/query-34a0dd9de9495f80a07e568323c5b94e33dfcacba9466bd870152b130d400794.json
@@ -0,0 +1,36 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT j.runnable_path, j.runnable_id, j.permissioned_as\n           FROM v2_job_queue q JOIN v2_job j ON j.id = q.id\n          WHERE q.id = $1 AND j.workspace_id = $2 AND q.tag = ANY($3)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "runnable_path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "runnable_id",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 2,
+        "name": "permissioned_as",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Text",
+        "TextArray"
+      ]
+    },
+    "nullable": [
+      true,
+      true,
+      false
+    ]
+  },
+  "hash": "34a0dd9de9495f80a07e568323c5b94e33dfcacba9466bd870152b130d400794"
+}
diff --git a/backend/.sqlx/query-34fbd17a412a11779fe54505a8c933a2884dbb4ab59161881fdf121ab48f1b35.json b/backend/.sqlx/query-34fbd17a412a11779fe54505a8c933a2884dbb4ab59161881fdf121ab48f1b35.json
new file mode 100644
index 0000000000..c1df08d9b0
--- /dev/null
+++ b/backend/.sqlx/query-34fbd17a412a11779fe54505a8c933a2884dbb4ab59161881fdf121ab48f1b35.json
@@ -0,0 +1,28 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH RECURSIVE ancestors AS (\n               SELECT id, parent_workspace_id, is_dev_workspace, dev_workspace_label, deleted,\n                      0 AS depth\n               FROM workspace WHERE id = $1\n               UNION ALL\n               SELECT w.id, w.parent_workspace_id, w.is_dev_workspace, w.dev_workspace_label,\n                      w.deleted, ancestors.depth + 1\n               FROM workspace w JOIN ancestors ON w.id = ancestors.parent_workspace_id\n               WHERE ancestors.depth < 20\n           )\n           SELECT id AS \"id!\", dev_workspace_label FROM ancestors\n           WHERE is_dev_workspace AND NOT deleted",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "dev_workspace_label",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      null,
+      null
+    ]
+  },
+  "hash": "34fbd17a412a11779fe54505a8c933a2884dbb4ab59161881fdf121ab48f1b35"
+}
diff --git a/backend/.sqlx/query-359b85d7940b82bb0e40ebf09e054f9191672e92fff6b22c2130bb04c7009665.json b/backend/.sqlx/query-359b85d7940b82bb0e40ebf09e054f9191672e92fff6b22c2130bb04c7009665.json
new file mode 100644
index 0000000000..e62e71a89a
--- /dev/null
+++ b/backend/.sqlx/query-359b85d7940b82bb0e40ebf09e054f9191672e92fff6b22c2130bb04c7009665.json
@@ -0,0 +1,32 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT path, on_behalf_of, on_behalf_of_email FROM script WHERE workspace_id = 'wm-fork-obo' ORDER BY path",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "on_behalf_of",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "on_behalf_of_email",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      false,
+      true,
+      true
+    ]
+  },
+  "hash": "359b85d7940b82bb0e40ebf09e054f9191672e92fff6b22c2130bb04c7009665"
+}
diff --git a/backend/.sqlx/query-36d0ace456b6022e5311491e0ef457b33679b6ffe75d068349638f9345693348.json b/backend/.sqlx/query-36d0ace456b6022e5311491e0ef457b33679b6ffe75d068349638f9345693348.json
new file mode 100644
index 0000000000..6cd95a08ac
--- /dev/null
+++ b/backend/.sqlx/query-36d0ace456b6022e5311491e0ef457b33679b6ffe75d068349638f9345693348.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE script SET on_behalf_of = $1 WHERE on_behalf_of = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "36d0ace456b6022e5311491e0ef457b33679b6ffe75d068349638f9345693348"
+}
diff --git a/backend/.sqlx/query-38125105da39bfedbdc1396fe37a8835f2630389dc339be0fda614ddb4d773df.json b/backend/.sqlx/query-38125105da39bfedbdc1396fe37a8835f2630389dc339be0fda614ddb4d773df.json
new file mode 100644
index 0000000000..a779a3c995
--- /dev/null
+++ b/backend/.sqlx/query-38125105da39bfedbdc1396fe37a8835f2630389dc339be0fda614ddb4d773df.json
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM dbt_node WHERE workspace_id = $1 AND script_path = $2\n           AND script_hash = $3 AND job_id = $4",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Int8",
+        "Uuid"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "38125105da39bfedbdc1396fe37a8835f2630389dc339be0fda614ddb4d773df"
+}
diff --git a/backend/.sqlx/query-381d59e7ab08e2ae7147e4c277a2d96f22375fa2b1eccafb7f09928a8b0cb549.json b/backend/.sqlx/query-381d59e7ab08e2ae7147e4c277a2d96f22375fa2b1eccafb7f09928a8b0cb549.json
new file mode 100644
index 0000000000..18df498bba
--- /dev/null
+++ b/backend/.sqlx/query-381d59e7ab08e2ae7147e4c277a2d96f22375fa2b1eccafb7f09928a8b0cb549.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE script SET archived = true, extra_perms = '{\"u/outsider\": true}'::jsonb\n            WHERE workspace_id = $1 AND hash = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "381d59e7ab08e2ae7147e4c277a2d96f22375fa2b1eccafb7f09928a8b0cb549"
+}
diff --git a/backend/.sqlx/query-38c20dba51b1e2b4b28e5eed51f9071e1d3cf78e89ec467927823177c5a439cc.json b/backend/.sqlx/query-38c20dba51b1e2b4b28e5eed51f9071e1d3cf78e89ec467927823177c5a439cc.json
new file mode 100644
index 0000000000..66681c2377
--- /dev/null
+++ b/backend/.sqlx/query-38c20dba51b1e2b4b28e5eed51f9071e1d3cf78e89ec467927823177c5a439cc.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT workspace_id FROM usr WHERE email = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "workspace_id",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "38c20dba51b1e2b4b28e5eed51f9071e1d3cf78e89ec467927823177c5a439cc"
+}
diff --git a/backend/.sqlx/query-3b20f17e0fadb619de37cda93b361f73d964ae4562e0cb862c7402ae779ed13a.json b/backend/.sqlx/query-3b20f17e0fadb619de37cda93b361f73d964ae4562e0cb862c7402ae779ed13a.json
new file mode 100644
index 0000000000..03b6042099
--- /dev/null
+++ b/backend/.sqlx/query-3b20f17e0fadb619de37cda93b361f73d964ae4562e0cb862c7402ae779ed13a.json
@@ -0,0 +1,153 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "select hash, tag, concurrency_key, concurrent_limit, concurrency_time_window_s, debounce_key, debounce_delay_s, cache_ttl, cache_ignore_s3_path, runnable_settings_handle, language as \"language: ScriptLang\", dedicated_worker, priority, timeout, on_behalf_of, created_by, labels FROM script\n             WHERE path = $1 AND workspace_id = $2 AND archived = false AND (lock IS NOT NULL OR $3 = false)\n             ORDER BY created_at DESC LIMIT 1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "hash",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "tag",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "concurrency_key",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 3,
+        "name": "concurrent_limit",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 4,
+        "name": "concurrency_time_window_s",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 5,
+        "name": "debounce_key",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 6,
+        "name": "debounce_delay_s",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 7,
+        "name": "cache_ttl",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 8,
+        "name": "cache_ignore_s3_path",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 9,
+        "name": "runnable_settings_handle",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 10,
+        "name": "language: ScriptLang",
+        "type_info": {
+          "Custom": {
+            "name": "script_lang",
+            "kind": {
+              "Enum": [
+                "python3",
+                "deno",
+                "go",
+                "bash",
+                "postgresql",
+                "nativets",
+                "bun",
+                "mysql",
+                "bigquery",
+                "snowflake",
+                "graphql",
+                "powershell",
+                "mssql",
+                "php",
+                "bunnative",
+                "rust",
+                "ansible",
+                "csharp",
+                "oracledb",
+                "nu",
+                "java",
+                "duckdb",
+                "ruby",
+                "rlang",
+                "dbt"
+              ]
+            }
+          }
+        }
+      },
+      {
+        "ordinal": 11,
+        "name": "dedicated_worker",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 12,
+        "name": "priority",
+        "type_info": "Int2"
+      },
+      {
+        "ordinal": 13,
+        "name": "timeout",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 14,
+        "name": "on_behalf_of",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 15,
+        "name": "created_by",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 16,
+        "name": "labels",
+        "type_info": "TextArray"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Bool"
+      ]
+    },
+    "nullable": [
+      false,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      false,
+      true,
+      true,
+      true,
+      true,
+      false,
+      true
+    ]
+  },
+  "hash": "3b20f17e0fadb619de37cda93b361f73d964ae4562e0cb862c7402ae779ed13a"
+}
diff --git a/backend/.sqlx/query-3b40cccf059fbd28ff9c8d0004daee26c81a8fe909e12ae997eaaba83ade634d.json b/backend/.sqlx/query-3b40cccf059fbd28ff9c8d0004daee26c81a8fe909e12ae997eaaba83ade634d.json
new file mode 100644
index 0000000000..d8afb95017
--- /dev/null
+++ b/backend/.sqlx/query-3b40cccf059fbd28ff9c8d0004daee26c81a8fe909e12ae997eaaba83ade634d.json
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO dbt_node (workspace_id, script_path, script_hash, job_id, unique_id,\n                               resource_type, name, asset_path, raw_code, tags)\n         VALUES ($1, $2, $3, $4, 'model.p.orders', 'model', 'orders',\n                 'u/a/wh/analytics/orders', 'select 2', '{}')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Int8",
+        "Uuid"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "3b40cccf059fbd28ff9c8d0004daee26c81a8fe909e12ae997eaaba83ade634d"
+}
diff --git a/backend/.sqlx/query-3c44de953b08ecfd8a962490d21b2dd0bfb66b7631acc958742523cce63793a0.json b/backend/.sqlx/query-3c44de953b08ecfd8a962490d21b2dd0bfb66b7631acc958742523cce63793a0.json
new file mode 100644
index 0000000000..4a6a4f0cb6
--- /dev/null
+++ b/backend/.sqlx/query-3c44de953b08ecfd8a962490d21b2dd0bfb66b7631acc958742523cce63793a0.json
@@ -0,0 +1,27 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO flow (\n        workspace_id, path, summary, description,\n        dependency_job, lock_error_logs, tag,\n        dedicated_worker, visible_to_runner_only,\n        ws_error_handler_muted,\n        value, schema, edited_by, edited_at, labels,\n        on_behalf_of, on_behalf_of_email\n    ) VALUES (\n        $1, $2, $3, $4,\n        NULL, '', $5,\n        $6, $7,\n        $8,\n        $9, $10::text::json, $11, now(), $12,\n        $13, $14\n    )",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Text",
+        "Text",
+        "Varchar",
+        "Bool",
+        "Bool",
+        "Bool",
+        "Jsonb",
+        "Text",
+        "Varchar",
+        "TextArray",
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "3c44de953b08ecfd8a962490d21b2dd0bfb66b7631acc958742523cce63793a0"
+}
diff --git a/backend/.sqlx/query-3c84781704b84b8a927ecce5a3fcb3adcf0175d0a71013f2497397c1c8ccc619.json b/backend/.sqlx/query-3c84781704b84b8a927ecce5a3fcb3adcf0175d0a71013f2497397c1c8ccc619.json
index 257e1e528f..2a02e5a8ce 100644
--- a/backend/.sqlx/query-3c84781704b84b8a927ecce5a3fcb3adcf0175d0a71013f2497397c1c8ccc619.json
+++ b/backend/.sqlx/query-3c84781704b84b8a927ecce5a3fcb3adcf0175d0a71013f2497397c1c8ccc619.json
@@ -77,7 +77,8 @@
                 "java",
                 "duckdb",
                 "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-3cc398db9c2f8f698a45cb763036c554a9d7525ad34f9ec1bd4ac3dc7afaee38.json b/backend/.sqlx/query-3cc398db9c2f8f698a45cb763036c554a9d7525ad34f9ec1bd4ac3dc7afaee38.json
new file mode 100644
index 0000000000..3905a1c7d1
--- /dev/null
+++ b/backend/.sqlx/query-3cc398db9c2f8f698a45cb763036c554a9d7525ad34f9ec1bd4ac3dc7afaee38.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO flow (\n            workspace_id, path, summary, description, value, edited_by, edited_at,\n            archived, schema, extra_perms, dependency_job, tag,\n            ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only,\n            concurrency_key, versions, on_behalf_of, on_behalf_of_email, lock_error_logs\n        )\n        SELECT $2, path, summary, description, value, edited_by, edited_at,\n               archived, schema, extra_perms, NULL, tag,\n               ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only,\n               concurrency_key, ARRAY[]::bigint[],\n               -- Same predicate as clone_scripts.\n               CASE WHEN on_behalf_of LIKE 'u/%' THEN\n                       (SELECT on_behalf_of WHERE EXISTS (\n                           SELECT 1 FROM usr u WHERE u.workspace_id = $2::varchar\n                             AND u.username = substring(on_behalf_of from 3)\n                           UNION ALL\n                           SELECT 1 FROM password p WHERE p.super_admin\n                             AND (p.username = substring(on_behalf_of from 3)\n                                  OR p.email = substring(on_behalf_of from 3))))\n                    WHEN on_behalf_of LIKE 'g/%' THEN\n                       (SELECT on_behalf_of WHERE EXISTS (\n                           SELECT 1 FROM group_ g WHERE g.workspace_id = $2::varchar\n                             AND g.name = substring(on_behalf_of from 3)))\n                    ELSE\n                       (SELECT on_behalf_of WHERE EXISTS (\n                           SELECT 1 FROM usr u WHERE u.workspace_id = $2::varchar\n                             AND u.username = on_behalf_of\n                           UNION ALL\n                           SELECT 1 FROM password p WHERE p.email = on_behalf_of\n                             AND p.super_admin))\n               END, on_behalf_of_email, lock_error_logs\n        FROM flow\n        WHERE workspace_id = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "3cc398db9c2f8f698a45cb763036c554a9d7525ad34f9ec1bd4ac3dc7afaee38"
+}
diff --git a/backend/.sqlx/query-ce5c081bbf8322371a6ec95b6a0b033837d574a1ec72dfe42b666172daf10880.json b/backend/.sqlx/query-3ce57583042b1daa2bd9d88502f6f4ab76c509dafee7371ac620c85e1b5d2498.json
similarity index 87%
rename from backend/.sqlx/query-ce5c081bbf8322371a6ec95b6a0b033837d574a1ec72dfe42b666172daf10880.json
rename to backend/.sqlx/query-3ce57583042b1daa2bd9d88502f6f4ab76c509dafee7371ac620c85e1b5d2498.json
index f2b40e0184..c5a7dd6079 100644
--- a/backend/.sqlx/query-ce5c081bbf8322371a6ec95b6a0b033837d574a1ec72dfe42b666172daf10880.json
+++ b/backend/.sqlx/query-3ce57583042b1daa2bd9d88502f6f4ab76c509dafee7371ac620c85e1b5d2498.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT\n            workspace_invite.workspace_id,\n            workspace_invite.email,\n            workspace_invite.is_admin,\n            workspace_invite.operator,\n            workspace.parent_workspace_id\n        FROM workspace_invite JOIN workspace ON workspace_invite.workspace_id = workspace.id\n        WHERE workspace_id = $1",
+  "query": "SELECT\n            workspace_invite.workspace_id,\n            workspace_invite.email,\n            workspace_invite.is_admin,\n            workspace_invite.operator,\n            workspace.parent_workspace_id\n        FROM workspace_invite JOIN workspace ON workspace_invite.workspace_id = workspace.id\n        WHERE workspace_id = $1\n        ORDER BY workspace_invite.email",
   "describe": {
     "columns": [
       {
@@ -42,5 +42,5 @@
       true
     ]
   },
-  "hash": "ce5c081bbf8322371a6ec95b6a0b033837d574a1ec72dfe42b666172daf10880"
+  "hash": "3ce57583042b1daa2bd9d88502f6f4ab76c509dafee7371ac620c85e1b5d2498"
 }
diff --git a/backend/.sqlx/query-3e474475c05ff5fc137a070b149dd3a5a77e1640e03f2964d5143c1063fd3d83.json b/backend/.sqlx/query-3e474475c05ff5fc137a070b149dd3a5a77e1640e03f2964d5143c1063fd3d83.json
new file mode 100644
index 0000000000..77d9c6d71b
--- /dev/null
+++ b/backend/.sqlx/query-3e474475c05ff5fc137a070b149dd3a5a77e1640e03f2964d5143c1063fd3d83.json
@@ -0,0 +1,35 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM datatable_migrations WHERE workspace_id = $1 AND datatable = ANY($2::text[]) RETURNING datatable, timestamp, name",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "datatable",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "timestamp",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 2,
+        "name": "name",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "TextArray"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false
+    ]
+  },
+  "hash": "3e474475c05ff5fc137a070b149dd3a5a77e1640e03f2964d5143c1063fd3d83"
+}
diff --git a/backend/.sqlx/query-2a510a8bec98055796f987d86c344ca116895d71de09db338ec09e425dcebe5e.json b/backend/.sqlx/query-3e869b95799300dff973a3c858f823a2872e33a360ff5a02169e4e80ce3d3b7b.json
similarity index 75%
rename from backend/.sqlx/query-2a510a8bec98055796f987d86c344ca116895d71de09db338ec09e425dcebe5e.json
rename to backend/.sqlx/query-3e869b95799300dff973a3c858f823a2872e33a360ff5a02169e4e80ce3d3b7b.json
index 23337708f8..ce3b4fcdf8 100644
--- a/backend/.sqlx/query-2a510a8bec98055796f987d86c344ca116895d71de09db338ec09e425dcebe5e.json
+++ b/backend/.sqlx/query-3e869b95799300dff973a3c858f823a2872e33a360ff5a02169e4e80ce3d3b7b.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT email, username, is_admin, is_operator, groups, folders FROM job_perms WHERE job_id = $1 AND workspace_id = $2",
+  "query": "SELECT email, username, is_admin, is_operator, groups, folders, end_user_email FROM job_perms WHERE job_id = $1 AND workspace_id = $2",
   "describe": {
     "columns": [
       {
@@ -32,6 +32,11 @@
         "ordinal": 5,
         "name": "folders",
         "type_info": "JsonbArray"
+      },
+      {
+        "ordinal": 6,
+        "name": "end_user_email",
+        "type_info": "Varchar"
       }
     ],
     "parameters": {
@@ -46,8 +51,9 @@
       false,
       false,
       false,
-      false
+      false,
+      true
     ]
   },
-  "hash": "2a510a8bec98055796f987d86c344ca116895d71de09db338ec09e425dcebe5e"
+  "hash": "3e869b95799300dff973a3c858f823a2872e33a360ff5a02169e4e80ce3d3b7b"
 }
diff --git a/backend/.sqlx/query-3ec280ad74cf63dc3cebb312c620e7a5c2a3b75051618fc3c9635b4cd8d48e25.json b/backend/.sqlx/query-3ec280ad74cf63dc3cebb312c620e7a5c2a3b75051618fc3c9635b4cd8d48e25.json
new file mode 100644
index 0000000000..7cbc8115c9
--- /dev/null
+++ b/backend/.sqlx/query-3ec280ad74cf63dc3cebb312c620e7a5c2a3b75051618fc3c9635b4cd8d48e25.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM script WHERE workspace_id = $1 AND path = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "3ec280ad74cf63dc3cebb312c620e7a5c2a3b75051618fc3c9635b4cd8d48e25"
+}
diff --git a/backend/.sqlx/query-407fdc870c39138811beb17e125bff3946d829f3d482a9b732ae3b37a9f7f2b5.json b/backend/.sqlx/query-407fdc870c39138811beb17e125bff3946d829f3d482a9b732ae3b37a9f7f2b5.json
new file mode 100644
index 0000000000..3db0bad5a7
--- /dev/null
+++ b/backend/.sqlx/query-407fdc870c39138811beb17e125bff3946d829f3d482a9b732ae3b37a9f7f2b5.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT on_behalf_of FROM script WHERE path = $1 AND workspace_id = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "on_behalf_of",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "407fdc870c39138811beb17e125bff3946d829f3d482a9b732ae3b37a9f7f2b5"
+}
diff --git a/backend/.sqlx/query-41428ecb8940a8fb4043b71eacb554314177fc11bc82212d95182e3723e64c6b.json b/backend/.sqlx/query-41428ecb8940a8fb4043b71eacb554314177fc11bc82212d95182e3723e64c6b.json
new file mode 100644
index 0000000000..c812a91912
--- /dev/null
+++ b/backend/.sqlx/query-41428ecb8940a8fb4043b71eacb554314177fc11bc82212d95182e3723e64c6b.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM dbt_run_progress\n          WHERE workspace_id = $1 AND updated_at < now() - make_interval(days => $2)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Int4"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "41428ecb8940a8fb4043b71eacb554314177fc11bc82212d95182e3723e64c6b"
+}
diff --git a/backend/.sqlx/query-42f2cf3165850524804842c51965c4020193a613357c7449644e09a89d6d5346.json b/backend/.sqlx/query-42f2cf3165850524804842c51965c4020193a613357c7449644e09a89d6d5346.json
new file mode 100644
index 0000000000..45031a9f99
--- /dev/null
+++ b/backend/.sqlx/query-42f2cf3165850524804842c51965c4020193a613357c7449644e09a89d6d5346.json
@@ -0,0 +1,18 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO dbt_graph_snapshot\n           (workspace_id, script_path, script_hash, job_id, permissioned_as, digest, ingested_at)\n         VALUES ($1, $2, NULL, $3, $4, $5, now())",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Uuid",
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "42f2cf3165850524804842c51965c4020193a613357c7449644e09a89d6d5346"
+}
diff --git a/backend/.sqlx/query-4301a7ad1f7c09e26f5dc7044e0a270be78e44c167fe3f6a73e0ff4b1e3baa35.json b/backend/.sqlx/query-4301a7ad1f7c09e26f5dc7044e0a270be78e44c167fe3f6a73e0ff4b1e3baa35.json
new file mode 100644
index 0000000000..3c41b3fb85
--- /dev/null
+++ b/backend/.sqlx/query-4301a7ad1f7c09e26f5dc7044e0a270be78e44c167fe3f6a73e0ff4b1e3baa35.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO flow (workspace_id, path, summary, description, value, edited_by, edited_at, on_behalf_of)\n         VALUES ('test-workspace', 'u/test-user/obo_flow', '', '', $1, 'test-user', NOW(), 'u/test-user-2')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "4301a7ad1f7c09e26f5dc7044e0a270be78e44c167fe3f6a73e0ff4b1e3baa35"
+}
diff --git a/backend/.sqlx/query-4330e66917f04dc6597d323e9102de473e3f319ba13fa0784dd5bef24224233c.json b/backend/.sqlx/query-4330e66917f04dc6597d323e9102de473e3f319ba13fa0784dd5bef24224233c.json
new file mode 100644
index 0000000000..4762ed3279
--- /dev/null
+++ b/backend/.sqlx/query-4330e66917f04dc6597d323e9102de473e3f319ba13fa0784dd5bef24224233c.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE dbt_run_state SET workspace_id = $1 WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "4330e66917f04dc6597d323e9102de473e3f319ba13fa0784dd5bef24224233c"
+}
diff --git a/backend/.sqlx/query-4374167ebf64c4e8dd683e31451800c2d068cbafbd279454724451d7f57e108e.json b/backend/.sqlx/query-4374167ebf64c4e8dd683e31451800c2d068cbafbd279454724451d7f57e108e.json
new file mode 100644
index 0000000000..a2e8f4127c
--- /dev/null
+++ b/backend/.sqlx/query-4374167ebf64c4e8dd683e31451800c2d068cbafbd279454724451d7f57e108e.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO script (workspace_id, hash, path, summary, description, content,\n                             created_by, language, lock)\n         VALUES ($1, $2, $3, '', '', 'profile: {}', 'test-user', 'dbt', '')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Int8",
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "4374167ebf64c4e8dd683e31451800c2d068cbafbd279454724451d7f57e108e"
+}
diff --git a/backend/.sqlx/query-471edf439cb293aa824440a2ef2f0afc28f425b061e90e1dfc6133b426a7f339.json b/backend/.sqlx/query-471edf439cb293aa824440a2ef2f0afc28f425b061e90e1dfc6133b426a7f339.json
new file mode 100644
index 0000000000..5903661c1a
--- /dev/null
+++ b/backend/.sqlx/query-471edf439cb293aa824440a2ef2f0afc28f425b061e90e1dfc6133b426a7f339.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT runnable_id FROM v2_job WHERE id = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "runnable_id",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "471edf439cb293aa824440a2ef2f0afc28f425b061e90e1dfc6133b426a7f339"
+}
diff --git a/backend/.sqlx/query-47f34b18306f043bdbd7dc74c3c83ac80b669a910eada527c2a75f5cbf7d830d.json b/backend/.sqlx/query-47f34b18306f043bdbd7dc74c3c83ac80b669a910eada527c2a75f5cbf7d830d.json
new file mode 100644
index 0000000000..28aa09d18d
--- /dev/null
+++ b/backend/.sqlx/query-47f34b18306f043bdbd7dc74c3c83ac80b669a910eada527c2a75f5cbf7d830d.json
@@ -0,0 +1,28 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT name, value FROM global_settings WHERE name = ANY($1)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "name",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "value",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "TextArray"
+      ]
+    },
+    "nullable": [
+      false,
+      false
+    ]
+  },
+  "hash": "47f34b18306f043bdbd7dc74c3c83ac80b669a910eada527c2a75f5cbf7d830d"
+}
diff --git a/backend/.sqlx/query-48969b648d36da8ef422d8f936eb5324655def916a0ac6f6a65eb649b17f102d.json b/backend/.sqlx/query-48969b648d36da8ef422d8f936eb5324655def916a0ac6f6a65eb649b17f102d.json
new file mode 100644
index 0000000000..ba9ccbbb77
--- /dev/null
+++ b/backend/.sqlx/query-48969b648d36da8ef422d8f936eb5324655def916a0ac6f6a65eb649b17f102d.json
@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        SELECT EXISTS(\n            SELECT 1\n            FROM workspace_settings ws\n            JOIN workspace w ON w.id = ws.workspace_id\n            WHERE w.deleted = false AND w.id NOT LIKE 'wm-fork%'\n              AND jsonb_exists(ws.large_file_storage->'secondary_storage', 'main')\n        ) AS \"exists!\"\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "exists!",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "48969b648d36da8ef422d8f936eb5324655def916a0ac6f6a65eb649b17f102d"
+}
diff --git a/backend/.sqlx/query-493b29e093bb2b8f8ed6947843e26fe8fb6aefe54ad5862cad9b8fd9868cdd91.json b/backend/.sqlx/query-493b29e093bb2b8f8ed6947843e26fe8fb6aefe54ad5862cad9b8fd9868cdd91.json
new file mode 100644
index 0000000000..2f36ff7969
--- /dev/null
+++ b/backend/.sqlx/query-493b29e093bb2b8f8ed6947843e26fe8fb6aefe54ad5862cad9b8fd9868cdd91.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE workspace_settings SET dbt_warehouses = $1 WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Jsonb",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "493b29e093bb2b8f8ed6947843e26fe8fb6aefe54ad5862cad9b8fd9868cdd91"
+}
diff --git a/backend/.sqlx/query-4956c7bb3312520e0ba0ae330037056f9a6157c1c448e46f502a17615ec25d87.json b/backend/.sqlx/query-4956c7bb3312520e0ba0ae330037056f9a6157c1c448e46f502a17615ec25d87.json
new file mode 100644
index 0000000000..c43bb800bb
--- /dev/null
+++ b/backend/.sqlx/query-4956c7bb3312520e0ba0ae330037056f9a6157c1c448e46f502a17615ec25d87.json
@@ -0,0 +1,44 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH t1 AS (UPDATE http_trigger SET script_path = $1 WHERE script_path = $2 AND workspace_id = $3 AND is_flow = $4), t2 AS (UPDATE email_trigger SET script_path = $1 WHERE script_path = $2 AND workspace_id = $3 AND is_flow = $4) UPDATE native_trigger SET script_path = $1, updated_at = NOW(), error = $5 WHERE script_path = $2 AND workspace_id = $3 AND is_flow = $4 RETURNING service_name::text AS \"service_name!\", external_id, script_path, is_flow",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "service_name!",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 1,
+        "name": "external_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "script_path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 3,
+        "name": "is_flow",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text",
+        "Text",
+        "Bool",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null,
+      false,
+      false,
+      false
+    ]
+  },
+  "hash": "4956c7bb3312520e0ba0ae330037056f9a6157c1c448e46f502a17615ec25d87"
+}
diff --git a/backend/.sqlx/query-4e3f3202e762aad38707315c05c9c3b7cebdbd9be8b5cc9a14b325c4ad1f5b4f.json b/backend/.sqlx/query-4e3f3202e762aad38707315c05c9c3b7cebdbd9be8b5cc9a14b325c4ad1f5b4f.json
new file mode 100644
index 0000000000..cf360c9dd5
--- /dev/null
+++ b/backend/.sqlx/query-4e3f3202e762aad38707315c05c9c3b7cebdbd9be8b5cc9a14b325c4ad1f5b4f.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT pg_advisory_lock(hashtextextended($1, 0))",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "pg_advisory_lock",
+        "type_info": "Void"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "4e3f3202e762aad38707315c05c9c3b7cebdbd9be8b5cc9a14b325c4ad1f5b4f"
+}
diff --git a/backend/.sqlx/query-4ed961992cd6c99e2efe889ab1cf06e6ad12305a5b845948dc200f304fb87a61.json b/backend/.sqlx/query-4ed961992cd6c99e2efe889ab1cf06e6ad12305a5b845948dc200f304fb87a61.json
new file mode 100644
index 0000000000..ee7535ffc9
--- /dev/null
+++ b/backend/.sqlx/query-4ed961992cd6c99e2efe889ab1cf06e6ad12305a5b845948dc200f304fb87a61.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT dbt_warehouses FROM workspace_settings WHERE workspace_id = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "dbt_warehouses",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "4ed961992cd6c99e2efe889ab1cf06e6ad12305a5b845948dc200f304fb87a61"
+}
diff --git a/backend/.sqlx/query-4f266373d5acdbcedc81e8ed3eb1fb95861ef17ca5570ef06b9903f04e9adb5e.json b/backend/.sqlx/query-4f266373d5acdbcedc81e8ed3eb1fb95861ef17ca5570ef06b9903f04e9adb5e.json
new file mode 100644
index 0000000000..922a187344
--- /dev/null
+++ b/backend/.sqlx/query-4f266373d5acdbcedc81e8ed3eb1fb95861ef17ca5570ef06b9903f04e9adb5e.json
@@ -0,0 +1,70 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT workspace.id, workspace.name, workspace.owner, workspace.deleted, workspace.premium, workspace_settings.color, workspace.parent_workspace_id, workspace.is_dev_workspace, workspace.dev_workspace_label\n         FROM workspace\n         LEFT JOIN workspace_settings ON workspace.id = workspace_settings.workspace_id\n         JOIN usr ON usr.workspace_id = workspace.id\n         WHERE usr.email = $1 AND workspace.deleted = false",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "name",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "owner",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 3,
+        "name": "deleted",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 4,
+        "name": "premium",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 5,
+        "name": "color",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 6,
+        "name": "parent_workspace_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 7,
+        "name": "is_dev_workspace",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 8,
+        "name": "dev_workspace_label",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      false,
+      false,
+      true,
+      true,
+      false,
+      true
+    ]
+  },
+  "hash": "4f266373d5acdbcedc81e8ed3eb1fb95861ef17ca5570ef06b9903f04e9adb5e"
+}
diff --git a/backend/.sqlx/query-50f81c128d644c60837e603099e169fbc7a500c11e79d2c78d6eccccf6491aec.json b/backend/.sqlx/query-50f81c128d644c60837e603099e169fbc7a500c11e79d2c78d6eccccf6491aec.json
index a7f5d2f785..e4e2c240c7 100644
--- a/backend/.sqlx/query-50f81c128d644c60837e603099e169fbc7a500c11e79d2c78d6eccccf6491aec.json
+++ b/backend/.sqlx/query-50f81c128d644c60837e603099e169fbc7a500c11e79d2c78d6eccccf6491aec.json
@@ -71,7 +71,8 @@
                 "java",
                 "duckdb",
                 "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-5145e0505df1de2aba1740dcef647f74748e5b08d49ad0f2cdb9153e3f59b79c.json b/backend/.sqlx/query-5145e0505df1de2aba1740dcef647f74748e5b08d49ad0f2cdb9153e3f59b79c.json
new file mode 100644
index 0000000000..2510e42835
--- /dev/null
+++ b/backend/.sqlx/query-5145e0505df1de2aba1740dcef647f74748e5b08d49ad0f2cdb9153e3f59b79c.json
@@ -0,0 +1,32 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT path, fork_last_event_kind, fork_last_event_origin FROM workspace_diff\n             WHERE fork_workspace_id = 'wm-fork-deferred' AND kind = 'flow'\n               AND fork_last_event_origin IS NOT NULL ORDER BY path",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "fork_last_event_kind",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "fork_last_event_origin",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      false,
+      true,
+      true
+    ]
+  },
+  "hash": "5145e0505df1de2aba1740dcef647f74748e5b08d49ad0f2cdb9153e3f59b79c"
+}
diff --git a/backend/.sqlx/query-5369258383098062e454539be369ea2f0a41771376720fb72c6b3c1fa4972eab.json b/backend/.sqlx/query-5369258383098062e454539be369ea2f0a41771376720fb72c6b3c1fa4972eab.json
index 6a010dd1f4..f1941c012c 100644
--- a/backend/.sqlx/query-5369258383098062e454539be369ea2f0a41771376720fb72c6b3c1fa4972eab.json
+++ b/backend/.sqlx/query-5369258383098062e454539be369ea2f0a41771376720fb72c6b3c1fa4972eab.json
@@ -35,7 +35,8 @@
                 "java",
                 "duckdb",
                 "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-5387fbfd4be55674dcbe9f9b3ce9649d0f5db125776fbdffea993a53a09708de.json b/backend/.sqlx/query-5387fbfd4be55674dcbe9f9b3ce9649d0f5db125776fbdffea993a53a09708de.json
index c617944b91..b00c398445 100644
--- a/backend/.sqlx/query-5387fbfd4be55674dcbe9f9b3ce9649d0f5db125776fbdffea993a53a09708de.json
+++ b/backend/.sqlx/query-5387fbfd4be55674dcbe9f9b3ce9649d0f5db125776fbdffea993a53a09708de.json
@@ -41,7 +41,8 @@
                 "java",
                 "duckdb",
                 "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-55d11300ccbe3869c42e7f1f9f7bdaaf4eb6cbec3bf5cf755aab45cbce4dbf84.json b/backend/.sqlx/query-55d11300ccbe3869c42e7f1f9f7bdaaf4eb6cbec3bf5cf755aab45cbce4dbf84.json
new file mode 100644
index 0000000000..a4831a626a
--- /dev/null
+++ b/backend/.sqlx/query-55d11300ccbe3869c42e7f1f9f7bdaaf4eb6cbec3bf5cf755aab45cbce4dbf84.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT COUNT(*) - COUNT(DISTINCT path) FROM resource_version WHERE workspace_id = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "?column?",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "55d11300ccbe3869c42e7f1f9f7bdaaf4eb6cbec3bf5cf755aab45cbce4dbf84"
+}
diff --git a/backend/.sqlx/query-56badc145d03676b6bd80a3830ce0a0401517a9b60e5689d3c9cdc9a87aaf2a8.json b/backend/.sqlx/query-56badc145d03676b6bd80a3830ce0a0401517a9b60e5689d3c9cdc9a87aaf2a8.json
new file mode 100644
index 0000000000..b467a2c39b
--- /dev/null
+++ b/backend/.sqlx/query-56badc145d03676b6bd80a3830ce0a0401517a9b60e5689d3c9cdc9a87aaf2a8.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO dbt_edge (workspace_id, script_path, script_hash, job_id,\n            parent_unique_id, child_unique_id, ingested_at)\n         SELECT $2, script_path, script_hash, job_id, parent_unique_id, child_unique_id,\n            ingested_at\n         FROM dbt_edge\n         WHERE workspace_id = $1 AND job_id = '00000000-0000-0000-0000-000000000000'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "56badc145d03676b6bd80a3830ce0a0401517a9b60e5689d3c9cdc9a87aaf2a8"
+}
diff --git a/backend/.sqlx/query-58e7d590631294899025c2cc279c4352708f65a6c094a89b4cafa1e6450a4e6a.json b/backend/.sqlx/query-58e7d590631294899025c2cc279c4352708f65a6c094a89b4cafa1e6450a4e6a.json
new file mode 100644
index 0000000000..1edc69b002
--- /dev/null
+++ b/backend/.sqlx/query-58e7d590631294899025c2cc279c4352708f65a6c094a89b4cafa1e6450a4e6a.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT result->'materialized' FROM v2_job_completed WHERE workspace_id = $1 AND id = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "?column?",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "58e7d590631294899025c2cc279c4352708f65a6c094a89b4cafa1e6450a4e6a"
+}
diff --git a/backend/.sqlx/query-59a913a29c3f32d2d0771f46f0d408e686283c8a6737ad4ededa019158e2cb8d.json b/backend/.sqlx/query-59a913a29c3f32d2d0771f46f0d408e686283c8a6737ad4ededa019158e2cb8d.json
new file mode 100644
index 0000000000..b89b1ff7f9
--- /dev/null
+++ b/backend/.sqlx/query-59a913a29c3f32d2d0771f46f0d408e686283c8a6737ad4ededa019158e2cb8d.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO password(email, password_hash, login_type, super_admin, verified, name)\n         VALUES ($1, '', 'password', true, true, '')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "59a913a29c3f32d2d0771f46f0d408e686283c8a6737ad4ededa019158e2cb8d"
+}
diff --git a/backend/.sqlx/query-5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55.json b/backend/.sqlx/query-5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55.json
index 36ddb8ab9f..713ccb9dd3 100644
--- a/backend/.sqlx/query-5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55.json
+++ b/backend/.sqlx/query-5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55.json
@@ -15,7 +15,7 @@
       ]
     },
     "nullable": [
-      true
+      null
     ]
   },
   "hash": "5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55"
diff --git a/backend/.sqlx/query-5a4e42f3bfa96bb1184adeccf14580c46c1e77cb8dd9b36523965d79eb5416bb.json b/backend/.sqlx/query-5a4e42f3bfa96bb1184adeccf14580c46c1e77cb8dd9b36523965d79eb5416bb.json
new file mode 100644
index 0000000000..c1f6558712
--- /dev/null
+++ b/backend/.sqlx/query-5a4e42f3bfa96bb1184adeccf14580c46c1e77cb8dd9b36523965d79eb5416bb.json
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO script (workspace_id, path, hash, content, summary, description, language, created_by, created_at, on_behalf_of, on_behalf_of_email)\n         VALUES ('test-workspace', 'u/test-user/sg', 95001, 'def main(): pass', '', '', 'python3', 'test-user', NOW(), 'g/ops', 'group-ops@windmill.dev'),\n                ('test-workspace', 'u/test-user/su', 95002, 'def main(): pass', '', '', 'python3', 'test-user', NOW(), 'u/test-user-2', 'group-ops@windmill.dev')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "5a4e42f3bfa96bb1184adeccf14580c46c1e77cb8dd9b36523965d79eb5416bb"
+}
diff --git a/backend/.sqlx/query-5ae004333c20e6f7c28025f16ad87562dbdac633f3248ac228e00b7c8b49b800.json b/backend/.sqlx/query-5ae004333c20e6f7c28025f16ad87562dbdac633f3248ac228e00b7c8b49b800.json
index c126b6371a..40c66a93f9 100644
--- a/backend/.sqlx/query-5ae004333c20e6f7c28025f16ad87562dbdac633f3248ac228e00b7c8b49b800.json
+++ b/backend/.sqlx/query-5ae004333c20e6f7c28025f16ad87562dbdac633f3248ac228e00b7c8b49b800.json
@@ -16,7 +16,8 @@
                 "variable",
                 "ducklake",
                 "datatable",
-                "volume"
+                "volume",
+                "dbt"
               ]
             }
           }
@@ -71,7 +72,8 @@
                       "variable",
                       "ducklake",
                       "datatable",
-                      "volume"
+                      "volume",
+                      "dbt"
                     ]
                   }
                 }
diff --git a/backend/.sqlx/query-5c0d0c7111b70b119b3182c9195361388ead36dc6ab03c6a7c17fb97d2b60a67.json b/backend/.sqlx/query-5c0d0c7111b70b119b3182c9195361388ead36dc6ab03c6a7c17fb97d2b60a67.json
index e72722d53e..be7d99f4a6 100644
--- a/backend/.sqlx/query-5c0d0c7111b70b119b3182c9195361388ead36dc6ab03c6a7c17fb97d2b60a67.json
+++ b/backend/.sqlx/query-5c0d0c7111b70b119b3182c9195361388ead36dc6ab03c6a7c17fb97d2b60a67.json
@@ -34,7 +34,8 @@
                 "java",
                 "duckdb",
                 "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-5c609ea0696df96ca02cba7fee359b785515a79dcda3745663e4c4f2cf328389.json b/backend/.sqlx/query-5c609ea0696df96ca02cba7fee359b785515a79dcda3745663e4c4f2cf328389.json
index 03de8472ad..fc8ed63f51 100644
--- a/backend/.sqlx/query-5c609ea0696df96ca02cba7fee359b785515a79dcda3745663e4c4f2cf328389.json
+++ b/backend/.sqlx/query-5c609ea0696df96ca02cba7fee359b785515a79dcda3745663e4c4f2cf328389.json
@@ -21,7 +21,8 @@
                 "variable",
                 "ducklake",
                 "datatable",
-                "volume"
+                "volume",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-5deb93bef71327582d997f3681b60e79b82f57c9c15c0870539ff057931c8f0a.json b/backend/.sqlx/query-5deb93bef71327582d997f3681b60e79b82f57c9c15c0870539ff057931c8f0a.json
new file mode 100644
index 0000000000..01f7f523ed
--- /dev/null
+++ b/backend/.sqlx/query-5deb93bef71327582d997f3681b60e79b82f57c9c15c0870539ff057931c8f0a.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT count(*) FROM dbt_graph_snapshot\n          WHERE workspace_id = $1 AND script_path = $2 AND script_hash IS NULL",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "count",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "5deb93bef71327582d997f3681b60e79b82f57c9c15c0870539ff057931c8f0a"
+}
diff --git a/backend/.sqlx/query-5ec262094e8ddf420b9098f2b3ef6d2c2caa94f39a0e57fe015e19fd1d0ab0ea.json b/backend/.sqlx/query-5ec262094e8ddf420b9098f2b3ef6d2c2caa94f39a0e57fe015e19fd1d0ab0ea.json
index 8ff04d2fc1..34f1870b7a 100644
--- a/backend/.sqlx/query-5ec262094e8ddf420b9098f2b3ef6d2c2caa94f39a0e57fe015e19fd1d0ab0ea.json
+++ b/backend/.sqlx/query-5ec262094e8ddf420b9098f2b3ef6d2c2caa94f39a0e57fe015e19fd1d0ab0ea.json
@@ -44,7 +44,8 @@
                 "java",
                 "duckdb",
                 "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-5f95454c29587117f7a482ca74506cda7ee52f5a85aea5c2186353f8b1decc46.json b/backend/.sqlx/query-5f95454c29587117f7a482ca74506cda7ee52f5a85aea5c2186353f8b1decc46.json
new file mode 100644
index 0000000000..d1b9e3c858
--- /dev/null
+++ b/backend/.sqlx/query-5f95454c29587117f7a482ca74506cda7ee52f5a85aea5c2186353f8b1decc46.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT on_behalf_of FROM flow WHERE path = $1 AND workspace_id = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "on_behalf_of",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "5f95454c29587117f7a482ca74506cda7ee52f5a85aea5c2186353f8b1decc46"
+}
diff --git a/backend/.sqlx/query-5fd6467e3316b64e0451614d6bb9101644d1869af85687ab55067308644a2523.json b/backend/.sqlx/query-5fd6467e3316b64e0451614d6bb9101644d1869af85687ab55067308644a2523.json
new file mode 100644
index 0000000000..418083acf9
--- /dev/null
+++ b/backend/.sqlx/query-5fd6467e3316b64e0451614d6bb9101644d1869af85687ab55067308644a2523.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT script_lang = 'dbt' FROM v2_job WHERE id = $1 AND workspace_id = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "?column?",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "5fd6467e3316b64e0451614d6bb9101644d1869af85687ab55067308644a2523"
+}
diff --git a/backend/.sqlx/query-608d487e6f3313d57c1f2f043b6942c9ab6f58f9d7ffecb13a9de2c71b9bb709.json b/backend/.sqlx/query-608d487e6f3313d57c1f2f043b6942c9ab6f58f9d7ffecb13a9de2c71b9bb709.json
new file mode 100644
index 0000000000..69951a8cb2
--- /dev/null
+++ b/backend/.sqlx/query-608d487e6f3313d57c1f2f043b6942c9ab6f58f9d7ffecb13a9de2c71b9bb709.json
@@ -0,0 +1,26 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT path, on_behalf_of FROM script WHERE workspace_id = 'wm-fork-obo' ORDER BY path",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "on_behalf_of",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      false,
+      true
+    ]
+  },
+  "hash": "608d487e6f3313d57c1f2f043b6942c9ab6f58f9d7ffecb13a9de2c71b9bb709"
+}
diff --git a/backend/.sqlx/query-617c19043d445ab1366630633e6afbeeea28b1d17dfacecb30dde65304cd9799.json b/backend/.sqlx/query-617c19043d445ab1366630633e6afbeeea28b1d17dfacecb30dde65304cd9799.json
new file mode 100644
index 0000000000..9f41bf73e0
--- /dev/null
+++ b/backend/.sqlx/query-617c19043d445ab1366630633e6afbeeea28b1d17dfacecb30dde65304cd9799.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO azure_trigger (\n            azure_resource_path, azure_mode, scope_resource_id, topic_name,\n            subscription_name, event_type_filters, push_auth_config, path, script_path,\n            is_flow, workspace_id, edited_by, edited_at, extra_perms, server_id,\n            last_server_ping, error, mode, permissioned_as, error_handler_path,\n            error_handler_args, retry, labels\n        )\n        SELECT\n            azure_resource_path, azure_mode, scope_resource_id, topic_name,\n            subscription_name, event_type_filters, push_auth_config, path, script_path,\n            is_flow, $1, edited_by, edited_at, extra_perms, NULL,\n            NULL, NULL, 'disabled'::TRIGGER_MODE, permissioned_as, error_handler_path,\n            error_handler_args, retry, labels\n        FROM azure_trigger WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "617c19043d445ab1366630633e6afbeeea28b1d17dfacecb30dde65304cd9799"
+}
diff --git a/backend/.sqlx/query-620e8c417d60a8c86b359673da943df36d9348bf14dcb7b97263b226f0f3b337.json b/backend/.sqlx/query-620e8c417d60a8c86b359673da943df36d9348bf14dcb7b97263b226f0f3b337.json
new file mode 100644
index 0000000000..9305fd955c
--- /dev/null
+++ b/backend/.sqlx/query-620e8c417d60a8c86b359673da943df36d9348bf14dcb7b97263b226f0f3b337.json
@@ -0,0 +1,32 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT path, fork_last_event_kind, fork_last_event_origin FROM workspace_diff\n             WHERE fork_workspace_id = 'wm-fork-renamed' AND kind = 'flow'\n               AND fork_last_event_origin IS NOT NULL ORDER BY path",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "fork_last_event_kind",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "fork_last_event_origin",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      false,
+      true,
+      true
+    ]
+  },
+  "hash": "620e8c417d60a8c86b359673da943df36d9348bf14dcb7b97263b226f0f3b337"
+}
diff --git a/backend/.sqlx/query-6348061d79b0b6b25bda7425f7a37344e04107f060f949cc197b4df9bca18fb8.json b/backend/.sqlx/query-6348061d79b0b6b25bda7425f7a37344e04107f060f949cc197b4df9bca18fb8.json
index f3d518eff0..3f1729e29a 100644
--- a/backend/.sqlx/query-6348061d79b0b6b25bda7425f7a37344e04107f060f949cc197b4df9bca18fb8.json
+++ b/backend/.sqlx/query-6348061d79b0b6b25bda7425f7a37344e04107f060f949cc197b4df9bca18fb8.json
@@ -34,7 +34,8 @@
                 "java",
                 "duckdb",
                 "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-652c7a8adefc03f06485a7e223f54ebcab136711b89671192f379bf06bf3ca9b.json b/backend/.sqlx/query-652c7a8adefc03f06485a7e223f54ebcab136711b89671192f379bf06bf3ca9b.json
new file mode 100644
index 0000000000..43a2c8952d
--- /dev/null
+++ b/backend/.sqlx/query-652c7a8adefc03f06485a7e223f54ebcab136711b89671192f379bf06bf3ca9b.json
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO password(email, password_hash, login_type, super_admin, verified, name, username)\n         VALUES ('sa@windmill.dev', 'not-a-real-hash', 'password', true, true, 'Ext', 'ext-sa')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "652c7a8adefc03f06485a7e223f54ebcab136711b89671192f379bf06bf3ca9b"
+}
diff --git a/backend/.sqlx/query-66c775b6e1120c5ed53b903d252e07f0965efb65c51580c529e61d09b8742dfd.json b/backend/.sqlx/query-66c775b6e1120c5ed53b903d252e07f0965efb65c51580c529e61d09b8742dfd.json
index 80f172aa40..f6e000ba6f 100644
--- a/backend/.sqlx/query-66c775b6e1120c5ed53b903d252e07f0965efb65c51580c529e61d09b8742dfd.json
+++ b/backend/.sqlx/query-66c775b6e1120c5ed53b903d252e07f0965efb65c51580c529e61d09b8742dfd.json
@@ -45,7 +45,8 @@
                 "java",
                 "duckdb",
                 "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-680f38ee8b7fd09aa3d0f521bce5ff3c9bf42c7a51aadbe7d7680827989211d0.json b/backend/.sqlx/query-680f38ee8b7fd09aa3d0f521bce5ff3c9bf42c7a51aadbe7d7680827989211d0.json
new file mode 100644
index 0000000000..22dfb381a0
--- /dev/null
+++ b/backend/.sqlx/query-680f38ee8b7fd09aa3d0f521bce5ff3c9bf42c7a51aadbe7d7680827989211d0.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT on_behalf_of FROM script\n          WHERE path = $1 AND workspace_id = $2 AND archived = false AND deleted = false\n          ORDER BY created_at DESC LIMIT 1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "on_behalf_of",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "680f38ee8b7fd09aa3d0f521bce5ff3c9bf42c7a51aadbe7d7680827989211d0"
+}
diff --git a/backend/.sqlx/query-68aebbc8a7798abab3163aaffe298f6ea2722c68efff0c2a1baaf5de4fc247b2.json b/backend/.sqlx/query-68aebbc8a7798abab3163aaffe298f6ea2722c68efff0c2a1baaf5de4fc247b2.json
new file mode 100644
index 0000000000..0b19784e3a
--- /dev/null
+++ b/backend/.sqlx/query-68aebbc8a7798abab3163aaffe298f6ea2722c68efff0c2a1baaf5de4fc247b2.json
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO script (workspace_id, path, hash, content, summary, description, language, created_by, created_at, on_behalf_of, on_behalf_of_email)\n         VALUES\n         ('test-workspace', 'u/test-user/obo_member', 91001, 'def main(): pass', '', '', 'python3', 'test-user', NOW(), 'u/test-user', 'test@windmill.dev'),\n         ('test-workspace', 'u/test-user/obo_stranger', 91002, 'def main(): pass', '', '', 'python3', 'test-user', NOW(), 'u/test-user-2', 'test2@windmill.dev'),\n         ('test-workspace', 'u/test-user/obo_group', 91003, 'def main(): pass', '', '', 'python3', 'test-user', NOW(), 'g/all', 'group-all@windmill.dev'),\n         ('test-workspace', 'u/test-user/obo_superadmin', 91004, 'def main(): pass', '', '', 'python3', 'test-user', NOW(), 'u/ext-sa', 'sa@windmill.dev'),\n         ('test-workspace', 'u/test-user/obo_address_only', 91005, 'def main(): pass', '', '', 'python3', 'test-user', NOW(), NULL, 'test2@windmill.dev')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "68aebbc8a7798abab3163aaffe298f6ea2722c68efff0c2a1baaf5de4fc247b2"
+}
diff --git a/backend/.sqlx/query-6a0912f2cee5434ffecbdb7ea7ad0fe6800283a8694df86f335013a3d6397996.json b/backend/.sqlx/query-6a0912f2cee5434ffecbdb7ea7ad0fe6800283a8694df86f335013a3d6397996.json
new file mode 100644
index 0000000000..b284ed202a
--- /dev/null
+++ b/backend/.sqlx/query-6a0912f2cee5434ffecbdb7ea7ad0fe6800283a8694df86f335013a3d6397996.json
@@ -0,0 +1,19 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes, fork_last_event_kind, fork_last_event_origin)\n            VALUES ($1, $2, $3, $4, 1, 0, NULL, $5, $6)\n            ON CONFLICT (source_workspace_id, fork_workspace_id, path, kind)\n            DO UPDATE SET\n                ahead = workspace_diff.ahead + 1,\n                has_changes = NULL,\n                fork_last_event_kind = EXCLUDED.fork_last_event_kind,\n                fork_last_event_origin = EXCLUDED.fork_last_event_origin",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "6a0912f2cee5434ffecbdb7ea7ad0fe6800283a8694df86f335013a3d6397996"
+}
diff --git a/backend/.sqlx/query-6a8865e80306a6deb68d0ff8ee79b179827ec89d4a2043b38cb96843f4675ccc.json b/backend/.sqlx/query-6a8865e80306a6deb68d0ff8ee79b179827ec89d4a2043b38cb96843f4675ccc.json
new file mode 100644
index 0000000000..59e1b8f3a5
--- /dev/null
+++ b/backend/.sqlx/query-6a8865e80306a6deb68d0ff8ee79b179827ec89d4a2043b38cb96843f4675ccc.json
@@ -0,0 +1,32 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT ahead, fork_last_event_kind, fork_last_event_origin FROM workspace_diff\n             WHERE source_workspace_id = 'test-workspace' AND fork_workspace_id = 'wm-fork-removal'\n               AND kind = 'script' AND path = 'u/admin/dropped_by_sync'",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "ahead",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 1,
+        "name": "fork_last_event_kind",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "fork_last_event_origin",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      false,
+      true,
+      true
+    ]
+  },
+  "hash": "6a8865e80306a6deb68d0ff8ee79b179827ec89d4a2043b38cb96843f4675ccc"
+}
diff --git a/backend/.sqlx/query-6aaddd80f8c07cfafea2021c1879c3d7b2fb156a43299e9a1209d05293c4f50f.json b/backend/.sqlx/query-6aaddd80f8c07cfafea2021c1879c3d7b2fb156a43299e9a1209d05293c4f50f.json
index 144bcb13f2..b54e73c157 100644
--- a/backend/.sqlx/query-6aaddd80f8c07cfafea2021c1879c3d7b2fb156a43299e9a1209d05293c4f50f.json
+++ b/backend/.sqlx/query-6aaddd80f8c07cfafea2021c1879c3d7b2fb156a43299e9a1209d05293c4f50f.json
@@ -22,7 +22,8 @@
                       "variable",
                       "ducklake",
                       "datatable",
-                      "volume"
+                      "volume",
+                      "dbt"
                     ]
                   }
                 }
diff --git a/backend/.sqlx/query-6d89436b268157453784087c076ef5fb7c5ae46bede607cca308e1d5778e6d1e.json b/backend/.sqlx/query-6d89436b268157453784087c076ef5fb7c5ae46bede607cca308e1d5778e6d1e.json
new file mode 100644
index 0000000000..8e6b0372b1
--- /dev/null
+++ b/backend/.sqlx/query-6d89436b268157453784087c076ef5fb7c5ae46bede607cca308e1d5778e6d1e.json
@@ -0,0 +1,62 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT asset_kind AS \"asset_kind: windmill_common::assets::AssetKind\", asset_path,\n                status::text AS \"status!\", row_count, error\n           FROM dbt_run_progress\n          WHERE workspace_id = $1 AND job_id = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "asset_kind: windmill_common::assets::AssetKind",
+        "type_info": {
+          "Custom": {
+            "name": "asset_kind",
+            "kind": {
+              "Enum": [
+                "s3object",
+                "resource",
+                "variable",
+                "ducklake",
+                "datatable",
+                "volume",
+                "dbt"
+              ]
+            }
+          }
+        }
+      },
+      {
+        "ordinal": 1,
+        "name": "asset_path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "status!",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 3,
+        "name": "row_count",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 4,
+        "name": "error",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      null,
+      true,
+      true
+    ]
+  },
+  "hash": "6d89436b268157453784087c076ef5fb7c5ae46bede607cca308e1d5778e6d1e"
+}
diff --git a/backend/.sqlx/query-6f1489b2c52e08566ffa9450709df2b9404a30197b05554a868bd06b1ed8ccaa.json b/backend/.sqlx/query-6f1489b2c52e08566ffa9450709df2b9404a30197b05554a868bd06b1ed8ccaa.json
new file mode 100644
index 0000000000..e71f76301e
--- /dev/null
+++ b/backend/.sqlx/query-6f1489b2c52e08566ffa9450709df2b9404a30197b05554a868bd06b1ed8ccaa.json
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE password SET email = 'group-ops@windmill.dev' WHERE email = 'test2@windmill.dev'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "6f1489b2c52e08566ffa9450709df2b9404a30197b05554a868bd06b1ed8ccaa"
+}
diff --git a/backend/.sqlx/query-717188b993d9c87f2de51d8edbafec074f8e02408efc6da2c742d81fd47c14f0.json b/backend/.sqlx/query-717188b993d9c87f2de51d8edbafec074f8e02408efc6da2c742d81fd47c14f0.json
new file mode 100644
index 0000000000..6dc8e9acc2
--- /dev/null
+++ b/backend/.sqlx/query-717188b993d9c87f2de51d8edbafec074f8e02408efc6da2c742d81fd47c14f0.json
@@ -0,0 +1,24 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT count(*) FROM dbt_node WHERE workspace_id = $1 AND script_hash = $2 AND job_id = $3",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "count",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Int8",
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "717188b993d9c87f2de51d8edbafec074f8e02408efc6da2c742d81fd47c14f0"
+}
diff --git a/backend/.sqlx/query-71767e6684957af5dff56a1bb64f980f712f92798d11feaeb0832962ad9ddb2e.json b/backend/.sqlx/query-71767e6684957af5dff56a1bb64f980f712f92798d11feaeb0832962ad9ddb2e.json
index 96a68f827d..64c6611843 100644
--- a/backend/.sqlx/query-71767e6684957af5dff56a1bb64f980f712f92798d11feaeb0832962ad9ddb2e.json
+++ b/backend/.sqlx/query-71767e6684957af5dff56a1bb64f980f712f92798d11feaeb0832962ad9ddb2e.json
@@ -84,7 +84,8 @@
                 "java",
                 "duckdb",
                 "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-71b341ba06d588a7fb425d97921f16a8fc4fdf0bcebecfd21c9b7154dedea25f.json b/backend/.sqlx/query-71b341ba06d588a7fb425d97921f16a8fc4fdf0bcebecfd21c9b7154dedea25f.json
new file mode 100644
index 0000000000..397b310807
--- /dev/null
+++ b/backend/.sqlx/query-71b341ba06d588a7fb425d97921f16a8fc4fdf0bcebecfd21c9b7154dedea25f.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE materialized_partition\n            SET status = 'failed',\n                error = COALESCE(error, 'the run ended before this model finished')\n          WHERE workspace_id = $1 AND job_id = $2 AND status = 'running'\n            AND NOT (asset_path = ANY($3))",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Uuid",
+        "TextArray"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "71b341ba06d588a7fb425d97921f16a8fc4fdf0bcebecfd21c9b7154dedea25f"
+}
diff --git a/backend/.sqlx/query-72fa27780070363e092a19dbea4b63195863245bfb271a946d2aa67c59da7b3c.json b/backend/.sqlx/query-72fa27780070363e092a19dbea4b63195863245bfb271a946d2aa67c59da7b3c.json
new file mode 100644
index 0000000000..d97f8be4ac
--- /dev/null
+++ b/backend/.sqlx/query-72fa27780070363e092a19dbea4b63195863245bfb271a946d2aa67c59da7b3c.json
@@ -0,0 +1,40 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT email, workspace_id, super_admin, owner FROM token WHERE token_hash = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "email",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "workspace_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "super_admin",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 3,
+        "name": "owner",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      true,
+      true,
+      false,
+      true
+    ]
+  },
+  "hash": "72fa27780070363e092a19dbea4b63195863245bfb271a946d2aa67c59da7b3c"
+}
diff --git a/backend/.sqlx/query-74cab23105c5892b5df86ba1e81ac3d575db3d3542341988917f68165174f133.json b/backend/.sqlx/query-74cab23105c5892b5df86ba1e81ac3d575db3d3542341988917f68165174f133.json
new file mode 100644
index 0000000000..a58ee643d0
--- /dev/null
+++ b/backend/.sqlx/query-74cab23105c5892b5df86ba1e81ac3d575db3d3542341988917f68165174f133.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE draft SET value = to_json(jsonb_set(to_jsonb(value), ARRAY['on_behalf_of'], to_jsonb($1::text))) WHERE value->>'on_behalf_of' = $2 AND workspace_id = $3",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "74cab23105c5892b5df86ba1e81ac3d575db3d3542341988917f68165174f133"
+}
diff --git a/backend/.sqlx/query-77146f3ebe59007b7608c88ba35dddc63e9fde5b301e7f935def7e1d0d41e672.json b/backend/.sqlx/query-77146f3ebe59007b7608c88ba35dddc63e9fde5b301e7f935def7e1d0d41e672.json
new file mode 100644
index 0000000000..35a2e8deda
--- /dev/null
+++ b/backend/.sqlx/query-77146f3ebe59007b7608c88ba35dddc63e9fde5b301e7f935def7e1d0d41e672.json
@@ -0,0 +1,34 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT label, expiration, scopes FROM token WHERE token_hash = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "label",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "expiration",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 2,
+        "name": "scopes",
+        "type_info": "TextArray"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      true,
+      true,
+      true
+    ]
+  },
+  "hash": "77146f3ebe59007b7608c88ba35dddc63e9fde5b301e7f935def7e1d0d41e672"
+}
diff --git a/backend/.sqlx/query-79db50d906264ab96dffa134673f9171b943e959eb5401a496af850aa686391b.json b/backend/.sqlx/query-79db50d906264ab96dffa134673f9171b943e959eb5401a496af850aa686391b.json
new file mode 100644
index 0000000000..75871561e9
--- /dev/null
+++ b/backend/.sqlx/query-79db50d906264ab96dffa134673f9171b943e959eb5401a496af850aa686391b.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT EXISTS(SELECT 1 FROM workspace WHERE id = $1) AS \"exists!\"",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "exists!",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "79db50d906264ab96dffa134673f9171b943e959eb5401a496af850aa686391b"
+}
diff --git a/backend/.sqlx/query-7ac16d499a630454d9327304d30ad667529f720e2a570b664679564cacec6708.json b/backend/.sqlx/query-7ac16d499a630454d9327304d30ad667529f720e2a570b664679564cacec6708.json
new file mode 100644
index 0000000000..22182b5470
--- /dev/null
+++ b/backend/.sqlx/query-7ac16d499a630454d9327304d30ad667529f720e2a570b664679564cacec6708.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO flow\n                (workspace_id, path, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, concurrency_key, versions, value, schema, edited_by, edited_at, labels)\n            SELECT workspace_id, $1, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, concurrency_key, versions, value, schema, edited_by, edited_at, labels\n                FROM flow\n                WHERE path = $2 AND workspace_id = $3",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "7ac16d499a630454d9327304d30ad667529f720e2a570b664679564cacec6708"
+}
diff --git a/backend/.sqlx/query-7bb8ff3426ec73672fb572cd1ce36f495a84e0ad7d60fd39eddcccbc129d43c8.json b/backend/.sqlx/query-7bb8ff3426ec73672fb572cd1ce36f495a84e0ad7d60fd39eddcccbc129d43c8.json
index b38e22ad67..d26e9f7c87 100644
--- a/backend/.sqlx/query-7bb8ff3426ec73672fb572cd1ce36f495a84e0ad7d60fd39eddcccbc129d43c8.json
+++ b/backend/.sqlx/query-7bb8ff3426ec73672fb572cd1ce36f495a84e0ad7d60fd39eddcccbc129d43c8.json
@@ -77,7 +77,8 @@
                 "java",
                 "duckdb",
                 "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-7be4645fe51c8a9bd13645a245846cb485c593b6df2194ae91ba2d8c584c0cce.json b/backend/.sqlx/query-7be4645fe51c8a9bd13645a245846cb485c593b6df2194ae91ba2d8c584c0cce.json
new file mode 100644
index 0000000000..936a85b611
--- /dev/null
+++ b/backend/.sqlx/query-7be4645fe51c8a9bd13645a245846cb485c593b6df2194ae91ba2d8c584c0cce.json
@@ -0,0 +1,42 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT identity, args, run_results, job_id FROM dbt_run_state\n         WHERE workspace_id = $1 AND script_path = $2 AND permissioned_as = $3",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "identity",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 1,
+        "name": "args",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 2,
+        "name": "run_results",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 3,
+        "name": "job_id",
+        "type_info": "Uuid"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      true
+    ]
+  },
+  "hash": "7be4645fe51c8a9bd13645a245846cb485c593b6df2194ae91ba2d8c584c0cce"
+}
diff --git a/backend/.sqlx/query-7c19d92d25b799e8872452c5c77ae110e2c0628b2721a44735f4fc06e59b5c77.json b/backend/.sqlx/query-7c19d92d25b799e8872452c5c77ae110e2c0628b2721a44735f4fc06e59b5c77.json
new file mode 100644
index 0000000000..ee215b9615
--- /dev/null
+++ b/backend/.sqlx/query-7c19d92d25b799e8872452c5c77ae110e2c0628b2721a44735f4fc06e59b5c77.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT count(*) FROM dbt_graph_snapshot WHERE workspace_id = $1 AND script_path = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "count",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "7c19d92d25b799e8872452c5c77ae110e2c0628b2721a44735f4fc06e59b5c77"
+}
diff --git a/backend/.sqlx/query-7cddbc01dbec7878e7a8e528f21fbb75b10af4af97f5ecbe094db8f8080bf21d.json b/backend/.sqlx/query-7cddbc01dbec7878e7a8e528f21fbb75b10af4af97f5ecbe094db8f8080bf21d.json
new file mode 100644
index 0000000000..72093610da
--- /dev/null
+++ b/backend/.sqlx/query-7cddbc01dbec7878e7a8e528f21fbb75b10af4af97f5ecbe094db8f8080bf21d.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO flow\n            (workspace_id, path, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, concurrency_key, versions, value, schema, edited_by, edited_at)\n        SELECT workspace_id, REGEXP_REPLACE(path,'u/' || $2 || '/(.*)','u/' || $1 || '/\\1'), summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, concurrency_key, versions, value, schema, edited_by, edited_at\n            FROM flow\n            WHERE path LIKE ('u/' || $2 || '/%') AND workspace_id = $3",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "7cddbc01dbec7878e7a8e528f21fbb75b10af4af97f5ecbe094db8f8080bf21d"
+}
diff --git a/backend/.sqlx/query-7ce4e7af3d3cd01e644b8f1cca15db49ab38ac4982c7c258b17bf9ef53047cb6.json b/backend/.sqlx/query-7ce4e7af3d3cd01e644b8f1cca15db49ab38ac4982c7c258b17bf9ef53047cb6.json
new file mode 100644
index 0000000000..04f84cd931
--- /dev/null
+++ b/backend/.sqlx/query-7ce4e7af3d3cd01e644b8f1cca15db49ab38ac4982c7c258b17bf9ef53047cb6.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE flow SET on_behalf_of = $1 WHERE on_behalf_of = $2 AND workspace_id = $3",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "7ce4e7af3d3cd01e644b8f1cca15db49ab38ac4982c7c258b17bf9ef53047cb6"
+}
diff --git a/backend/.sqlx/query-7e9e07f55ebb12d76efee5c92e98b85dbf7eebfdd64a605569b9b2f814f7fc77.json b/backend/.sqlx/query-7e9e07f55ebb12d76efee5c92e98b85dbf7eebfdd64a605569b9b2f814f7fc77.json
new file mode 100644
index 0000000000..cc4dd630cf
--- /dev/null
+++ b/backend/.sqlx/query-7e9e07f55ebb12d76efee5c92e98b85dbf7eebfdd64a605569b9b2f814f7fc77.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO flow\n            (workspace_id, path, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, lock_error_logs)\n        SELECT $1, path, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, lock_error_logs\n            FROM flow WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "7e9e07f55ebb12d76efee5c92e98b85dbf7eebfdd64a605569b9b2f814f7fc77"
+}
diff --git a/backend/.sqlx/query-8058042d5564a934534517e9c0446c5fcc0c3654746c5e65994123ffb4d05f78.json b/backend/.sqlx/query-8058042d5564a934534517e9c0446c5fcc0c3654746c5e65994123ffb4d05f78.json
deleted file mode 100644
index 5453ec6899..0000000000
--- a/backend/.sqlx/query-8058042d5564a934534517e9c0446c5fcc0c3654746c5e65994123ffb4d05f78.json
+++ /dev/null
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO workspace_settings (workspace_id, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, ducklake, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts) SELECT $1, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, ducklake, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts FROM workspace_settings WHERE workspace_id = $2",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "8058042d5564a934534517e9c0446c5fcc0c3654746c5e65994123ffb4d05f78"
-}
diff --git a/backend/.sqlx/query-80a3a4e8f35190352aa4e4c5716013ce4a6f7b3ba27c63c77c4c765bf9076624.json b/backend/.sqlx/query-80a3a4e8f35190352aa4e4c5716013ce4a6f7b3ba27c63c77c4c765bf9076624.json
new file mode 100644
index 0000000000..a72789aa6b
--- /dev/null
+++ b/backend/.sqlx/query-80a3a4e8f35190352aa4e4c5716013ce4a6f7b3ba27c63c77c4c765bf9076624.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE app SET path = path WHERE path = $1 AND workspace_id = $2 RETURNING 1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "?column?",
+        "type_info": "Int4"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "80a3a4e8f35190352aa4e4c5716013ce4a6f7b3ba27c63c77c4c765bf9076624"
+}
diff --git a/backend/.sqlx/query-825b7e301307373ecfa6b59b4091e5fe53514913562ca93de44d9ad0a02a0fe8.json b/backend/.sqlx/query-825b7e301307373ecfa6b59b4091e5fe53514913562ca93de44d9ad0a02a0fe8.json
new file mode 100644
index 0000000000..46ec0bde59
--- /dev/null
+++ b/backend/.sqlx/query-825b7e301307373ecfa6b59b4091e5fe53514913562ca93de44d9ad0a02a0fe8.json
@@ -0,0 +1,71 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT workspace_id, path, value, description, resource_type, extra_perms, created_by, edited_at, labels FROM resource WHERE workspace_id = $1 AND resource_type <> ALL($2)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "workspace_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "value",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 3,
+        "name": "description",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 4,
+        "name": "resource_type",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 5,
+        "name": "extra_perms",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 6,
+        "name": "created_by",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 7,
+        "name": "edited_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 8,
+        "name": "labels",
+        "type_info": "TextArray"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "TextArray"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      true,
+      true,
+      false,
+      false,
+      true,
+      true,
+      true
+    ]
+  },
+  "hash": "825b7e301307373ecfa6b59b4091e5fe53514913562ca93de44d9ad0a02a0fe8"
+}
diff --git a/backend/.sqlx/query-8317932e7a9a5d927881bc9cc573895307eed9eb259862da07813b6daa37ba9e.json b/backend/.sqlx/query-8317932e7a9a5d927881bc9cc573895307eed9eb259862da07813b6daa37ba9e.json
new file mode 100644
index 0000000000..660a01d710
--- /dev/null
+++ b/backend/.sqlx/query-8317932e7a9a5d927881bc9cc573895307eed9eb259862da07813b6daa37ba9e.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT EXISTS(SELECT 1 FROM folder WHERE workspace_id = $1 AND name = $2)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "exists",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "8317932e7a9a5d927881bc9cc573895307eed9eb259862da07813b6daa37ba9e"
+}
diff --git a/backend/.sqlx/query-836297c7d83185ac4f317e0bd0b2e73c55932927b05f963d45479103e3191ecd.json b/backend/.sqlx/query-836297c7d83185ac4f317e0bd0b2e73c55932927b05f963d45479103e3191ecd.json
new file mode 100644
index 0000000000..a4026be742
--- /dev/null
+++ b/backend/.sqlx/query-836297c7d83185ac4f317e0bd0b2e73c55932927b05f963d45479103e3191ecd.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n    INSERT INTO script\n    (workspace_id, hash, path, parent_hashes, summary, description, content, created_by, schema, is_template, extra_perms, lock, language, kind, tag, envs, concurrent_limit, concurrency_time_window_s, cache_ttl, cache_ignore_s3_path, dedicated_worker, ws_error_handler_muted, priority, restart_unless_cancelled, delete_after_use, delete_after_secs, timeout, concurrency_key, visible_to_runner_only, auto_kind, codebase, has_preprocessor, on_behalf_of, schema_validation, assets, debounce_key, debounce_delay_s, runnable_settings_handle, modules, labels)\n\n    SELECT  workspace_id, $1, path, array_prepend($2::bigint, COALESCE(parent_hashes, '{}'::bigint[])), summary, description, content, created_by, schema, is_template, extra_perms, NULL, language, kind, tag, envs, concurrent_limit, concurrency_time_window_s, cache_ttl, cache_ignore_s3_path, dedicated_worker, ws_error_handler_muted, priority, restart_unless_cancelled, delete_after_use, delete_after_secs, timeout, concurrency_key, visible_to_runner_only, auto_kind, codebase, has_preprocessor, on_behalf_of, schema_validation, assets, debounce_key, debounce_delay_s, runnable_settings_handle, modules, labels\n\n    FROM script WHERE hash = $2 AND workspace_id = $3;\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Int8",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "836297c7d83185ac4f317e0bd0b2e73c55932927b05f963d45479103e3191ecd"
+}
diff --git a/backend/.sqlx/query-83c4fed5d1a05365c3f486543519963c1068ea26e11307acec28fd07d0ce6b90.json b/backend/.sqlx/query-83c4fed5d1a05365c3f486543519963c1068ea26e11307acec28fd07d0ce6b90.json
new file mode 100644
index 0000000000..baf02539cf
--- /dev/null
+++ b/backend/.sqlx/query-83c4fed5d1a05365c3f486543519963c1068ea26e11307acec28fd07d0ce6b90.json
@@ -0,0 +1,24 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH inserted AS (\n            INSERT INTO flow\n                (workspace_id, path, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, labels, lock_error_logs)\n            SELECT workspace_id, REGEXP_REPLACE(path, 'u/' || $2 || '/(.*)', $1 || '/\\1'), summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, labels, lock_error_logs\n                FROM flow\n                WHERE path LIKE ('u/' || $2 || '/%') AND workspace_id = $3\n            RETURNING 1\n        ) SELECT COUNT(*) FROM inserted",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "count",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "83c4fed5d1a05365c3f486543519963c1068ea26e11307acec28fd07d0ce6b90"
+}
diff --git a/backend/.sqlx/query-843ef7d1c619d2784306fa1dd06036c6967b5a2ebb88cf174f435a2ce692c5dc.json b/backend/.sqlx/query-843ef7d1c619d2784306fa1dd06036c6967b5a2ebb88cf174f435a2ce692c5dc.json
new file mode 100644
index 0000000000..5c000ffd34
--- /dev/null
+++ b/backend/.sqlx/query-843ef7d1c619d2784306fa1dd06036c6967b5a2ebb88cf174f435a2ce692c5dc.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT count(*) FROM dbt_graph_snapshot WHERE workspace_id = $1 AND job_id = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "count",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "843ef7d1c619d2784306fa1dd06036c6967b5a2ebb88cf174f435a2ce692c5dc"
+}
diff --git a/backend/.sqlx/query-84c88cd1c907317714dfe0e7acb3dd3ea34c1fc5c2700fdcccdd17fbff5dcee5.json b/backend/.sqlx/query-84c88cd1c907317714dfe0e7acb3dd3ea34c1fc5c2700fdcccdd17fbff5dcee5.json
new file mode 100644
index 0000000000..d608d90996
--- /dev/null
+++ b/backend/.sqlx/query-84c88cd1c907317714dfe0e7acb3dd3ea34c1fc5c2700fdcccdd17fbff5dcee5.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT EXISTS(SELECT 1 FROM script WHERE workspace_id = $1 AND path = $2 AND archived = false)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "exists",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "84c88cd1c907317714dfe0e7acb3dd3ea34c1fc5c2700fdcccdd17fbff5dcee5"
+}
diff --git a/backend/.sqlx/query-850b5e3414851e53f9d5580b0ab1fdb97b053620ac14b8196ebf09208510fb1f.json b/backend/.sqlx/query-850b5e3414851e53f9d5580b0ab1fdb97b053620ac14b8196ebf09208510fb1f.json
new file mode 100644
index 0000000000..4c72eca991
--- /dev/null
+++ b/backend/.sqlx/query-850b5e3414851e53f9d5580b0ab1fdb97b053620ac14b8196ebf09208510fb1f.json
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE dbt_graph_snapshot SET relation_root_at_last_ingest = $4\n          WHERE workspace_id = $1 AND script_path = $2 AND script_hash = $3\n            AND job_id = '00000000-0000-0000-0000-000000000000'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Int8",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "850b5e3414851e53f9d5580b0ab1fdb97b053620ac14b8196ebf09208510fb1f"
+}
diff --git a/backend/.sqlx/query-853230da671371fd8bbeeb4c87f8c20a9e310092ae787efe4b0657399c799424.json b/backend/.sqlx/query-853230da671371fd8bbeeb4c87f8c20a9e310092ae787efe4b0657399c799424.json
index 5aacf1a295..a535cf8aed 100644
--- a/backend/.sqlx/query-853230da671371fd8bbeeb4c87f8c20a9e310092ae787efe4b0657399c799424.json
+++ b/backend/.sqlx/query-853230da671371fd8bbeeb4c87f8c20a9e310092ae787efe4b0657399c799424.json
@@ -16,7 +16,8 @@
                 "variable",
                 "ducklake",
                 "datatable",
-                "volume"
+                "volume",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-86102dd1a05cb22bc20e153d33113dc5e56df70ec8743027fbde8d5c4155bfc5.json b/backend/.sqlx/query-86102dd1a05cb22bc20e153d33113dc5e56df70ec8743027fbde8d5c4155bfc5.json
new file mode 100644
index 0000000000..b9f06081b4
--- /dev/null
+++ b/backend/.sqlx/query-86102dd1a05cb22bc20e153d33113dc5e56df70ec8743027fbde8d5c4155bfc5.json
@@ -0,0 +1,19 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes, source_last_event_kind, source_last_event_origin)\n                SELECT $1, unnest($2::varchar[]), $3, $4, 0, 1, NULL, $5, $6\n                ON CONFLICT (source_workspace_id, fork_workspace_id, path, kind)\n                DO UPDATE SET\n                    behind = workspace_diff.behind + 1,\n                    has_changes = NULL,\n                    source_last_event_kind = CASE WHEN $6::varchar IS NULL THEN workspace_diff.source_last_event_kind ELSE $5 END,\n                    source_last_event_origin = COALESCE($6, workspace_diff.source_last_event_origin)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "VarcharArray",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "86102dd1a05cb22bc20e153d33113dc5e56df70ec8743027fbde8d5c4155bfc5"
+}
diff --git a/backend/.sqlx/query-86c1c8712587acbacc830fde1be608f7f9b84c13d8d906113467c00d440a8fa2.json b/backend/.sqlx/query-86c1c8712587acbacc830fde1be608f7f9b84c13d8d906113467c00d440a8fa2.json
new file mode 100644
index 0000000000..3c4815172c
--- /dev/null
+++ b/backend/.sqlx/query-86c1c8712587acbacc830fde1be608f7f9b84c13d8d906113467c00d440a8fa2.json
@@ -0,0 +1,42 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        UPDATE native_trigger\n        SET script_path = $1, is_flow = $2, webhook_token_hash = $3, service_config = $4,\n            summary = $5, error = NULL, updated_at = NOW()\n        WHERE\n            workspace_id = $6\n            AND service_name = $7\n            AND external_id = $8\n            AND script_path = $9\n            AND is_flow = $10\n        RETURNING 1 AS \"applied!\"\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "applied!",
+        "type_info": "Int4"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Bool",
+        "Varchar",
+        "Jsonb",
+        "Varchar",
+        "Text",
+        {
+          "Custom": {
+            "name": "native_trigger_service",
+            "kind": {
+              "Enum": [
+                "nextcloud",
+                "google",
+                "github"
+              ]
+            }
+          }
+        },
+        "Text",
+        "Text",
+        "Bool"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "86c1c8712587acbacc830fde1be608f7f9b84c13d8d906113467c00d440a8fa2"
+}
diff --git a/backend/.sqlx/query-87afd5289e54b6accda8a399ec3c66df3d19217059f62903be3c74eadb9c15d5.json b/backend/.sqlx/query-87afd5289e54b6accda8a399ec3c66df3d19217059f62903be3c74eadb9c15d5.json
new file mode 100644
index 0000000000..8cdb2d5907
--- /dev/null
+++ b/backend/.sqlx/query-87afd5289e54b6accda8a399ec3c66df3d19217059f62903be3c74eadb9c15d5.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO draft (workspace_id, path, typ, value, created_at, email)\n         SELECT $2, path, typ,\n                CASE WHEN typ IN ('script', 'flow')\n                     THEN to_json(to_jsonb(value) - 'on_behalf_of')\n                     ELSE value END,\n                created_at, email\n         FROM draft\n         WHERE workspace_id = $1 AND (email = $3 OR email IS NULL)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "87afd5289e54b6accda8a399ec3c66df3d19217059f62903be3c74eadb9c15d5"
+}
diff --git a/backend/.sqlx/query-87ca1f2a34f54dade76f5a2cde5ecdac6806e1a306dca880943d97bb6d6a889d.json b/backend/.sqlx/query-87ca1f2a34f54dade76f5a2cde5ecdac6806e1a306dca880943d97bb6d6a889d.json
index ffce4491e3..f26bca1232 100644
--- a/backend/.sqlx/query-87ca1f2a34f54dade76f5a2cde5ecdac6806e1a306dca880943d97bb6d6a889d.json
+++ b/backend/.sqlx/query-87ca1f2a34f54dade76f5a2cde5ecdac6806e1a306dca880943d97bb6d6a889d.json
@@ -44,7 +44,8 @@
                 "java",
                 "duckdb",
                 "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-8901dc69384685a7e05f39e1fae65471decea3d46ee35582c3b7c1ac333d8dd5.json b/backend/.sqlx/query-8901dc69384685a7e05f39e1fae65471decea3d46ee35582c3b7c1ac333d8dd5.json
new file mode 100644
index 0000000000..e2b87fd182
--- /dev/null
+++ b/backend/.sqlx/query-8901dc69384685a7e05f39e1fae65471decea3d46ee35582c3b7c1ac333d8dd5.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT EXISTS(\n                SELECT 1 FROM script WHERE on_behalf_of = $1\n                UNION ALL SELECT 1 FROM flow WHERE on_behalf_of = $1\n                UNION ALL SELECT 1 FROM app WHERE policy->>'on_behalf_of' = $1\n                UNION ALL SELECT 1 FROM schedule WHERE permissioned_as = $1\n                UNION ALL SELECT 1 FROM http_trigger WHERE permissioned_as = $1\n                UNION ALL SELECT 1 FROM websocket_trigger WHERE permissioned_as = $1\n                UNION ALL SELECT 1 FROM postgres_trigger WHERE permissioned_as = $1\n                UNION ALL SELECT 1 FROM mqtt_trigger WHERE permissioned_as = $1\n                UNION ALL SELECT 1 FROM kafka_trigger WHERE permissioned_as = $1\n                UNION ALL SELECT 1 FROM nats_trigger WHERE permissioned_as = $1\n                UNION ALL SELECT 1 FROM sqs_trigger WHERE permissioned_as = $1\n                UNION ALL SELECT 1 FROM gcp_trigger WHERE permissioned_as = $1\n                UNION ALL SELECT 1 FROM email_trigger WHERE permissioned_as = $1\n                UNION ALL SELECT 1 FROM amqp_trigger WHERE permissioned_as = $1\n                UNION ALL SELECT 1 FROM azure_trigger WHERE permissioned_as = $1\n                UNION ALL SELECT 1 FROM folder\n                    WHERE default_permissioned_as @> jsonb_build_array(\n                        jsonb_build_object('permissioned_as', $1::text)))",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "exists",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "8901dc69384685a7e05f39e1fae65471decea3d46ee35582c3b7c1ac333d8dd5"
+}
diff --git a/backend/.sqlx/query-8a40b3e7b9c59f1a0b50d3fe6b320748a912eff01dda22df9f489b6703435166.json b/backend/.sqlx/query-8a40b3e7b9c59f1a0b50d3fe6b320748a912eff01dda22df9f489b6703435166.json
new file mode 100644
index 0000000000..0f743221dc
--- /dev/null
+++ b/backend/.sqlx/query-8a40b3e7b9c59f1a0b50d3fe6b320748a912eff01dda22df9f489b6703435166.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO script (workspace_id, hash, path, summary, description, content, created_by,\n                             language, lock)\n         VALUES ($1, $2, $3, '', '', 'profile: {}', 'test-user', 'dbt', '')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Int8",
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "8a40b3e7b9c59f1a0b50d3fe6b320748a912eff01dda22df9f489b6703435166"
+}
diff --git a/backend/.sqlx/query-8acc8c47123af84d2308042dcd34d04b941e928c7621e66d3bdc510c335f8c20.json b/backend/.sqlx/query-8acc8c47123af84d2308042dcd34d04b941e928c7621e66d3bdc510c335f8c20.json
index 6f7468033a..44e6cc5c81 100644
--- a/backend/.sqlx/query-8acc8c47123af84d2308042dcd34d04b941e928c7621e66d3bdc510c335f8c20.json
+++ b/backend/.sqlx/query-8acc8c47123af84d2308042dcd34d04b941e928c7621e66d3bdc510c335f8c20.json
@@ -42,7 +42,8 @@
                 "java",
                 "duckdb",
                 "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-8bad2a916f9afe1c037a01ffe69e136b562ace2d8265c9d26bcdf866f0f2c280.json b/backend/.sqlx/query-8bad2a916f9afe1c037a01ffe69e136b562ace2d8265c9d26bcdf866f0f2c280.json
new file mode 100644
index 0000000000..a087c3619f
--- /dev/null
+++ b/backend/.sqlx/query-8bad2a916f9afe1c037a01ffe69e136b562ace2d8265c9d26bcdf866f0f2c280.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE dbt_run_progress SET workspace_id = $1\n         WHERE workspace_id = $2 AND job_id IN (SELECT id FROM v2_job WHERE workspace_id = $1)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "8bad2a916f9afe1c037a01ffe69e136b562ace2d8265c9d26bcdf866f0f2c280"
+}
diff --git a/backend/.sqlx/query-8c33cbe3dc0a7539835fab61f981f5117da38c3410ad6e34ad67f5441deaf89e.json b/backend/.sqlx/query-8c33cbe3dc0a7539835fab61f981f5117da38c3410ad6e34ad67f5441deaf89e.json
new file mode 100644
index 0000000000..ab72d4040a
--- /dev/null
+++ b/backend/.sqlx/query-8c33cbe3dc0a7539835fab61f981f5117da38c3410ad6e34ad67f5441deaf89e.json
@@ -0,0 +1,71 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT\n            workspace.id AS \"id!\",\n            workspace.name AS \"name!\",\n            workspace.owner AS \"owner!\",\n            workspace.deleted AS \"deleted!\",\n            workspace.premium AS \"premium!\",\n            workspace_settings.color AS \"color\",\n            workspace.parent_workspace_id AS \"parent_workspace_id\",\n            workspace.is_dev_workspace AS \"is_dev_workspace!\",\n            workspace.dev_workspace_label AS \"dev_workspace_label\"\n        FROM workspace\n        LEFT JOIN workspace_settings ON workspace.id = workspace_settings.workspace_id\n         LIMIT $1 OFFSET $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "name!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "owner!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 3,
+        "name": "deleted!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 4,
+        "name": "premium!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 5,
+        "name": "color",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 6,
+        "name": "parent_workspace_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 7,
+        "name": "is_dev_workspace!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 8,
+        "name": "dev_workspace_label",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      false,
+      false,
+      true,
+      true,
+      false,
+      true
+    ]
+  },
+  "hash": "8c33cbe3dc0a7539835fab61f981f5117da38c3410ad6e34ad67f5441deaf89e"
+}
diff --git a/backend/.sqlx/query-8cd02a5378bea03012e6cb937f23460b6438d0a320b5554acec0beddbdeb008b.json b/backend/.sqlx/query-8cd02a5378bea03012e6cb937f23460b6438d0a320b5554acec0beddbdeb008b.json
index 24d70efae1..09fc3c9ad1 100644
--- a/backend/.sqlx/query-8cd02a5378bea03012e6cb937f23460b6438d0a320b5554acec0beddbdeb008b.json
+++ b/backend/.sqlx/query-8cd02a5378bea03012e6cb937f23460b6438d0a320b5554acec0beddbdeb008b.json
@@ -36,7 +36,8 @@
                 "variable",
                 "ducklake",
                 "datatable",
-                "volume"
+                "volume",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-8d444380516faf56369cdbff645904e20477aa597e30891926af42eee56ab081.json b/backend/.sqlx/query-8d444380516faf56369cdbff645904e20477aa597e30891926af42eee56ab081.json
index d7f59025e7..fbb3d579de 100644
--- a/backend/.sqlx/query-8d444380516faf56369cdbff645904e20477aa597e30891926af42eee56ab081.json
+++ b/backend/.sqlx/query-8d444380516faf56369cdbff645904e20477aa597e30891926af42eee56ab081.json
@@ -154,7 +154,8 @@
                 "java",
                 "duckdb",
                 "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-8e4397a299c29687bec108899bd520d67718b2c60e717d69439ea13da272c81e.json b/backend/.sqlx/query-8e4397a299c29687bec108899bd520d67718b2c60e717d69439ea13da272c81e.json
new file mode 100644
index 0000000000..04d2fe0a77
--- /dev/null
+++ b/backend/.sqlx/query-8e4397a299c29687bec108899bd520d67718b2c60e717d69439ea13da272c81e.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT count(*) FROM dbt_graph_snapshot WHERE workspace_id = $1 AND script_hash = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "count",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Int8"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "8e4397a299c29687bec108899bd520d67718b2c60e717d69439ea13da272c81e"
+}
diff --git a/backend/.sqlx/query-8e829a7358ea47100c99e78067266eb7a83e312b88f0244d1c517b03a9bcdea0.json b/backend/.sqlx/query-8e829a7358ea47100c99e78067266eb7a83e312b88f0244d1c517b03a9bcdea0.json
index eac4547361..406917a99f 100644
--- a/backend/.sqlx/query-8e829a7358ea47100c99e78067266eb7a83e312b88f0244d1c517b03a9bcdea0.json
+++ b/backend/.sqlx/query-8e829a7358ea47100c99e78067266eb7a83e312b88f0244d1c517b03a9bcdea0.json
@@ -16,7 +16,8 @@
                 "variable",
                 "ducklake",
                 "datatable",
-                "volume"
+                "volume",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-90489615820818332e40a46a3d720977b23f696e74735de1a56da58713e64b50.json b/backend/.sqlx/query-90489615820818332e40a46a3d720977b23f696e74735de1a56da58713e64b50.json
new file mode 100644
index 0000000000..ebc76b2fb4
--- /dev/null
+++ b/backend/.sqlx/query-90489615820818332e40a46a3d720977b23f696e74735de1a56da58713e64b50.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE script SET path = $1 WHERE workspace_id = 'test-workspace' AND path = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "90489615820818332e40a46a3d720977b23f696e74735de1a56da58713e64b50"
+}
diff --git a/backend/.sqlx/query-916c6305639df0ecefd254901138b0663458209676179e8f64c3eb5c7d0262f8.json b/backend/.sqlx/query-916c6305639df0ecefd254901138b0663458209676179e8f64c3eb5c7d0262f8.json
new file mode 100644
index 0000000000..8671ee1e77
--- /dev/null
+++ b/backend/.sqlx/query-916c6305639df0ecefd254901138b0663458209676179e8f64c3eb5c7d0262f8.json
@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes, source_last_event_kind, source_last_event_origin)\n            SELECT $1, unnest($2::varchar[]), $3, $4, 0, 1, NULL, $5, $6\n            ON CONFLICT (source_workspace_id, fork_workspace_id, path, kind)\n            DO UPDATE SET\n                behind = workspace_diff.behind + 1,\n                has_changes = NULL,\n                source_last_event_kind = CASE WHEN $6::varchar IS NULL OR (NOT $7 AND workspace_diff.source_last_event_origin IS NOT NULL) THEN workspace_diff.source_last_event_kind ELSE $5 END,\n                source_last_event_origin = CASE WHEN $6::varchar IS NULL OR (NOT $7 AND workspace_diff.source_last_event_origin IS NOT NULL) THEN workspace_diff.source_last_event_origin ELSE $6 END",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "VarcharArray",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Bool"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "916c6305639df0ecefd254901138b0663458209676179e8f64c3eb5c7d0262f8"
+}
diff --git a/backend/.sqlx/query-925359a7b0fe8f4ed17f072f7299c7d503eac045a6d5d13ac3c953a3fbdac0ff.json b/backend/.sqlx/query-925359a7b0fe8f4ed17f072f7299c7d503eac045a6d5d13ac3c953a3fbdac0ff.json
new file mode 100644
index 0000000000..59472d78dd
--- /dev/null
+++ b/backend/.sqlx/query-925359a7b0fe8f4ed17f072f7299c7d503eac045a6d5d13ac3c953a3fbdac0ff.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT versions[array_upper(versions, 1)] FROM app\n             WHERE path = $1 AND workspace_id = $2 FOR UPDATE",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "versions",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "925359a7b0fe8f4ed17f072f7299c7d503eac045a6d5d13ac3c953a3fbdac0ff"
+}
diff --git a/backend/.sqlx/query-92723ff15a596e97edc71d24a5b653deb9d0e44259b22f2c6c5f43579f687360.json b/backend/.sqlx/query-92723ff15a596e97edc71d24a5b653deb9d0e44259b22f2c6c5f43579f687360.json
new file mode 100644
index 0000000000..860da63f0b
--- /dev/null
+++ b/backend/.sqlx/query-92723ff15a596e97edc71d24a5b653deb9d0e44259b22f2c6c5f43579f687360.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO script (\n            workspace_id, hash, path, parent_hashes, summary, description, content,\n            created_by, created_at, archived, schema, deleted, is_template,\n            extra_perms, lock, lock_error_logs, language, kind, tag,\n            envs, concurrent_limit, concurrency_time_window_s, cache_ttl,\n            dedicated_worker, ws_error_handler_muted, priority, timeout,\n            delete_after_use, delete_after_secs, restart_unless_cancelled, concurrency_key,\n            visible_to_runner_only, auto_kind, codebase, has_preprocessor,\n            on_behalf_of, on_behalf_of_email, assets, modules\n        )\n        SELECT\n            $1, hash, path, parent_hashes, summary, description, content,\n            created_by, created_at, archived, schema, deleted, is_template,\n            extra_perms, lock, lock_error_logs, language, kind, tag,\n            envs, concurrent_limit, concurrency_time_window_s, cache_ttl,\n            dedicated_worker, ws_error_handler_muted, priority, timeout,\n            delete_after_use, delete_after_secs, restart_unless_cancelled, concurrency_key,\n            visible_to_runner_only, auto_kind, codebase, has_preprocessor,\n            -- Same three forms and the same prefix-first rule as permissioned_as_exists,\n            -- superadmin fallback included: one acting outside their workspaces has no usr\n            -- row but still authenticates.\n            CASE WHEN on_behalf_of LIKE 'u/%' THEN\n                    (SELECT on_behalf_of WHERE EXISTS (\n                        SELECT 1 FROM usr u WHERE u.workspace_id = $1::varchar\n                          AND u.username = substring(on_behalf_of from 3)\n                        UNION ALL\n                        SELECT 1 FROM password p WHERE p.super_admin\n                          AND (p.username = substring(on_behalf_of from 3)\n                               OR p.email = substring(on_behalf_of from 3))))\n                 WHEN on_behalf_of LIKE 'g/%' THEN\n                    (SELECT on_behalf_of WHERE EXISTS (\n                        SELECT 1 FROM group_ g WHERE g.workspace_id = $1::varchar\n                          AND g.name = substring(on_behalf_of from 3)))\n                 ELSE\n                    (SELECT on_behalf_of WHERE EXISTS (\n                        SELECT 1 FROM usr u WHERE u.workspace_id = $1::varchar\n                          AND u.username = on_behalf_of\n                        UNION ALL\n                        SELECT 1 FROM password p WHERE p.email = on_behalf_of\n                          AND p.super_admin))\n            END, on_behalf_of_email, assets, modules\n        FROM script\n        WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "92723ff15a596e97edc71d24a5b653deb9d0e44259b22f2c6c5f43579f687360"
+}
diff --git a/backend/.sqlx/query-9309262d8a37827e5ab0b3534d1595cb6d94118432fd1770f1f89f7cb52a4f12.json b/backend/.sqlx/query-9309262d8a37827e5ab0b3534d1595cb6d94118432fd1770f1f89f7cb52a4f12.json
new file mode 100644
index 0000000000..da77dc1de5
--- /dev/null
+++ b/backend/.sqlx/query-9309262d8a37827e5ab0b3534d1595cb6d94118432fd1770f1f89f7cb52a4f12.json
@@ -0,0 +1,134 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH live AS (\n             -- The graph is stored per deployed VERSION, so this endpoint — which\n             -- describes the project as it is now — takes the newest live one per\n             -- path. Resolved once here rather than per row: a correlated lookup\n             -- on every node is what makes these queries fall over.\n             SELECT * FROM (\n               SELECT DISTINCT ON (s.path) s.path, s.hash\n                 FROM script s\n                WHERE $5::text IS NULL AND s.workspace_id = $1 AND s.language = 'dbt'\n                  AND ($3::bigint IS NULL OR s.hash = $3)\n                  -- A pinned version may be archived by now; that is precisely\n                  -- the case a historical run needs, so the liveness filter\n                  -- applies only when picking the current one.\n                  AND ($3::bigint IS NOT NULL OR (s.deleted = false AND s.archived = false))\n                ORDER BY s.path, s.created_at DESC\n             ) cur\n             UNION ALL\n             -- A pinned run names its own version, so `script` is not consulted:\n             -- under RLS it would answer for the CALLER's grants on the project,\n             -- emptying the graph for a share-link viewer who is entitled to the\n             -- run but not the script. A NULL hash here is a job that names no\n             -- version at all — an editor buffer parse — and matches only the\n             -- version-less rows that parse stored.\n             SELECT $5::text, $3::bigint WHERE $5::text IS NOT NULL\n           ),\n           -- The run's own snapshot when it left one, the version's graph\n           -- otherwise. A static descriptor never snapshots, so all of its runs\n           -- fall through to the same rows. Existence comes from the marker, not\n           -- from a node row: a dynamic run that disabled every model has a\n           -- snapshot whose graph is legitimately empty.\n           chosen AS (\n             -- No visibility check on the job here: reaching this with a job at\n             -- all means the caller passed `require_job_read_access` for it, and\n             -- re-deciding it under plain RLS can only DISAGREE with that answer\n             -- — silently, by falling back to the deployed graph rather than\n             -- erroring. A share-link viewer is entitled to the run and would be\n             -- shown a different run's model set. See `asset_graph_for`.\n             SELECT CASE WHEN $4::uuid IS NOT NULL AND EXISTS (\n                      SELECT 1 FROM dbt_graph_snapshot g\n                       WHERE g.workspace_id = $1 AND g.job_id = $4)\n                    THEN $4::uuid\n                    ELSE '00000000-0000-0000-0000-000000000000'::uuid END AS job_id\n           ),\n           scoped AS (\n             SELECT n.script_path, n.unique_id FROM dbt_node n\n              -- `=` still, with the NULL-to-NULL case spelled out and gated on\n              -- the pin: a version-less row's hash is NULL on both sides, which\n              -- `=` never matches, but `IS NOT DISTINCT FROM` would cost the\n              -- equality its index bound on the UNPINNED workspace graph — the\n              -- hot path. Unpinned, `$5` is NULL and the second arm folds away.\n              JOIN live l ON l.path = n.script_path\n                         AND (n.script_hash = l.hash\n                              OR ($5::text IS NOT NULL AND l.hash IS NULL\n                                  AND n.script_hash IS NULL))\n              JOIN chosen ch ON ch.job_id = n.job_id\n              WHERE n.workspace_id = $1 AND n.asset_path IS NOT NULL\n                -- Unpinned, the scope is the relations in view: `asset` says\n                -- which of them this folder touches. Pinned, that table is the\n                -- WRONG scope — it holds one row set per path, describing the\n                -- current deploy, so a model this version had and the current one\n                -- dropped would be filtered out of its own run's graph. The\n                -- pinned graph's nodes are the scope. Keyed on the pin rather\n                -- than on the hash: an editor parse pins without naming one, and\n                -- its models are precisely the ones `asset` does not know yet.\n                AND ($3::bigint IS NOT NULL OR $5::text IS NOT NULL\n                     OR n.asset_path IN (\n                  SELECT path FROM asset\n                   WHERE workspace_id = $1 AND kind = 'dbt'\n                     AND ($2::text IS NULL OR usage_path LIKE $2)))\n           )\n           SELECT n.script_path AS \"script_path!\", n.unique_id AS \"unique_id!\",\n                  n.resource_type AS \"resource_type!\", n.name AS \"name!\", n.asset_path,\n                  n.materialized, n.materialize_strategy, n.tags AS \"tags!\", n.description,\n                  n.test_kind, n.test_column, n.test_args, n.severity, n.attached_node,\n                  n.columns, n.freshness,\n                  n.raw_code, n.original_file_path,\n                  -- Whether the caller may read the project this row describes.\n                  -- The query deliberately reaches outside the requested folder\n                  -- so an in-scope consumer can explain the relation it reads,\n                  -- and `dbt_node` carries no RLS of its own; the relation's\n                  -- SHAPE is fine to answer that way, everything the project's\n                  -- author WROTE is not. Applied in Rust, over one predicate, so\n                  -- the fields it covers are named in one place. This runs in the\n                  -- authed transaction, so `script`'s RLS answers it. Matched on\n                  -- the HASH as well: `extra_perms` is per row, so a path\n                  -- recreated with narrower ones leaves the archived version\n                  -- readable, and a path-only probe would answer for THAT grant\n                  -- while returning this version's source.\n                  --\n                  -- A version-less row has no `script` row to ask, and needs\n                  -- none: it exists only because this caller's own parse job\n                  -- created it from a buffer they wrote, and the unpinned `live`\n                  -- branch — fed from `script` — can never join to one.\n                  (n.script_hash IS NULL OR EXISTS (\n                      SELECT 1 FROM script sc\n                       WHERE sc.workspace_id = n.workspace_id AND sc.path = n.script_path\n                         AND sc.hash = n.script_hash\n                  )) AS \"script_visible!\"\n             FROM dbt_node n\n             JOIN live l ON l.path = n.script_path\n                        AND (n.script_hash = l.hash\n                             OR ($5::text IS NOT NULL AND l.hash IS NULL\n                                 AND n.script_hash IS NULL))\n             -- Every join onto `dbt_node` needs this, not just the scoping CTE:\n             -- `job_id` is part of the key, so without it each model comes back\n             -- once per retained snapshot plus once for the version's graph.\n             JOIN chosen ch ON ch.job_id = n.job_id\n            WHERE n.workspace_id = $1\n              -- Joined on BOTH columns: a dbt `unique_id` is project-local, so\n              -- two projects with the same model name would otherwise pull each\n              -- other's rows.\n              AND (EXISTS (SELECT 1 FROM scoped s\n                            WHERE s.script_path = n.script_path\n                              AND s.unique_id = n.unique_id)\n                   OR EXISTS (SELECT 1 FROM scoped s\n                               WHERE s.script_path = n.script_path\n                                 AND s.unique_id = n.attached_node))\n            ORDER BY n.script_path, n.unique_id",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "script_path!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "unique_id!",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 2,
+        "name": "resource_type!",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 3,
+        "name": "name!",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 4,
+        "name": "asset_path",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 5,
+        "name": "materialized",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 6,
+        "name": "materialize_strategy",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 7,
+        "name": "tags!",
+        "type_info": "TextArray"
+      },
+      {
+        "ordinal": 8,
+        "name": "description",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 9,
+        "name": "test_kind",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 10,
+        "name": "test_column",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 11,
+        "name": "test_args",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 12,
+        "name": "severity",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 13,
+        "name": "attached_node",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 14,
+        "name": "columns",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 15,
+        "name": "freshness",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 16,
+        "name": "raw_code",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 17,
+        "name": "original_file_path",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 18,
+        "name": "script_visible!",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Int8",
+        "Uuid",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      false,
+      true,
+      true,
+      true,
+      false,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      null
+    ]
+  },
+  "hash": "9309262d8a37827e5ab0b3534d1595cb6d94118432fd1770f1f89f7cb52a4f12"
+}
diff --git a/backend/.sqlx/query-932f7d0df4ab3e200b9eaea424f51756433c03af6e7810c2a5f9421515df8aa3.json b/backend/.sqlx/query-932f7d0df4ab3e200b9eaea424f51756433c03af6e7810c2a5f9421515df8aa3.json
new file mode 100644
index 0000000000..e2e3f374a6
--- /dev/null
+++ b/backend/.sqlx/query-932f7d0df4ab3e200b9eaea424f51756433c03af6e7810c2a5f9421515df8aa3.json
@@ -0,0 +1,29 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT created_by, on_behalf_of_email FROM script\n          WHERE path = $1 AND workspace_id = $2 AND archived = false AND deleted = false\n          ORDER BY created_at DESC LIMIT 1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "created_by",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "on_behalf_of_email",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      true
+    ]
+  },
+  "hash": "932f7d0df4ab3e200b9eaea424f51756433c03af6e7810c2a5f9421515df8aa3"
+}
diff --git a/backend/.sqlx/query-94c0aae349172b9295b81b9e61e2f8f0ca36920ab66e8922815157a0c147bc47.json b/backend/.sqlx/query-94c0aae349172b9295b81b9e61e2f8f0ca36920ab66e8922815157a0c147bc47.json
new file mode 100644
index 0000000000..823a65cda3
--- /dev/null
+++ b/backend/.sqlx/query-94c0aae349172b9295b81b9e61e2f8f0ca36920ab66e8922815157a0c147bc47.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO dbt_node (workspace_id, script_path, script_hash, job_id, unique_id,\n            resource_type, name, asset_path, materialized, materialize_strategy, unique_key,\n            tags, description, test_kind, test_column, test_args, severity, attached_node,\n            columns, freshness, raw_code, original_file_path, ingested_at)\n         SELECT $2, script_path, script_hash, job_id, unique_id,\n            resource_type, name, asset_path, materialized, materialize_strategy, unique_key,\n            tags, description, test_kind, test_column, test_args, severity, attached_node,\n            columns, freshness, raw_code, original_file_path, ingested_at\n         FROM dbt_node\n         WHERE workspace_id = $1 AND job_id = '00000000-0000-0000-0000-000000000000'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "94c0aae349172b9295b81b9e61e2f8f0ca36920ab66e8922815157a0c147bc47"
+}
diff --git a/backend/.sqlx/query-95c184a8f7d9396ed124bc1e2c3fddaeed002fe148f5d0434b41fda5d1203f27.json b/backend/.sqlx/query-95c184a8f7d9396ed124bc1e2c3fddaeed002fe148f5d0434b41fda5d1203f27.json
new file mode 100644
index 0000000000..0fc9445931
--- /dev/null
+++ b/backend/.sqlx/query-95c184a8f7d9396ed124bc1e2c3fddaeed002fe148f5d0434b41fda5d1203f27.json
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO script (workspace_id, path, hash, content, summary, description, language, created_by, created_at, on_behalf_of, on_behalf_of_email)\n         VALUES\n         ('test-workspace', 'u/test-user/obo_member', 91001, 'def main(): pass', '', '', 'python3', 'test-user', NOW(), 'u/test-user', 'test@windmill.dev'),\n         ('test-workspace', 'u/test-user/obo_stranger', 91002, 'def main(): pass', '', '', 'python3', 'test-user', NOW(), 'u/test-user-2', 'test2@windmill.dev'),\n         ('test-workspace', 'u/test-user/obo_group', 91003, 'def main(): pass', '', '', 'python3', 'test-user', NOW(), 'g/all', 'group-all@windmill.dev'),\n         ('test-workspace', 'u/test-user/obo_superadmin', 91004, 'def main(): pass', '', '', 'python3', 'test-user', NOW(), 'u/ext-sa', 'sa@windmill.dev')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "95c184a8f7d9396ed124bc1e2c3fddaeed002fe148f5d0434b41fda5d1203f27"
+}
diff --git a/backend/.sqlx/query-9621928b5736c56928368d17bd4111faeea6bfb54debbf8ee686db19364084fe.json b/backend/.sqlx/query-9621928b5736c56928368d17bd4111faeea6bfb54debbf8ee686db19364084fe.json
new file mode 100644
index 0000000000..6c4bced8ce
--- /dev/null
+++ b/backend/.sqlx/query-9621928b5736c56928368d17bd4111faeea6bfb54debbf8ee686db19364084fe.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT EXISTS(\n            SELECT 1 FROM usr WHERE workspace_id = $1 AND username = $2\n            UNION ALL\n            SELECT 1 FROM password WHERE email = $2 AND super_admin\n        )",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "exists",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "9621928b5736c56928368d17bd4111faeea6bfb54debbf8ee686db19364084fe"
+}
diff --git a/backend/.sqlx/query-96aa1db2859c80d37ffecc2885442ae6d6d4b6731c3f62e7b85ae7a4f1b666a7.json b/backend/.sqlx/query-96aa1db2859c80d37ffecc2885442ae6d6d4b6731c3f62e7b85ae7a4f1b666a7.json
new file mode 100644
index 0000000000..733478e0e9
--- /dev/null
+++ b/backend/.sqlx/query-96aa1db2859c80d37ffecc2885442ae6d6d4b6731c3f62e7b85ae7a4f1b666a7.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n    INSERT INTO script\n    (workspace_id, hash, path, parent_hashes, summary, description, content, created_by, schema, is_template, extra_perms, lock, language, kind, tag, envs, concurrent_limit, concurrency_time_window_s, cache_ttl, cache_ignore_s3_path, dedicated_worker, ws_error_handler_muted, priority, restart_unless_cancelled, delete_after_use, delete_after_secs, timeout, concurrency_key, visible_to_runner_only, auto_kind, codebase, has_preprocessor, on_behalf_of, on_behalf_of_email, schema_validation, assets, debounce_key, debounce_delay_s, runnable_settings_handle, modules, labels)\n\n    SELECT  workspace_id, $1, path, array_prepend($2::bigint, COALESCE(parent_hashes, '{}'::bigint[])), summary, description, content, created_by, schema, is_template, extra_perms, NULL, language, kind, tag, envs, concurrent_limit, concurrency_time_window_s, cache_ttl, cache_ignore_s3_path, dedicated_worker, ws_error_handler_muted, priority, restart_unless_cancelled, delete_after_use, delete_after_secs, timeout, concurrency_key, visible_to_runner_only, auto_kind, codebase, has_preprocessor, on_behalf_of, on_behalf_of_email, schema_validation, assets, debounce_key, debounce_delay_s, runnable_settings_handle, modules, labels\n\n    FROM script WHERE hash = $2 AND workspace_id = $3;\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Int8",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "96aa1db2859c80d37ffecc2885442ae6d6d4b6731c3f62e7b85ae7a4f1b666a7"
+}
diff --git a/backend/.sqlx/query-96ba9c55e1f3b6ec20ce4c21a72b12a4c8aa3dda05cceb694234107eb324cbf9.json b/backend/.sqlx/query-96ba9c55e1f3b6ec20ce4c21a72b12a4c8aa3dda05cceb694234107eb324cbf9.json
new file mode 100644
index 0000000000..5061c42c94
--- /dev/null
+++ b/backend/.sqlx/query-96ba9c55e1f3b6ec20ce4c21a72b12a4c8aa3dda05cceb694234107eb324cbf9.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM materialized_partition\n          WHERE workspace_id = $1 AND job_id = $2 AND status = 'running'\n            AND asset_path = ANY($3)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Uuid",
+        "TextArray"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "96ba9c55e1f3b6ec20ce4c21a72b12a4c8aa3dda05cceb694234107eb324cbf9"
+}
diff --git a/backend/.sqlx/query-972ee0dd58b98c1f0ff7242922e25b58b5ce504f2f4c4db952a796b3019a67d0.json b/backend/.sqlx/query-972ee0dd58b98c1f0ff7242922e25b58b5ce504f2f4c4db952a796b3019a67d0.json
new file mode 100644
index 0000000000..ec34b5f46a
--- /dev/null
+++ b/backend/.sqlx/query-972ee0dd58b98c1f0ff7242922e25b58b5ce504f2f4c4db952a796b3019a67d0.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM dbt_run_state WHERE workspace_id = $1 AND script_path = $2\n           AND NOT EXISTS (SELECT 1 FROM script\n                            WHERE workspace_id = $1 AND path = $2\n                              AND deleted = false AND archived = false)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "972ee0dd58b98c1f0ff7242922e25b58b5ce504f2f4c4db952a796b3019a67d0"
+}
diff --git a/backend/.sqlx/query-9809fad5552d306f8cf04dfd9059be14ec5518c6ba8572362f5a849657237294.json b/backend/.sqlx/query-9809fad5552d306f8cf04dfd9059be14ec5518c6ba8572362f5a849657237294.json
new file mode 100644
index 0000000000..42b8a2b09c
--- /dev/null
+++ b/backend/.sqlx/query-9809fad5552d306f8cf04dfd9059be14ec5518c6ba8572362f5a849657237294.json
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO dbt_node (workspace_id, script_path, script_hash, job_id, unique_id,\n                                 resource_type, name, tags, test_kind, test_column, test_args,\n                                 attached_node)\n           VALUES ($1, $2, $3, $4, 'test.p.accepted_values_orders_status', 'test',\n                   'accepted_values_orders_status', '{}', 'accepted_values', 'status',\n                   '{\"values\": [\"gold\", \"silver\"]}'::jsonb, 'model.p.orders')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Int8",
+        "Uuid"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "9809fad5552d306f8cf04dfd9059be14ec5518c6ba8572362f5a849657237294"
+}
diff --git a/backend/.sqlx/query-98206f64a4393791f679a609a5ee1a6bb6dae0bc091e2cbb2d583dd6a5b44941.json b/backend/.sqlx/query-98206f64a4393791f679a609a5ee1a6bb6dae0bc091e2cbb2d583dd6a5b44941.json
new file mode 100644
index 0000000000..5d1b35b17d
--- /dev/null
+++ b/backend/.sqlx/query-98206f64a4393791f679a609a5ee1a6bb6dae0bc091e2cbb2d583dd6a5b44941.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT files FROM workspace_shared_ui WHERE workspace_id = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "files",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "98206f64a4393791f679a609a5ee1a6bb6dae0bc091e2cbb2d583dd6a5b44941"
+}
diff --git a/backend/.sqlx/query-98500dd427fdc64e711090387e08543ae8dfa457c6db2d74ebdc0cd748d72ac3.json b/backend/.sqlx/query-98500dd427fdc64e711090387e08543ae8dfa457c6db2d74ebdc0cd748d72ac3.json
new file mode 100644
index 0000000000..46f6c9765e
--- /dev/null
+++ b/backend/.sqlx/query-98500dd427fdc64e711090387e08543ae8dfa457c6db2d74ebdc0cd748d72ac3.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE draft SET value = to_json(jsonb_set(to_jsonb(value), ARRAY['on_behalf_of'], to_jsonb($1::text))) WHERE typ IN ('script', 'flow') AND value->>'on_behalf_of' = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "98500dd427fdc64e711090387e08543ae8dfa457c6db2d74ebdc0cd748d72ac3"
+}
diff --git a/backend/.sqlx/query-9ac8b60c53631de2c3dab765ddc23cc99f9154e4239d228c0ef8f3726b0d19fc.json b/backend/.sqlx/query-9ac8b60c53631de2c3dab765ddc23cc99f9154e4239d228c0ef8f3726b0d19fc.json
new file mode 100644
index 0000000000..777aa0feb2
--- /dev/null
+++ b/backend/.sqlx/query-9ac8b60c53631de2c3dab765ddc23cc99f9154e4239d228c0ef8f3726b0d19fc.json
@@ -0,0 +1,31 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT g.job_id, g.ingested_at FROM dbt_graph_snapshot g\n                  WHERE g.workspace_id = $1 AND g.script_path = $2\n                    AND g.script_hash IS NOT DISTINCT FROM $3\n                    AND g.job_id = CASE WHEN EXISTS (\n                          SELECT 1 FROM dbt_graph_snapshot s\n                           WHERE s.workspace_id = $1 AND s.job_id = $4)\n                        THEN $4::uuid\n                        ELSE '00000000-0000-0000-0000-000000000000'::uuid END\n                  LIMIT 1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "job_id",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 1,
+        "name": "ingested_at",
+        "type_info": "Timestamptz"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Int8",
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      false,
+      false
+    ]
+  },
+  "hash": "9ac8b60c53631de2c3dab765ddc23cc99f9154e4239d228c0ef8f3726b0d19fc"
+}
diff --git a/backend/.sqlx/query-9be99f3104f595b0c7e73b67b120c2789ded855c69d5cd6e8b07c88710252ac5.json b/backend/.sqlx/query-9be99f3104f595b0c7e73b67b120c2789ded855c69d5cd6e8b07c88710252ac5.json
new file mode 100644
index 0000000000..fe90532de7
--- /dev/null
+++ b/backend/.sqlx/query-9be99f3104f595b0c7e73b67b120c2789ded855c69d5cd6e8b07c88710252ac5.json
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO draft(workspace_id, path, typ, value, email)\n         VALUES ('test-workspace', 'u/test-user/dg', 'script', '{\"on_behalf_of\": \"g/ops\", \"on_behalf_of_email\": \"group-ops@windmill.dev\"}'::json, 'test@windmill.dev'),\n                ('test-workspace', 'u/test-user/du', 'script', '{\"on_behalf_of\": \"u/test-user-2\", \"on_behalf_of_email\": \"group-ops@windmill.dev\"}'::json, 'test@windmill.dev')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "9be99f3104f595b0c7e73b67b120c2789ded855c69d5cd6e8b07c88710252ac5"
+}
diff --git a/backend/.sqlx/query-9cd98de055f34b86e98f6f1c060837644c813f45572896b42a55b4996cde1be8.json b/backend/.sqlx/query-9cd98de055f34b86e98f6f1c060837644c813f45572896b42a55b4996cde1be8.json
new file mode 100644
index 0000000000..6aa872bfd4
--- /dev/null
+++ b/backend/.sqlx/query-9cd98de055f34b86e98f6f1c060837644c813f45572896b42a55b4996cde1be8.json
@@ -0,0 +1,30 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE datatable_migrations SET datatable = $3 WHERE workspace_id = $1 AND datatable = $2 RETURNING timestamp, name",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "timestamp",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "name",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Varchar"
+      ]
+    },
+    "nullable": [
+      false,
+      false
+    ]
+  },
+  "hash": "9cd98de055f34b86e98f6f1c060837644c813f45572896b42a55b4996cde1be8"
+}
diff --git a/backend/.sqlx/query-b3771b690c5966272b1f42c9965bb6a8f961c119516e4c33dc928cd3b4f4edbc.json b/backend/.sqlx/query-9d331b63c901071a7e82c0a4a6859c77a37ef784fdac78ca1e7a971e141e780f.json
similarity index 88%
rename from backend/.sqlx/query-b3771b690c5966272b1f42c9965bb6a8f961c119516e4c33dc928cd3b4f4edbc.json
rename to backend/.sqlx/query-9d331b63c901071a7e82c0a4a6859c77a37ef784fdac78ca1e7a971e141e780f.json
index 3bbd0f043e..b73ee34566 100644
--- a/backend/.sqlx/query-b3771b690c5966272b1f42c9965bb6a8f961c119516e4c33dc928cd3b4f4edbc.json
+++ b/backend/.sqlx/query-9d331b63c901071a7e82c0a4a6859c77a37ef784fdac78ca1e7a971e141e780f.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT\n                id,\n                q.runnable_settings_handle,\n                q.workspace_id,\n                j.runnable_id as \"runnable_id: ScriptHash\",\n                scheduled_for,\n                parent_job,\n                flow_innermost_root_job,\n                runnable_path,\n                kind as \"kind: JobKind\",\n                started_at,\n                permissioned_as,\n                created_by,\n                script_lang as \"script_lang: ScriptLang\",\n                permissioned_as_email,\n                flow_step_id,\n                trigger_kind as \"trigger_kind: JobTriggerKind\",\n                trigger,\n                q.priority,\n                concurrent_limit,\n                q.tag,\n                cache_ttl,\n                cache_ignore_s3_path,\n                r.ping as last_ping,\n                worker,\n                memory_peak,\n                running\n            FROM v2_job_queue q\n                JOIN v2_job j USING (id)\n                LEFT JOIN v2_job_runtime r USING (id)\n                LEFT JOIN v2_job_status s USING (id)\n            WHERE j.id = $1",
+  "query": "SELECT\n                id,\n                q.runnable_settings_handle,\n                q.workspace_id,\n                j.runnable_id as \"runnable_id: ScriptHash\",\n                scheduled_for,\n                parent_job,\n                flow_innermost_root_job,\n                runnable_path,\n                kind as \"kind: JobKind\",\n                started_at,\n                permissioned_as,\n                created_by,\n                script_lang as \"script_lang: ScriptLang\",\n                permissioned_as_email,\n                flow_step_id,\n                trigger_kind as \"trigger_kind: TriggerKindLabel\",\n                trigger,\n                q.priority,\n                concurrent_limit,\n                q.tag,\n                cache_ttl,\n                cache_ignore_s3_path,\n                r.ping as last_ping,\n                worker,\n                memory_peak,\n                running\n            FROM v2_job_queue q\n                JOIN v2_job j USING (id)\n                LEFT JOIN v2_job_runtime r USING (id)\n                LEFT JOIN v2_job_status s USING (id)\n            WHERE j.id = $1",
   "describe": {
     "columns": [
       {
@@ -124,7 +124,8 @@
                 "java",
                 "duckdb",
                 "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
               ]
             }
           }
@@ -142,7 +143,7 @@
       },
       {
         "ordinal": 15,
-        "name": "trigger_kind: JobTriggerKind",
+        "name": "trigger_kind: TriggerKindLabel",
         "type_info": {
           "Custom": {
             "name": "job_trigger_kind",
@@ -259,5 +260,5 @@
       false
     ]
   },
-  "hash": "b3771b690c5966272b1f42c9965bb6a8f961c119516e4c33dc928cd3b4f4edbc"
+  "hash": "9d331b63c901071a7e82c0a4a6859c77a37ef784fdac78ca1e7a971e141e780f"
 }
diff --git a/backend/.sqlx/query-9ecd7eee162905fc55ae4f641c1a2095c02f020a0c8ee47e0b4dbc357ced6fd2.json b/backend/.sqlx/query-9ecd7eee162905fc55ae4f641c1a2095c02f020a0c8ee47e0b4dbc357ced6fd2.json
new file mode 100644
index 0000000000..5555235da8
--- /dev/null
+++ b/backend/.sqlx/query-9ecd7eee162905fc55ae4f641c1a2095c02f020a0c8ee47e0b4dbc357ced6fd2.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM resource_version rv\n         USING (\n             SELECT id FROM (\n                 SELECT id, row_number() OVER (\n                     PARTITION BY workspace_id, path ORDER BY id DESC\n                 ) AS rn\n                 FROM resource_version\n             ) ranked WHERE rn > $1\n         ) over_cap\n         WHERE rv.id = over_cap.id\n         RETURNING rv.id",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "9ecd7eee162905fc55ae4f641c1a2095c02f020a0c8ee47e0b4dbc357ced6fd2"
+}
diff --git a/backend/.sqlx/query-9f4a95c35fe740d7f47db99335fe8a43b1df30076d6b487bdb6f762892bbec76.json b/backend/.sqlx/query-9f4a95c35fe740d7f47db99335fe8a43b1df30076d6b487bdb6f762892bbec76.json
new file mode 100644
index 0000000000..721eeee984
--- /dev/null
+++ b/backend/.sqlx/query-9f4a95c35fe740d7f47db99335fe8a43b1df30076d6b487bdb6f762892bbec76.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE script SET on_behalf_of_email = $1 WHERE on_behalf_of_email = $2 AND (on_behalf_of IS NULL OR on_behalf_of NOT LIKE 'g/%')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "9f4a95c35fe740d7f47db99335fe8a43b1df30076d6b487bdb6f762892bbec76"
+}
diff --git a/backend/.sqlx/query-a0ef88bd0ec4823e4c8a226a790cf572fbf901326e80806bb6dcaa953f7b7b60.json b/backend/.sqlx/query-a0ef88bd0ec4823e4c8a226a790cf572fbf901326e80806bb6dcaa953f7b7b60.json
new file mode 100644
index 0000000000..6097dab23e
--- /dev/null
+++ b/backend/.sqlx/query-a0ef88bd0ec4823e4c8a226a790cf572fbf901326e80806bb6dcaa953f7b7b60.json
@@ -0,0 +1,53 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        SELECT service_config, webhook_token_hash, script_path, is_flow\n        FROM native_trigger\n        WHERE workspace_id = $1\n          AND service_name = $2\n          AND external_id = $3\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "service_config",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 1,
+        "name": "webhook_token_hash",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "script_path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 3,
+        "name": "is_flow",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        {
+          "Custom": {
+            "name": "native_trigger_service",
+            "kind": {
+              "Enum": [
+                "nextcloud",
+                "google",
+                "github"
+              ]
+            }
+          }
+        },
+        "Text"
+      ]
+    },
+    "nullable": [
+      true,
+      false,
+      false,
+      false
+    ]
+  },
+  "hash": "a0ef88bd0ec4823e4c8a226a790cf572fbf901326e80806bb6dcaa953f7b7b60"
+}
diff --git a/backend/.sqlx/query-a2b8356365a2e5e0efa5f851b2aa2d74a2f14a57ce8292f44b8fb482c7a07e2e.json b/backend/.sqlx/query-a2b8356365a2e5e0efa5f851b2aa2d74a2f14a57ce8292f44b8fb482c7a07e2e.json
new file mode 100644
index 0000000000..b69ccb6cde
--- /dev/null
+++ b/backend/.sqlx/query-a2b8356365a2e5e0efa5f851b2aa2d74a2f14a57ce8292f44b8fb482c7a07e2e.json
@@ -0,0 +1,78 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n                                SELECT\n                                    flow_version.id AS version,\n                                    flow_version.value->>'early_return' as early_return,\n                                    flow_version.value->>'preprocessor_module' IS NOT NULL as has_preprocessor,\n                                    flow_version.value->>'failure_module' IS NOT NULL as has_failure_module,\n                                    (flow_version.value->>'chat_input_enabled')::boolean as chat_input_enabled,\n                                    flow.tag,\n                                    flow.dedicated_worker,\n                                    flow.on_behalf_of,\n                                    flow.edited_by,\n                                    flow.labels\n                                FROM\n                                    flow_version\n                                INNER JOIN flow\n                                    ON flow.path = flow_version.path AND\n                                       flow.workspace_id = flow_version.workspace_id\n                                WHERE\n                                    flow_version.workspace_id = $1 AND\n                                    flow_version.path = $2 AND\n                                    flow_version.id = $3\n                            ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "version",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "early_return",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 2,
+        "name": "has_preprocessor",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 3,
+        "name": "has_failure_module",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 4,
+        "name": "chat_input_enabled",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 5,
+        "name": "tag",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 6,
+        "name": "dedicated_worker",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 7,
+        "name": "on_behalf_of",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 8,
+        "name": "edited_by",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 9,
+        "name": "labels",
+        "type_info": "TextArray"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false,
+      null,
+      null,
+      null,
+      null,
+      true,
+      true,
+      true,
+      false,
+      true
+    ]
+  },
+  "hash": "a2b8356365a2e5e0efa5f851b2aa2d74a2f14a57ce8292f44b8fb482c7a07e2e"
+}
diff --git a/backend/.sqlx/query-a4651f0ec5daaa0cbf09a71a7da9e16ea112e0a3855cc730d2fe99259c64eb41.json b/backend/.sqlx/query-a4651f0ec5daaa0cbf09a71a7da9e16ea112e0a3855cc730d2fe99259c64eb41.json
new file mode 100644
index 0000000000..de91a548ad
--- /dev/null
+++ b/backend/.sqlx/query-a4651f0ec5daaa0cbf09a71a7da9e16ea112e0a3855cc730d2fe99259c64eb41.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT envs FROM script WHERE workspace_id = $1 AND hash = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "envs",
+        "type_info": "VarcharArray"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Int8"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "a4651f0ec5daaa0cbf09a71a7da9e16ea112e0a3855cc730d2fe99259c64eb41"
+}
diff --git a/backend/.sqlx/query-a4b6371d33206010b2f3ffd2b09e33244fe8ab9a803248fc23f334034d24aad4.json b/backend/.sqlx/query-a4b6371d33206010b2f3ffd2b09e33244fe8ab9a803248fc23f334034d24aad4.json
index 4824bba526..2b9ac8283b 100644
--- a/backend/.sqlx/query-a4b6371d33206010b2f3ffd2b09e33244fe8ab9a803248fc23f334034d24aad4.json
+++ b/backend/.sqlx/query-a4b6371d33206010b2f3ffd2b09e33244fe8ab9a803248fc23f334034d24aad4.json
@@ -134,7 +134,8 @@
                 "java",
                 "duckdb",
                 "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-a606d8fc5876ef1e40278120d841994b8ec76d2008bcf749fcdcc607368bcdc3.json b/backend/.sqlx/query-a606d8fc5876ef1e40278120d841994b8ec76d2008bcf749fcdcc607368bcdc3.json
new file mode 100644
index 0000000000..998563293a
--- /dev/null
+++ b/backend/.sqlx/query-a606d8fc5876ef1e40278120d841994b8ec76d2008bcf749fcdcc607368bcdc3.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO flow\n            (workspace_id, path, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at)\n        SELECT workspace_id, REGEXP_REPLACE(path,'u/' || $2 || '/(.*)','u/' || $1 || '/\\1'), summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at\n            FROM flow\n            WHERE path LIKE ('u/' || $2 || '/%') AND workspace_id = $3",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "a606d8fc5876ef1e40278120d841994b8ec76d2008bcf749fcdcc607368bcdc3"
+}
diff --git a/backend/.sqlx/query-a6decdebcd9750691f20f874b66a9c6f2ede08c33605c6a3c3dfc213a3eda76a.json b/backend/.sqlx/query-a6decdebcd9750691f20f874b66a9c6f2ede08c33605c6a3c3dfc213a3eda76a.json
new file mode 100644
index 0000000000..0532a5d3a0
--- /dev/null
+++ b/backend/.sqlx/query-a6decdebcd9750691f20f874b66a9c6f2ede08c33605c6a3c3dfc213a3eda76a.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        UPDATE workspace_settings\n        SET\n            ai_config = source_ws.ai_config,\n            large_file_storage = source_ws.large_file_storage,\n            ducklake = source_ws.ducklake,\n            dbt_warehouses = source_ws.dbt_warehouses,\n            datatable = source_ws.datatable,\n            git_app_installations = source_ws.git_app_installations\n        FROM workspace_settings source_ws\n        WHERE source_ws.workspace_id = $1\n        AND workspace_settings.workspace_id = $2\n        ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "a6decdebcd9750691f20f874b66a9c6f2ede08c33605c6a3c3dfc213a3eda76a"
+}
diff --git a/backend/.sqlx/query-a6f59e8751b79d23fcd2a8204fbc38002fc6d0cf7e4a83f21d31fb28bd98efb8.json b/backend/.sqlx/query-a6f59e8751b79d23fcd2a8204fbc38002fc6d0cf7e4a83f21d31fb28bd98efb8.json
new file mode 100644
index 0000000000..e7a544525f
--- /dev/null
+++ b/backend/.sqlx/query-a6f59e8751b79d23fcd2a8204fbc38002fc6d0cf7e4a83f21d31fb28bd98efb8.json
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO app(workspace_id, path, summary, policy, versions)\n         VALUES ('test-workspace', 'u/test-user/g', '', '{\"on_behalf_of\": \"g/ops\", \"on_behalf_of_email\": \"group-ops@windmill.dev\"}'::jsonb, '{}'),\n                ('test-workspace', 'u/test-user/u', '', '{\"on_behalf_of\": \"u/test-user-2\", \"on_behalf_of_email\": \"group-ops@windmill.dev\"}'::jsonb, '{}')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "a6f59e8751b79d23fcd2a8204fbc38002fc6d0cf7e4a83f21d31fb28bd98efb8"
+}
diff --git a/backend/.sqlx/query-a8bcae108af1eda6efe3a4b8c6f8807bc464a81c0883e68f5a69b89b94b0b34b.json b/backend/.sqlx/query-a8bcae108af1eda6efe3a4b8c6f8807bc464a81c0883e68f5a69b89b94b0b34b.json
index 0d1bb6cb41..0faa9d0e33 100644
--- a/backend/.sqlx/query-a8bcae108af1eda6efe3a4b8c6f8807bc464a81c0883e68f5a69b89b94b0b34b.json
+++ b/backend/.sqlx/query-a8bcae108af1eda6efe3a4b8c6f8807bc464a81c0883e68f5a69b89b94b0b34b.json
@@ -39,7 +39,8 @@
                 "java",
                 "duckdb",
                 "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-a8eb013bbbb4d8cdc0d4e5e3f46e805e039e57ef9f7be07d2e738d6628e585d5.json b/backend/.sqlx/query-a8eb013bbbb4d8cdc0d4e5e3f46e805e039e57ef9f7be07d2e738d6628e585d5.json
new file mode 100644
index 0000000000..4419bf7a6d
--- /dev/null
+++ b/backend/.sqlx/query-a8eb013bbbb4d8cdc0d4e5e3f46e805e039e57ef9f7be07d2e738d6628e585d5.json
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE draft SET value = to_json(jsonb_set(jsonb_set(to_jsonb(value), ARRAY['on_behalf_of'], to_jsonb($1::text)), ARRAY['on_behalf_of_email'], to_jsonb($4::text))) WHERE typ IN ('script', 'flow') AND value->>'on_behalf_of' = $2 AND workspace_id = $3",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "a8eb013bbbb4d8cdc0d4e5e3f46e805e039e57ef9f7be07d2e738d6628e585d5"
+}
diff --git a/backend/.sqlx/query-aa463baab01d9530ae97ace8b5a296ce9855bce50ea8c5918941564a696c029c.json b/backend/.sqlx/query-aa463baab01d9530ae97ace8b5a296ce9855bce50ea8c5918941564a696c029c.json
new file mode 100644
index 0000000000..e417d1e948
--- /dev/null
+++ b/backend/.sqlx/query-aa463baab01d9530ae97ace8b5a296ce9855bce50ea8c5918941564a696c029c.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO folder (workspace_id, name, display_name, owners, extra_perms)\n         VALUES ($1, 'private', 'private', '{}', '{}')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "aa463baab01d9530ae97ace8b5a296ce9855bce50ea8c5918941564a696c029c"
+}
diff --git a/backend/.sqlx/query-ab18d8765d6795eaa8035a8ac902790ff61549c5dd76e5b5cfb14b110a98abf2.json b/backend/.sqlx/query-ab18d8765d6795eaa8035a8ac902790ff61549c5dd76e5b5cfb14b110a98abf2.json
index 04131f8f88..0bba0710e8 100644
--- a/backend/.sqlx/query-ab18d8765d6795eaa8035a8ac902790ff61549c5dd76e5b5cfb14b110a98abf2.json
+++ b/backend/.sqlx/query-ab18d8765d6795eaa8035a8ac902790ff61549c5dd76e5b5cfb14b110a98abf2.json
@@ -16,7 +16,8 @@
                 "variable",
                 "ducklake",
                 "datatable",
-                "volume"
+                "volume",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-ab46ac8e14a05a79340511ad081f9f540139e1f593ac6f80221378ff856954cb.json b/backend/.sqlx/query-ab46ac8e14a05a79340511ad081f9f540139e1f593ac6f80221378ff856954cb.json
new file mode 100644
index 0000000000..6ed6813681
--- /dev/null
+++ b/backend/.sqlx/query-ab46ac8e14a05a79340511ad081f9f540139e1f593ac6f80221378ff856954cb.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO flow\n                (workspace_id, path, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, labels)\n            SELECT workspace_id, $1, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, labels\n                FROM flow\n                WHERE path = $2 AND workspace_id = $3",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "ab46ac8e14a05a79340511ad081f9f540139e1f593ac6f80221378ff856954cb"
+}
diff --git a/backend/.sqlx/query-ab906821072ddaa6303c5ea632150b5db1bf5a11d7a162130ebb826178c4ea08.json b/backend/.sqlx/query-ab906821072ddaa6303c5ea632150b5db1bf5a11d7a162130ebb826178c4ea08.json
new file mode 100644
index 0000000000..f6598ded42
--- /dev/null
+++ b/backend/.sqlx/query-ab906821072ddaa6303c5ea632150b5db1bf5a11d7a162130ebb826178c4ea08.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT id FROM workspace\n         WHERE parent_workspace_id = $1 AND is_dev_workspace AND NOT deleted",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "ab906821072ddaa6303c5ea632150b5db1bf5a11d7a162130ebb826178c4ea08"
+}
diff --git a/backend/.sqlx/query-aba0caddc216e218225d41cc3e14db0d8013ca448ca469f1c8c90965a514a8fb.json b/backend/.sqlx/query-aba0caddc216e218225d41cc3e14db0d8013ca448ca469f1c8c90965a514a8fb.json
new file mode 100644
index 0000000000..f344bf3795
--- /dev/null
+++ b/backend/.sqlx/query-aba0caddc216e218225d41cc3e14db0d8013ca448ca469f1c8c90965a514a8fb.json
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff\n         (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes, exists_in_source, exists_in_fork)\n         VALUES ('test-workspace', 'wm-fork-test-workspace', 'f/rt/parent_only', 'http_trigger', 1, 0, true, true, false)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "aba0caddc216e218225d41cc3e14db0d8013ca448ca469f1c8c90965a514a8fb"
+}
diff --git a/backend/.sqlx/query-ac113ee13ac2b6e8da5ebb6bf9f8207e1b46ba34fcb0f6957caef4be49bbbaa9.json b/backend/.sqlx/query-ac113ee13ac2b6e8da5ebb6bf9f8207e1b46ba34fcb0f6957caef4be49bbbaa9.json
new file mode 100644
index 0000000000..52ebcb5422
--- /dev/null
+++ b/backend/.sqlx/query-ac113ee13ac2b6e8da5ebb6bf9f8207e1b46ba34fcb0f6957caef4be49bbbaa9.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT hash FROM script WHERE workspace_id = $1 AND path = $2 AND deleted = false AND archived = false ORDER BY created_at DESC LIMIT 1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "hash",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "ac113ee13ac2b6e8da5ebb6bf9f8207e1b46ba34fcb0f6957caef4be49bbbaa9"
+}
diff --git a/backend/.sqlx/query-ad4a4e651ac84847554ce66bd6b04650df33cd4e57069a0194625cdc83f4c8eb.json b/backend/.sqlx/query-ad4a4e651ac84847554ce66bd6b04650df33cd4e57069a0194625cdc83f4c8eb.json
new file mode 100644
index 0000000000..e660c17021
--- /dev/null
+++ b/backend/.sqlx/query-ad4a4e651ac84847554ce66bd6b04650df33cd4e57069a0194625cdc83f4c8eb.json
@@ -0,0 +1,32 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT ahead, fork_last_event_kind, fork_last_event_origin FROM workspace_diff\n             WHERE fork_workspace_id = 'wm-fork-deferred' AND kind = 'flow'\n               AND path = 'u/admin/moved_by_user'",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "ahead",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 1,
+        "name": "fork_last_event_kind",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "fork_last_event_origin",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      false,
+      true,
+      true
+    ]
+  },
+  "hash": "ad4a4e651ac84847554ce66bd6b04650df33cd4e57069a0194625cdc83f4c8eb"
+}
diff --git a/backend/.sqlx/query-ad943dcd77732868fb79fa7d6330fe3f297f5701e7ef8e3d6377a921d08360f9.json b/backend/.sqlx/query-ad943dcd77732868fb79fa7d6330fe3f297f5701e7ef8e3d6377a921d08360f9.json
new file mode 100644
index 0000000000..6641a69ea2
--- /dev/null
+++ b/backend/.sqlx/query-ad943dcd77732868fb79fa7d6330fe3f297f5701e7ef8e3d6377a921d08360f9.json
@@ -0,0 +1,30 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT email, username FROM password\n         WHERE disabled IS false\n           AND (email ILIKE $2 OR username ILIKE $2)\n           AND NOT EXISTS (SELECT 1 FROM usr WHERE usr.workspace_id = $1 AND usr.email = password.email)\n         ORDER BY email\n         LIMIT $3",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "email",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "username",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false,
+      true
+    ]
+  },
+  "hash": "ad943dcd77732868fb79fa7d6330fe3f297f5701e7ef8e3d6377a921d08360f9"
+}
diff --git a/backend/.sqlx/query-adbe6ce27d46ba0d2d3ce87d875f60c179e5bccc54a36c8d5dcf04fd84445309.json b/backend/.sqlx/query-adbe6ce27d46ba0d2d3ce87d875f60c179e5bccc54a36c8d5dcf04fd84445309.json
new file mode 100644
index 0000000000..04ef8a7d24
--- /dev/null
+++ b/backend/.sqlx/query-adbe6ce27d46ba0d2d3ce87d875f60c179e5bccc54a36c8d5dcf04fd84445309.json
@@ -0,0 +1,19 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            UPDATE workspace_protection_rule\n            SET name = $1, rules = $2, bypass_groups = $3, bypass_users = $4\n            WHERE workspace_id = $5 AND name = $6\n        ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Int4",
+        "TextArray",
+        "TextArray",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "adbe6ce27d46ba0d2d3ce87d875f60c179e5bccc54a36c8d5dcf04fd84445309"
+}
diff --git a/backend/.sqlx/query-af2f8c70ad5a14d35048211631b250879d18751a53597ef262b63d1e29bcb6a7.json b/backend/.sqlx/query-af2f8c70ad5a14d35048211631b250879d18751a53597ef262b63d1e29bcb6a7.json
new file mode 100644
index 0000000000..f8129440a8
--- /dev/null
+++ b/backend/.sqlx/query-af2f8c70ad5a14d35048211631b250879d18751a53597ef262b63d1e29bcb6a7.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE dbt_run_state SET workspace_id = $1\n         WHERE workspace_id = $2 AND job_id IN (SELECT id FROM v2_job WHERE workspace_id = $1)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "af2f8c70ad5a14d35048211631b250879d18751a53597ef262b63d1e29bcb6a7"
+}
diff --git a/backend/.sqlx/query-b085fff6f34149a53bff05c9aa75e3d30bd900eb2e1064c209846918c388a2a1.json b/backend/.sqlx/query-b085fff6f34149a53bff05c9aa75e3d30bd900eb2e1064c209846918c388a2a1.json
new file mode 100644
index 0000000000..ebe190ebc1
--- /dev/null
+++ b/backend/.sqlx/query-b085fff6f34149a53bff05c9aa75e3d30bd900eb2e1064c209846918c388a2a1.json
@@ -0,0 +1,24 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT EXISTS(SELECT 1 FROM datatable_migrations WHERE workspace_id = $1 AND datatable = $2 AND timestamp = $3)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "exists",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Int8"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "b085fff6f34149a53bff05c9aa75e3d30bd900eb2e1064c209846918c388a2a1"
+}
diff --git a/backend/.sqlx/query-b0a7963de04faccae3262823dc98f2faa8ef6ead3f797a49be9f5b075bad1490.json b/backend/.sqlx/query-b0a7963de04faccae3262823dc98f2faa8ef6ead3f797a49be9f5b075bad1490.json
new file mode 100644
index 0000000000..b825e2146e
--- /dev/null
+++ b/backend/.sqlx/query-b0a7963de04faccae3262823dc98f2faa8ef6ead3f797a49be9f5b075bad1490.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH RECURSIVE chain AS (\n               SELECT id, parent_workspace_id, 0 AS depth FROM workspace WHERE id = $1\n               UNION ALL\n               SELECT w.id, w.parent_workspace_id, chain.depth + 1 FROM workspace w\n               JOIN chain ON w.id = chain.parent_workspace_id\n               WHERE chain.depth < 20\n           )\n           SELECT EXISTS(SELECT 1 FROM chain WHERE id = $2) AS \"cycle!\"",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "cycle!",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "b0a7963de04faccae3262823dc98f2faa8ef6ead3f797a49be9f5b075bad1490"
+}
diff --git a/backend/.sqlx/query-b19f5156b3e36b5e831ce792637bf54a3f182c03cef0aef06a1c75b45992cd39.json b/backend/.sqlx/query-b19f5156b3e36b5e831ce792637bf54a3f182c03cef0aef06a1c75b45992cd39.json
new file mode 100644
index 0000000000..10adc6e68d
--- /dev/null
+++ b/backend/.sqlx/query-b19f5156b3e36b5e831ce792637bf54a3f182c03cef0aef06a1c75b45992cd39.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT count(*) FROM dbt_edge WHERE workspace_id = $1 AND script_hash = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "count",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Int8"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "b19f5156b3e36b5e831ce792637bf54a3f182c03cef0aef06a1c75b45992cd39"
+}
diff --git a/backend/.sqlx/query-b23784ed2737c01aaf05efe42bcdcfc9579aa203005ead60322fb71fd33b15b0.json b/backend/.sqlx/query-b23784ed2737c01aaf05efe42bcdcfc9579aa203005ead60322fb71fd33b15b0.json
index 1f21f33ce2..806b923acb 100644
--- a/backend/.sqlx/query-b23784ed2737c01aaf05efe42bcdcfc9579aa203005ead60322fb71fd33b15b0.json
+++ b/backend/.sqlx/query-b23784ed2737c01aaf05efe42bcdcfc9579aa203005ead60322fb71fd33b15b0.json
@@ -154,7 +154,8 @@
                 "java",
                 "duckdb",
                 "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-b24c1ed9aa3b856eed3da73eadb99a11874d6680f584324827f0ae59bb9fe506.json b/backend/.sqlx/query-b24c1ed9aa3b856eed3da73eadb99a11874d6680f584324827f0ae59bb9fe506.json
new file mode 100644
index 0000000000..e29c1c0dbb
--- /dev/null
+++ b/backend/.sqlx/query-b24c1ed9aa3b856eed3da73eadb99a11874d6680f584324827f0ae59bb9fe506.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM dbt_graph_snapshot\n          WHERE workspace_id = $1 AND script_path = $2 AND script_hash = $3",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "b24c1ed9aa3b856eed3da73eadb99a11874d6680f584324827f0ae59bb9fe506"
+}
diff --git a/backend/.sqlx/query-b2dd773eebe0005eb4220f19e6a01aa9d12e461a89243bd0b651d1e5b837b6f4.json b/backend/.sqlx/query-b2dd773eebe0005eb4220f19e6a01aa9d12e461a89243bd0b651d1e5b837b6f4.json
new file mode 100644
index 0000000000..b865865c1d
--- /dev/null
+++ b/backend/.sqlx/query-b2dd773eebe0005eb4220f19e6a01aa9d12e461a89243bd0b651d1e5b837b6f4.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM dbt_run_state\n                  WHERE workspace_id = $1 AND script_path = $2 AND permissioned_as = $3",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "b2dd773eebe0005eb4220f19e6a01aa9d12e461a89243bd0b651d1e5b837b6f4"
+}
diff --git a/backend/.sqlx/query-b44afcf1b9c047ac525638f0952c2cb01d65b1b46693331ac157dfca0dab6824.json b/backend/.sqlx/query-b44afcf1b9c047ac525638f0952c2cb01d65b1b46693331ac157dfca0dab6824.json
index eab78c7de8..9187cc29b7 100644
--- a/backend/.sqlx/query-b44afcf1b9c047ac525638f0952c2cb01d65b1b46693331ac157dfca0dab6824.json
+++ b/backend/.sqlx/query-b44afcf1b9c047ac525638f0952c2cb01d65b1b46693331ac157dfca0dab6824.json
@@ -44,7 +44,8 @@
                 "java",
                 "duckdb",
                 "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-b546a7a68143a3b0de1d900e5f635b8a1e4d1ba18298ace1602defacb9e67f0c.json b/backend/.sqlx/query-b546a7a68143a3b0de1d900e5f635b8a1e4d1ba18298ace1602defacb9e67f0c.json
new file mode 100644
index 0000000000..3aaa58da40
--- /dev/null
+++ b/backend/.sqlx/query-b546a7a68143a3b0de1d900e5f635b8a1e4d1ba18298ace1602defacb9e67f0c.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE dbt_run_state SET script_path = $3 WHERE workspace_id = $1 AND script_path = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "b546a7a68143a3b0de1d900e5f635b8a1e4d1ba18298ace1602defacb9e67f0c"
+}
diff --git a/backend/.sqlx/query-b6303603bebdcf6d5bad2006ce65fe7900e33a843711934799b7259d1c451da6.json b/backend/.sqlx/query-b6303603bebdcf6d5bad2006ce65fe7900e33a843711934799b7259d1c451da6.json
new file mode 100644
index 0000000000..218cf8252f
--- /dev/null
+++ b/backend/.sqlx/query-b6303603bebdcf6d5bad2006ce65fe7900e33a843711934799b7259d1c451da6.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE script SET on_behalf_of = $1 WHERE on_behalf_of = $2 AND workspace_id = $3",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "b6303603bebdcf6d5bad2006ce65fe7900e33a843711934799b7259d1c451da6"
+}
diff --git a/backend/.sqlx/query-b6f0ebbe674e1290afda7b5bed3b463f1d73d66b5924734274272509c98573db.json b/backend/.sqlx/query-b6f0ebbe674e1290afda7b5bed3b463f1d73d66b5924734274272509c98573db.json
new file mode 100644
index 0000000000..74d2a57de7
--- /dev/null
+++ b/backend/.sqlx/query-b6f0ebbe674e1290afda7b5bed3b463f1d73d66b5924734274272509c98573db.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO app (workspace_id, path, summary, policy, versions)\n         VALUES ($1, $2, '', '{}'::jsonb, '{}') RETURNING 1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "?column?",
+        "type_info": "Int4"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "b6f0ebbe674e1290afda7b5bed3b463f1d73d66b5924734274272509c98573db"
+}
diff --git a/backend/.sqlx/query-b9686c115e83ad0725503e2c076960914f825eaa2b44281a4e147cea6e886e7a.json b/backend/.sqlx/query-b9686c115e83ad0725503e2c076960914f825eaa2b44281a4e147cea6e886e7a.json
new file mode 100644
index 0000000000..ebb5cee72c
--- /dev/null
+++ b/backend/.sqlx/query-b9686c115e83ad0725503e2c076960914f825eaa2b44281a4e147cea6e886e7a.json
@@ -0,0 +1,34 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM native_trigger WHERE workspace_id = $1 AND service_name = $2 RETURNING webhook_token_hash",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "webhook_token_hash",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        {
+          "Custom": {
+            "name": "native_trigger_service",
+            "kind": {
+              "Enum": [
+                "nextcloud",
+                "google",
+                "github"
+              ]
+            }
+          }
+        }
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "b9686c115e83ad0725503e2c076960914f825eaa2b44281a4e147cea6e886e7a"
+}
diff --git a/backend/.sqlx/query-bc59b7d863fc9df10cddf7487d6c2a3bd3ca8334f6cb5eaf42e14265a32ae472.json b/backend/.sqlx/query-bc59b7d863fc9df10cddf7487d6c2a3bd3ca8334f6cb5eaf42e14265a32ae472.json
new file mode 100644
index 0000000000..09367d07d3
--- /dev/null
+++ b/backend/.sqlx/query-bc59b7d863fc9df10cddf7487d6c2a3bd3ca8334f6cb5eaf42e14265a32ae472.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE dbt_run_progress SET workspace_id = $1 WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "bc59b7d863fc9df10cddf7487d6c2a3bd3ca8334f6cb5eaf42e14265a32ae472"
+}
diff --git a/backend/.sqlx/query-bc75df084b33779868317fe5c1d09bc8f1e01228aeb60fb1cdc034b4422888e0.json b/backend/.sqlx/query-bc75df084b33779868317fe5c1d09bc8f1e01228aeb60fb1cdc034b4422888e0.json
new file mode 100644
index 0000000000..a245f1868f
--- /dev/null
+++ b/backend/.sqlx/query-bc75df084b33779868317fe5c1d09bc8f1e01228aeb60fb1cdc034b4422888e0.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE flow SET on_behalf_of_email = $1 WHERE on_behalf_of_email = $2 AND (on_behalf_of IS NULL OR on_behalf_of NOT LIKE 'g/%')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "bc75df084b33779868317fe5c1d09bc8f1e01228aeb60fb1cdc034b4422888e0"
+}
diff --git a/backend/.sqlx/query-bd293b1e468f70dcc21ab4a91eb5225058fb14d29a8a4de04fe161af0ff2d167.json b/backend/.sqlx/query-bd293b1e468f70dcc21ab4a91eb5225058fb14d29a8a4de04fe161af0ff2d167.json
new file mode 100644
index 0000000000..501a8460a1
--- /dev/null
+++ b/backend/.sqlx/query-bd293b1e468f70dcc21ab4a91eb5225058fb14d29a8a4de04fe161af0ff2d167.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM dbt_run_state\n              WHERE workspace_id = $1 AND script_path = $2 AND permissioned_as = $3",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "bd293b1e468f70dcc21ab4a91eb5225058fb14d29a8a4de04fe161af0ff2d167"
+}
diff --git a/backend/.sqlx/query-bdb53068a223c12c2d317635993e8fda531e69a880d0ebc44fb5f13ac976b67d.json b/backend/.sqlx/query-bdb53068a223c12c2d317635993e8fda531e69a880d0ebc44fb5f13ac976b67d.json
index 2e194c9580..be50a16b17 100644
--- a/backend/.sqlx/query-bdb53068a223c12c2d317635993e8fda531e69a880d0ebc44fb5f13ac976b67d.json
+++ b/backend/.sqlx/query-bdb53068a223c12c2d317635993e8fda531e69a880d0ebc44fb5f13ac976b67d.json
@@ -41,7 +41,8 @@
                 "java",
                 "duckdb",
                 "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-be6d2c92a62b7b284651c45af809746147aa9b8d0a81642a7b7cb4738a0cad66.json b/backend/.sqlx/query-be6d2c92a62b7b284651c45af809746147aa9b8d0a81642a7b7cb4738a0cad66.json
index 809deb1a55..32e4c5404e 100644
--- a/backend/.sqlx/query-be6d2c92a62b7b284651c45af809746147aa9b8d0a81642a7b7cb4738a0cad66.json
+++ b/backend/.sqlx/query-be6d2c92a62b7b284651c45af809746147aa9b8d0a81642a7b7cb4738a0cad66.json
@@ -78,7 +78,8 @@
                 "java",
                 "duckdb",
                 "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-bea1144ea4d50aff717654eb1c2fd3a98c72172fd907c5a710ae50abbd02fd92.json b/backend/.sqlx/query-bea1144ea4d50aff717654eb1c2fd3a98c72172fd907c5a710ae50abbd02fd92.json
new file mode 100644
index 0000000000..ea3dbea9fb
--- /dev/null
+++ b/backend/.sqlx/query-bea1144ea4d50aff717654eb1c2fd3a98c72172fd907c5a710ae50abbd02fd92.json
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO group_(workspace_id, name, summary, extra_perms) VALUES ('test-workspace', 'ops', '', '{}')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "bea1144ea4d50aff717654eb1c2fd3a98c72172fd907c5a710ae50abbd02fd92"
+}
diff --git a/backend/.sqlx/query-bf45139e3ae5c5c16591afb26c51c01c1e2fd56a2dc2dbd1ed41f08be7e61e08.json b/backend/.sqlx/query-bf45139e3ae5c5c16591afb26c51c01c1e2fd56a2dc2dbd1ed41f08be7e61e08.json
new file mode 100644
index 0000000000..d5763deb84
--- /dev/null
+++ b/backend/.sqlx/query-bf45139e3ae5c5c16591afb26c51c01c1e2fd56a2dc2dbd1ed41f08be7e61e08.json
@@ -0,0 +1,32 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT path, value->>'on_behalf_of_email' AS email, value->>'on_behalf_of' AS principal FROM draft WHERE workspace_id = 'test-workspace' ORDER BY path",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "email",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 2,
+        "name": "principal",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      false,
+      null,
+      null
+    ]
+  },
+  "hash": "bf45139e3ae5c5c16591afb26c51c01c1e2fd56a2dc2dbd1ed41f08be7e61e08"
+}
diff --git a/backend/.sqlx/query-bf63f1e3c2f06b1133a4cd6ced5a3f7752e79027a2a8636808bb41628b789ebc.json b/backend/.sqlx/query-bf63f1e3c2f06b1133a4cd6ced5a3f7752e79027a2a8636808bb41628b789ebc.json
new file mode 100644
index 0000000000..a0ab56888b
--- /dev/null
+++ b/backend/.sqlx/query-bf63f1e3c2f06b1133a4cd6ced5a3f7752e79027a2a8636808bb41628b789ebc.json
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE usr SET email = 'group-ops@windmill.dev' WHERE workspace_id = 'test-workspace' AND username = 'test-user-2'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "bf63f1e3c2f06b1133a4cd6ced5a3f7752e79027a2a8636808bb41628b789ebc"
+}
diff --git a/backend/.sqlx/query-bfb97d2f48157a1575b7b6f3e64e0d075701d541a44dd7a0b586d1f337ced5e1.json b/backend/.sqlx/query-bfb97d2f48157a1575b7b6f3e64e0d075701d541a44dd7a0b586d1f337ced5e1.json
index a051b068a5..df982f3296 100644
--- a/backend/.sqlx/query-bfb97d2f48157a1575b7b6f3e64e0d075701d541a44dd7a0b586d1f337ced5e1.json
+++ b/backend/.sqlx/query-bfb97d2f48157a1575b7b6f3e64e0d075701d541a44dd7a0b586d1f337ced5e1.json
@@ -34,7 +34,8 @@
                 "variable",
                 "ducklake",
                 "datatable",
-                "volume"
+                "volume",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-c13f203478d6bc623c27bba9b6fc6e9c9d36bcf9f7138422414f31f0319e6cfb.json b/backend/.sqlx/query-c13f203478d6bc623c27bba9b6fc6e9c9d36bcf9f7138422414f31f0319e6cfb.json
new file mode 100644
index 0000000000..a1bf434814
--- /dev/null
+++ b/backend/.sqlx/query-c13f203478d6bc623c27bba9b6fc6e9c9d36bcf9f7138422414f31f0319e6cfb.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT EXISTS(SELECT 1 FROM script WHERE path = $1 AND workspace_id = $2 AND archived = false AND deleted = false)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "exists",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "c13f203478d6bc623c27bba9b6fc6e9c9d36bcf9f7138422414f31f0319e6cfb"
+}
diff --git a/backend/.sqlx/query-c159975f7b9ad9c8eeef340ca03ed4919122d653e1235d0847bfad84f0a3e539.json b/backend/.sqlx/query-c159975f7b9ad9c8eeef340ca03ed4919122d653e1235d0847bfad84f0a3e539.json
new file mode 100644
index 0000000000..4be222b94d
--- /dev/null
+++ b/backend/.sqlx/query-c159975f7b9ad9c8eeef340ca03ed4919122d653e1235d0847bfad84f0a3e539.json
@@ -0,0 +1,26 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT path, policy->>'on_behalf_of_email' AS email FROM app WHERE workspace_id = 'test-workspace' ORDER BY path",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "email",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      false,
+      null
+    ]
+  },
+  "hash": "c159975f7b9ad9c8eeef340ca03ed4919122d653e1235d0847bfad84f0a3e539"
+}
diff --git a/backend/.sqlx/query-c1a85cf2d1555ae33bbdaf85cf243d44a23f2fe2abf7a9ff8f271f9dfb1433e3.json b/backend/.sqlx/query-c1a85cf2d1555ae33bbdaf85cf243d44a23f2fe2abf7a9ff8f271f9dfb1433e3.json
new file mode 100644
index 0000000000..5fb1a353e7
--- /dev/null
+++ b/backend/.sqlx/query-c1a85cf2d1555ae33bbdaf85cf243d44a23f2fe2abf7a9ff8f271f9dfb1433e3.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM dbt_edge\n          WHERE job_id <> '00000000-0000-0000-0000-000000000000'\n            AND ingested_at < now() - make_interval(days => $1)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int4"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "c1a85cf2d1555ae33bbdaf85cf243d44a23f2fe2abf7a9ff8f271f9dfb1433e3"
+}
diff --git a/backend/.sqlx/query-c1fb844ac8fb9293510d08dfb1cec03751a661076ee3250446b5157c43defc97.json b/backend/.sqlx/query-c1fb844ac8fb9293510d08dfb1cec03751a661076ee3250446b5157c43defc97.json
new file mode 100644
index 0000000000..cd2dead06d
--- /dev/null
+++ b/backend/.sqlx/query-c1fb844ac8fb9293510d08dfb1cec03751a661076ee3250446b5157c43defc97.json
@@ -0,0 +1,18 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO dbt_graph_snapshot\n           (workspace_id, script_path, script_hash, job_id, digest, ingested_at)\n         VALUES ($1, $2, $3, $4, $5, now())\n         ON CONFLICT (workspace_id, script_path, script_hash, job_id)\n           WHERE script_hash IS NOT NULL\n         DO UPDATE SET digest = EXCLUDED.digest, ingested_at = now()",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Int8",
+        "Uuid",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "c1fb844ac8fb9293510d08dfb1cec03751a661076ee3250446b5157c43defc97"
+}
diff --git a/backend/.sqlx/query-c237044a7e04a6f87bd90114a33672a181bf5399c5b17ef8c4f806163bf20f70.json b/backend/.sqlx/query-c237044a7e04a6f87bd90114a33672a181bf5399c5b17ef8c4f806163bf20f70.json
new file mode 100644
index 0000000000..49745d0791
--- /dev/null
+++ b/backend/.sqlx/query-c237044a7e04a6f87bd90114a33672a181bf5399c5b17ef8c4f806163bf20f70.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT EXISTS(SELECT 1 FROM flow WHERE workspace_id = $1 AND path = $2 AND archived = false)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "exists",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "c237044a7e04a6f87bd90114a33672a181bf5399c5b17ef8c4f806163bf20f70"
+}
diff --git a/backend/.sqlx/query-c28e066bf24263f9e3b48a2ecabdf037178ba246092dbc1d2b3816e7a9269dc3.json b/backend/.sqlx/query-c28e066bf24263f9e3b48a2ecabdf037178ba246092dbc1d2b3816e7a9269dc3.json
index 7981dbc983..9844615122 100644
--- a/backend/.sqlx/query-c28e066bf24263f9e3b48a2ecabdf037178ba246092dbc1d2b3816e7a9269dc3.json
+++ b/backend/.sqlx/query-c28e066bf24263f9e3b48a2ecabdf037178ba246092dbc1d2b3816e7a9269dc3.json
@@ -16,7 +16,8 @@
                 "variable",
                 "ducklake",
                 "datatable",
-                "volume"
+                "volume",
+                "dbt"
               ]
             }
           }
@@ -87,7 +88,8 @@
                 "variable",
                 "ducklake",
                 "datatable",
-                "volume"
+                "volume",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-c2e5f233e134ccc70b05d62239aaf736b456dbdd7d358e58744aa565e5889241.json b/backend/.sqlx/query-c2e5f233e134ccc70b05d62239aaf736b456dbdd7d358e58744aa565e5889241.json
new file mode 100644
index 0000000000..d8f9fbcee4
--- /dev/null
+++ b/backend/.sqlx/query-c2e5f233e134ccc70b05d62239aaf736b456dbdd7d358e58744aa565e5889241.json
@@ -0,0 +1,21 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO dbt_run_state (workspace_id, script_path, permissioned_as, identity, args, run_results, job_id, retryable, updated_at)\n                 SELECT $1::varchar, $2::varchar, $7::varchar, $3::text, $4::jsonb, $5::text, $6::uuid, $8::boolean, now()\n                  WHERE EXISTS (SELECT 1 FROM script\n                                 WHERE workspace_id = $1 AND path = $2\n                                   AND deleted = false AND archived = false\n                                   AND language = 'dbt')\n                 ON CONFLICT (workspace_id, script_path, permissioned_as) DO UPDATE SET\n                   identity = EXCLUDED.identity, args = EXCLUDED.args,\n                   run_results = EXCLUDED.run_results, job_id = EXCLUDED.job_id,\n                   retryable = EXCLUDED.retryable, updated_at = now()",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Text",
+        "Jsonb",
+        "Text",
+        "Uuid",
+        "Varchar",
+        "Bool"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "c2e5f233e134ccc70b05d62239aaf736b456dbdd7d358e58744aa565e5889241"
+}
diff --git a/backend/.sqlx/query-c6706971489603027edc678f9d6c42e8341d5d3c5e4f46a53b8dc637484dd760.json b/backend/.sqlx/query-c6706971489603027edc678f9d6c42e8341d5d3c5e4f46a53b8dc637484dd760.json
new file mode 100644
index 0000000000..27087b4c4d
--- /dev/null
+++ b/backend/.sqlx/query-c6706971489603027edc678f9d6c42e8341d5d3c5e4f46a53b8dc637484dd760.json
@@ -0,0 +1,24 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT path FROM script WHERE on_behalf_of = $1 AND NOT path LIKE $2 AND workspace_id = $3 AND NOT archived AND NOT deleted",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "path",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "c6706971489603027edc678f9d6c42e8341d5d3c5e4f46a53b8dc637484dd760"
+}
diff --git a/backend/.sqlx/query-c868e87f7ccc5ce19c421c857f67285177bd4eaa3a14af5bf08dbc32c7bda558.json b/backend/.sqlx/query-c868e87f7ccc5ce19c421c857f67285177bd4eaa3a14af5bf08dbc32c7bda558.json
new file mode 100644
index 0000000000..8bc10809dc
--- /dev/null
+++ b/backend/.sqlx/query-c868e87f7ccc5ce19c421c857f67285177bd4eaa3a14af5bf08dbc32c7bda558.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT deleted FROM script WHERE workspace_id = $1 AND hash = $2 FOR UPDATE",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "deleted",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "c868e87f7ccc5ce19c421c857f67285177bd4eaa3a14af5bf08dbc32c7bda558"
+}
diff --git a/backend/.sqlx/query-c894582ce2be367edd09aa82cf1261ce9fde9657bb4fbcb37e9c14b63ae909af.json b/backend/.sqlx/query-c894582ce2be367edd09aa82cf1261ce9fde9657bb4fbcb37e9c14b63ae909af.json
new file mode 100644
index 0000000000..e55d8a1017
--- /dev/null
+++ b/backend/.sqlx/query-c894582ce2be367edd09aa82cf1261ce9fde9657bb4fbcb37e9c14b63ae909af.json
@@ -0,0 +1,24 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE resource SET value = $1, edited_at = now() WHERE path = $2 AND workspace_id = $3\n         RETURNING resource_type",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "resource_type",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Jsonb",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "c894582ce2be367edd09aa82cf1261ce9fde9657bb4fbcb37e9c14b63ae909af"
+}
diff --git a/backend/.sqlx/query-c8caa96a2003348768ed3dc9929f6d05234f25f8212ec61be5ed4cef386d2d14.json b/backend/.sqlx/query-c8caa96a2003348768ed3dc9929f6d05234f25f8212ec61be5ed4cef386d2d14.json
new file mode 100644
index 0000000000..0c20b97d90
--- /dev/null
+++ b/backend/.sqlx/query-c8caa96a2003348768ed3dc9929f6d05234f25f8212ec61be5ed4cef386d2d14.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT path FROM variable WHERE workspace_id = $1 AND path = ANY($2)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "path",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "TextArray"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "c8caa96a2003348768ed3dc9929f6d05234f25f8212ec61be5ed4cef386d2d14"
+}
diff --git a/backend/.sqlx/query-c8cdc44f76411a3a01b02eed6647e8319c368ca9ccdc095f94945cda082f8857.json b/backend/.sqlx/query-c8cdc44f76411a3a01b02eed6647e8319c368ca9ccdc095f94945cda082f8857.json
new file mode 100644
index 0000000000..ac8ae1fa0b
--- /dev/null
+++ b/backend/.sqlx/query-c8cdc44f76411a3a01b02eed6647e8319c368ca9ccdc095f94945cda082f8857.json
@@ -0,0 +1,34 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT id, permissioned_as, permissioned_as_email FROM v2_job WHERE id = ANY($1)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 1,
+        "name": "permissioned_as",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "permissioned_as_email",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "UuidArray"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false
+    ]
+  },
+  "hash": "c8cdc44f76411a3a01b02eed6647e8319c368ca9ccdc095f94945cda082f8857"
+}
diff --git a/backend/.sqlx/query-cbc68952e976e3daeba2dba398de11f81ef4d93f6f6d164269a5190af85512d9.json b/backend/.sqlx/query-cbc68952e976e3daeba2dba398de11f81ef4d93f6f6d164269a5190af85512d9.json
new file mode 100644
index 0000000000..9ea2efa7ac
--- /dev/null
+++ b/backend/.sqlx/query-cbc68952e976e3daeba2dba398de11f81ef4d93f6f6d164269a5190af85512d9.json
@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT on_behalf_of FROM script WHERE path = 'u/test-user/s' AND workspace_id = 'test-workspace'",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "on_behalf_of",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "cbc68952e976e3daeba2dba398de11f81ef4d93f6f6d164269a5190af85512d9"
+}
diff --git a/backend/.sqlx/query-d01d85e7e5371591f0f2e5843448f464ed38bd4c314a19cc9a9e6f7d89b4a173.json b/backend/.sqlx/query-d01d85e7e5371591f0f2e5843448f464ed38bd4c314a19cc9a9e6f7d89b4a173.json
new file mode 100644
index 0000000000..98550a98e9
--- /dev/null
+++ b/backend/.sqlx/query-d01d85e7e5371591f0f2e5843448f464ed38bd4c314a19cc9a9e6f7d89b4a173.json
@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT on_behalf_of_email FROM script WHERE path = 'u/test-user/obo_recorded' AND workspace_id = 'test-workspace'",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "on_behalf_of_email",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "d01d85e7e5371591f0f2e5843448f464ed38bd4c314a19cc9a9e6f7d89b4a173"
+}
diff --git a/backend/.sqlx/query-d4211392e174a0e8f89c7fcebdf120e5b0f629f9f04e08a2982df33ff23ac7a9.json b/backend/.sqlx/query-d0df9d1fda20f0366505bf6abf67446a5e8e23d87eebc46bbb90bdbdf128935b.json
similarity index 94%
rename from backend/.sqlx/query-d4211392e174a0e8f89c7fcebdf120e5b0f629f9f04e08a2982df33ff23ac7a9.json
rename to backend/.sqlx/query-d0df9d1fda20f0366505bf6abf67446a5e8e23d87eebc46bbb90bdbdf128935b.json
index 0bd066afd1..0da783f056 100644
--- a/backend/.sqlx/query-d4211392e174a0e8f89c7fcebdf120e5b0f629f9f04e08a2982df33ff23ac7a9.json
+++ b/backend/.sqlx/query-d0df9d1fda20f0366505bf6abf67446a5e8e23d87eebc46bbb90bdbdf128935b.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT\n        v2_job_queue.workspace_id,\n        v2_job_queue.id,\n        v2_job.args as \"args: sqlx::types::Json<HashMap<String, Box<RawValue>>>\",\n        v2_job.parent_job,\n        v2_job.created_by,\n        v2_job_queue.started_at,\n        v2_job_queue.runnable_settings_handle,\n        scheduled_for,\n        runnable_path,\n        kind as \"kind: JobKind\",\n        runnable_id as \"runnable_id: ScriptHash\",\n        canceled_reason,\n        canceled_by,\n        permissioned_as,\n        permissioned_as_email,\n        flow_status as \"flow_status: sqlx::types::Json<Box<RawValue>>\",\n        v2_job.tag,\n        script_lang as \"script_lang: ScriptLang\",\n        same_worker,\n        pre_run_error,\n        concurrent_limit,\n        concurrency_time_window_s,\n        flow_innermost_root_job,\n        root_job,\n        timeout,\n        flow_step_id,\n        cache_ttl,\n        cache_ignore_s3_path,\n        v2_job_queue.priority,\n        preprocessed,\n        script_entrypoint_override,\n        trigger,\n        trigger_kind as \"trigger_kind: JobTriggerKind\",\n        visible_to_owner,\n        NULL as permissioned_as_end_user_email\n        FROM v2_job_queue INNER JOIN v2_job ON v2_job.id = v2_job_queue.id LEFT JOIN v2_job_status ON v2_job_status.id = v2_job_queue.id WHERE v2_job_queue.id = $1",
+  "query": "SELECT\n        v2_job_queue.workspace_id,\n        v2_job_queue.id,\n        v2_job.args as \"args: sqlx::types::Json<HashMap<String, Box<RawValue>>>\",\n        v2_job.parent_job,\n        v2_job.created_by,\n        v2_job_queue.started_at,\n        v2_job_queue.runnable_settings_handle,\n        scheduled_for,\n        runnable_path,\n        kind as \"kind: JobKind\",\n        runnable_id as \"runnable_id: ScriptHash\",\n        canceled_reason,\n        canceled_by,\n        permissioned_as,\n        permissioned_as_email,\n        flow_status as \"flow_status: sqlx::types::Json<Box<RawValue>>\",\n        v2_job.tag,\n        script_lang as \"script_lang: ScriptLang\",\n        same_worker,\n        pre_run_error,\n        concurrent_limit,\n        concurrency_time_window_s,\n        flow_innermost_root_job,\n        root_job,\n        timeout,\n        flow_step_id,\n        cache_ttl,\n        cache_ignore_s3_path,\n        v2_job_queue.priority,\n        preprocessed,\n        script_entrypoint_override,\n        trigger,\n        trigger_kind as \"trigger_kind: TriggerKindLabel\",\n        visible_to_owner,\n        NULL as permissioned_as_end_user_email\n        FROM v2_job_queue INNER JOIN v2_job ON v2_job.id = v2_job_queue.id LEFT JOIN v2_job_status ON v2_job_status.id = v2_job_queue.id WHERE v2_job_queue.id = $1",
   "describe": {
     "columns": [
       {
@@ -149,7 +149,8 @@
                 "java",
                 "duckdb",
                 "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
               ]
             }
           }
@@ -227,7 +228,7 @@
       },
       {
         "ordinal": 32,
-        "name": "trigger_kind: JobTriggerKind",
+        "name": "trigger_kind: TriggerKindLabel",
         "type_info": {
           "Custom": {
             "name": "job_trigger_kind",
@@ -313,5 +314,5 @@
       null
     ]
   },
-  "hash": "d4211392e174a0e8f89c7fcebdf120e5b0f629f9f04e08a2982df33ff23ac7a9"
+  "hash": "d0df9d1fda20f0366505bf6abf67446a5e8e23d87eebc46bbb90bdbdf128935b"
 }
diff --git a/backend/.sqlx/query-d22f81df67d55b2d8f1d15404194a7b4604171d12c6a4620514c6d030086936d.json b/backend/.sqlx/query-d22f81df67d55b2d8f1d15404194a7b4604171d12c6a4620514c6d030086936d.json
index c4526daccc..64b4056596 100644
--- a/backend/.sqlx/query-d22f81df67d55b2d8f1d15404194a7b4604171d12c6a4620514c6d030086936d.json
+++ b/backend/.sqlx/query-d22f81df67d55b2d8f1d15404194a7b4604171d12c6a4620514c6d030086936d.json
@@ -69,7 +69,8 @@
                 "java",
                 "duckdb",
                 "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-d29aedfdf8ac4220085c9a6ee2f1d9bc795e24291d4e1f83d3314d56a65587bd.json b/backend/.sqlx/query-d29aedfdf8ac4220085c9a6ee2f1d9bc795e24291d4e1f83d3314d56a65587bd.json
new file mode 100644
index 0000000000..df4b4bcc1a
--- /dev/null
+++ b/backend/.sqlx/query-d29aedfdf8ac4220085c9a6ee2f1d9bc795e24291d4e1f83d3314d56a65587bd.json
@@ -0,0 +1,19 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes, source_last_event_kind, source_last_event_origin)\n            SELECT $1, unnest($2::varchar[]), $3, $4, 0, 1, NULL, $5, $6\n            ON CONFLICT (source_workspace_id, fork_workspace_id, path, kind)\n            DO UPDATE SET\n                behind = workspace_diff.behind + 1,\n                has_changes = NULL,\n                source_last_event_kind = EXCLUDED.source_last_event_kind,\n                source_last_event_origin = EXCLUDED.source_last_event_origin",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "VarcharArray",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "d29aedfdf8ac4220085c9a6ee2f1d9bc795e24291d4e1f83d3314d56a65587bd"
+}
diff --git a/backend/.sqlx/query-d41ea93fd58381b89e151c965eae1ea2fe96a1b94f5a92953fb1c1642d15c016.json b/backend/.sqlx/query-d41ea93fd58381b89e151c965eae1ea2fe96a1b94f5a92953fb1c1642d15c016.json
index 2660ca05ef..cd1e0c4c39 100644
--- a/backend/.sqlx/query-d41ea93fd58381b89e151c965eae1ea2fe96a1b94f5a92953fb1c1642d15c016.json
+++ b/backend/.sqlx/query-d41ea93fd58381b89e151c965eae1ea2fe96a1b94f5a92953fb1c1642d15c016.json
@@ -78,7 +78,8 @@
                 "java",
                 "duckdb",
                 "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-d735f355d9eb2612b563b606c6c897c5ad764a882b2c9054a7665dd68b7a528b.json b/backend/.sqlx/query-d735f355d9eb2612b563b606c6c897c5ad764a882b2c9054a7665dd68b7a528b.json
new file mode 100644
index 0000000000..edd7f2f97a
--- /dev/null
+++ b/backend/.sqlx/query-d735f355d9eb2612b563b606c6c897c5ad764a882b2c9054a7665dd68b7a528b.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM dbt_graph_snapshot\n          WHERE job_id <> '00000000-0000-0000-0000-000000000000'\n            AND ingested_at < now() - make_interval(days => $1)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int4"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "d735f355d9eb2612b563b606c6c897c5ad764a882b2c9054a7665dd68b7a528b"
+}
diff --git a/backend/.sqlx/query-d75bbac607ef4439d8aef2b33d1b2a035d2ecb8169fd26e6a1cb2b49ead6c4ea.json b/backend/.sqlx/query-d75bbac607ef4439d8aef2b33d1b2a035d2ecb8169fd26e6a1cb2b49ead6c4ea.json
new file mode 100644
index 0000000000..02845d173a
--- /dev/null
+++ b/backend/.sqlx/query-d75bbac607ef4439d8aef2b33d1b2a035d2ecb8169fd26e6a1cb2b49ead6c4ea.json
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO password(email, password_hash, login_type, super_admin, verified, name)\n         VALUES ('ext@windmill.dev', 'not-a-real-hash', 'password', true, true, 'Ext')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "d75bbac607ef4439d8aef2b33d1b2a035d2ecb8169fd26e6a1cb2b49ead6c4ea"
+}
diff --git a/backend/.sqlx/query-da10117644334b74bdb68e3f9d7ef37cd4aa442e68f80d8ce5f2b74a20d5146f.json b/backend/.sqlx/query-da10117644334b74bdb68e3f9d7ef37cd4aa442e68f80d8ce5f2b74a20d5146f.json
new file mode 100644
index 0000000000..55b950ab4f
--- /dev/null
+++ b/backend/.sqlx/query-da10117644334b74bdb68e3f9d7ef37cd4aa442e68f80d8ce5f2b74a20d5146f.json
@@ -0,0 +1,26 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT on_behalf_of, on_behalf_of_email FROM script WHERE path = 'f/shared/obo' AND workspace_id = 'test-workspace'",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "on_behalf_of",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "on_behalf_of_email",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      true,
+      true
+    ]
+  },
+  "hash": "da10117644334b74bdb68e3f9d7ef37cd4aa442e68f80d8ce5f2b74a20d5146f"
+}
diff --git a/backend/.sqlx/query-daccf6fd7d626e99cdd8795e204344f36c27d8757e78fa1990a86c2dfcddf808.json b/backend/.sqlx/query-daccf6fd7d626e99cdd8795e204344f36c27d8757e78fa1990a86c2dfcddf808.json
new file mode 100644
index 0000000000..001995f90b
--- /dev/null
+++ b/backend/.sqlx/query-daccf6fd7d626e99cdd8795e204344f36c27d8757e78fa1990a86c2dfcddf808.json
@@ -0,0 +1,19 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes, source_last_event_kind, source_last_event_origin)\n                SELECT $1, unnest($2::varchar[]), $3, $4, 0, 1, NULL, $5, $6\n                ON CONFLICT (source_workspace_id, fork_workspace_id, path, kind)\n                DO UPDATE SET\n                    behind = workspace_diff.behind + 1,\n                    has_changes = NULL,\n                    source_last_event_kind = EXCLUDED.source_last_event_kind,\n                    source_last_event_origin = EXCLUDED.source_last_event_origin",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "VarcharArray",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "daccf6fd7d626e99cdd8795e204344f36c27d8757e78fa1990a86c2dfcddf808"
+}
diff --git a/backend/.sqlx/query-dbe64a8367fad74866b15f96565ef1ae7c58848714974a8c803085a0c0e655d6.json b/backend/.sqlx/query-dbe64a8367fad74866b15f96565ef1ae7c58848714974a8c803085a0c0e655d6.json
new file mode 100644
index 0000000000..520d04c762
--- /dev/null
+++ b/backend/.sqlx/query-dbe64a8367fad74866b15f96565ef1ae7c58848714974a8c803085a0c0e655d6.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM dbt_edge WHERE workspace_id = $1 AND script_path = $2 AND script_hash = $3",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "dbe64a8367fad74866b15f96565ef1ae7c58848714974a8c803085a0c0e655d6"
+}
diff --git a/backend/.sqlx/query-dcbf4630616d214c510dd8bda9cb77215453c094cc1caab16ae4b4e5148b0c58.json b/backend/.sqlx/query-dcbf4630616d214c510dd8bda9cb77215453c094cc1caab16ae4b4e5148b0c58.json
new file mode 100644
index 0000000000..363c96f694
--- /dev/null
+++ b/backend/.sqlx/query-dcbf4630616d214c510dd8bda9cb77215453c094cc1caab16ae4b4e5148b0c58.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO flow\n            (workspace_id, path, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, concurrency_key, versions, value, schema, edited_by, edited_at, lock_error_logs)\n        SELECT $1, path, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, concurrency_key, versions, value, schema, edited_by, edited_at, lock_error_logs\n            FROM flow WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "dcbf4630616d214c510dd8bda9cb77215453c094cc1caab16ae4b4e5148b0c58"
+}
diff --git a/backend/.sqlx/query-df278f1115680387ee1a5385c4ac5d112a798a8debb0b37bbbc5cebbe9af0087.json b/backend/.sqlx/query-df278f1115680387ee1a5385c4ac5d112a798a8debb0b37bbbc5cebbe9af0087.json
new file mode 100644
index 0000000000..b455cc1b5c
--- /dev/null
+++ b/backend/.sqlx/query-df278f1115680387ee1a5385c4ac5d112a798a8debb0b37bbbc5cebbe9af0087.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT EXISTS(SELECT 1 FROM resource WHERE workspace_id = $1 AND path = $2)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "exists",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "df278f1115680387ee1a5385c4ac5d112a798a8debb0b37bbbc5cebbe9af0087"
+}
diff --git a/backend/.sqlx/query-e013b906ba3e95350ebcda6a8b8cc3ee04f6782587bc34d44338d2b2cad03165.json b/backend/.sqlx/query-e013b906ba3e95350ebcda6a8b8cc3ee04f6782587bc34d44338d2b2cad03165.json
new file mode 100644
index 0000000000..36161cb99c
--- /dev/null
+++ b/backend/.sqlx/query-e013b906ba3e95350ebcda6a8b8cc3ee04f6782587bc34d44338d2b2cad03165.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM dbt_node\n          WHERE job_id <> '00000000-0000-0000-0000-000000000000'\n            AND ingested_at < now() - make_interval(days => $1)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int4"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "e013b906ba3e95350ebcda6a8b8cc3ee04f6782587bc34d44338d2b2cad03165"
+}
diff --git a/backend/.sqlx/query-e01e9040f2336d9db41638842c5a4a07af79130e1dbfd91f1601c04721186609.json b/backend/.sqlx/query-e01e9040f2336d9db41638842c5a4a07af79130e1dbfd91f1601c04721186609.json
new file mode 100644
index 0000000000..4967ac0212
--- /dev/null
+++ b/backend/.sqlx/query-e01e9040f2336d9db41638842c5a4a07af79130e1dbfd91f1601c04721186609.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE dbt_run_progress\n            SET status = 'failed',\n                error = COALESCE(error, 'the run ended before this model finished')\n          WHERE workspace_id = $1 AND job_id = $2 AND status = 'running'\n            AND NOT (asset_path = ANY($3))",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Uuid",
+        "TextArray"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "e01e9040f2336d9db41638842c5a4a07af79130e1dbfd91f1601c04721186609"
+}
diff --git a/backend/.sqlx/query-e041b20c1c4166b30ced8c6a0f50bcf0691ab2554ead6b489a8441a32fc0af82.json b/backend/.sqlx/query-e041b20c1c4166b30ced8c6a0f50bcf0691ab2554ead6b489a8441a32fc0af82.json
index 037c796fc7..0470656ba6 100644
--- a/backend/.sqlx/query-e041b20c1c4166b30ced8c6a0f50bcf0691ab2554ead6b489a8441a32fc0af82.json
+++ b/backend/.sqlx/query-e041b20c1c4166b30ced8c6a0f50bcf0691ab2554ead6b489a8441a32fc0af82.json
@@ -17,7 +17,8 @@
                 "variable",
                 "ducklake",
                 "datatable",
-                "volume"
+                "volume",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-e27ed86394e6568afdf7a1dd72edd7943c87fdf1d05fba193cbe575cb7281db5.json b/backend/.sqlx/query-e27ed86394e6568afdf7a1dd72edd7943c87fdf1d05fba193cbe575cb7281db5.json
new file mode 100644
index 0000000000..68825a19c7
--- /dev/null
+++ b/backend/.sqlx/query-e27ed86394e6568afdf7a1dd72edd7943c87fdf1d05fba193cbe575cb7281db5.json
@@ -0,0 +1,36 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT id, created_at, created_by FROM resource_version\n         WHERE workspace_id = $1 AND path = $2 ORDER BY id DESC LIMIT $3",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "created_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 2,
+        "name": "created_by",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      true
+    ]
+  },
+  "hash": "e27ed86394e6568afdf7a1dd72edd7943c87fdf1d05fba193cbe575cb7281db5"
+}
diff --git a/backend/.sqlx/query-e3fd8cfde2ae3e374b7c4ffcab91fcce10865992242cd053779760cc68909ff7.json b/backend/.sqlx/query-e3fd8cfde2ae3e374b7c4ffcab91fcce10865992242cd053779760cc68909ff7.json
new file mode 100644
index 0000000000..9509a76604
--- /dev/null
+++ b/backend/.sqlx/query-e3fd8cfde2ae3e374b7c4ffcab91fcce10865992242cd053779760cc68909ff7.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM script_trigger\n          WHERE workspace_id = $1 AND runnable_kind = 'script' AND runnable_path = $2\n            AND trigger_kind = 'asset' AND trigger_ref LIKE 'dbt://%'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "e3fd8cfde2ae3e374b7c4ffcab91fcce10865992242cd053779760cc68909ff7"
+}
diff --git a/backend/.sqlx/query-e4d71278fb80126a7a9da73f1889352d4d1e3cb3a8a08f1c9c03055a1cab1235.json b/backend/.sqlx/query-e4d71278fb80126a7a9da73f1889352d4d1e3cb3a8a08f1c9c03055a1cab1235.json
index ad34773e36..29d3eede53 100644
--- a/backend/.sqlx/query-e4d71278fb80126a7a9da73f1889352d4d1e3cb3a8a08f1c9c03055a1cab1235.json
+++ b/backend/.sqlx/query-e4d71278fb80126a7a9da73f1889352d4d1e3cb3a8a08f1c9c03055a1cab1235.json
@@ -134,7 +134,8 @@
                 "java",
                 "duckdb",
                 "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-704d873d4585e00aa0a88cc9949d3a6cc806b33a844b8e0e600cb8bfae428e84.json b/backend/.sqlx/query-e5775b1417d506e90953dc8e2b769ba049d314d93e4436f8f14f4812eb4990a0.json
similarity index 92%
rename from backend/.sqlx/query-704d873d4585e00aa0a88cc9949d3a6cc806b33a844b8e0e600cb8bfae428e84.json
rename to backend/.sqlx/query-e5775b1417d506e90953dc8e2b769ba049d314d93e4436f8f14f4812eb4990a0.json
index 9f80167752..3fa97c8ae5 100644
--- a/backend/.sqlx/query-704d873d4585e00aa0a88cc9949d3a6cc806b33a844b8e0e600cb8bfae428e84.json
+++ b/backend/.sqlx/query-e5775b1417d506e90953dc8e2b769ba049d314d93e4436f8f14f4812eb4990a0.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n        SELECT workspace_id, username, email, is_admin, created_at, operator, disabled, role, added_via, is_service_account\n          FROM usr\n         WHERE workspace_id = $1\n         ",
+  "query": "\n        SELECT workspace_id, username, email, is_admin, created_at, operator, disabled, role, added_via, is_service_account\n          FROM usr\n         WHERE workspace_id = $1\n         ORDER BY email\n         ",
   "describe": {
     "columns": [
       {
@@ -72,5 +72,5 @@
       false
     ]
   },
-  "hash": "704d873d4585e00aa0a88cc9949d3a6cc806b33a844b8e0e600cb8bfae428e84"
+  "hash": "e5775b1417d506e90953dc8e2b769ba049d314d93e4436f8f14f4812eb4990a0"
 }
diff --git a/backend/.sqlx/query-e74e283951aa87627a46aa8286819cf7aa4fecbde17bc7a67ee6f49c427cee9e.json b/backend/.sqlx/query-e74e283951aa87627a46aa8286819cf7aa4fecbde17bc7a67ee6f49c427cee9e.json
new file mode 100644
index 0000000000..77399cdf62
--- /dev/null
+++ b/backend/.sqlx/query-e74e283951aa87627a46aa8286819cf7aa4fecbde17bc7a67ee6f49c427cee9e.json
@@ -0,0 +1,29 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT path, value FROM resource_version WHERE workspace_id = $1 AND id = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "value",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false,
+      true
+    ]
+  },
+  "hash": "e74e283951aa87627a46aa8286819cf7aa4fecbde17bc7a67ee6f49c427cee9e"
+}
diff --git a/backend/.sqlx/query-e782878f409796f1fe2a773f054f0b3f63185a6e6a9f4e0dfe961dd466a41808.json b/backend/.sqlx/query-e782878f409796f1fe2a773f054f0b3f63185a6e6a9f4e0dfe961dd466a41808.json
new file mode 100644
index 0000000000..73f5c2e9f7
--- /dev/null
+++ b/backend/.sqlx/query-e782878f409796f1fe2a773f054f0b3f63185a6e6a9f4e0dfe961dd466a41808.json
@@ -0,0 +1,24 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH inserted AS (\n            INSERT INTO flow\n                (workspace_id, path, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, concurrency_key, versions, value, schema, edited_by, edited_at, labels, lock_error_logs)\n            SELECT workspace_id, REGEXP_REPLACE(path, 'u/' || $2 || '/(.*)', $1 || '/\\1'), summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, concurrency_key, versions, value, schema, edited_by, edited_at, labels, lock_error_logs\n                FROM flow\n                WHERE path LIKE ('u/' || $2 || '/%') AND workspace_id = $3\n            RETURNING 1\n        ) SELECT COUNT(*) FROM inserted",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "count",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "e782878f409796f1fe2a773f054f0b3f63185a6e6a9f4e0dfe961dd466a41808"
+}
diff --git a/backend/.sqlx/query-e7f617f9abc523708567ee415f95150048be5d7d0e494fbd3aaf550f4c4d8125.json b/backend/.sqlx/query-e7f617f9abc523708567ee415f95150048be5d7d0e494fbd3aaf550f4c4d8125.json
new file mode 100644
index 0000000000..a96671ab04
--- /dev/null
+++ b/backend/.sqlx/query-e7f617f9abc523708567ee415f95150048be5d7d0e494fbd3aaf550f4c4d8125.json
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO group_ (workspace_id, name, summary, extra_perms) VALUES ('test-workspace', 'ops', '', '{}') ON CONFLICT DO NOTHING",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "e7f617f9abc523708567ee415f95150048be5d7d0e494fbd3aaf550f4c4d8125"
+}
diff --git a/backend/.sqlx/query-e9ea69ee2a7927e18a2bae9721407e05b1ab61512e00034982dfd9b4ac3257aa.json b/backend/.sqlx/query-e9ea69ee2a7927e18a2bae9721407e05b1ab61512e00034982dfd9b4ac3257aa.json
new file mode 100644
index 0000000000..a698761d8a
--- /dev/null
+++ b/backend/.sqlx/query-e9ea69ee2a7927e18a2bae9721407e05b1ab61512e00034982dfd9b4ac3257aa.json
@@ -0,0 +1,34 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT (parent_workspace_id IS NOT NULL) AS \"is_fork!\", is_dev_workspace, deleted\n           FROM workspace WHERE id = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "is_fork!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 1,
+        "name": "is_dev_workspace",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 2,
+        "name": "deleted",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      null,
+      false,
+      false
+    ]
+  },
+  "hash": "e9ea69ee2a7927e18a2bae9721407e05b1ab61512e00034982dfd9b4ac3257aa"
+}
diff --git a/backend/.sqlx/query-ea95c0684cd436673ddc5f242ffaede3b52ebab41c74c57a4748ee912f45f6b1.json b/backend/.sqlx/query-ea95c0684cd436673ddc5f242ffaede3b52ebab41c74c57a4748ee912f45f6b1.json
new file mode 100644
index 0000000000..8591604eb8
--- /dev/null
+++ b/backend/.sqlx/query-ea95c0684cd436673ddc5f242ffaede3b52ebab41c74c57a4748ee912f45f6b1.json
@@ -0,0 +1,83 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT path, kind, ahead, behind, has_changes, exists_in_source, exists_in_fork,\n            fork_last_event_kind, fork_last_event_origin, source_last_event_kind, source_last_event_origin\n        FROM workspace_diff\n        WHERE source_workspace_id = $1 AND fork_workspace_id = $2\n        AND NOT EXISTS (\n            SELECT 1 FROM ws_specific ws\n            WHERE ws.path = workspace_diff.path\n              AND ws.item_kind = workspace_diff.kind\n              AND ws.workspace_id IN (workspace_diff.source_workspace_id, workspace_diff.fork_workspace_id)\n        )",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "kind",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "ahead",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 3,
+        "name": "behind",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 4,
+        "name": "has_changes",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 5,
+        "name": "exists_in_source",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 6,
+        "name": "exists_in_fork",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 7,
+        "name": "fork_last_event_kind",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 8,
+        "name": "fork_last_event_origin",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 9,
+        "name": "source_last_event_kind",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 10,
+        "name": "source_last_event_origin",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      false,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true
+    ]
+  },
+  "hash": "ea95c0684cd436673ddc5f242ffaede3b52ebab41c74c57a4748ee912f45f6b1"
+}
diff --git a/backend/.sqlx/query-ad25201d0eea65972234cade87a95d8cd99fc26e5bd466942423cbd09efcebe4.json b/backend/.sqlx/query-eaad94dd1b419f814af4cb54f2843e8d12a191ca97954c499ae5dc022410a240.json
similarity index 74%
rename from backend/.sqlx/query-ad25201d0eea65972234cade87a95d8cd99fc26e5bd466942423cbd09efcebe4.json
rename to backend/.sqlx/query-eaad94dd1b419f814af4cb54f2843e8d12a191ca97954c499ae5dc022410a240.json
index 7b989b68f5..29aa952292 100644
--- a/backend/.sqlx/query-ad25201d0eea65972234cade87a95d8cd99fc26e5bd466942423cbd09efcebe4.json
+++ b/backend/.sqlx/query-eaad94dd1b419f814af4cb54f2843e8d12a191ca97954c499ae5dc022410a240.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n            INSERT INTO azure_trigger (\n                azure_resource_path, azure_mode, scope_resource_id, topic_name,\n                subscription_name, event_type_filters,\n                push_auth_config, workspace_id, path, script_path, is_flow,\n                permissioned_as, mode, edited_by, email,\n                error_handler_path, error_handler_args, retry\n            ) VALUES (\n                $1, $2, $3, $4, $5, $6, $7,\n                $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18\n            )\n            ",
+  "query": "\n            INSERT INTO azure_trigger (\n                azure_resource_path, azure_mode, scope_resource_id, topic_name,\n                subscription_name, event_type_filters,\n                push_auth_config, workspace_id, path, script_path, is_flow,\n                permissioned_as, mode, edited_by,\n                error_handler_path, error_handler_args, retry\n            ) VALUES (\n                $1, $2, $3, $4, $5, $6, $7,\n                $8, $9, $10, $11, $12, $13, $14, $15, $16, $17\n            )\n            ",
   "describe": {
     "columns": [],
     "parameters": {
@@ -42,12 +42,11 @@
         },
         "Varchar",
         "Varchar",
-        "Varchar",
         "Jsonb",
         "Jsonb"
       ]
     },
     "nullable": []
   },
-  "hash": "ad25201d0eea65972234cade87a95d8cd99fc26e5bd466942423cbd09efcebe4"
+  "hash": "eaad94dd1b419f814af4cb54f2843e8d12a191ca97954c499ae5dc022410a240"
 }
diff --git a/backend/.sqlx/query-ebe7822c6fbdd8afea833e96cfd65e3f5fe96ff6dee2c6d41798328a3852fe76.json b/backend/.sqlx/query-ebe7822c6fbdd8afea833e96cfd65e3f5fe96ff6dee2c6d41798328a3852fe76.json
new file mode 100644
index 0000000000..ac9b645b01
--- /dev/null
+++ b/backend/.sqlx/query-ebe7822c6fbdd8afea833e96cfd65e3f5fe96ff6dee2c6d41798328a3852fe76.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH RECURSIVE seeded AS (SELECT unnest($1::text[]) AS id),\n           up AS (\n               SELECT w.id, w.parent_workspace_id, 0 AS depth\n               FROM workspace w JOIN seeded s ON w.id = s.id\n               UNION ALL\n               SELECT w.id, w.parent_workspace_id, up.depth + 1\n               FROM workspace w JOIN up ON w.id = up.parent_workspace_id\n               WHERE up.depth < 20\n           ),\n           down AS (\n               SELECT w.id, 0 AS depth FROM workspace w JOIN seeded s ON w.id = s.id\n               UNION ALL\n               SELECT w.id, down.depth + 1\n               FROM workspace w JOIN down ON w.parent_workspace_id = down.id\n               WHERE down.depth < 20 AND w.is_dev_workspace\n           )\n           SELECT id AS \"id!\" FROM (\n               SELECT id FROM seeded UNION SELECT id FROM up UNION SELECT id FROM down\n           ) n ORDER BY id",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id!",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "TextArray"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "ebe7822c6fbdd8afea833e96cfd65e3f5fe96ff6dee2c6d41798328a3852fe76"
+}
diff --git a/backend/.sqlx/query-ec2ed5203effe26c9584b266c5ccbc2a399e3a0e126c9ba7d0558d37c16926fa.json b/backend/.sqlx/query-ec2ed5203effe26c9584b266c5ccbc2a399e3a0e126c9ba7d0558d37c16926fa.json
new file mode 100644
index 0000000000..d6e1a1bb57
--- /dev/null
+++ b/backend/.sqlx/query-ec2ed5203effe26c9584b266c5ccbc2a399e3a0e126c9ba7d0558d37c16926fa.json
@@ -0,0 +1,30 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO dbt_run_progress\n           (workspace_id, job_id, asset_kind, asset_path, status, row_count, error, updated_at)\n         VALUES ($1, $2, 'dbt', $3, $4, $5, $6, now())\n         ON CONFLICT (workspace_id, job_id, asset_kind, asset_path)\n         DO UPDATE SET status = EXCLUDED.status, row_count = EXCLUDED.row_count,\n                       error = EXCLUDED.error, updated_at = now()",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Uuid",
+        "Varchar",
+        {
+          "Custom": {
+            "name": "materialization_status",
+            "kind": {
+              "Enum": [
+                "running",
+                "materialized",
+                "failed"
+              ]
+            }
+          }
+        },
+        "Int8",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "ec2ed5203effe26c9584b266c5ccbc2a399e3a0e126c9ba7d0558d37c16926fa"
+}
diff --git a/backend/.sqlx/query-ed421d15d2f9883196619418b3ebd7c687900b66cd8c3a173f2e3410e4ed86d9.json b/backend/.sqlx/query-ed421d15d2f9883196619418b3ebd7c687900b66cd8c3a173f2e3410e4ed86d9.json
new file mode 100644
index 0000000000..90e4ba1e36
--- /dev/null
+++ b/backend/.sqlx/query-ed421d15d2f9883196619418b3ebd7c687900b66cd8c3a173f2e3410e4ed86d9.json
@@ -0,0 +1,24 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT EXISTS(SELECT 1 FROM v2_job_queue q JOIN v2_job j ON j.id = q.id\n                            WHERE q.id = $1 AND j.workspace_id = $2 AND q.tag = ANY($3))",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "exists",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Text",
+        "TextArray"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "ed421d15d2f9883196619418b3ebd7c687900b66cd8c3a173f2e3410e4ed86d9"
+}
diff --git a/backend/.sqlx/query-edd6c09b7f012588788fd3c572d20eb439a80d52ae75ebd25128ffce759cd313.json b/backend/.sqlx/query-edd6c09b7f012588788fd3c572d20eb439a80d52ae75ebd25128ffce759cd313.json
index 33b0b1f144..2357865ebc 100644
--- a/backend/.sqlx/query-edd6c09b7f012588788fd3c572d20eb439a80d52ae75ebd25128ffce759cd313.json
+++ b/backend/.sqlx/query-edd6c09b7f012588788fd3c572d20eb439a80d52ae75ebd25128ffce759cd313.json
@@ -44,7 +44,8 @@
                 "java",
                 "duckdb",
                 "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-ee85a02a8e3abe3385524c9e549a9f1685387f527eb8739125f6a75ecfb991ac.json b/backend/.sqlx/query-ee85a02a8e3abe3385524c9e549a9f1685387f527eb8739125f6a75ecfb991ac.json
new file mode 100644
index 0000000000..fe4797b43b
--- /dev/null
+++ b/backend/.sqlx/query-ee85a02a8e3abe3385524c9e549a9f1685387f527eb8739125f6a75ecfb991ac.json
@@ -0,0 +1,28 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        UPDATE\n            flow\n        SET\n            path = $1,\n            summary = $2,\n            description = $3,\n            dependency_job = NULL,\n            lock_error_logs = '',\n            tag = $4,\n            dedicated_worker = $5,\n            visible_to_runner_only = $6,\n            ws_error_handler_muted = $7,\n            value = $8,\n            schema = $9::text::json,\n            edited_by = $10,\n            edited_at = now(),\n            labels = COALESCE($13, labels),\n            on_behalf_of = $14,\n            on_behalf_of_email = $15\n        WHERE\n            path = $11 AND workspace_id = $12",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text",
+        "Text",
+        "Varchar",
+        "Bool",
+        "Bool",
+        "Bool",
+        "Jsonb",
+        "Text",
+        "Varchar",
+        "Text",
+        "Text",
+        "TextArray",
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "ee85a02a8e3abe3385524c9e549a9f1685387f527eb8739125f6a75ecfb991ac"
+}
diff --git a/backend/.sqlx/query-eed8122fdcd007543dc6ca28b216845c6249c4598c4e16aa50067fdc6136451c.json b/backend/.sqlx/query-eed8122fdcd007543dc6ca28b216845c6249c4598c4e16aa50067fdc6136451c.json
new file mode 100644
index 0000000000..63babb575e
--- /dev/null
+++ b/backend/.sqlx/query-eed8122fdcd007543dc6ca28b216845c6249c4598c4e16aa50067fdc6136451c.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO dbt_graph_snapshot (workspace_id, script_path, script_hash, job_id,\n            digest, relation_root_at_last_ingest, ingested_at)\n         SELECT $2, script_path, script_hash, job_id, digest, relation_root_at_last_ingest,\n            ingested_at\n         FROM dbt_graph_snapshot\n         WHERE workspace_id = $1 AND job_id = '00000000-0000-0000-0000-000000000000'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "eed8122fdcd007543dc6ca28b216845c6249c4598c4e16aa50067fdc6136451c"
+}
diff --git a/backend/.sqlx/query-ef50e495c86edf69817a0850f2b8001814ac69e890f8cfdd57a345711194150e.json b/backend/.sqlx/query-ef50e495c86edf69817a0850f2b8001814ac69e890f8cfdd57a345711194150e.json
new file mode 100644
index 0000000000..e8ad9d0335
--- /dev/null
+++ b/backend/.sqlx/query-ef50e495c86edf69817a0850f2b8001814ac69e890f8cfdd57a345711194150e.json
@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes, fork_last_event_kind, fork_last_event_origin)\n                VALUES ($1, $2, $3, $4, 1, 0, NULL, $5, $6)\n                ON CONFLICT (source_workspace_id, fork_workspace_id, path, kind)\n                DO UPDATE SET\n                    ahead = workspace_diff.ahead + 1,\n                    has_changes = NULL,\n                    fork_last_event_kind = CASE WHEN $6::varchar IS NULL OR (NOT $7 AND workspace_diff.fork_last_event_origin IS NOT NULL) THEN workspace_diff.fork_last_event_kind ELSE $5 END,\n                    fork_last_event_origin = CASE WHEN $6::varchar IS NULL OR (NOT $7 AND workspace_diff.fork_last_event_origin IS NOT NULL) THEN workspace_diff.fork_last_event_origin ELSE $6 END",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Bool"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "ef50e495c86edf69817a0850f2b8001814ac69e890f8cfdd57a345711194150e"
+}
diff --git a/backend/.sqlx/query-ef59abddc518f5213827e47a31aee49be917a61c46916c29d79c094438b1ff35.json b/backend/.sqlx/query-ef59abddc518f5213827e47a31aee49be917a61c46916c29d79c094438b1ff35.json
new file mode 100644
index 0000000000..2a9c7cac4f
--- /dev/null
+++ b/backend/.sqlx/query-ef59abddc518f5213827e47a31aee49be917a61c46916c29d79c094438b1ff35.json
@@ -0,0 +1,47 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT id, path, created_at, created_by, value FROM resource_version\n         WHERE workspace_id = $1 AND id = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "created_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 3,
+        "name": "created_by",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 4,
+        "name": "value",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      true,
+      true
+    ]
+  },
+  "hash": "ef59abddc518f5213827e47a31aee49be917a61c46916c29d79c094438b1ff35"
+}
diff --git a/backend/.sqlx/query-f0858450021df721d8a48b1b5dc887c5424562acd9769c80c5899193ef16b56b.json b/backend/.sqlx/query-f0858450021df721d8a48b1b5dc887c5424562acd9769c80c5899193ef16b56b.json
index ad6028c14f..1bd565d00c 100644
--- a/backend/.sqlx/query-f0858450021df721d8a48b1b5dc887c5424562acd9769c80c5899193ef16b56b.json
+++ b/backend/.sqlx/query-f0858450021df721d8a48b1b5dc887c5424562acd9769c80c5899193ef16b56b.json
@@ -44,7 +44,8 @@
                 "java",
                 "duckdb",
                 "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-f0d8ebbf62a1d92f39c2f86a70236cece6d6c9e28cce9aff7fe5496bba569807.json b/backend/.sqlx/query-f0d8ebbf62a1d92f39c2f86a70236cece6d6c9e28cce9aff7fe5496bba569807.json
new file mode 100644
index 0000000000..912db1a932
--- /dev/null
+++ b/backend/.sqlx/query-f0d8ebbf62a1d92f39c2f86a70236cece6d6c9e28cce9aff7fe5496bba569807.json
@@ -0,0 +1,26 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT fork_last_event_kind, fork_last_event_origin FROM workspace_diff\n             WHERE fork_workspace_id = 'wm-fork-renamed' AND kind = 'script'\n               AND path = 'u/admin/inline' AND fork_last_event_kind IS NOT NULL",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "fork_last_event_kind",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "fork_last_event_origin",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      true,
+      true
+    ]
+  },
+  "hash": "f0d8ebbf62a1d92f39c2f86a70236cece6d6c9e28cce9aff7fe5496bba569807"
+}
diff --git a/backend/.sqlx/query-88a6a86285fcfaa778e9716d5072f555dff175feb704c3d825d6100defe91bce.json b/backend/.sqlx/query-f1a34561f208c05d75b2f981cd55465e579dd71a9439a2182ef05d9d3cfe462e.json
similarity index 83%
rename from backend/.sqlx/query-88a6a86285fcfaa778e9716d5072f555dff175feb704c3d825d6100defe91bce.json
rename to backend/.sqlx/query-f1a34561f208c05d75b2f981cd55465e579dd71a9439a2182ef05d9d3cfe462e.json
index 9097eb8584..81034a3861 100644
--- a/backend/.sqlx/query-88a6a86285fcfaa778e9716d5072f555dff175feb704c3d825d6100defe91bce.json
+++ b/backend/.sqlx/query-f1a34561f208c05d75b2f981cd55465e579dd71a9439a2182ef05d9d3cfe462e.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n        SELECT\n            workspace_id,\n            slack_team_id,\n            teams_team_id,\n            teams_team_name,\n            teams_team_guid,\n            slack_name,\n            slack_command_script,\n            teams_command_script,\n            slack_email,\n            slack_oauth_client_id,\n            slack_oauth_client_secret,\n            customer_id,\n            plan,\n            webhook,\n            ai_config,\n            large_file_storage,\n            datatable,\n            ducklake,\n            git_sync,\n            deploy_ui,\n            default_app,\n            default_scripts,\n            mute_critical_alerts,\n            color,\n            operator_settings,\n            git_app_installations,\n            auto_invite,\n            error_handler,\n            success_handler,\n            public_app_execution_limit_per_minute,\n            error_handler_fallback_to_instance_alerts\n        FROM\n            workspace_settings\n        WHERE\n            workspace_id = $1\n        ",
+  "query": "\n        SELECT\n            workspace_id,\n            slack_team_id,\n            teams_team_id,\n            teams_team_name,\n            teams_team_guid,\n            slack_name,\n            slack_command_script,\n            teams_command_script,\n            slack_email,\n            slack_oauth_client_id,\n            slack_oauth_client_secret,\n            customer_id,\n            plan,\n            webhook,\n            ai_config,\n            dbt_warehouses,\n            large_file_storage,\n            datatable,\n            ducklake,\n            git_sync,\n            deploy_ui,\n            default_app,\n            default_scripts,\n            mute_critical_alerts,\n            color,\n            operator_settings,\n            git_app_installations,\n            auto_invite,\n            error_handler,\n            success_handler,\n            public_app_execution_limit_per_minute,\n            error_handler_fallback_to_instance_alerts\n        FROM\n            workspace_settings\n        WHERE\n            workspace_id = $1\n        ",
   "describe": {
     "columns": [
       {
@@ -80,81 +80,86 @@
       },
       {
         "ordinal": 15,
-        "name": "large_file_storage",
+        "name": "dbt_warehouses",
         "type_info": "Jsonb"
       },
       {
         "ordinal": 16,
-        "name": "datatable",
+        "name": "large_file_storage",
         "type_info": "Jsonb"
       },
       {
         "ordinal": 17,
-        "name": "ducklake",
+        "name": "datatable",
         "type_info": "Jsonb"
       },
       {
         "ordinal": 18,
-        "name": "git_sync",
+        "name": "ducklake",
         "type_info": "Jsonb"
       },
       {
         "ordinal": 19,
-        "name": "deploy_ui",
+        "name": "git_sync",
         "type_info": "Jsonb"
       },
       {
         "ordinal": 20,
+        "name": "deploy_ui",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 21,
         "name": "default_app",
         "type_info": "Varchar"
       },
       {
-        "ordinal": 21,
+        "ordinal": 22,
         "name": "default_scripts",
         "type_info": "Jsonb"
       },
       {
-        "ordinal": 22,
+        "ordinal": 23,
         "name": "mute_critical_alerts",
         "type_info": "Bool"
       },
       {
-        "ordinal": 23,
+        "ordinal": 24,
         "name": "color",
         "type_info": "Varchar"
       },
       {
-        "ordinal": 24,
+        "ordinal": 25,
         "name": "operator_settings",
         "type_info": "Jsonb"
       },
       {
-        "ordinal": 25,
+        "ordinal": 26,
         "name": "git_app_installations",
         "type_info": "Jsonb"
       },
       {
-        "ordinal": 26,
+        "ordinal": 27,
         "name": "auto_invite",
         "type_info": "Jsonb"
       },
       {
-        "ordinal": 27,
+        "ordinal": 28,
         "name": "error_handler",
         "type_info": "Jsonb"
       },
       {
-        "ordinal": 28,
+        "ordinal": 29,
         "name": "success_handler",
         "type_info": "Jsonb"
       },
       {
-        "ordinal": 29,
+        "ordinal": 30,
         "name": "public_app_execution_limit_per_minute",
         "type_info": "Int4"
       },
       {
-        "ordinal": 30,
+        "ordinal": 31,
         "name": "error_handler_fallback_to_instance_alerts",
         "type_info": "Bool"
       }
@@ -190,6 +195,7 @@
       true,
       true,
       true,
+      true,
       false,
       true,
       true,
@@ -198,5 +204,5 @@
       false
     ]
   },
-  "hash": "88a6a86285fcfaa778e9716d5072f555dff175feb704c3d825d6100defe91bce"
+  "hash": "f1a34561f208c05d75b2f981cd55465e579dd71a9439a2182ef05d9d3cfe462e"
 }
diff --git a/backend/.sqlx/query-f1b13ed0a8b834b0a55bfc7ef6470c2a3aaef44f19fbff2673d7bbd9d9a9aca2.json b/backend/.sqlx/query-f1b13ed0a8b834b0a55bfc7ef6470c2a3aaef44f19fbff2673d7bbd9d9a9aca2.json
new file mode 100644
index 0000000000..43f0740aad
--- /dev/null
+++ b/backend/.sqlx/query-f1b13ed0a8b834b0a55bfc7ef6470c2a3aaef44f19fbff2673d7bbd9d9a9aca2.json
@@ -0,0 +1,41 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT created_by, runnable_path,\n                CASE WHEN kind = 'script' THEN runnable_id END AS script_hash,\n                -- Whether this job PARSED a graph of its own with no version\n                -- behind it: the dbt editor refreshing its buffer. That graph is\n                -- reachable no other way, so the job pins to it; every other\n                -- versionless job keeps answering with the workspace graph.\n                EXISTS (SELECT 1 FROM dbt_graph_snapshot g\n                         WHERE g.workspace_id = $2 AND g.job_id = $1\n                           AND g.script_hash IS NULL) AS \"editor_graph!\"\n           FROM v2_job WHERE id = $1 AND workspace_id = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "created_by",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "runnable_path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "script_hash",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 3,
+        "name": "editor_graph!",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      true,
+      null,
+      null
+    ]
+  },
+  "hash": "f1b13ed0a8b834b0a55bfc7ef6470c2a3aaef44f19fbff2673d7bbd9d9a9aca2"
+}
diff --git a/backend/.sqlx/query-f22cb6c5443352cfc826c122ff971df2b3725f8551baf29223b22f00f65495d4.json b/backend/.sqlx/query-f22cb6c5443352cfc826c122ff971df2b3725f8551baf29223b22f00f65495d4.json
new file mode 100644
index 0000000000..1c764c4987
--- /dev/null
+++ b/backend/.sqlx/query-f22cb6c5443352cfc826c122ff971df2b3725f8551baf29223b22f00f65495d4.json
@@ -0,0 +1,19 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes, fork_last_event_kind, fork_last_event_origin)\n            VALUES ($1, $2, $3, $4, 1, 0, NULL, $5, $6)\n            ON CONFLICT (source_workspace_id, fork_workspace_id, path, kind)\n            DO UPDATE SET\n                ahead = workspace_diff.ahead + 1,\n                has_changes = NULL,\n                fork_last_event_kind = CASE WHEN $6::varchar IS NULL THEN workspace_diff.fork_last_event_kind ELSE $5 END,\n                fork_last_event_origin = COALESCE($6, workspace_diff.fork_last_event_origin)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "f22cb6c5443352cfc826c122ff971df2b3725f8551baf29223b22f00f65495d4"
+}
diff --git a/backend/.sqlx/query-f2bd875385052618533c868bee309de8863a5d10a482f012ee790eda64e88211.json b/backend/.sqlx/query-f2bd875385052618533c868bee309de8863a5d10a482f012ee790eda64e88211.json
index 07191c20b8..197229bb4c 100644
--- a/backend/.sqlx/query-f2bd875385052618533c868bee309de8863a5d10a482f012ee790eda64e88211.json
+++ b/backend/.sqlx/query-f2bd875385052618533c868bee309de8863a5d10a482f012ee790eda64e88211.json
@@ -41,7 +41,8 @@
                 "java",
                 "duckdb",
                 "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
               ]
             }
           }
diff --git a/backend/.sqlx/query-f2fa27ed5020aa9c085176b25466be1bceb79c82e7b5542f17b23b6d70cc02d6.json b/backend/.sqlx/query-f2fa27ed5020aa9c085176b25466be1bceb79c82e7b5542f17b23b6d70cc02d6.json
index 12eceb0110..57d80d6aaa 100644
--- a/backend/.sqlx/query-f2fa27ed5020aa9c085176b25466be1bceb79c82e7b5542f17b23b6d70cc02d6.json
+++ b/backend/.sqlx/query-f2fa27ed5020aa9c085176b25466be1bceb79c82e7b5542f17b23b6d70cc02d6.json
@@ -39,7 +39,8 @@
                 "java",
                 "duckdb",
                 "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
               ]
             }
           }
@@ -86,7 +87,8 @@
                       "java",
                       "duckdb",
                       "ruby",
-                      "rlang"
+                      "rlang",
+                      "dbt"
                     ]
                   }
                 }
diff --git a/backend/.sqlx/query-f45962e947ae236266f8eb9b08ca6420ac7e0d548fb59473a2f7ac5be2ee5194.json b/backend/.sqlx/query-f45962e947ae236266f8eb9b08ca6420ac7e0d548fb59473a2f7ac5be2ee5194.json
new file mode 100644
index 0000000000..8cae250396
--- /dev/null
+++ b/backend/.sqlx/query-f45962e947ae236266f8eb9b08ca6420ac7e0d548fb59473a2f7ac5be2ee5194.json
@@ -0,0 +1,24 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT job_id FROM dbt_run_state\n          WHERE workspace_id = $1 AND script_path = $2 AND permissioned_as = $3",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "job_id",
+        "type_info": "Uuid"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "f45962e947ae236266f8eb9b08ca6420ac7e0d548fb59473a2f7ac5be2ee5194"
+}
diff --git a/backend/.sqlx/query-f5eedc14b082c88a1096e61279faa73793c99a2ab5793bebc5924146f60d19a8.json b/backend/.sqlx/query-f5eedc14b082c88a1096e61279faa73793c99a2ab5793bebc5924146f60d19a8.json
new file mode 100644
index 0000000000..0c2078f793
--- /dev/null
+++ b/backend/.sqlx/query-f5eedc14b082c88a1096e61279faa73793c99a2ab5793bebc5924146f60d19a8.json
@@ -0,0 +1,62 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT asset_kind AS \"asset_kind: windmill_common::assets::AssetKind\", asset_path,\n                    status::text AS \"status!\", row_count, error\n               FROM materialized_partition\n              WHERE workspace_id = $1 AND job_id = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "asset_kind: windmill_common::assets::AssetKind",
+        "type_info": {
+          "Custom": {
+            "name": "asset_kind",
+            "kind": {
+              "Enum": [
+                "s3object",
+                "resource",
+                "variable",
+                "ducklake",
+                "datatable",
+                "volume",
+                "dbt"
+              ]
+            }
+          }
+        }
+      },
+      {
+        "ordinal": 1,
+        "name": "asset_path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "status!",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 3,
+        "name": "row_count",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 4,
+        "name": "error",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      null,
+      true,
+      true
+    ]
+  },
+  "hash": "f5eedc14b082c88a1096e61279faa73793c99a2ab5793bebc5924146f60d19a8"
+}
diff --git a/backend/.sqlx/query-f60339bdf63e72c63df45530be4e13380720237a1a310d8acf5e975189981422.json b/backend/.sqlx/query-f60339bdf63e72c63df45530be4e13380720237a1a310d8acf5e975189981422.json
new file mode 100644
index 0000000000..ee7d298c23
--- /dev/null
+++ b/backend/.sqlx/query-f60339bdf63e72c63df45530be4e13380720237a1a310d8acf5e975189981422.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT on_behalf_of FROM script WHERE path = $1 AND workspace_id = $2 ORDER BY created_at DESC LIMIT 1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "on_behalf_of",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "f60339bdf63e72c63df45530be4e13380720237a1a310d8acf5e975189981422"
+}
diff --git a/backend/.sqlx/query-f6516385c2ff4691aa5b41ad72034b58f7f1deb9526d982ad7e91c2ac93c1f70.json b/backend/.sqlx/query-f6516385c2ff4691aa5b41ad72034b58f7f1deb9526d982ad7e91c2ac93c1f70.json
new file mode 100644
index 0000000000..4e3a7e9b7c
--- /dev/null
+++ b/backend/.sqlx/query-f6516385c2ff4691aa5b41ad72034b58f7f1deb9526d982ad7e91c2ac93c1f70.json
@@ -0,0 +1,19 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes, source_last_event_kind, source_last_event_origin)\n            SELECT $1, unnest($2::varchar[]), $3, $4, 0, 1, NULL, $5, $6\n            ON CONFLICT (source_workspace_id, fork_workspace_id, path, kind)\n            DO UPDATE SET\n                behind = workspace_diff.behind + 1,\n                has_changes = NULL,\n                source_last_event_kind = CASE WHEN $6::varchar IS NULL THEN workspace_diff.source_last_event_kind ELSE $5 END,\n                source_last_event_origin = COALESCE($6, workspace_diff.source_last_event_origin)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "VarcharArray",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "f6516385c2ff4691aa5b41ad72034b58f7f1deb9526d982ad7e91c2ac93c1f70"
+}
diff --git a/backend/.sqlx/query-f720dc3321c8a351655fbb774cc954c655e4368f7e496e7d05b6beeaf091db95.json b/backend/.sqlx/query-f720dc3321c8a351655fbb774cc954c655e4368f7e496e7d05b6beeaf091db95.json
new file mode 100644
index 0000000000..d5e8ddcdd5
--- /dev/null
+++ b/backend/.sqlx/query-f720dc3321c8a351655fbb774cc954c655e4368f7e496e7d05b6beeaf091db95.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT count(*) FROM dbt_node\n          WHERE workspace_id = $1 AND job_id = $2 AND script_hash IS NULL",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "count",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "f720dc3321c8a351655fbb774cc954c655e4368f7e496e7d05b6beeaf091db95"
+}
diff --git a/backend/.sqlx/query-fa160bec1a7eb688f95a5176f64983f5e92cb1e330a5f1611cd5c9ba0681dece.json b/backend/.sqlx/query-fa160bec1a7eb688f95a5176f64983f5e92cb1e330a5f1611cd5c9ba0681dece.json
new file mode 100644
index 0000000000..3c009edaff
--- /dev/null
+++ b/backend/.sqlx/query-fa160bec1a7eb688f95a5176f64983f5e92cb1e330a5f1611cd5c9ba0681dece.json
@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes, fork_last_event_kind, fork_last_event_origin)\n            VALUES ($1, $2, $3, $4, 1, 0, NULL, $5, $6)\n            ON CONFLICT (source_workspace_id, fork_workspace_id, path, kind)\n            DO UPDATE SET\n                ahead = workspace_diff.ahead + 1,\n                has_changes = NULL,\n                fork_last_event_kind = CASE WHEN $6::varchar IS NULL OR (NOT $7 AND workspace_diff.fork_last_event_origin IS NOT NULL) THEN workspace_diff.fork_last_event_kind ELSE $5 END,\n                fork_last_event_origin = CASE WHEN $6::varchar IS NULL OR (NOT $7 AND workspace_diff.fork_last_event_origin IS NOT NULL) THEN workspace_diff.fork_last_event_origin ELSE $6 END",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Bool"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "fa160bec1a7eb688f95a5176f64983f5e92cb1e330a5f1611cd5c9ba0681dece"
+}
diff --git a/backend/.sqlx/query-fad10d08b6a7fb4c6974a6dce79028f9bae1b9a9806c9efb2844f7e7e8196f5b.json b/backend/.sqlx/query-fad10d08b6a7fb4c6974a6dce79028f9bae1b9a9806c9efb2844f7e7e8196f5b.json
new file mode 100644
index 0000000000..6d0fdd1bd8
--- /dev/null
+++ b/backend/.sqlx/query-fad10d08b6a7fb4c6974a6dce79028f9bae1b9a9806c9efb2844f7e7e8196f5b.json
@@ -0,0 +1,32 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH live AS (\n             SELECT * FROM (\n               SELECT DISTINCT ON (s.path) s.path, s.hash\n                 FROM script s\n                WHERE $5::text IS NULL AND s.workspace_id = $1 AND s.language = 'dbt'\n                  AND ($3::bigint IS NULL OR s.hash = $3)\n                  AND ($3::bigint IS NOT NULL OR (s.deleted = false AND s.archived = false))\n                ORDER BY s.path, s.created_at DESC\n             ) cur\n             UNION ALL\n             SELECT $5::text, $3::bigint WHERE $5::text IS NOT NULL\n           ),\n           -- The run's own snapshot when it left one, the version's graph\n           -- otherwise. A static descriptor never snapshots, so all of its runs\n           -- fall through to the same rows. Existence comes from the marker, not\n           -- from a node row: a dynamic run that disabled every model has a\n           -- snapshot whose graph is legitimately empty.\n           chosen AS (\n             -- No visibility check on the job here: reaching this with a job at\n             -- all means the caller passed `require_job_read_access` for it, and\n             -- re-deciding it under plain RLS can only DISAGREE with that answer\n             -- — silently, by falling back to the deployed graph rather than\n             -- erroring. A share-link viewer is entitled to the run and would be\n             -- shown a different run's model set. See `asset_graph_for`.\n             SELECT CASE WHEN $4::uuid IS NOT NULL AND EXISTS (\n                      SELECT 1 FROM dbt_graph_snapshot g\n                       WHERE g.workspace_id = $1 AND g.job_id = $4)\n                    THEN $4::uuid\n                    ELSE '00000000-0000-0000-0000-000000000000'::uuid END AS job_id\n           )\n           SELECT p.asset_path AS \"from_path!\", c.asset_path AS \"to_path!\"\n             FROM dbt_edge e\n             JOIN live l ON l.path = e.script_path\n                        AND (e.script_hash = l.hash\n                             OR ($5::text IS NOT NULL AND l.hash IS NULL\n                                 AND e.script_hash IS NULL))\n             JOIN chosen ch ON ch.job_id = e.job_id\n             -- Gated the same way as the `live` joins above, and for the same\n             -- reason twice over: unpinned this folds to a plain equality the\n             -- versioned key can bound, and pinned it is the only way an editor\n             -- graph's NULL-to-NULL hashes meet at all.\n             JOIN dbt_node p ON p.workspace_id = e.workspace_id\n                            AND p.script_path = e.script_path\n                            AND (p.script_hash = e.script_hash\n                                 OR ($5::text IS NOT NULL AND e.script_hash IS NULL\n                                     AND p.script_hash IS NULL))\n                            AND p.job_id = ch.job_id\n                            AND p.unique_id = e.parent_unique_id\n             JOIN dbt_node c ON c.workspace_id = e.workspace_id\n                            AND c.script_path = e.script_path\n                            AND (c.script_hash = e.script_hash\n                                 OR ($5::text IS NOT NULL AND e.script_hash IS NULL\n                                     AND c.script_hash IS NULL))\n                            AND c.job_id = ch.job_id\n                            AND c.unique_id = e.child_unique_id\n            WHERE e.workspace_id = $1\n              AND p.asset_path IS NOT NULL AND c.asset_path IS NOT NULL\n              -- Tests attach to their model as a badge, not as a lineage edge.\n              AND c.resource_type <> 'test'\n              -- Scoped by the RELATIONS, like the node provenance above, not by\n              -- the producing script's folder: two tables consumed in this\n              -- folder but produced by a dbt project outside it would otherwise\n              -- both render with their `ref()` edge missing.\n              -- Same as the node scope: pinned, `asset` describes the CURRENT\n              -- deploy, so gating on it drops the edges of models this version\n              -- had and a later one removed. The pinned graph's own edges are\n              -- the answer.\n              AND ($3::bigint IS NOT NULL OR $5::text IS NOT NULL OR EXISTS (\n                SELECT 1 FROM asset a\n                 WHERE a.workspace_id = $1 AND a.kind = 'dbt'\n                   AND a.path = c.asset_path\n                   AND ($2::text IS NULL OR a.usage_path LIKE $2)))",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "from_path!",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 1,
+        "name": "to_path!",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Int8",
+        "Uuid",
+        "Text"
+      ]
+    },
+    "nullable": [
+      true,
+      true
+    ]
+  },
+  "hash": "fad10d08b6a7fb4c6974a6dce79028f9bae1b9a9806c9efb2844f7e7e8196f5b"
+}
diff --git a/backend/.sqlx/query-fb2a7f9b797a45351439746e1478545c969d995dc02aaf6673183a73cab67179.json b/backend/.sqlx/query-fb2a7f9b797a45351439746e1478545c969d995dc02aaf6673183a73cab67179.json
new file mode 100644
index 0000000000..d74c17a1ed
--- /dev/null
+++ b/backend/.sqlx/query-fb2a7f9b797a45351439746e1478545c969d995dc02aaf6673183a73cab67179.json
@@ -0,0 +1,24 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT job_id FROM dbt_run_state\n              WHERE workspace_id = $1 AND script_path = $2 AND permissioned_as = $3",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "job_id",
+        "type_info": "Uuid"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "fb2a7f9b797a45351439746e1478545c969d995dc02aaf6673183a73cab67179"
+}
diff --git a/backend/.sqlx/query-fb3f9cfbe874a1f19ccf54660496532ad995ba641f0833babe5d5d597fedd55a.json b/backend/.sqlx/query-fb3f9cfbe874a1f19ccf54660496532ad995ba641f0833babe5d5d597fedd55a.json
new file mode 100644
index 0000000000..d2d36be4a5
--- /dev/null
+++ b/backend/.sqlx/query-fb3f9cfbe874a1f19ccf54660496532ad995ba641f0833babe5d5d597fedd55a.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT COALESCE(\n            (SELECT username FROM usr WHERE workspace_id = $1 AND email = $2),\n            (SELECT COALESCE(username, email) FROM password WHERE email = $2 AND super_admin = true)\n        )",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "coalesce",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "fb3f9cfbe874a1f19ccf54660496532ad995ba641f0833babe5d5d597fedd55a"
+}
diff --git a/backend/.sqlx/query-fc4583d1570f3a2a428bb28390ca72e61719fae68aa4b42730f9076f3bd97441.json b/backend/.sqlx/query-fc4583d1570f3a2a428bb28390ca72e61719fae68aa4b42730f9076f3bd97441.json
deleted file mode 100644
index 484dd23e2a..0000000000
--- a/backend/.sqlx/query-fc4583d1570f3a2a428bb28390ca72e61719fae68aa4b42730f9076f3bd97441.json
+++ /dev/null
@@ -1,29 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT req.id AS \"id!\",\n                (CASE\n                    WHEN usr.email IS NULL THEN 'deleted'\n                    WHEN workspace.deleted THEN 'archived'\n                    ELSE 'active'\n                END) AS \"status!\"\n         FROM unnest($1::text[]) AS req(id)\n         LEFT JOIN workspace ON workspace.id = req.id\n         LEFT JOIN usr ON usr.workspace_id = workspace.id AND usr.email = $2",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id!",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 1,
-        "name": "status!",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "TextArray",
-        "Text"
-      ]
-    },
-    "nullable": [
-      null,
-      null
-    ]
-  },
-  "hash": "fc4583d1570f3a2a428bb28390ca72e61719fae68aa4b42730f9076f3bd97441"
-}
diff --git a/backend/.sqlx/query-fcca85a3f80bac6c7c1e6e53bc514c050960c7f8f515c0e601ef486c68c7fcfd.json b/backend/.sqlx/query-fcca85a3f80bac6c7c1e6e53bc514c050960c7f8f515c0e601ef486c68c7fcfd.json
new file mode 100644
index 0000000000..777b03cc41
--- /dev/null
+++ b/backend/.sqlx/query-fcca85a3f80bac6c7c1e6e53bc514c050960c7f8f515c0e601ef486c68c7fcfd.json
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO script (workspace_id, path, hash, content, summary, description, language, created_by, created_at, on_behalf_of)\n         VALUES\n         ('test-workspace', 'u/test-user/obo_member', 91001, 'def main(): pass', '', '', 'python3', 'test-user', NOW(), 'u/test-user'),\n         ('test-workspace', 'u/test-user/obo_stranger', 91002, 'def main(): pass', '', '', 'python3', 'test-user', NOW(), 'u/test-user-2'),\n         ('test-workspace', 'u/test-user/obo_group', 91003, 'def main(): pass', '', '', 'python3', 'test-user', NOW(), 'g/all'),\n         ('test-workspace', 'u/test-user/obo_superadmin', 91004, 'def main(): pass', '', '', 'python3', 'test-user', NOW(), 'u/ext-sa')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "fcca85a3f80bac6c7c1e6e53bc514c050960c7f8f515c0e601ef486c68c7fcfd"
+}
diff --git a/backend/.sqlx/query-fd790067c02d384aead5ff8f94efb37cc20d2f7a3749d21a1de5642e888b5f42.json b/backend/.sqlx/query-fd790067c02d384aead5ff8f94efb37cc20d2f7a3749d21a1de5642e888b5f42.json
deleted file mode 100644
index a39ccd7796..0000000000
--- a/backend/.sqlx/query-fd790067c02d384aead5ff8f94efb37cc20d2f7a3749d21a1de5642e888b5f42.json
+++ /dev/null
@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE resource SET value = $1, edited_at = now() WHERE path = $2 AND workspace_id = $3",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Jsonb",
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "fd790067c02d384aead5ff8f94efb37cc20d2f7a3749d21a1de5642e888b5f42"
-}
diff --git a/backend/.sqlx/query-fddab529cbb59c1dd621113a1018457546eeeaba57f5dd3abac948d60ecd952f.json b/backend/.sqlx/query-fddab529cbb59c1dd621113a1018457546eeeaba57f5dd3abac948d60ecd952f.json
new file mode 100644
index 0000000000..35c401fdef
--- /dev/null
+++ b/backend/.sqlx/query-fddab529cbb59c1dd621113a1018457546eeeaba57f5dd3abac948d60ecd952f.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO dbt_graph_snapshot (workspace_id, script_path, script_hash, job_id, digest)\n         VALUES ($1, $2, NULL, $3, 'd')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Uuid"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "fddab529cbb59c1dd621113a1018457546eeeaba57f5dd3abac948d60ecd952f"
+}
diff --git a/backend/.sqlx/query-ff244d58f154fc3132205fbb8374f01ceb707d9ae0b02bf382d4f5dca73829e2.json b/backend/.sqlx/query-ff244d58f154fc3132205fbb8374f01ceb707d9ae0b02bf382d4f5dca73829e2.json
new file mode 100644
index 0000000000..13ed472958
--- /dev/null
+++ b/backend/.sqlx/query-ff244d58f154fc3132205fbb8374f01ceb707d9ae0b02bf382d4f5dca73829e2.json
@@ -0,0 +1,25 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT digest FROM dbt_graph_snapshot\n              WHERE workspace_id = $1 AND script_path = $2 AND script_hash = $3\n                AND job_id = $4",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "digest",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Int8",
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "ff244d58f154fc3132205fbb8374f01ceb707d9ae0b02bf382d4f5dca73829e2"
+}
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 7dd3c795aa..d406dc6dcb 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -100,9 +100,9 @@ dependencies = [
 
 [[package]]
 name = "aho-corasick"
-version = "1.1.4"
+version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
+checksum = "c982642fa9e8606056828ee9a8505737230110bb1099153c79efe865c59d12ba"
 dependencies = [
  "memchr",
 ]
@@ -178,9 +178,9 @@ dependencies = [
 
 [[package]]
 name = "android_system_properties"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+checksum = "ae221649c9976a6f6c56ae1facf410f3ddb33cc661c4b7b61020a912d4237fbc"
 dependencies = [
  "libc",
 ]
@@ -243,11 +243,11 @@ checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
 
 [[package]]
 name = "ar_archive_writer"
-version = "0.5.2"
+version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4087686b4b0a3427190bae57a1d9a478dbb2d40c5dc1bd6e2b6d797913bdd348"
+checksum = "73cd58deff2140a0a8eae87e417bd01db68a33e148aa93d1e8cd837e55e312b6"
 dependencies = [
- "object",
+ "object 0.39.1",
 ]
 
 [[package]]
@@ -803,7 +803,7 @@ checksum = "850b60ddcc664dcd848f8a2fa8436ab9336e051d6dd2b3f21f897dd8e9c24703"
 dependencies = [
  "base64 0.22.1",
  "bytes",
- "http 1.4.2",
+ "http 1.5.0",
  "rand 0.8.5",
  "reqwest 0.12.28",
  "serde",
@@ -953,7 +953,7 @@ dependencies = [
  "bytes",
  "fastrand 2.5.0",
  "hex",
- "http 1.4.2",
+ "http 1.5.0",
  "ring 0.17.14",
  "time",
  "tokio",
@@ -1016,7 +1016,7 @@ dependencies = [
  "bytes",
  "bytes-utils",
  "fastrand 2.5.0",
- "http 1.4.2",
+ "http 1.5.0",
  "http-body 1.1.0",
  "percent-encoding",
  "pin-project-lite",
@@ -1043,7 +1043,7 @@ dependencies = [
  "bytes",
  "fastrand 2.5.0",
  "http 0.2.12",
- "http 1.4.2",
+ "http 1.5.0",
  "regex-lite",
  "tracing",
 ]
@@ -1118,7 +1118,7 @@ dependencies = [
  "aws-types",
  "fastrand 2.5.0",
  "http 0.2.12",
- "http 1.4.2",
+ "http 1.5.0",
  "regex-lite",
  "tracing",
  "url",
@@ -1143,7 +1143,7 @@ dependencies = [
  "bytes",
  "fastrand 2.5.0",
  "http 0.2.12",
- "http 1.4.2",
+ "http 1.5.0",
  "regex-lite",
  "tracing",
 ]
@@ -1189,7 +1189,7 @@ dependencies = [
  "bytes",
  "fastrand 2.5.0",
  "http 0.2.12",
- "http 1.4.2",
+ "http 1.5.0",
  "regex-lite",
  "tracing",
 ]
@@ -1213,7 +1213,7 @@ dependencies = [
  "bytes",
  "fastrand 2.5.0",
  "http 0.2.12",
- "http 1.4.2",
+ "http 1.5.0",
  "regex-lite",
  "tracing",
 ]
@@ -1257,7 +1257,7 @@ dependencies = [
  "hex",
  "hmac",
  "http 0.2.12",
- "http 1.4.2",
+ "http 1.5.0",
  "percent-encoding",
  "sha2 0.10.9",
  "time",
@@ -1300,7 +1300,7 @@ dependencies = [
  "futures-core",
  "futures-util",
  "http 0.2.12",
- "http 1.4.2",
+ "http 1.5.0",
  "http-body 0.4.6",
  "percent-encoding",
  "pin-project-lite",
@@ -1320,7 +1320,7 @@ dependencies = [
  "bytes-utils",
  "futures-core",
  "futures-util",
- "http 1.4.2",
+ "http 1.5.0",
  "http-body 1.1.0",
  "http-body-util",
  "percent-encoding",
@@ -1341,7 +1341,7 @@ dependencies = [
  "h2 0.3.27",
  "h2 0.4.15",
  "http 0.2.12",
- "http 1.4.2",
+ "http 1.5.0",
  "http-body 0.4.6",
  "hyper 0.14.32",
  "hyper 1.11.0",
@@ -1411,7 +1411,7 @@ dependencies = [
  "bytes",
  "fastrand 2.5.0",
  "http 0.2.12",
- "http 1.4.2",
+ "http 1.5.0",
  "http-body 0.4.6",
  "http-body 1.1.0",
  "http-body-util",
@@ -1431,7 +1431,7 @@ dependencies = [
  "aws-smithy-types",
  "bytes",
  "http 0.2.12",
- "http 1.4.2",
+ "http 1.5.0",
  "pin-project-lite",
  "tokio",
  "tracing",
@@ -1449,7 +1449,7 @@ dependencies = [
  "bytes-utils",
  "futures-core",
  "http 0.2.12",
- "http 1.4.2",
+ "http 1.5.0",
  "http-body 0.4.6",
  "http-body 1.1.0",
  "http-body-util",
@@ -1507,7 +1507,7 @@ dependencies = [
  "axum-core 0.4.5",
  "bytes",
  "futures-util",
- "http 1.4.2",
+ "http 1.5.0",
  "http-body 1.1.0",
  "http-body-util",
  "itoa",
@@ -1535,7 +1535,7 @@ dependencies = [
  "bytes",
  "form_urlencoded",
  "futures-util",
- "http 1.4.2",
+ "http 1.5.0",
  "http-body 1.1.0",
  "http-body-util",
  "hyper 1.11.0",
@@ -1568,7 +1568,7 @@ dependencies = [
  "async-trait",
  "bytes",
  "futures-util",
- "http 1.4.2",
+ "http 1.5.0",
  "http-body 1.1.0",
  "http-body-util",
  "mime",
@@ -1587,7 +1587,7 @@ checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
 dependencies = [
  "bytes",
  "futures-core",
- "http 1.4.2",
+ "http 1.5.0",
  "http-body 1.1.0",
  "http-body-util",
  "mime",
@@ -1636,7 +1636,7 @@ dependencies = [
  "cfg-if",
  "libc",
  "miniz_oxide",
- "object",
+ "object 0.37.3",
  "rustc-demangle",
  "windows-link 0.2.1",
 ]
@@ -1671,6 +1671,12 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
+[[package]]
+name = "base64"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
+
 [[package]]
 name = "base64-simd"
 version = "0.8.0"
@@ -1826,9 +1832,9 @@ dependencies = [
 
 [[package]]
 name = "blake3"
-version = "1.8.5"
+version = "1.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0aa83c34e62843d924f905e0f5c866eb1dd6545fc4d719e803d9ba6030371fce"
+checksum = "76ae7bad254120e9e4c63bafc385310756f90c484eac0e36b8317cf09cb92a77"
 dependencies = [
  "arrayref",
  "arrayvec",
@@ -1907,7 +1913,7 @@ dependencies = [
  "futures-core",
  "futures-util",
  "hex",
- "http 1.4.2",
+ "http 1.5.0",
  "http-body-util",
  "hyper 1.11.0",
  "hyper-named-pipe",
@@ -2123,13 +2129,13 @@ dependencies = [
 
 [[package]]
 name = "bytemuck_derive"
-version = "1.11.0"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f65693059b6b9c588b9f62fed1cedbf0a8b805631457ea162d68f0de186f3de5"
+checksum = "fc0e56a716f1e132ff6bf4bdac1c944a3fcdc1cae65f70a4a2a1ac3b401d2d1f"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.3",
 ]
 
 [[package]]
@@ -2270,6 +2276,12 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "cast"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"
+
 [[package]]
 name = "castaway"
 version = "0.2.4"
@@ -2306,12 +2318,6 @@ version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4f4c707c6a209cbe82d10abd08e1ea8995e9ea937d2550646e02798948992be0"
 
-[[package]]
-name = "cesu8"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c"
-
 [[package]]
 name = "cexpr"
 version = "0.6.0"
@@ -2399,9 +2405,9 @@ dependencies = [
 
 [[package]]
 name = "clang-sys"
-version = "1.8.1"
+version = "1.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b023947811758c97c59bf9d1c188fd619ad4718dcaa767947df1cadb14f39f4"
+checksum = "157a8ba7b480713b56f4c09fd13fc3e0a22a5dfab8097ba61cbc5feef950788a"
 dependencies = [
  "glob",
  "libc",
@@ -2410,9 +2416,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.6.4"
+version = "4.6.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d91e0c145792ef73a6ad36d27c75ac09f1832222a3c209689d90f534685ee5b7"
+checksum = "473c7e07f409a8d772161724aa8db6a765a2532a70f9667eeb7b49d3d02fbdca"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -2420,9 +2426,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.6.2"
+version = "4.6.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f09628afdcc538b57f3c6341e9c8e9970f18e4a481690a64974d7023bd33548b"
+checksum = "7b48fea5a88e9ae728a2dcbedbfc0e730f7d60da42e1cb049a83c9fb8b789889"
 dependencies = [
  "anstream",
  "anstyle",
@@ -2933,6 +2939,16 @@ dependencies = [
  "darling_macro 0.23.0",
 ]
 
+[[package]]
+name = "darling"
+version = "0.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88490bf1b990d87eaaa7ac8aa887f629a08e7359765b4911faf63c3763347d23"
+dependencies = [
+ "darling_core 0.24.0",
+ "darling_macro 0.24.0",
+]
+
 [[package]]
 name = "darling_core"
 version = "0.13.4"
@@ -2988,6 +3004,19 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "darling_core"
+version = "0.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "084e274f91c482280130e1e34e0b8d6e66776a060d7b6de7b84289ca778868c4"
+dependencies = [
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim 0.11.1",
+ "syn 3.0.3",
+]
+
 [[package]]
 name = "darling_macro"
 version = "0.13.4"
@@ -3032,6 +3061,17 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "darling_macro"
+version = "0.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68f5792fa0d41cd2325ce0ffa64f0a340eaebd4971a3a0c5e1ffd2cc488a355e"
+dependencies = [
+ "darling_core 0.24.0",
+ "quote",
+ "syn 3.0.3",
+]
+
 [[package]]
 name = "dashmap"
 version = "6.2.1"
@@ -3048,9 +3088,9 @@ dependencies = [
 
 [[package]]
 name = "data-encoding"
-version = "2.11.0"
+version = "2.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8"
+checksum = "4583a4551df46e2792f82ceeac45e850d2e2d5debba0b91f102385cda5b11f06"
 
 [[package]]
 name = "data-url"
@@ -3889,7 +3929,7 @@ dependencies = [
  "error_reporter",
  "h2 0.4.15",
  "hickory-resolver",
- "http 1.4.2",
+ "http 1.5.0",
  "http-body-util",
  "hyper 1.11.0",
  "hyper-rustls 0.27.9",
@@ -4720,22 +4760,22 @@ dependencies = [
 
 [[package]]
 name = "enum-ordinalize"
-version = "4.4.1"
+version = "4.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07f808d588c10e464ea6f7d3eaed500049eff30aaac103460f61828c2d65b3eb"
+checksum = "89dd01549b09589510cf0647475075d12071456586d70f5c75c98ae2a5537677"
 dependencies = [
  "enum-ordinalize-derive",
 ]
 
 [[package]]
 name = "enum-ordinalize-derive"
-version = "4.4.1"
+version = "4.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42e528e2d34ba8a67a1a650b86beae8ef69fc5fdb638016f386b973226590432"
+checksum = "a65863d15a4ce2888bd2f0f543cc963d3879c3a022c8ee43f6141d479a3ac815"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.3",
 ]
 
 [[package]]
@@ -5515,9 +5555,9 @@ checksum = "e4eba85ea1d0a966a983acd07deee566e67395d2d96b6fb39e62b5a833f1eb0b"
 
 [[package]]
 name = "globset"
-version = "0.4.19"
+version = "0.4.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e47d37d2ae4464254884b60ab7071be2b876a9c35b696bd018ddcc76847309cd"
+checksum = "07c34a9410465b45bd9787443bc7370f37735bad04b0f0cd57ff1a3186c98988"
 dependencies = [
  "aho-corasick",
  "bstr",
@@ -5567,7 +5607,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "de13e62d7e0ffc3eb40a0113ddf753cf6ec741be739164442b08893db4f9bfca"
 dependencies = [
  "google-cloud-token",
- "http 1.4.2",
+ "http 1.5.0",
  "thiserror 1.0.69",
  "tokio",
  "tokio-retry2",
@@ -5688,7 +5728,7 @@ dependencies = [
  "fnv",
  "futures-core",
  "futures-sink",
- "http 1.4.2",
+ "http 1.5.0",
  "indexmap 2.14.0",
  "slab",
  "tokio",
@@ -5795,7 +5835,7 @@ dependencies = [
  "base64 0.22.1",
  "bytes",
  "headers-core",
- "http 1.4.2",
+ "http 1.5.0",
  "httpdate",
  "mime",
  "sha1",
@@ -5807,7 +5847,7 @@ version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "54b4a22553d4242c49fddb9ba998a99962b5cc6f22cb5a3482bec22522403ce4"
 dependencies = [
- "http 1.4.2",
+ "http 1.5.0",
 ]
 
 [[package]]
@@ -5842,7 +5882,7 @@ checksum = "629d8f3bbeda9d148036d6b0de0a3ab947abd08ce90626327fc3547a49d59d97"
 dependencies = [
  "dirs 6.0.0",
  "futures",
- "http 1.4.2",
+ "http 1.5.0",
  "indicatif",
  "libc",
  "log",
@@ -5976,9 +6016,9 @@ dependencies = [
 
 [[package]]
 name = "http"
-version = "1.4.2"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6970f50e31d6fc17d3fa27329444bfa74e196cf62e95052a3f6fee181dba6425"
+checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0"
 dependencies = [
  "bytes",
  "itoa",
@@ -6002,7 +6042,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c"
 dependencies = [
  "bytes",
- "http 1.4.2",
+ "http 1.5.0",
 ]
 
 [[package]]
@@ -6013,7 +6053,7 @@ checksum = "e9f41fd6a08e4d4ec69df65976da761afd5ad5e58a9d4acb46bd1c953a9e3ff2"
 dependencies = [
  "bytes",
  "futures-core",
- "http 1.4.2",
+ "http 1.5.0",
  "http-body 1.1.0",
  "pin-project-lite",
 ]
@@ -6039,7 +6079,7 @@ dependencies = [
  "async-compression",
  "bstr",
  "futures",
- "http 1.4.2",
+ "http 1.5.0",
  "http-body-util",
  "hyper 1.11.0",
  "hyper-rustls 0.26.0",
@@ -6100,7 +6140,7 @@ dependencies = [
  "futures-channel",
  "futures-core",
  "h2 0.4.15",
- "http 1.4.2",
+ "http 1.5.0",
  "http-body 1.1.0",
  "httparse",
  "httpdate",
@@ -6120,7 +6160,7 @@ dependencies = [
  "bytes",
  "futures-util",
  "headers",
- "http 1.4.2",
+ "http 1.5.0",
  "hyper 1.11.0",
  "hyper-rustls 0.27.9",
  "hyper-util",
@@ -6167,7 +6207,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a0bea761b46ae2b24eb4aef630d8d1c398157b6fc29e6350ecf090a0b70c952c"
 dependencies = [
  "futures-util",
- "http 1.4.2",
+ "http 1.5.0",
  "hyper 1.11.0",
  "hyper-util",
  "log",
@@ -6185,7 +6225,7 @@ version = "0.27.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
 dependencies = [
- "http 1.4.2",
+ "http 1.5.0",
  "hyper 1.11.0",
  "hyper-util",
  "log",
@@ -6251,7 +6291,7 @@ dependencies = [
  "bytes",
  "futures-channel",
  "futures-util",
- "http 1.4.2",
+ "http 1.5.0",
  "http-body 1.1.0",
  "hyper 1.11.0",
  "ipnet",
@@ -6527,9 +6567,9 @@ dependencies = [
 
 [[package]]
 name = "ipnet"
-version = "2.12.0"
+version = "2.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
+checksum = "6a756c3fac73139e83f14c2d742155dd2b78d3ee56597b419a0579b7bdd6dd78"
 
 [[package]]
 name = "ipnetwork"
@@ -6608,27 +6648,32 @@ checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
 [[package]]
 name = "jni"
-version = "0.21.1"
+version = "0.22.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a87aa2bb7d2af34197c04845522473242e1aa17c12f4935d5856491a7fb8c97"
+checksum = "5efd9a482cf3a427f00d6b35f14332adc7902ce91efb778580e180ff90fa3498"
 dependencies = [
- "cesu8",
  "cfg-if",
  "combine",
- "jni-sys 0.3.1",
+ "jni-macros",
+ "jni-sys",
  "log",
- "thiserror 1.0.69",
+ "simd_cesu8",
+ "thiserror 2.0.19",
  "walkdir",
- "windows-sys 0.45.0",
+ "windows-link 0.2.1",
 ]
 
 [[package]]
-name = "jni-sys"
-version = "0.3.1"
+name = "jni-macros"
+version = "0.22.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41a652e1f9b6e0275df1f15b32661cf0d4b78d4d87ddec5e0c3c20f097433258"
+checksum = "a00109accc170f0bdb141fed3e393c565b6f5e072365c3bd58f5b062591560a3"
 dependencies = [
- "jni-sys 0.4.1",
+ "proc-macro2",
+ "quote",
+ "rustc_version 0.4.1",
+ "simd_cesu8",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -6662,11 +6707,12 @@ dependencies = [
 
 [[package]]
 name = "js-sys"
-version = "0.3.80"
+version = "0.3.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "852f13bec5eba4ba9afbeb93fd7c13fe56147f055939ae21c43a29a0ecb2702e"
+checksum = "53b44bfcdb3f8d5837a46dae1ca9660a837176eee74a28b229bc626816589102"
 dependencies = [
- "once_cell",
+ "cfg-if",
+ "futures-util",
  "wasm-bindgen",
 ]
 
@@ -6782,9 +6828,9 @@ checksum = "a4933f3f57a8e9d9da04db23fb153356ecaf00cbd14aee46279c33dc80925c37"
 
 [[package]]
 name = "kstat-rs"
-version = "0.2.4"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "27964e4632377753acb0898ce6f28770d50cbca1339200ae63d700cff97b5c2b"
+checksum = "52d0786643a0b49f595bd1fc81e1c1aa7bad8555bc820c6892f4d28cb20cf210"
 dependencies = [
  "libc",
  "thiserror 1.0.69",
@@ -6815,7 +6861,7 @@ dependencies = [
  "either",
  "futures",
  "home",
- "http 1.4.2",
+ "http 1.5.0",
  "http-body 1.1.0",
  "http-body-util",
  "hyper 1.11.0",
@@ -6849,7 +6895,7 @@ dependencies = [
  "chrono",
  "derive_more 2.1.1",
  "form_urlencoded",
- "http 1.4.2",
+ "http 1.5.0",
  "json-patch",
  "k8s-openapi",
  "schemars 0.8.22",
@@ -7066,9 +7112,9 @@ dependencies = [
 
 [[package]]
 name = "libredox"
-version = "0.1.18"
+version = "0.1.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c943259e342f1e06ff2da7a83eabdfe7f92ce10262688dbf1895ff0b3e6e4652"
+checksum = "2026a5056764a10b2bf5d56488cba40da507f5493a6a429340e2004d9ed085fa"
 dependencies = [
  "bitflags 2.13.1",
  "libc",
@@ -7200,9 +7246,9 @@ dependencies = [
 
 [[package]]
 name = "lru"
-version = "0.18.1"
+version = "0.18.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b6180140927ee907000b0aa540091f6ea512ead4447c92b8fc35bc72788a5a6"
+checksum = "5d2f2f9b4ba7e6b24d95e7e899329d35be83bcded72c8540cdd5368932d1d90a"
 dependencies = [
  "hashbrown 0.17.1",
 ]
@@ -7265,19 +7311,19 @@ checksum = "dae608c151f68243f2b000364e1f7b186d9c29845f7d2d85bd31b9ad77ad552b"
 
 [[package]]
 name = "macro_rules_attribute"
-version = "0.2.2"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65049d7923698040cd0b1ddcced9b0eb14dd22c5f86ae59c3740eab64a676520"
+checksum = "b3ae8f6d608c795738406608304d30a2dfbdc8e58e44f7ba43236da5208ded3c"
 dependencies = [
  "macro_rules_attribute-proc_macro",
- "paste",
+ "pastey",
 ]
 
 [[package]]
 name = "macro_rules_attribute-proc_macro"
-version = "0.2.2"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "670fdfda89751bc4a84ac13eaa63e205cf0fd22b4c9a5fbfa085b63c1f1d3a30"
+checksum = "fc04a4c58212d57930a24bf47d3fa87485264a3a054e9c10e042eb373573ad3c"
 
 [[package]]
 name = "magic-crypt"
@@ -7640,7 +7686,7 @@ dependencies = [
  "bytes",
  "encoding_rs",
  "futures-util",
- "http 1.4.2",
+ "http 1.5.0",
  "httparse",
  "memchr",
  "mime",
@@ -7686,7 +7732,7 @@ dependencies = [
  "futures-sink",
  "futures-util",
  "keyed_priority_queue",
- "lru 0.18.1",
+ "lru 0.18.2",
  "mysql_common",
  "native-tls",
  "pem 3.0.6",
@@ -8147,7 +8193,7 @@ dependencies = [
  "base64 0.22.1",
  "chrono",
  "getrandom 0.2.17",
- "http 1.4.2",
+ "http 1.5.0",
  "rand 0.8.5",
  "reqwest 0.12.28",
  "serde",
@@ -8167,6 +8213,15 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "object"
+version = "0.39.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e5a6c098c7a3b6547378093f5cc30bc54fd361ce711e05293a5cc589562739b"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "object_store"
 version = "0.12.0"
@@ -8178,7 +8233,7 @@ dependencies = [
  "chrono",
  "form_urlencoded",
  "futures",
- "http 1.4.2",
+ "http 1.5.0",
  "http-body-util",
  "httparse",
  "humantime",
@@ -8277,6 +8332,12 @@ dependencies = [
  "pkg-config",
 ]
 
+[[package]]
+name = "oorandom"
+version = "11.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6790f58c7ff633d8771f42965289203411a5e5c68388703c06e14f24770b41e"
+
 [[package]]
 name = "opaque-debug"
 version = "0.3.1"
@@ -8294,7 +8355,7 @@ dependencies = [
  "dyn-clone",
  "ed25519-dalek",
  "hmac",
- "http 1.4.2",
+ "http 1.5.0",
  "itertools 0.10.5",
  "log",
  "oauth2",
@@ -8421,7 +8482,7 @@ checksum = "10a8a7f5f6ba7c1b286c2fbca0454eaba116f63bbe69ed250b642d36fbb04d80"
 dependencies = [
  "async-trait",
  "bytes",
- "http 1.4.2",
+ "http 1.5.0",
  "opentelemetry 0.27.1",
 ]
 
@@ -8433,7 +8494,7 @@ checksum = "50f6639e842a97dbea8886e3439710ae463120091e2e064518ba8e716e6ac36d"
 dependencies = [
  "async-trait",
  "bytes",
- "http 1.4.2",
+ "http 1.5.0",
  "opentelemetry 0.30.0",
  "reqwest 0.12.28",
 ]
@@ -8446,7 +8507,7 @@ checksum = "91cf61a1868dacc576bf2b2a1c3e9ab150af7272909e80085c3173384fe11f76"
 dependencies = [
  "async-trait",
  "futures-core",
- "http 1.4.2",
+ "http 1.5.0",
  "opentelemetry 0.27.1",
  "opentelemetry-http 0.27.0",
  "opentelemetry-proto 0.27.0",
@@ -8465,7 +8526,7 @@ version = "0.30.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dbee664a43e07615731afc539ca60c6d9f1a9425e25ca09c57bc36c87c55852b"
 dependencies = [
- "http 1.4.2",
+ "http 1.5.0",
  "opentelemetry 0.30.0",
  "opentelemetry-http 0.30.0",
  "opentelemetry-proto 0.30.0",
@@ -9453,9 +9514,9 @@ dependencies = [
 
 [[package]]
 name = "psm"
-version = "0.1.31"
+version = "0.1.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "645dbe486e346d9b5de3ef16ede18c26e6c70ad97418f4874b8b1889d6e761ea"
+checksum = "4dcd034599e63b970727f70d79e02d62390a4a84f7c6b827c27c46d5ac3fa622"
 dependencies = [
  "ar_archive_writer",
  "cc",
@@ -9983,9 +10044,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.16"
+version = "0.4.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fcfdb36bda0c880c5931cdc7a2bcdc8ba4556847b9d912bca70bc94708711ad"
+checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -10041,7 +10102,7 @@ dependencies = [
  "futures-core",
  "futures-util",
  "h2 0.4.15",
- "http 1.4.2",
+ "http 1.5.0",
  "http-body 1.1.0",
  "http-body-util",
  "hyper 1.11.0",
@@ -10072,16 +10133,16 @@ dependencies = [
  "url",
  "wasm-bindgen",
  "wasm-bindgen-futures",
- "wasm-streams",
+ "wasm-streams 0.4.2",
  "web-sys",
  "webpki-roots 1.0.9",
 ]
 
 [[package]]
 name = "reqwest"
-version = "0.13.1"
+version = "0.13.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04e9018c9d814e5f30cc16a0f03271aeab3571e609612d9fe78c1aa8d11c2f62"
+checksum = "219c5811de6525e5416c7d5d53bb656d3afdbc6c5af816e0802bcfa42dbdc1c3"
 dependencies = [
  "base64 0.22.1",
  "bytes",
@@ -10089,7 +10150,7 @@ dependencies = [
  "futures-core",
  "futures-util",
  "h2 0.4.15",
- "http 1.4.2",
+ "http 1.5.0",
  "http-body 1.1.0",
  "http-body-util",
  "hyper 1.11.0",
@@ -10118,7 +10179,7 @@ dependencies = [
  "url",
  "wasm-bindgen",
  "wasm-bindgen-futures",
- "wasm-streams",
+ "wasm-streams 0.5.0",
  "web-sys",
 ]
 
@@ -10130,8 +10191,8 @@ checksum = "07bc3f1384cffa4f274dad2d4ddd73aed32fed8f786d96c6be8aa4e5fd3c3b58"
 dependencies = [
  "anyhow",
  "async-trait",
- "http 1.4.2",
- "reqwest 0.13.1",
+ "http 1.5.0",
+ "reqwest 0.13.4",
  "serde",
  "thiserror 2.0.19",
  "tower-service",
@@ -10147,9 +10208,9 @@ dependencies = [
  "async-trait",
  "futures",
  "getrandom 0.2.17",
- "http 1.4.2",
+ "http 1.5.0",
  "hyper 1.11.0",
- "reqwest 0.13.1",
+ "reqwest 0.13.4",
  "reqwest-middleware",
  "retry-policies",
  "thiserror 2.0.19",
@@ -10243,24 +10304,23 @@ dependencies = [
 
 [[package]]
 name = "rmcp"
-version = "0.15.0"
+version = "3.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bef41ebc9ebed2c1b1d90203e9d1756091e8a00bbc3107676151f39868ca0ee"
+checksum = "ad26b216c966e987e80e86daf784a455c039c43d98575ceed57b8faa259e5695"
 dependencies = [
  "async-trait",
- "axum 0.8.9",
- "base64 0.22.1",
+ "base64 0.23.1",
  "bytes",
  "chrono",
  "futures",
- "http 1.4.2",
+ "http 1.5.0",
  "http-body 1.1.0",
  "http-body-util",
  "oauth2",
  "pastey",
  "pin-project-lite",
- "rand 0.9.0",
- "reqwest 0.12.28",
+ "rand 0.10.2",
+ "reqwest 0.13.4",
  "rmcp-macros",
  "schemars 1.2.2",
  "serde",
@@ -10278,15 +10338,15 @@ dependencies = [
 
 [[package]]
 name = "rmcp-macros"
-version = "0.15.0"
+version = "3.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e88ad84b8b6237a934534a62b379a5be6388915663c0cc598ceb9b3292bbbfe"
+checksum = "737d947bcfd946fae6a179a4ef6487be6dcf25c930c2393856b820f1386e52a6"
 dependencies = [
- "darling 0.23.0",
+ "darling 0.24.0",
  "proc-macro2",
  "quote",
  "serde_json",
- "syn 2.0.119",
+ "syn 3.0.3",
 ]
 
 [[package]]
@@ -10647,9 +10707,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-platform-verifier"
-version = "0.6.2"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d99feebc72bae7ab76ba994bb5e121b8d83d910ca40b36e0921f53becc41784"
+checksum = "26d1e2536ce4f35f4846aa13bff16bd0ff40157cdb14cc056c7b14ba41233ba0"
 dependencies = [
  "core-foundation 0.10.1",
  "core-foundation-sys",
@@ -11454,6 +11514,16 @@ version = "0.3.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea"
 
+[[package]]
+name = "simd_cesu8"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11031e251abf8611c80f460e19dbdeb54a66db918e49c65a7065b46ac7aec520"
+dependencies = [
+ "rustc_version 0.4.1",
+ "simdutf8",
+]
+
 [[package]]
 name = "simdutf8"
 version = "0.1.5"
@@ -11492,9 +11562,9 @@ checksum = "1b6709c7b6754dca1311b3c73e79fcce40dd414c782c66d88e8823030093b02b"
 
 [[package]]
 name = "sketches-ddsketch"
-version = "0.4.0"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05e40b6cf54d988dc1a2223531b969c9a9e30906ad90ef64890c27b4bfbb46ea"
+checksum = "513c3f5f732bfd6fbb187619c2dfe9d2f25f1a2976f01d575f0fd329d565df56"
 dependencies = [
  "serde",
 ]
@@ -11899,9 +11969,9 @@ checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 
 [[package]]
 name = "stacker"
-version = "0.1.24"
+version = "0.1.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "640c8cdd92b6b12f5bcb1803ca3bbf5ab96e5e6b6b96b9ab77dabe9e880b3190"
+checksum = "707f49d46706bacf8a2b00d51dace3f9de527c13eec3778f570c411f89e69967"
 dependencies = [
  "cc",
  "cfg-if",
@@ -12912,9 +12982,9 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.54"
+version = "0.3.55"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e1d5e639ff6bab73cb6885cc7e7b1de96c3f32c68ec55f3952614bec1092244"
+checksum = "cdb87b95ec50ddfa440816d227a17b2ccbdda963a316a727fda0fc4334f7d134"
 dependencies = [
  "deranged",
  "num-conv",
@@ -13262,7 +13332,7 @@ dependencies = [
  "bytes",
  "futures-core",
  "futures-sink",
- "http 1.4.2",
+ "http 1.5.0",
  "httparse",
  "rand 0.8.5",
  "ring 0.17.14",
@@ -13350,7 +13420,7 @@ dependencies = [
  "bytes",
  "flate2",
  "h2 0.4.15",
- "http 1.4.2",
+ "http 1.5.0",
  "http-body 1.1.0",
  "http-body-util",
  "hyper 1.11.0",
@@ -13382,7 +13452,7 @@ dependencies = [
  "base64 0.22.1",
  "bytes",
  "h2 0.4.15",
- "http 1.4.2",
+ "http 1.5.0",
  "http-body 1.1.0",
  "http-body-util",
  "hyper 1.11.0",
@@ -13450,7 +13520,7 @@ dependencies = [
  "axum-core 0.5.6",
  "cookie",
  "futures-util",
- "http 1.4.2",
+ "http 1.5.0",
  "parking_lot",
  "pin-project-lite",
  "tower-layer",
@@ -13469,7 +13539,7 @@ dependencies = [
  "bytes",
  "futures-core",
  "futures-util",
- "http 1.4.2",
+ "http 1.5.0",
  "http-body 1.1.0",
  "http-body-util",
  "mime",
@@ -13704,7 +13774,7 @@ dependencies = [
  "byteorder",
  "bytes",
  "data-encoding",
- "http 1.4.2",
+ "http 1.5.0",
  "httparse",
  "log",
  "native-tls",
@@ -13726,7 +13796,7 @@ dependencies = [
  "byteorder",
  "bytes",
  "data-encoding",
- "http 1.4.2",
+ "http 1.5.0",
  "httparse",
  "log",
  "native-tls",
@@ -14211,9 +14281,9 @@ checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.103"
+version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab10a69fbd0a177f5f649ad4d8d3305499c42bab9aef2f7ff592d0ec8f833819"
+checksum = "4b067c0c11094aef6b7a801c1e34a26affafdf3d051dba08456b868789aaf9a4"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -14223,38 +14293,21 @@ dependencies = [
  "wasm-bindgen-shared",
 ]
 
-[[package]]
-name = "wasm-bindgen-backend"
-version = "0.2.103"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0bb702423545a6007bbc368fde243ba47ca275e549c8a28617f56f6ba53b1d1c"
-dependencies = [
- "bumpalo",
- "log",
- "proc-macro2",
- "quote",
- "syn 2.0.119",
- "wasm-bindgen-shared",
-]
-
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.53"
+version = "0.4.76"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a0b221ff421256839509adbb55998214a70d829d3a28c69b4a6672e9d2a42f67"
+checksum = "c62df1340f32221cb9c54d6a27b030e3dba64361d4a95bed55f9aacb44da291d"
 dependencies = [
- "cfg-if",
  "js-sys",
- "once_cell",
  "wasm-bindgen",
- "web-sys",
 ]
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.103"
+version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc65f4f411d91494355917b605e1480033152658d71f722a90647f56a70c88a0"
+checksum = "167ce5e579f6bcf889c4f7175a8a5a585de84e8ff93976ce393efa5f2837aab1"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -14262,50 +14315,65 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.103"
+version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ffc003a991398a8ee604a401e194b6b3a39677b3173d6e74495eb51b82e99a32"
+checksum = "f3997c7839262f4ef12cf90b818d6340c18e80f263f1a94bf157d0ec4420380e"
 dependencies = [
+ "bumpalo",
  "proc-macro2",
  "quote",
  "syn 2.0.119",
- "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.103"
+version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "293c37f4efa430ca14db3721dfbe48d8c33308096bd44d80ebaa775ab71ba1cf"
+checksum = "dc1b4cb0cc549fcf58d7dfc081778139b3d283a081644e833e84682ad71cea24"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "wasm-bindgen-test"
-version = "0.3.53"
+version = "0.3.76"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aee0a0f5343de9221a0d233b04520ed8dc2e6728dce180b1dcd9288ec9d9fa3c"
+checksum = "2a0d555ca874445df8d314f94f5c948a4e74e5418f332c89f660a3d8310a96f4"
 dependencies = [
+ "async-trait",
+ "cast",
  "js-sys",
+ "libm",
  "minicov",
+ "nu-ansi-term",
+ "num-traits",
+ "oorandom",
+ "serde",
+ "serde_json",
  "wasm-bindgen",
  "wasm-bindgen-futures",
  "wasm-bindgen-test-macro",
+ "wasm-bindgen-test-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-test-macro"
-version = "0.3.53"
+version = "0.3.76"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a369369e4360c2884c3168d22bded735c43cccae97bbc147586d4b480edd138d"
+checksum = "94eb68555b95bcea5e8cf4abe280b529049479fa995bfc23734af96a6aedc120"
 dependencies = [
  "proc-macro2",
  "quote",
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "wasm-bindgen-test-shared"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c31d56021e873866c968588ed85ccdf56db5c426e44afdb4618c39895104b920"
+
 [[package]]
 name = "wasm-streams"
 version = "0.4.2"
@@ -14319,6 +14387,19 @@ dependencies = [
  "web-sys",
 ]
 
+[[package]]
+name = "wasm-streams"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d1ec4f6517c9e11ae630e200b2b65d193279042e28edd4a2cda233e46670bbb"
+dependencies = [
+ "futures-util",
+ "js-sys",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
 [[package]]
 name = "wasm_dep_analyzer"
 version = "0.3.0"
@@ -14345,9 +14426,9 @@ dependencies = [
 
 [[package]]
 name = "web-sys"
-version = "0.3.80"
+version = "0.3.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fbe734895e869dc429d78c4b433f8d17d95f8d05317440b4fad5ab2d33e596dc"
+checksum = "8622dcb61c0bcc9fffa6938bed81210af2da9a7e4a1a834b2e37a59b6dfb6141"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -14370,7 +14451,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "974fa1e325e6cc5327de8887f189a441fcff4f8eedcd31ec87f0ef0cc5283fbc"
 dependencies = [
  "bytes",
- "http 1.4.2",
+ "http 1.5.0",
  "thiserror 2.0.19",
  "url",
 ]
@@ -14489,7 +14570,7 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14513,7 +14594,7 @@ dependencies = [
  "prometheus",
  "rand 0.9.0",
  "rdkafka",
- "reqwest 0.13.1",
+ "reqwest 0.13.4",
  "rumqttc",
  "rustls 0.23.35",
  "serde",
@@ -14574,7 +14655,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-ai"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "async-stream",
  "async-trait",
@@ -14587,10 +14668,10 @@ dependencies = [
  "bytes",
  "eventsource-stream",
  "futures",
- "http 1.4.2",
+ "http 1.5.0",
  "lazy_static",
  "mime_guess",
- "reqwest 0.13.1",
+ "reqwest 0.13.4",
  "serde",
  "serde_json",
  "sqlx",
@@ -14607,7 +14688,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14620,7 +14701,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -14649,7 +14730,7 @@ dependencies = [
  "git-version",
  "hex",
  "hmac",
- "http 1.4.2",
+ "http 1.5.0",
  "hyper 1.11.0",
  "indexmap 2.14.0",
  "itertools 0.14.0",
@@ -14666,10 +14747,11 @@ dependencies = [
  "pin-project",
  "postgres-native-tls 0.5.3",
  "prometheus",
+ "quick-xml",
  "quick_cache",
  "rand 0.9.0",
  "regex",
- "reqwest 0.13.1",
+ "reqwest 0.13.4",
  "rsa",
  "rust-embed",
  "rustls 0.23.35",
@@ -14759,11 +14841,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
- "http 1.4.2",
+ "http 1.5.0",
  "hyper 1.11.0",
  "lazy_static",
  "quick_cache",
@@ -14782,14 +14864,16 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
  "serde",
  "serde_json",
  "sqlx",
+ "tokio",
  "tracing",
+ "uuid",
  "windmill-api-auth",
  "windmill-common",
  "windmill-parser-sql-asset",
@@ -14797,17 +14881,17 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
  "chrono",
- "http 1.4.2",
+ "http 1.5.0",
  "itertools 0.14.0",
  "jsonwebtoken 8.3.0",
  "lazy_static",
  "quick_cache",
- "reqwest 0.13.1",
+ "reqwest 0.13.4",
  "serde",
  "serde_json",
  "sqlx",
@@ -14823,7 +14907,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -14833,7 +14917,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14850,7 +14934,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "axum 0.8.9",
  "base64 0.22.1",
@@ -14872,7 +14956,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14881,7 +14965,7 @@ dependencies = [
  "candle-transformers",
  "hf-hub",
  "lazy_static",
- "reqwest 0.13.1",
+ "reqwest 0.13.4",
  "serde",
  "serde_json",
  "sqlx",
@@ -14895,7 +14979,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14911,7 +14995,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14927,12 +15011,13 @@ dependencies = [
  "windmill-common",
  "windmill-dep-map",
  "windmill-git-sync",
+ "windmill-native-triggers",
  "windmill-queue",
 ]
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14953,7 +15038,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14967,7 +15052,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14981,7 +15066,7 @@ dependencies = [
  "hmac",
  "rand 0.9.0",
  "rdkafka",
- "reqwest 0.13.1",
+ "reqwest 0.13.4",
  "rmcp",
  "rumqttc",
  "serde",
@@ -15002,13 +15087,13 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
  "base64 0.22.1",
  "chrono",
- "http 1.4.2",
+ "http 1.5.0",
  "hyper 1.11.0",
  "lazy_static",
  "serde",
@@ -15027,11 +15112,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "axum 0.8.9",
  "flate2",
- "reqwest 0.13.1",
+ "reqwest 0.13.4",
  "serde",
  "serde_json",
  "sqlx",
@@ -15045,11 +15130,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
- "http 1.4.2",
+ "http 1.5.0",
  "indexmap 2.14.0",
  "itertools 0.14.0",
  "lazy_static",
@@ -15067,7 +15152,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15087,18 +15172,18 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
  "futures",
- "http 1.4.2",
+ "http 1.5.0",
  "hyper 1.11.0",
  "itertools 0.14.0",
  "lazy_static",
  "prometheus",
  "quick_cache",
- "reqwest 0.13.1",
+ "reqwest 0.13.4",
  "serde",
  "serde_json",
  "sql-builder",
@@ -15110,6 +15195,7 @@ dependencies = [
  "windmill-common",
  "windmill-dep-map",
  "windmill-git-sync",
+ "windmill-native-triggers",
  "windmill-object-store",
  "windmill-parser",
  "windmill-parser-py",
@@ -15124,7 +15210,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15152,7 +15238,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "lazy_static",
  "serde",
@@ -15164,13 +15250,13 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "argon2",
  "axum 0.8.9",
  "chrono",
  "dashmap",
- "http 1.4.2",
+ "http 1.5.0",
  "hyper 1.11.0",
  "lazy_static",
  "serde",
@@ -15189,7 +15275,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15203,13 +15289,13 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
  "futures",
  "hex",
- "http 1.4.2",
+ "http 1.5.0",
  "hyper 1.11.0",
  "lazy_static",
  "magic-crypt",
@@ -15238,7 +15324,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15252,7 +15338,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15271,7 +15357,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
@@ -15332,7 +15418,7 @@ dependencies = [
  "quick_cache",
  "rand 0.9.0",
  "regex",
- "reqwest 0.13.1",
+ "reqwest 0.13.4",
  "reqwest-middleware",
  "reqwest-retry",
  "rsa",
@@ -15375,7 +15461,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "chrono",
  "itertools 0.14.0",
@@ -15394,7 +15480,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "regex",
  "serde",
@@ -15409,7 +15495,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -15433,7 +15519,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -15450,7 +15536,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15466,15 +15552,15 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "async-trait",
  "chrono",
  "futures",
- "http 1.4.2",
+ "http 1.5.0",
  "oauth2",
- "reqwest 0.12.28",
+ "reqwest 0.13.4",
  "rmcp",
  "serde",
  "serde_json",
@@ -15487,7 +15573,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15496,10 +15582,10 @@ dependencies = [
  "base64 0.22.1",
  "chrono",
  "hmac",
- "http 1.4.2",
+ "http 1.5.0",
  "itertools 0.14.0",
  "lazy_static",
- "reqwest 0.13.1",
+ "reqwest 0.13.4",
  "serde",
  "serde_json",
  "sha2 0.10.9",
@@ -15518,7 +15604,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -15543,7 +15629,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -15561,7 +15647,7 @@ dependencies = [
  "lazy_static",
  "object_store",
  "quick_cache",
- "reqwest 0.13.1",
+ "reqwest 0.13.4",
  "serde",
  "serde_json",
  "sqlx",
@@ -15577,7 +15663,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -15595,7 +15681,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15604,7 +15690,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15616,7 +15702,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15628,7 +15714,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15640,7 +15726,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15652,7 +15738,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15664,7 +15750,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15675,7 +15761,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15686,7 +15772,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15698,7 +15784,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15709,7 +15795,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15731,7 +15817,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15743,7 +15829,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15757,7 +15843,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15774,7 +15860,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15787,7 +15873,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -15799,7 +15885,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15817,7 +15903,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -15833,7 +15919,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15849,18 +15935,21 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
+ "lazy_static",
+ "regex",
  "serde",
  "serde_json",
+ "serde_yml",
  "windmill-parser",
  "yaml-rust",
 ]
 
 [[package]]
 name = "windmill-queue"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15881,7 +15970,7 @@ dependencies = [
  "quick_cache",
  "rand 0.9.0",
  "regex",
- "reqwest 0.13.1",
+ "reqwest 0.13.4",
  "serde",
  "serde_json",
  "serde_urlencoded",
@@ -15899,7 +15988,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "const_format",
@@ -15923,7 +16012,7 @@ dependencies = [
  "lazy_static",
  "rcgen",
  "regex",
- "reqwest 0.13.1",
+ "reqwest 0.13.4",
  "rustls 0.23.35",
  "serde",
  "serde_json",
@@ -15939,7 +16028,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "getrandom 0.3.4",
  "wasm-bindgen",
@@ -15950,21 +16039,22 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "async-recursion",
  "axum 0.8.9",
  "base64 0.22.1",
  "chrono",
+ "dashmap",
  "futures",
  "hex",
- "http 1.4.2",
+ "http 1.5.0",
  "hyper 1.11.0",
  "lazy_static",
  "magic-crypt",
  "quick_cache",
- "reqwest 0.13.1",
+ "reqwest 0.13.4",
  "serde",
  "serde_json",
  "sha2 0.10.9",
@@ -15984,7 +16074,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16008,18 +16098,18 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "async-trait",
  "axum 0.8.9",
  "chrono",
- "http 1.4.2",
+ "http 1.5.0",
  "hyper 1.11.0",
  "itertools 0.14.0",
  "lazy_static",
  "rand 0.9.0",
- "reqwest 0.13.1",
+ "reqwest 0.13.4",
  "serde",
  "serde_json",
  "sql-builder",
@@ -16041,7 +16131,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-amqp"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16068,7 +16158,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-azure"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16078,12 +16168,12 @@ dependencies = [
  "chrono",
  "constant_time_eq 0.3.1",
  "hex",
- "http 1.4.2",
+ "http 1.5.0",
  "itertools 0.14.0",
  "lazy_static",
  "quick_cache",
  "rand 0.9.0",
- "reqwest 0.13.1",
+ "reqwest 0.13.4",
  "serde",
  "serde_json",
  "sha2 0.10.9",
@@ -16101,7 +16191,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16121,7 +16211,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16131,12 +16221,12 @@ dependencies = [
  "chrono",
  "google-cloud-googleapis",
  "google-cloud-pubsub",
- "http 1.4.2",
+ "http 1.5.0",
  "itertools 0.14.0",
  "jsonwebtoken 8.3.0",
  "lazy_static",
  "quick_cache",
- "reqwest 0.13.1",
+ "reqwest 0.13.4",
  "serde",
  "serde_json",
  "sqlx",
@@ -16155,7 +16245,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16166,7 +16256,7 @@ dependencies = [
  "futures",
  "hex",
  "hmac",
- "http 1.4.2",
+ "http 1.5.0",
  "hyper 1.11.0",
  "itertools 0.14.0",
  "lazy_static",
@@ -16191,7 +16281,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16214,7 +16304,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16238,7 +16328,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -16262,7 +16352,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16297,7 +16387,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16325,14 +16415,14 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "async-trait",
  "axum 0.8.9",
  "base64 0.22.1",
  "futures",
- "http 1.4.2",
+ "http 1.5.0",
  "itertools 0.14.0",
  "serde",
  "serde_json",
@@ -16350,7 +16440,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "bitflags 2.13.1",
@@ -16369,7 +16459,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -16423,7 +16513,7 @@ dependencies = [
  "rand 0.9.0",
  "rcgen",
  "regex",
- "reqwest 0.13.1",
+ "reqwest 0.13.4",
  "reqwest-middleware",
  "rsa",
  "rust_decimal",
@@ -16432,6 +16522,7 @@ dependencies = [
  "rustls-pemfile 2.2.0",
  "serde",
  "serde_json",
+ "serde_yml",
  "sha2 0.10.9",
  "sqlx",
  "tar",
@@ -16484,7 +16575,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker-volumes"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "bytes",
  "futures",
@@ -16758,15 +16849,6 @@ dependencies = [
  "windows-link 0.2.1",
 ]
 
-[[package]]
-name = "windows-sys"
-version = "0.45.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
-dependencies = [
- "windows-targets 0.42.2",
-]
-
 [[package]]
 name = "windows-sys"
 version = "0.48.0"
@@ -16812,21 +16894,6 @@ dependencies = [
  "windows-link 0.2.1",
 ]
 
-[[package]]
-name = "windows-targets"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071"
-dependencies = [
- "windows_aarch64_gnullvm 0.42.2",
- "windows_aarch64_msvc 0.42.2",
- "windows_i686_gnu 0.42.2",
- "windows_i686_msvc 0.42.2",
- "windows_x86_64_gnu 0.42.2",
- "windows_x86_64_gnullvm 0.42.2",
- "windows_x86_64_msvc 0.42.2",
-]
-
 [[package]]
 name = "windows-targets"
 version = "0.48.5"
@@ -16884,12 +16951,6 @@ dependencies = [
  "windows-link 0.1.3",
 ]
 
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
-
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.48.5"
@@ -16908,12 +16969,6 @@ version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
 
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
-
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.48.5"
@@ -16932,12 +16987,6 @@ version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
 
-[[package]]
-name = "windows_i686_gnu"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
-
 [[package]]
 name = "windows_i686_gnu"
 version = "0.48.5"
@@ -16968,12 +17017,6 @@ version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
 
-[[package]]
-name = "windows_i686_msvc"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
-
 [[package]]
 name = "windows_i686_msvc"
 version = "0.48.5"
@@ -16992,12 +17035,6 @@ version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
 
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
-
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.48.5"
@@ -17016,12 +17053,6 @@ version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
 
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
-
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.48.5"
@@ -17040,12 +17071,6 @@ version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
 
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
-
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.48.5"
@@ -17250,18 +17275,18 @@ dependencies = [
 
 [[package]]
 name = "zerocopy"
-version = "0.8.55"
+version = "0.8.56"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5a105cd7b140f6eeec8acff2ea38135d3cab283ada58540f629fe51e46696eb"
+checksum = "556764e583adb45a9f8d413c2a147fa7e8d821e48e12b14fd560b607998b75eb"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.55"
+version = "0.8.56"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fe976fb70c78cd64cccfe3a6fc142244e8a77b70959b30faf9d0ac37ee228eb"
+checksum = "f2ab42fc20575779bd240faa45f94a74256f755c0fa9e89f0ede20d91d0cdfc1"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -17356,9 +17381,9 @@ dependencies = [
 
 [[package]]
 name = "zlib-rs"
-version = "0.6.6"
+version = "0.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b142a20ec14a91d5bc708c1dc21b080c550113d8aa77afa29635673a65dd02c5"
+checksum = "34b31d188d9d685a4f9c7b46d6e36631b07058d2cfe190267adce54dc230bf12"
 
 [[package]]
 name = "zmij"
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index a6fffe33f4..9163904548 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.775.2"
+version = "1.783.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -88,7 +88,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.775.2"
+version = "1.783.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
@@ -467,6 +467,7 @@ php-parser-rs = { git = "https://github.com/php-rust-tools/parser", rev = "ec4cb
 cron = "^0"
 mail-send = { version = "0.4.0", features = ["builder"], default-features=false }
 urlencoding = "^2"
+quick-xml = { version = "^0.37", features = ["serialize"] }
 url = { version = "^2" , features = ["serde"]}
 async-oauth2 = "0.5.1"
 reqwest = { version = "^0.13", features = ["json", "stream", "gzip", "multipart", "query", "form"] }
@@ -567,7 +568,12 @@ dashmap = "6.1.0"
 gosyn = "0.2.6"
 bytes = "1.4.0"
 gethostname = "0.4.3"
-wasm-bindgen = "=0.2.103"
+# Not pinned exactly: the excluded `parsers/windmill-parser-wasm` workspace pins
+# =0.2.103 to match its vendored `cli/wasm/*` artifacts, yet path-depends on
+# sibling parser crates that inherit this requirement from here. Two exact pins
+# on the same semver range cannot both resolve, so keep this a range and let each
+# workspace's lockfile settle it (here, js-sys forces 0.2.108).
+wasm-bindgen = "0.2"
 serde-wasm-bindgen = "^0"
 wasm-bindgen-test = "^0"
 convert_case = "0.6.0"
@@ -611,7 +617,7 @@ nkeys = "0.4.4"
 nu-parser = { version = "0.101.0", default-features = false }
 globset = "0.4.16"
 croner = "2.2.0"
-rmcp = { version = "=0.15.0", features = ["client", "transport-streamable-http-client", "transport-streamable-http-client-reqwest"] }
+rmcp = { version = "=3.1.0", features = ["client", "transport-streamable-http-client", "transport-streamable-http-client-reqwest"] }
 rquickjs = { version = "0.11", features = ["futures", "parallel", "macro"] }
 process-wrap = { version = "8.2.1", features = ["tokio1"] }
 
diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index f008a12d4c..f6c4f387b4 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-aa05ca8e97fc8265cd724753a80db37f83243254
+f0df8b82c4c089d384423ed64b8504506084820d
diff --git a/backend/generate_mcp_endpoints_tools/generate_mcp_tools.py b/backend/generate_mcp_endpoints_tools/generate_mcp_tools.py
index 20ea1a0a6c..3ed9cc259d 100644
--- a/backend/generate_mcp_endpoints_tools/generate_mcp_tools.py
+++ b/backend/generate_mcp_endpoints_tools/generate_mcp_tools.py
@@ -398,7 +398,10 @@ def schema_to_rust_value(schema: Optional[Dict[str, Any]]) -> str:
     """Convert a schema dict to a Rust serde_json::json! expression."""
     if schema is None:
         return "None"
-    return f"Some(serde_json::json!({json.dumps(schema, indent=8)}))"
+    # ensure_ascii=False: json.dumps would escape a non-ASCII character in a
+    # description as \uXXXX, which Rust rejects — its string literals spell it
+    # \u{XXXX}. Emitting the character itself is valid in both.
+    return f"Some(serde_json::json!({json.dumps(schema, indent=8, ensure_ascii=False)}))"
 
 def build_tool_description(operation: Dict[str, Any], method: str, path: str) -> str:
     """Build the MCP tool description from OpenAPI summary and description."""
@@ -423,7 +426,11 @@ def find_mcp_tools(spec: Dict[str, Any]) -> List[Dict[str, Any]]:
             if isinstance(operation, dict) and operation.get('x-mcp-tool') is True:
                 # Extract tool information
                 tool = {
-                    'name': operation.get('operationId', f"{method}_{path.replace('/', '_').replace('{', '').replace('}', '')}"),
+                    # The name an agent sees. Defaults to the operationId, which
+                    # every generated client is keyed on, so an endpoint whose
+                    # tool should read differently overrides it here rather than
+                    # by renaming the operation.
+                    'name': operation.get('x-mcp-tool-name') or operation.get('operationId', f"{method}_{path.replace('/', '_').replace('{', '').replace('}', '')}"),
                     'description': build_tool_description(operation, method, path),
                     'instructions': operation.get('x-mcp-instructions', ''),
                     'path': path,
@@ -436,7 +443,16 @@ def find_mcp_tools(spec: Dict[str, Any]) -> List[Dict[str, Any]]:
                     'include_query_params': operation.get('x-mcp-tool-include-query-params'),
                 }
                 tools.append(tool)
-    
+
+    # A tool name used to be an operationId, which OpenAPI already keeps unique.
+    # `x-mcp-tool-name` gives that up, and a duplicate would be silent: a token's
+    # `mcp:endpoints:<name>` resolves by first match, so which endpoint it reaches
+    # would depend on the order of this file.
+    names = [t['name'] for t in tools]
+    duplicates = sorted({n for n in names if names.count(n) > 1})
+    if duplicates:
+        raise ValueError(f"duplicate MCP tool name(s): {', '.join(duplicates)}")
+
     return tools
 
 def generate_typescript_code(tools: List[Dict[str, Any]], spec: Dict[str, Any], base_path: str = "") -> str:
diff --git a/backend/migrations/20260725084224_add_dbt_lang.down.sql b/backend/migrations/20260725084224_add_dbt_lang.down.sql
new file mode 100644
index 0000000000..d2f607c5b8
--- /dev/null
+++ b/backend/migrations/20260725084224_add_dbt_lang.down.sql
@@ -0,0 +1 @@
+-- Add down migration script here
diff --git a/backend/migrations/20260725084224_add_dbt_lang.up.sql b/backend/migrations/20260725084224_add_dbt_lang.up.sql
new file mode 100644
index 0000000000..ec99678460
--- /dev/null
+++ b/backend/migrations/20260725084224_add_dbt_lang.up.sql
@@ -0,0 +1,2 @@
+ALTER TYPE SCRIPT_LANG ADD VALUE IF NOT EXISTS 'dbt';
+UPDATE config SET config = jsonb_set(config, '{worker_tags}', config->'worker_tags' || '["dbt"]'::jsonb) WHERE name = 'worker__default' AND config @> '{"worker_tags": ["deno", "python3", "go", "bash", "powershell", "dependency", "flow", "hub", "other", "bun", "php", "rust", "ansible", "csharp", "nu", "java", "duckdb", "ruby", "rlang"]}'::jsonb AND NOT config->'worker_tags' @> '"dbt"'::jsonb;
diff --git a/backend/migrations/20260725084314_dbt_runtime.down.sql b/backend/migrations/20260725084314_dbt_runtime.down.sql
new file mode 100644
index 0000000000..93fd7ef4b5
--- /dev/null
+++ b/backend/migrations/20260725084314_dbt_runtime.down.sql
@@ -0,0 +1,7 @@
+DROP TABLE IF EXISTS dbt_run_progress;
+DROP TABLE IF EXISTS dbt_run_state;
+DROP TABLE IF EXISTS dbt_graph_snapshot;
+DROP TABLE IF EXISTS dbt_edge;
+DROP TABLE IF EXISTS dbt_node;
+
+ALTER TABLE workspace_settings DROP COLUMN IF EXISTS dbt_warehouses;
diff --git a/backend/migrations/20260725084314_dbt_runtime.up.sql b/backend/migrations/20260725084314_dbt_runtime.up.sql
new file mode 100644
index 0000000000..c40441933d
--- /dev/null
+++ b/backend/migrations/20260725084314_dbt_runtime.up.sql
@@ -0,0 +1,218 @@
+-- The dbt runtime's tables: the parsed manifest that becomes the asset graph,
+-- the retry state a `dbt retry` resumes from, and a run's live per-model
+-- progress.
+
+-- Physical-relation asset kind. Identity is the relation itself
+-- (`<warehouse>/<schema>/<name>`, the warehouse named as the workspace
+-- configures it), never the producing tool, so a dbt mart and a native script
+-- reading the same table resolve to one node and the lineage is one graph
+-- across the boundary (docs/dbt-runtime.md, decision 11).
+ALTER TYPE ASSET_KIND ADD VALUE IF NOT EXISTS 'dbt';
+
+-- Warehouses configured once for the workspace, so a dbt project needs no
+-- connection knowledge to run: the descriptor names one by NAME (or nothing, for
+-- `main`) and the value here points at the RESOURCE that holds the credentials,
+-- exactly as `large_file_storage` does for buckets. A flat map keyed by name,
+-- which is also what asset identity keys on.
+--
+--   {"main": {"resource_path": "$res:u/admin/wh", "target": "prod"},
+--    "eu":   {"resource_path": "$res:u/admin/wh_eu"}}
+ALTER TABLE workspace_settings ADD COLUMN IF NOT EXISTS dbt_warehouses JSONB;
+
+-- Parsed dbt manifest, one row per dbt node. The full manifest.json is not
+-- stored -- only the fields the asset graph renders.
+--
+-- Keyed by (path, version, job). The VERSION because each deployed version of a
+-- script keeps its own graph, so a finished run can be shown the project as it
+-- was rather than whatever is deployed today. The JOB because a dynamic
+-- descriptor -- a `{{ }}` placeholder in `vars` -- can resolve to a different
+-- set of models per run, and those runs re-ingest; the zero UUID means "the
+-- version's own graph, as deployed", which is what a static descriptor writes
+-- once and every one of its runs reads. A sentinel rather than NULL because
+-- `job_id` is part of the key and Postgres does not treat two NULLs as the same
+-- key, so each re-ingest would add a row set instead of replacing one.
+CREATE TABLE IF NOT EXISTS dbt_node (
+  workspace_id     VARCHAR(50) NOT NULL REFERENCES workspace(id) ON DELETE CASCADE ON UPDATE CASCADE,
+  script_path      VARCHAR(255) NOT NULL,
+  script_hash      BIGINT NOT NULL,
+  job_id           UUID NOT NULL DEFAULT '00000000-0000-0000-0000-000000000000',
+  -- dbt's own node id, e.g. `model.jaffle_shop.customers`. Stable across runs
+  -- and the join key for dbt_edge and for run_results ingestion.
+  unique_id        TEXT NOT NULL,
+  resource_type    TEXT NOT NULL,
+  name             TEXT NOT NULL,
+  -- The physical relation this node produces, spelled as the matching `asset`
+  -- row's path (`<warehouse>/<schema>/<name>`). NULL for nodes with no
+  -- relation: ephemeral models, tests.
+  asset_path       TEXT,
+  materialized     TEXT,
+  -- Windmill's equivalent write strategy (replace | append | merge | scd2),
+  -- NULL when dbt's materialization has no analogue (view, ephemeral).
+  materialize_strategy TEXT,
+  unique_key       TEXT,
+  tags             TEXT[] NOT NULL DEFAULT '{}',
+  description      TEXT,
+  -- Test nodes only: the generic test name (`unique`, `not_null`,
+  -- `accepted_values`, `relationships`, or a package/custom test's own name),
+  -- the column it is attached to, its rendered kwargs and dbt's severity.
+  -- Severity is stored as dbt spells it; readers compare case-insensitively
+  -- because dbt-core 1.x echoes the author's casing while 2.x uppercases it.
+  test_kind        TEXT,
+  test_column      TEXT,
+  test_args        JSONB,
+  severity         TEXT,
+  attached_node    TEXT,
+  -- Declared per-column metadata (name -> description), the column sets the
+  -- asset graph shows. dbt's manifest carries no column-to-column lineage, so
+  -- this is not a column lineage graph.
+  columns          JSONB,
+  freshness        JSONB,
+  -- The model's SQL as written, for the graph to render. `dbt parse` fills it;
+  -- `compiled_code` would need a `dbt compile`, which no phase runs.
+  raw_code         TEXT,
+  -- Its path inside the dbt project, e.g. `models/staging/stg_orders.sql`.
+  original_file_path TEXT,
+  ingested_at      TIMESTAMPTZ NOT NULL DEFAULT now(),
+  PRIMARY KEY (workspace_id, script_path, script_hash, job_id, unique_id),
+  -- Composite because `script`'s key is (workspace_id, hash). A version's graph
+  -- dies with the version and nothing has to sweep it.
+  CONSTRAINT dbt_node_script_fkey FOREIGN KEY (workspace_id, script_hash)
+    REFERENCES script (workspace_id, hash) ON DELETE CASCADE ON UPDATE CASCADE
+);
+
+-- `ref()` / `source()` lineage, straight from the manifest's parent_map.
+CREATE TABLE IF NOT EXISTS dbt_edge (
+  workspace_id     VARCHAR(50) NOT NULL REFERENCES workspace(id) ON DELETE CASCADE ON UPDATE CASCADE,
+  script_path      VARCHAR(255) NOT NULL,
+  script_hash      BIGINT NOT NULL,
+  job_id           UUID NOT NULL DEFAULT '00000000-0000-0000-0000-000000000000',
+  parent_unique_id TEXT NOT NULL,
+  child_unique_id  TEXT NOT NULL,
+  ingested_at      TIMESTAMPTZ NOT NULL DEFAULT now(),
+  PRIMARY KEY (workspace_id, script_path, script_hash, job_id, parent_unique_id, child_unique_id),
+  CONSTRAINT dbt_edge_script_fkey FOREIGN KEY (workspace_id, script_hash)
+    REFERENCES script (workspace_id, hash) ON DELETE CASCADE ON UPDATE CASCADE
+);
+
+-- One row per stored graph, so a snapshot's EXISTENCE does not depend on it
+-- having any nodes: a dynamic run can disable every model, and that empty graph
+-- has to be distinguishable from a run that stored nothing -- otherwise the run
+-- page falls back to the deployed models and shows what the run never built.
+--
+-- It is also where the content digest lives, once. A run whose digest matches
+-- the version's writes no snapshot at all: marking a descriptor dynamic is
+-- conservative (a `{{ }}` in `vars` says the arguments reach dbt, not that they
+-- change which models exist), so the usual dynamic run resolves to exactly the
+-- graph the deploy stored.
+CREATE TABLE IF NOT EXISTS dbt_graph_snapshot (
+  workspace_id VARCHAR(50) NOT NULL REFERENCES workspace(id) ON DELETE CASCADE ON UPDATE CASCADE,
+  script_path  VARCHAR(255) NOT NULL,
+  script_hash  BIGINT NOT NULL,
+  job_id       UUID NOT NULL,
+  digest       TEXT NOT NULL,
+  -- On the DEPLOYED row only: the relation root the last ingest to write this
+  -- row resolved. Written by every ingest that is not a run's own snapshot,
+  -- including one that publishes no ownership — a version that cannot claim the
+  -- path would otherwise record nothing and compare against a stale root.
+  --
+  -- The drift check needs "where do the current usages point", and no other
+  -- row answers it: the deploy's own root goes stale the moment a run at a
+  -- moved profile republishes, and "the newest ingest" is wrong because a run
+  -- whose graph matches the deploy's stores nothing at all.
+  relation_root_at_last_ingest TEXT,
+  ingested_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
+  PRIMARY KEY (workspace_id, script_path, script_hash, job_id),
+  -- Same cascade as the rows it stands for. A marker outliving its nodes is
+  -- read as a snapshot that has none, and its digest still answers the
+  -- suppression check.
+  CONSTRAINT dbt_graph_snapshot_script_fkey FOREIGN KEY (workspace_id, script_hash)
+    REFERENCES script (workspace_id, hash) ON DELETE CASCADE ON UPDATE CASCADE
+);
+
+-- What a `dbt retry` resumes from. Keyed by path, not by version: there is one
+-- saved run per script, and `identity` -- the project digest, warehouse and
+-- engine -- is what refuses a resume that no longer describes the same run.
+CREATE TABLE IF NOT EXISTS dbt_run_state (
+  workspace_id VARCHAR(50) NOT NULL REFERENCES workspace(id) ON DELETE CASCADE ON UPDATE CASCADE,
+  script_path  VARCHAR(255) NOT NULL,
+  -- Part of the key: a retry replaces the caller's arguments with the saved
+  -- ones, so state written by one principal must not be restorable by another
+  -- — that would hand them the literal `select` and `vars` of a run they were
+  -- never entitled to see.
+  permissioned_as VARCHAR(255) NOT NULL,
+  identity     TEXT NOT NULL,
+  -- The invocation's job arguments. `dbt retry` reuses the original selection
+  -- and vars, so the graph refresh and the build must agree with them rather
+  -- than with the retry request's.
+  args         JSONB NOT NULL DEFAULT '{}'::jsonb,
+  -- Text rather than jsonb: nothing queries inside it, and this is highly
+  -- repetitive JSON that TOAST's compression handles well (about nine to one).
+  run_results  TEXT NOT NULL,
+  job_id       UUID,
+  -- Whether those results hold a node `dbt retry` would rebuild. A run that
+  -- failed before building anything, or succeeded outright, is still saved —
+  -- restoring it is how a retry can say the run succeeded rather than that no
+  -- state exists — but nothing may offer it as resumable.
+  retryable    BOOLEAN NOT NULL DEFAULT false,
+  updated_at   TIMESTAMPTZ NOT NULL DEFAULT now(),
+  PRIMARY KEY (workspace_id, script_path, permissioned_as)
+);
+
+-- Live per-model progress for one RUN.
+--
+-- `materialized_partition` cannot answer this: its key is the relation, one row
+-- per table, and its `job_id` names only the last writer. Two runs of one
+-- project building the same models take that row from each other, so a progress
+-- read filtered by job loses nodes and flickers between states. That table is
+-- left as it is -- the current state of a relation is what the pipeline canvas
+-- and fork defer read, and one row per relation is right for them.
+CREATE TABLE IF NOT EXISTS dbt_run_progress (
+  workspace_id VARCHAR(50) NOT NULL REFERENCES workspace(id) ON DELETE CASCADE ON UPDATE CASCADE,
+  job_id       UUID NOT NULL,
+  asset_kind   ASSET_KIND NOT NULL,
+  asset_path   VARCHAR(255) NOT NULL,
+  status       MATERIALIZATION_STATUS NOT NULL,
+  row_count    BIGINT,
+  error        TEXT,
+  updated_at   TIMESTAMPTZ NOT NULL DEFAULT now(),
+  PRIMARY KEY (workspace_id, job_id, asset_kind, asset_path)
+);
+
+-- Resolve a physical relation back to the dbt node that produces it: the asset
+-- graph renders from `asset` rows and needs the dbt provenance per node.
+CREATE INDEX IF NOT EXISTS idx_dbt_node_asset_path
+  ON dbt_node (workspace_id, asset_path) WHERE asset_path IS NOT NULL;
+
+-- No foreign key from the per-run rows to `v2_job`: three were deliberately
+-- dropped from it for the write amplification they cost on the hottest table in
+-- the system. Growth is bounded by age instead and pruned by the dbt runs
+-- themselves, so no background sweep has to learn about these tables -- hence
+-- an index per age sweep, and one per "does this job have a snapshot" lookup.
+CREATE INDEX IF NOT EXISTS idx_dbt_node_job ON dbt_node (job_id)
+  WHERE job_id <> '00000000-0000-0000-0000-000000000000';
+CREATE INDEX IF NOT EXISTS idx_dbt_node_run_age ON dbt_node (ingested_at)
+  WHERE job_id <> '00000000-0000-0000-0000-000000000000';
+CREATE INDEX IF NOT EXISTS idx_dbt_edge_run_age ON dbt_edge (ingested_at)
+  WHERE job_id <> '00000000-0000-0000-0000-000000000000';
+CREATE INDEX IF NOT EXISTS idx_dbt_graph_snapshot_job
+  ON dbt_graph_snapshot (workspace_id, job_id);
+CREATE INDEX IF NOT EXISTS idx_dbt_graph_snapshot_age
+  ON dbt_graph_snapshot (ingested_at)
+  WHERE job_id <> '00000000-0000-0000-0000-000000000000';
+CREATE INDEX IF NOT EXISTS idx_dbt_run_progress_updated_at
+  ON dbt_run_progress (updated_at);
+
+-- All of these are written on a user_db transaction (SET LOCAL ROLE
+-- windmill_user/windmill_admin), so they must be granted explicitly rather than
+-- relying on ALTER DEFAULT PRIVILEGES, which only covers objects created by the
+-- role that set them (see 20260720131744).
+GRANT ALL ON dbt_node TO windmill_user;
+GRANT ALL ON dbt_node TO windmill_admin;
+GRANT ALL ON dbt_edge TO windmill_user;
+GRANT ALL ON dbt_edge TO windmill_admin;
+GRANT ALL ON dbt_graph_snapshot TO windmill_user;
+GRANT ALL ON dbt_graph_snapshot TO windmill_admin;
+GRANT ALL ON dbt_run_state TO windmill_user;
+GRANT ALL ON dbt_run_state TO windmill_admin;
+GRANT ALL ON dbt_run_progress TO windmill_user;
+GRANT ALL ON dbt_run_progress TO windmill_admin;
diff --git a/backend/migrations/20260727145314_materialized_partition_job_id_index.down.sql b/backend/migrations/20260727145314_materialized_partition_job_id_index.down.sql
new file mode 100644
index 0000000000..9b33bff978
--- /dev/null
+++ b/backend/migrations/20260727145314_materialized_partition_job_id_index.down.sql
@@ -0,0 +1 @@
+DROP INDEX IF EXISTS idx_materialized_partition_job;
diff --git a/backend/migrations/20260727145314_materialized_partition_job_id_index.up.sql b/backend/migrations/20260727145314_materialized_partition_job_id_index.up.sql
new file mode 100644
index 0000000000..6bcdc246ae
--- /dev/null
+++ b/backend/migrations/20260727145314_materialized_partition_job_id_index.up.sql
@@ -0,0 +1,9 @@
+-- `job_id` leads neither the primary key nor the asset/status index, both shaped
+-- for the per-relation lookups that came first — but the closing sweep a dbt run
+-- makes (`terminalize_running_relations`) reads and writes by it, settling the
+-- models a cancelled or timed-out run left `running`.
+-- Small table until a partitioned asset is backfilled, then one row per slice
+-- per asset.
+CREATE INDEX IF NOT EXISTS idx_materialized_partition_job
+    ON materialized_partition (workspace_id, job_id)
+    WHERE job_id IS NOT NULL;
diff --git a/backend/migrations/20260731161812_backfill_datatablemigration_git_sync_include_type.down.sql b/backend/migrations/20260731161812_backfill_datatablemigration_git_sync_include_type.down.sql
new file mode 100644
index 0000000000..e1b90875dc
--- /dev/null
+++ b/backend/migrations/20260731161812_backfill_datatablemigration_git_sync_include_type.down.sql
@@ -0,0 +1,37 @@
+-- Strip `datatablemigration` back out of every include_type, at both levels.
+-- Lossy in the same way the up is: a config that had opted in deliberately is
+-- indistinguishable from one the backfill touched.
+
+UPDATE workspace_settings
+SET git_sync = jsonb_set(
+        git_sync,
+        '{include_type}',
+        (git_sync->'include_type') - 'datatablemigration'
+    )
+WHERE jsonb_typeof(git_sync->'include_type') = 'array'
+  AND git_sync->'include_type' @> '"datatablemigration"'::jsonb;
+
+UPDATE workspace_settings ws
+SET git_sync = jsonb_set(ws.git_sync, '{repositories}', updated.repositories)
+FROM (
+    SELECT
+        s.workspace_id,
+        jsonb_agg(
+            CASE
+                WHEN repo->'settings'->'include_type' @> '"datatablemigration"'::jsonb
+                THEN jsonb_set(
+                        repo,
+                        '{settings,include_type}',
+                        (repo->'settings'->'include_type') - 'datatablemigration'
+                     )
+                ELSE repo
+            END
+            ORDER BY idx
+        ) AS repositories
+    FROM workspace_settings s,
+         LATERAL jsonb_array_elements(s.git_sync->'repositories') WITH ORDINALITY AS t(repo, idx)
+    WHERE jsonb_typeof(s.git_sync->'repositories') = 'array'
+    GROUP BY s.workspace_id
+) AS updated
+WHERE ws.workspace_id = updated.workspace_id
+  AND ws.git_sync->'repositories' IS DISTINCT FROM updated.repositories;
diff --git a/backend/migrations/20260731161812_backfill_datatablemigration_git_sync_include_type.up.sql b/backend/migrations/20260731161812_backfill_datatablemigration_git_sync_include_type.up.sql
new file mode 100644
index 0000000000..3ec18bf607
--- /dev/null
+++ b/backend/migrations/20260731161812_backfill_datatablemigration_git_sync_include_type.up.sql
@@ -0,0 +1,45 @@
+-- Data table SQL migrations became a git-sync object type (`datatablemigration`).
+-- Existing settings were written before it existed, so every workspace would read
+-- as "migrations opted out" until someone re-saved the form. Opt in the configs
+-- that already sync something, at both levels an include_type can live: the
+-- workspace-level default and each repository's own settings.
+--
+-- An absent or empty include_type means "inherit / not configured yet" and is left
+-- alone; the defaults the UI and CLI now write already carry the new type.
+
+UPDATE workspace_settings
+SET git_sync = jsonb_set(
+        git_sync,
+        '{include_type}',
+        (git_sync->'include_type') || '"datatablemigration"'::jsonb
+    )
+WHERE jsonb_typeof(git_sync->'include_type') = 'array'
+  AND jsonb_array_length(git_sync->'include_type') > 0
+  AND NOT (git_sync->'include_type' @> '"datatablemigration"'::jsonb);
+
+UPDATE workspace_settings ws
+SET git_sync = jsonb_set(ws.git_sync, '{repositories}', updated.repositories)
+FROM (
+    SELECT
+        s.workspace_id,
+        jsonb_agg(
+            CASE
+                WHEN jsonb_typeof(repo->'settings'->'include_type') = 'array'
+                     AND jsonb_array_length(repo->'settings'->'include_type') > 0
+                     AND NOT (repo->'settings'->'include_type' @> '"datatablemigration"'::jsonb)
+                THEN jsonb_set(
+                        repo,
+                        '{settings,include_type}',
+                        (repo->'settings'->'include_type') || '"datatablemigration"'::jsonb
+                     )
+                ELSE repo
+            END
+            ORDER BY idx
+        ) AS repositories
+    FROM workspace_settings s,
+         LATERAL jsonb_array_elements(s.git_sync->'repositories') WITH ORDINALITY AS t(repo, idx)
+    WHERE jsonb_typeof(s.git_sync->'repositories') = 'array'
+    GROUP BY s.workspace_id
+) AS updated
+WHERE ws.workspace_id = updated.workspace_id
+  AND ws.git_sync->'repositories' IS DISTINCT FROM updated.repositories;
diff --git a/backend/migrations/20260731220637_on_behalf_of.down.sql b/backend/migrations/20260731220637_on_behalf_of.down.sql
new file mode 100644
index 0000000000..f4947b27bf
--- /dev/null
+++ b/backend/migrations/20260731220637_on_behalf_of.down.sql
@@ -0,0 +1,3 @@
+-- Add down migration script here
+ALTER TABLE script DROP COLUMN IF EXISTS on_behalf_of;
+ALTER TABLE flow DROP COLUMN IF EXISTS on_behalf_of;
diff --git a/backend/migrations/20260731220637_on_behalf_of.up.sql b/backend/migrations/20260731220637_on_behalf_of.up.sql
new file mode 100644
index 0000000000..ca2c6fd884
--- /dev/null
+++ b/backend/migrations/20260731220637_on_behalf_of.up.sql
@@ -0,0 +1,6 @@
+-- Add up migration script here
+-- Authorization identity a script/flow runs as. NULL means "not recorded"; the migration that
+-- follows this one backfills every row that had an on_behalf_of_email, so by the end of this
+-- release a NULL principal means the runnable runs as its caller.
+ALTER TABLE script ADD COLUMN IF NOT EXISTS on_behalf_of VARCHAR(255);
+ALTER TABLE flow ADD COLUMN IF NOT EXISTS on_behalf_of VARCHAR(255);
diff --git a/backend/migrations/20260801043001_backfill_on_behalf_of.down.sql b/backend/migrations/20260801043001_backfill_on_behalf_of.down.sql
new file mode 100644
index 0000000000..bcd8d2cbd5
--- /dev/null
+++ b/backend/migrations/20260801043001_backfill_on_behalf_of.down.sql
@@ -0,0 +1,33 @@
+-- Add down migration script here
+-- The column was never dropped, so this only re-derives it from the principal for the rows the
+-- up migration backfilled. One naming a group gets that group's synthetic address, which is what
+-- the column held before.
+
+CREATE FUNCTION pg_temp.email_from_permissioned_as(w_id VARCHAR, permissioned_as VARCHAR)
+RETURNS VARCHAR AS $$
+    -- Prefix first, as every reader decides: a group name or an email-shaped username may
+    -- itself contain '@', so only an unprefixed value is an address.
+    SELECT CASE
+        WHEN $2 LIKE 'g/%'
+            THEN 'group-' || substring($2 from 3) || '@windmill.dev'
+        -- Mirrors the up migration's `u/` arm, superadmin fallback included: one acting
+        -- outside their workspaces has no usr row, and losing their address here would
+        -- leave the previous runtime unable to authenticate the runnable.
+        WHEN $2 LIKE 'u/%'
+            THEN COALESCE(
+                (SELECT u.email FROM usr u WHERE u.workspace_id = $1 AND u.username = substring($2 from 3)),
+                (SELECT p.email FROM password p WHERE p.super_admin
+                   AND (p.username = substring($2 from 3) OR p.email = substring($2 from 3))
+                 ORDER BY p.email LIMIT 1),
+                substring($2 from 3) || '@unknown.windmill.dev')
+        ELSE $2
+    END;
+$$ LANGUAGE SQL STABLE;
+
+UPDATE script SET on_behalf_of_email =
+    pg_temp.email_from_permissioned_as(workspace_id, on_behalf_of)
+ WHERE on_behalf_of IS NOT NULL;
+
+UPDATE flow SET on_behalf_of_email =
+    pg_temp.email_from_permissioned_as(workspace_id, on_behalf_of)
+ WHERE on_behalf_of IS NOT NULL;
diff --git a/backend/migrations/20260801043001_backfill_on_behalf_of.up.sql b/backend/migrations/20260801043001_backfill_on_behalf_of.up.sql
new file mode 100644
index 0000000000..fc27c23999
--- /dev/null
+++ b/backend/migrations/20260801043001_backfill_on_behalf_of.up.sql
@@ -0,0 +1,63 @@
+-- Add up migration script here
+-- The permissioned_as becomes the identity this release reads; the email is derived from it at
+-- read time, as triggers have always done. Backfilling it also retires the fallback to
+-- created_by / edited_by, so a runnable deployed before the column existed starts running
+-- as the user its on_behalf_of_email always named rather than as whoever last deployed it.
+--
+-- `on_behalf_of_email` stays for now: a worker predating this release resolves a script or flow
+-- through `get_script_info_for_hash` / `get_latest_hash_for_path`, which select that column, and
+-- workers are expected to lag the server. Deploys keep writing it until every live worker is new
+-- (MIN_VERSION_SUPPORTS_ON_BEHALF_OF_PRINCIPAL); a later release stops writing it and drops it.
+--
+-- That later migration MUST re-run this backfill before dropping: server pods are mixed for the
+-- minute or two a rollout takes, and one still on the previous release writes only the address —
+-- leaving a runnable deployed in that window with no principal, which reads as no identity at
+-- all and runs it as its caller. Re-deriving picks those up; dropping without it makes them
+-- permanent.
+
+-- Mirrors `users::permissioned_as_from_email`: a real account wins over the synthetic group
+-- namespace, which is not reserved and may be a user's own address.
+CREATE FUNCTION pg_temp.permissioned_as_from_email(w_id VARCHAR, email VARCHAR)
+RETURNS VARCHAR AS $$
+    SELECT COALESCE(
+        -- `username_to_permissioned_as`: an email-shaped username is its own principal unless
+        -- it contains a slash, which a reader would split on.
+        (SELECT CASE WHEN u.username LIKE '%@%' AND u.username NOT LIKE '%/%' THEN u.username
+                     ELSE 'u/' || u.username END
+           FROM usr u WHERE u.workspace_id = $1 AND u.email = $2),
+        -- A superadmin acting outside their workspaces has no usr row.
+        (SELECT CASE WHEN COALESCE(p.username, p.email) LIKE '%@%'
+                      AND COALESCE(p.username, p.email) NOT LIKE '%/%'
+                     THEN COALESCE(p.username, p.email)
+                     ELSE 'u/' || COALESCE(p.username, p.email) END
+           FROM password p WHERE p.email = $2 AND p.super_admin),
+        (SELECT 'g/' || g.name FROM group_ g
+          WHERE g.workspace_id = $1
+            AND $2 = 'group-' || g.name || '@windmill.dev')
+    );
+$$ LANGUAGE SQL STABLE;
+
+-- A principal wider than `v2_job.permissioned_as` could not be enqueued, so it is not recorded
+-- at all — the runnable falls back to running as its caller until someone picks an identity the
+-- deploy path accepts. Only an address-derived principal can reach that width; a username is
+-- capped at 50.
+UPDATE script SET on_behalf_of =
+    pg_temp.permissioned_as_from_email(workspace_id, on_behalf_of_email)
+ WHERE on_behalf_of_email IS NOT NULL AND on_behalf_of IS NULL
+   AND length(pg_temp.permissioned_as_from_email(workspace_id, on_behalf_of_email)) <= 55;
+
+UPDATE flow SET on_behalf_of =
+    pg_temp.permissioned_as_from_email(workspace_id, on_behalf_of_email)
+ WHERE on_behalf_of_email IS NOT NULL AND on_behalf_of IS NULL
+   AND length(pg_temp.permissioned_as_from_email(workspace_id, on_behalf_of_email)) <= 55;
+
+-- Drafts carry the same pair in their value.
+UPDATE draft SET value = to_json(jsonb_set(
+        to_jsonb(value),
+        ARRAY['on_behalf_of'],
+        to_jsonb(pg_temp.permissioned_as_from_email(workspace_id, value->>'on_behalf_of_email'))))
+ WHERE typ IN ('script', 'flow')
+   AND value->>'on_behalf_of_email' IS NOT NULL
+   AND value->>'on_behalf_of' IS NULL
+   AND length(pg_temp.permissioned_as_from_email(workspace_id, value->>'on_behalf_of_email')) <= 55;
+
diff --git a/backend/migrations/20260801060114_drop_azure_trigger_email.down.sql b/backend/migrations/20260801060114_drop_azure_trigger_email.down.sql
new file mode 100644
index 0000000000..cf51c37487
--- /dev/null
+++ b/backend/migrations/20260801060114_drop_azure_trigger_email.down.sql
@@ -0,0 +1,23 @@
+-- Rebuild email from permissioned_as, mirroring
+-- windmill_common::users::get_email_from_permissioned_as.
+
+ALTER TABLE azure_trigger ADD COLUMN email VARCHAR(255) NOT NULL DEFAULT '';
+
+UPDATE azure_trigger t SET email = CASE
+    WHEN t.permissioned_as LIKE 'u/%' THEN COALESCE(
+        (SELECT u.email FROM usr u
+          WHERE u.workspace_id = t.workspace_id
+            AND u.username = SUBSTRING(t.permissioned_as FROM 3)),
+        (SELECT p.email FROM password p
+          WHERE p.super_admin
+            AND (p.username = SUBSTRING(t.permissioned_as FROM 3)
+                 OR p.email = SUBSTRING(t.permissioned_as FROM 3))
+          LIMIT 1),
+        SUBSTRING(t.permissioned_as FROM 3) || '@unknown.windmill.dev'
+    )
+    WHEN t.permissioned_as LIKE 'g/%'
+        THEN 'group-' || SUBSTRING(t.permissioned_as FROM 3) || '@windmill.dev'
+    ELSE t.permissioned_as
+END;
+
+ALTER TABLE azure_trigger ALTER COLUMN email DROP DEFAULT;
diff --git a/backend/migrations/20260801060114_drop_azure_trigger_email.up.sql b/backend/migrations/20260801060114_drop_azure_trigger_email.up.sql
new file mode 100644
index 0000000000..293822e25c
--- /dev/null
+++ b/backend/migrations/20260801060114_drop_azure_trigger_email.up.sql
@@ -0,0 +1,4 @@
+-- azure_trigger.email duplicated an address that permissioned_as already
+-- determines, and which every other trigger table derives at fire time.
+
+ALTER TABLE azure_trigger DROP COLUMN email;
diff --git a/backend/migrations/20260801121717_dbt_editor_preview_graph.down.sql b/backend/migrations/20260801121717_dbt_editor_preview_graph.down.sql
new file mode 100644
index 0000000000..ada8fa319c
--- /dev/null
+++ b/backend/migrations/20260801121717_dbt_editor_preview_graph.down.sql
@@ -0,0 +1,26 @@
+-- The editor graphs go first: they are exactly the rows the restored NOT NULL
+-- would reject, and they are throwaway by construction.
+DELETE FROM dbt_node WHERE script_hash IS NULL;
+DELETE FROM dbt_edge WHERE script_hash IS NULL;
+DELETE FROM dbt_graph_snapshot WHERE script_hash IS NULL;
+
+DROP INDEX IF EXISTS idx_dbt_graph_snapshot_editor_path;
+ALTER TABLE dbt_graph_snapshot DROP COLUMN IF EXISTS permissioned_as;
+
+DROP INDEX IF EXISTS dbt_node_editor_key;
+DROP INDEX IF EXISTS dbt_node_versioned_key;
+ALTER TABLE dbt_node ALTER COLUMN script_hash SET NOT NULL;
+ALTER TABLE dbt_node ADD CONSTRAINT dbt_node_pkey
+  PRIMARY KEY (workspace_id, script_path, script_hash, job_id, unique_id);
+
+DROP INDEX IF EXISTS dbt_edge_editor_key;
+DROP INDEX IF EXISTS dbt_edge_versioned_key;
+ALTER TABLE dbt_edge ALTER COLUMN script_hash SET NOT NULL;
+ALTER TABLE dbt_edge ADD CONSTRAINT dbt_edge_pkey
+  PRIMARY KEY (workspace_id, script_path, script_hash, job_id, parent_unique_id, child_unique_id);
+
+DROP INDEX IF EXISTS dbt_graph_snapshot_editor_key;
+DROP INDEX IF EXISTS dbt_graph_snapshot_versioned_key;
+ALTER TABLE dbt_graph_snapshot ALTER COLUMN script_hash SET NOT NULL;
+ALTER TABLE dbt_graph_snapshot ADD CONSTRAINT dbt_graph_snapshot_pkey
+  PRIMARY KEY (workspace_id, script_path, script_hash, job_id);
diff --git a/backend/migrations/20260801121717_dbt_editor_preview_graph.up.sql b/backend/migrations/20260801121717_dbt_editor_preview_graph.up.sql
new file mode 100644
index 0000000000..b43950517b
--- /dev/null
+++ b/backend/migrations/20260801121717_dbt_editor_preview_graph.up.sql
@@ -0,0 +1,62 @@
+-- A graph parsed from the EDITOR's buffer, which names no deployed version.
+--
+-- The two provenances that existed keyed on one: a version's own graph (the
+-- zero-UUID `job_id`) and a run's snapshot of a version. A buffer refresh is
+-- neither. It cannot borrow the deployed version's hash — the buffer differs
+-- from it, which is the point, and a project being written has no deployed
+-- version at all — so `script_hash` becomes NULL and the graph is keyed to the
+-- preview job that parsed it, readable only back through that job and never
+-- through the path.
+--
+-- The foreign key to `script` is left exactly as written: it is MATCH SIMPLE,
+-- so a NULL in either column satisfies it. A versioned row still dies with its
+-- version and a version-less one is simply outside its reach.
+--
+-- Two partial unique indexes rather than one with NULLS NOT DISTINCT, which
+-- needs Postgres 15: a versioned graph is keyed by its version, a buffer parse
+-- by its job alone (a preview job id is unique on its own).
+ALTER TABLE dbt_node DROP CONSTRAINT dbt_node_pkey;
+ALTER TABLE dbt_node ALTER COLUMN script_hash DROP NOT NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS dbt_node_versioned_key
+  ON dbt_node (workspace_id, script_path, script_hash, job_id, unique_id)
+  WHERE script_hash IS NOT NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS dbt_node_editor_key
+  ON dbt_node (workspace_id, job_id, unique_id)
+  WHERE script_hash IS NULL;
+
+ALTER TABLE dbt_edge DROP CONSTRAINT dbt_edge_pkey;
+ALTER TABLE dbt_edge ALTER COLUMN script_hash DROP NOT NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS dbt_edge_versioned_key
+  ON dbt_edge (workspace_id, script_path, script_hash, job_id, parent_unique_id, child_unique_id)
+  WHERE script_hash IS NOT NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS dbt_edge_editor_key
+  ON dbt_edge (workspace_id, job_id, parent_unique_id, child_unique_id)
+  WHERE script_hash IS NULL;
+
+ALTER TABLE dbt_graph_snapshot DROP CONSTRAINT dbt_graph_snapshot_pkey;
+ALTER TABLE dbt_graph_snapshot ALTER COLUMN script_hash DROP NOT NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS dbt_graph_snapshot_versioned_key
+  ON dbt_graph_snapshot (workspace_id, script_path, script_hash, job_id)
+  WHERE script_hash IS NOT NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS dbt_graph_snapshot_editor_key
+  ON dbt_graph_snapshot (workspace_id, job_id)
+  WHERE script_hash IS NULL;
+
+-- On an EDITOR graph only: the principal whose parse wrote it.
+--
+-- Retention for these is a count per script rather than a clock, and the scope
+-- has to be something the caller cannot choose. A preview's path IS the
+-- caller's to choose and needs only `jobs:run`, so bounding by path alone would
+-- let one caller's parses evict the graphs of whoever is actually editing that
+-- script. `permissioned_as` is the execution principal the queue derived, which
+-- is the same reason `dbt_run_state` keys on it.
+ALTER TABLE dbt_graph_snapshot ADD COLUMN IF NOT EXISTS permissioned_as VARCHAR(255);
+
+-- An editor graph is bounded per (path, principal) rather than by age: the
+-- newest few are kept and the rest dropped as each refresh lands, so this is the
+-- index that ordering reads. The instance-wide age sweep every dbt run already
+-- performs (`job_id <> DEPLOYED_GRAPH`) still catches one refreshed once and
+-- left.
+CREATE INDEX IF NOT EXISTS idx_dbt_graph_snapshot_editor_path
+  ON dbt_graph_snapshot (workspace_id, script_path, permissioned_as, ingested_at)
+  WHERE script_hash IS NULL;
diff --git a/backend/migrations/20260803182436_workspace_diff_last_event.down.sql b/backend/migrations/20260803182436_workspace_diff_last_event.down.sql
new file mode 100644
index 0000000000..8c09aacf27
--- /dev/null
+++ b/backend/migrations/20260803182436_workspace_diff_last_event.down.sql
@@ -0,0 +1,5 @@
+ALTER TABLE workspace_diff
+    DROP COLUMN fork_last_event_kind,
+    DROP COLUMN fork_last_event_origin,
+    DROP COLUMN source_last_event_kind,
+    DROP COLUMN source_last_event_origin;
diff --git a/backend/migrations/20260803182436_workspace_diff_last_event.up.sql b/backend/migrations/20260803182436_workspace_diff_last_event.up.sql
new file mode 100644
index 0000000000..c2c0257c19
--- /dev/null
+++ b/backend/migrations/20260803182436_workspace_diff_last_event.up.sql
@@ -0,0 +1,21 @@
+-- `ahead`/`behind` count writes on a side without recording what kind of write it
+-- was or who made it, which leaves one row shape undecidable: an item the parent
+-- has and the fork does not can mean the parent added it, the fork deleted it, or
+-- a sync reverted it in the fork. Record the last event per side so the merge
+-- direction can offer a removal on evidence.
+--
+-- `kind` is 'write' | 'delete' | 'rename_from' (the path was vacated by a rename
+-- to another path); create and update are not split because nothing at the tally
+-- point tells them apart for every item kind. `origin` is 'authored' | 'sync'
+-- (applied by a git-sync pull or a workspace-to-workspace deploy rather than
+-- authored in that workspace) and is the load-bearing half: a sync-origin delete
+-- is a revert, not a fork deletion.
+--
+-- NULL on every row written before this migration, and on a side that has not
+-- been written since: such a row has no history and must keep the conservative
+-- rule (no removal offered).
+ALTER TABLE workspace_diff
+    ADD COLUMN fork_last_event_kind VARCHAR(20),
+    ADD COLUMN fork_last_event_origin VARCHAR(20),
+    ADD COLUMN source_last_event_kind VARCHAR(20),
+    ADD COLUMN source_last_event_origin VARCHAR(20);
diff --git a/backend/migrations/20260807103416_resource_version.down.sql b/backend/migrations/20260807103416_resource_version.down.sql
new file mode 100644
index 0000000000..f2407acf80
--- /dev/null
+++ b/backend/migrations/20260807103416_resource_version.down.sql
@@ -0,0 +1,6 @@
+-- Add down migration script here
+
+DROP TRIGGER IF EXISTS record_resource_version_insert_trigger ON resource;
+DROP TRIGGER IF EXISTS record_resource_version_update_trigger ON resource;
+DROP FUNCTION IF EXISTS record_resource_version();
+DROP TABLE resource_version;
diff --git a/backend/migrations/20260807103416_resource_version.up.sql b/backend/migrations/20260807103416_resource_version.up.sql
new file mode 100644
index 0000000000..f4eef9ae7c
--- /dev/null
+++ b/backend/migrations/20260807103416_resource_version.up.sql
@@ -0,0 +1,108 @@
+-- Add up migration script here
+
+-- Append-only value history for resources. Keyed by (workspace_id, path) with a
+-- cascading FK so a rename carries the history along and a delete takes it with it;
+-- without ON UPDATE CASCADE a rename would strand the history at the old path.
+CREATE TABLE resource_version (
+    id BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+    workspace_id VARCHAR(50) NOT NULL,
+    path VARCHAR(255) NOT NULL,
+    resource_type VARCHAR(50) NOT NULL,
+    value JSONB,
+    created_by VARCHAR(500),
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
+    FOREIGN KEY (workspace_id, path) REFERENCES resource (workspace_id, path)
+        ON DELETE CASCADE ON UPDATE CASCADE
+);
+
+-- Serves both "latest version of this path" and the paginated history listing.
+CREATE INDEX index_resource_version_path ON resource_version (workspace_id, path, id DESC);
+
+GRANT ALL ON resource_version TO windmill_admin;
+GRANT ALL ON resource_version TO windmill_user;
+
+ALTER TABLE resource_version ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY admin_policy ON resource_version FOR ALL TO windmill_admin USING (true);
+
+-- Read visibility follows the parent resource: the subquery is itself subject to resource's
+-- own path/extra_perms policies, so the several rules there stay stated once instead of being
+-- mirrored (and left to drift) here.
+--
+-- SELECT only, deliberately. `FOR ALL ... USING` would be reused as the INSERT/UPDATE/DELETE
+-- check expression, and since the subquery is a SELECT it applies resource's *read* policies —
+-- which would let a user with read-only access to a resource write its history. Nothing but the
+-- trigger below writes this table, and it is SECURITY DEFINER so it does not need a policy.
+CREATE POLICY see_parent_resource ON resource_version FOR SELECT TO windmill_user
+USING (
+    EXISTS (
+        SELECT 1 FROM resource r
+        WHERE r.workspace_id = resource_version.workspace_id
+          AND r.path = resource_version.path
+    )
+);
+
+-- Seed the value every existing resource currently holds, so the first edit after
+-- this migration has something to diff against. `state` and `cache` are machine
+-- churn (setState, job result caching) and are excluded here and in the trigger, the
+-- same way workspace export excludes them (INTERNAL_RESOURCE_TYPES in
+-- windmill-store/src/resources.rs — keep the two lists in step).
+INSERT INTO resource_version (workspace_id, path, resource_type, value, created_by, created_at)
+SELECT workspace_id, path, resource_type, value, created_by, COALESCE(edited_at, now())
+FROM resource
+WHERE resource_type NOT IN ('state', 'cache');
+
+-- Recording lives in a trigger rather than the API handlers because resource values are
+-- written from well outside them: a variable rename rewrites its linked resource
+-- (windmill-store/src/variables.rs), workspace forks clone resources wholesale
+-- (windmill-api-workspaces/src/workspaces.rs), native integrations upsert them
+-- (windmill-native-triggers/src/workspace_integrations.rs), and trashbin restores
+-- reinsert them (windmill-api/src/trash.rs). Handler-level hooks would miss all of those
+-- and every path added later, leaving a history that silently disagrees with the value it
+-- claims to describe.
+--
+-- Deleting a resource hard-deletes it, so the FK cascade takes its whole history with it: a
+-- trashbin restore lands on an empty history and starts a new one at v1.
+CREATE OR REPLACE FUNCTION record_resource_version() RETURNS trigger AS $$
+BEGIN
+    -- `session.user` is set by UserDB::begin for authed requests; worker and system writes fall
+    -- back to the row's own author. NULLIF because a transaction-local set_config resets the
+    -- placeholder to the empty string rather than unsetting it, so a pooled connection that
+    -- previously served an authed request reports '' here, not NULL.
+    INSERT INTO resource_version (workspace_id, path, resource_type, value, created_by)
+    VALUES (
+        NEW.workspace_id, NEW.path, NEW.resource_type, NEW.value,
+        COALESCE(NULLIF(current_setting('session.user', true), ''), NEW.created_by)
+    );
+
+    -- The per-path cap is enforced by trim_resource_versions in the monitor, not here: trimming
+    -- on every write would tax a path `setResource` can drive in a loop, to keep a bound that
+    -- does not need to hold instantaneously.
+
+    RETURN NEW;
+END;
+-- SECURITY DEFINER so history is written on behalf of every writer, including the read-only
+-- policy above, without granting anyone direct write access to the table. `SET search_path FROM
+-- CURRENT` is the injection hardening that goes with it, captured rather than hardcoded so
+-- installs running a non-public PG_SCHEMA still resolve (see
+-- 20260624103600_repair_folder_labels_search_path.up.sql).
+$$ LANGUAGE plpgsql SECURITY DEFINER SET search_path FROM CURRENT;
+
+-- Split in two, and gated in WHEN rather than in the function body, so the rows that never
+-- produce a version never enter plpgsql at all: `state`/`cache` writes (one per setState and
+-- per cached job result — by far the hottest writers of this table) and updates that leave the
+-- value alone. Separate triggers because a WHEN on INSERT cannot reference OLD.
+CREATE TRIGGER record_resource_version_insert_trigger
+AFTER INSERT ON resource
+FOR EACH ROW
+WHEN (NEW.resource_type NOT IN ('state', 'cache'))
+EXECUTE FUNCTION record_resource_version();
+
+CREATE TRIGGER record_resource_version_update_trigger
+AFTER UPDATE ON resource
+FOR EACH ROW
+WHEN (
+    NEW.resource_type NOT IN ('state', 'cache')
+    AND NEW.value IS DISTINCT FROM OLD.value
+)
+EXECUTE FUNCTION record_resource_version();
diff --git a/backend/parsers/windmill-parser-py-asset/src/lib.rs b/backend/parsers/windmill-parser-py-asset/src/lib.rs
index b8a12fb476..9c70b93d64 100644
--- a/backend/parsers/windmill-parser-py-asset/src/lib.rs
+++ b/backend/parsers/windmill-parser-py-asset/src/lib.rs
@@ -273,7 +273,7 @@ impl AssetsFinder {
             Some(Expr::Constant(ExprConstant { value: Constant::Str(value), .. })) => {
                 let path = parse_asset_syntax(&value, false)
                     .map(|(_, p)| p)
-                    .unwrap_or(&value);
+                    .unwrap_or(std::borrow::Cow::Borrowed(value));
                 self.assets.push(ParseAssetsResult {
                     kind,
                     path: path.to_string(),
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.lock b/backend/parsers/windmill-parser-wasm/Cargo.lock
index 0e4e12eb89..8bd1d5bb1b 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.lock
+++ b/backend/parsers/windmill-parser-wasm/Cargo.lock
@@ -6191,7 +6191,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill-common"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -6227,6 +6227,7 @@ dependencies = [
  "jsonwebtoken",
  "lazy_static",
  "magic-crypt",
+ "memchr",
  "native-tls",
  "once_cell",
  "pep440_rs",
@@ -6266,13 +6267,14 @@ dependencies = [
  "windmill-macros",
  "windmill-parser",
  "windmill-parser-sql",
+ "windmill-parser-sql-asset",
  "windmill-parser-ts",
  "windmill-types",
 ]
 
 [[package]]
 name = "windmill-macros"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6284,7 +6286,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "convert_case",
  "serde",
@@ -6293,7 +6295,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6305,7 +6307,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6317,7 +6319,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -6329,7 +6331,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6341,7 +6343,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6353,7 +6355,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -6364,7 +6366,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6375,7 +6377,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6387,7 +6389,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6398,7 +6400,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -6420,7 +6422,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6432,7 +6434,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6446,7 +6448,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "convert_case",
@@ -6463,7 +6465,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6476,7 +6478,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6488,7 +6490,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6506,7 +6508,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -6522,7 +6524,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6538,7 +6540,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wasm"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "getrandom 0.2.17",
@@ -6570,18 +6572,21 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
+ "lazy_static",
+ "regex",
  "serde",
  "serde_json",
+ "serde_yml",
  "windmill-parser",
  "yaml-rust",
 ]
 
 [[package]]
 name = "windmill-types"
-version = "1.775.2"
+version = "1.783.0"
 dependencies = [
  "anyhow",
  "bitflags",
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.toml b/backend/parsers/windmill-parser-wasm/Cargo.toml
index 1cb5004022..2e527cef86 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.toml
+++ b/backend/parsers/windmill-parser-wasm/Cargo.toml
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]
 
 [workspace.package]
-version = "1.775.2"
+version = "1.783.0"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 
diff --git a/backend/parsers/windmill-parser-wasm/src/lib.rs b/backend/parsers/windmill-parser-wasm/src/lib.rs
index c843652e26..59e963d52c 100644
--- a/backend/parsers/windmill-parser-wasm/src/lib.rs
+++ b/backend/parsers/windmill-parser-wasm/src/lib.rs
@@ -164,6 +164,14 @@ pub fn parse_ansible(code: &str) -> String {
     wrap_sig(windmill_parser_yaml::parse_ansible_sig(code))
 }
 
+/// Shares the ansible parser's feature: both live in windmill-parser-yaml, and
+/// a dbt descriptor is YAML too.
+#[cfg(feature = "ansible-parser")]
+#[wasm_bindgen]
+pub fn parse_dbt(code: &str) -> String {
+    wrap_sig(windmill_parser_yaml::parse_dbt_sig(code))
+}
+
 #[cfg(feature = "ansible-parser")]
 #[wasm_bindgen]
 pub fn parse_ansible_delegate(code: &str) -> String {
diff --git a/backend/parsers/windmill-parser-yaml/Cargo.toml b/backend/parsers/windmill-parser-yaml/Cargo.toml
index eb01ba1936..eb2f16fccc 100644
--- a/backend/parsers/windmill-parser-yaml/Cargo.toml
+++ b/backend/parsers/windmill-parser-yaml/Cargo.toml
@@ -14,3 +14,6 @@ windmill-parser.workspace = true
 anyhow.workspace = true
 serde_json.workspace = true
 serde.workspace = true
+serde_yml.workspace = true
+regex.workspace = true
+lazy_static.workspace = true
diff --git a/backend/parsers/windmill-parser-yaml/src/dbt.rs b/backend/parsers/windmill-parser-yaml/src/dbt.rs
new file mode 100644
index 0000000000..24f1e2c39d
--- /dev/null
+++ b/backend/parsers/windmill-parser-yaml/src/dbt.rs
@@ -0,0 +1,781 @@
+//! The `ScriptLang::Dbt` script artifact: a YAML descriptor holding a dbt
+//! project's run configuration. The project itself is the script's module
+//! bundle, so the descriptor names no source for it.
+//!
+//! Field names track dbt's and astronomer-cosmos's vocabulary so the mental
+//! model ports without translation (docs/dbt-runtime.md, decision 22).
+//! `select` / `exclude` / `selector` are passed to dbt **verbatim**: the
+//! selector grammar is dbt's, and reimplementing it is a standing source of
+//! divergence.
+
+use std::collections::BTreeMap;
+
+use serde::{Deserialize, Serialize};
+use windmill_parser::{Arg, MainArgSignature, Typ};
+
+/// Which dbt to run. The shipped default is `dbt-core-1x` because it runs
+/// today's projects untouched; `fusion` is never bundled and is fetched from
+/// dbt Labs at runtime (docs/dbt-runtime.md, decision 1).
+#[derive(Serialize, Deserialize, Debug, Clone, Copy, PartialEq, Eq, Default)]
+#[serde(rename_all = "kebab-case")]
+pub enum DbtEngine {
+    #[default]
+    #[serde(rename = "dbt-core-1x")]
+    DbtCore1x,
+    #[serde(rename = "dbt-core-2x")]
+    DbtCore2x,
+    Fusion,
+}
+
+impl DbtEngine {
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            DbtEngine::DbtCore1x => "dbt-core-1x",
+            DbtEngine::DbtCore2x => "dbt-core-2x",
+            DbtEngine::Fusion => "fusion",
+        }
+    }
+
+    /// The level the machine-readable file log is written at. Separate from the
+    /// console log, which always stays human-readable at the default level and
+    /// is what reaches the job log.
+    pub fn progress_log_level(&self) -> &'static str {
+        match self {
+            DbtEngine::DbtCore1x => "info",
+            DbtEngine::DbtCore2x | DbtEngine::Fusion => "debug",
+        }
+    }
+
+    /// Whether the engine writes per-node events to its JSON **file** log — the
+    /// only source of *live* per-model status.
+    ///
+    /// Not a claim that the others produce none: dbt-core 2.x and Fusion emit
+    /// the same events, on the console, and ignore `--log-format-file json`
+    /// though both accept it. Reading them would mean taking over the console
+    /// and re-rendering the job log. Flip this the moment either honours the
+    /// flag — nothing else has to change (docs/dbt-runtime.md, "Live per-model
+    /// progress").
+    pub fn emits_node_events(&self) -> bool {
+        matches!(self, DbtEngine::DbtCore1x)
+    }
+}
+
+/// How the warehouse connection is supplied. Both paths are supported
+/// (decision 8): render `profiles.yml` from a Windmill resource, or keep the
+/// project's own file and inject Windmill secrets as env vars for
+/// `{{ env_var() }}`.
+#[derive(Serialize, Deserialize, Debug, Clone, Default)]
+#[serde(deny_unknown_fields)]
+pub struct DbtProfile {
+    /// A warehouse configured on the workspace, by name; omitted takes the
+    /// default one. This is the ONLY way a project names a warehouse — there is
+    /// no per-descriptor resource — so a dbt project carries no connection at
+    /// all, the same bargain `s3://` and `ducklake://` make with workspace
+    /// storage, and asset identity has exactly one spelling to key on.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub warehouse: Option<String>,
+
+    /// dbt target name. It selects which output of the profile runs; the
+    /// `<warehouse>` component of asset identity comes from `warehouse` above.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub target: Option<String>,
+    /// Path (relative to `project`) of the project's own `profiles.yml`, used
+    /// instead of rendering one.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub profiles_yml: Option<String>,
+    /// Target schema (BigQuery calls it the dataset). Required for adapters
+    /// whose Windmill resource carries none — a BigQuery resource is a raw
+    /// service-account JSON, which has no dataset in it. Overrides the
+    /// resource's own value where there is one.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub schema: Option<String>,
+    /// dbt adapter (`postgres` | `snowflake` | `bigquery` | `databricks`),
+    /// spelled as dbt's own `type:`. Optional: the worker infers it from the
+    /// resource's shape, and this pins it when the inference is wrong or the
+    /// resource is a custom type.
+    #[serde(default, rename = "type", skip_serializing_if = "Option::is_none")]
+    pub adapter: Option<String>,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, Default)]
+#[serde(rename_all = "snake_case")]
+pub enum DbtTestBehavior {
+    /// `dbt build` — models and their tests interleaved, a model's tests gating
+    /// its children. dbt's own default and the only behavior that stops bad
+    /// data propagating mid-run.
+    #[default]
+    Build,
+    /// `dbt run` then `dbt test`.
+    AfterAll,
+    /// `dbt run` only.
+    None,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, Default)]
+#[serde(deny_unknown_fields)]
+pub struct DbtDescriptor {
+    #[serde(default)]
+    pub engine: Option<DbtEngine>,
+    #[serde(default)]
+    pub profile: DbtProfile,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub select: Vec<String>,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub exclude: Vec<String>,
+    /// A named selector from the project's `selectors.yml`, passed verbatim.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub selector: Option<String>,
+    #[serde(default)]
+    pub test_behavior: DbtTestBehavior,
+    /// `--vars`. dbt vars are typed — numbers, booleans, lists and objects are
+    /// all normal — so values keep their YAML type; only string leaves carry
+    /// `{{ arg }}` placeholders the worker substitutes from job args. Coercing
+    /// everything to a string would make a `false` var truthy in Jinja.
+    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+    pub vars: BTreeMap<String, serde_json::Value>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub threads: Option<u32>,
+    #[serde(default)]
+    pub full_refresh: bool,
+    /// Automatic in-job retry of the nodes a build failed on.
+    ///
+    /// dbt already confines a failure to its own subtree, and `dbt retry`
+    /// rebuilds exactly the failed and skipped set, so a transient warehouse
+    /// error costs those nodes rather than the whole project. Doing it inside
+    /// the same job is what keeps the state question out of it: the previous
+    /// attempt's `run_results.json` is still in the job directory.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub retry_failed_nodes: Option<DbtNodeRetry>,
+    /// Extra environment for the dbt process, for the project's own
+    /// `{{ env_var() }}` lookups and for engine flags such as
+    /// `DBT_ALLOW_EXPERIMENTAL_ADAPTERS`. A `$var:<path>` value is resolved to
+    /// that Windmill variable's value by the worker, so a password never has to
+    /// sit in the descriptor — which is versioned script content.
+    ///
+    /// This is the map to use for anything the GRAPH depends on — an
+    /// `env_var()` driving a schema, alias or `enabled` — because it applies at
+    /// deploy as well as at run. Script-level environment variables reach the
+    /// run only, so a graph parsed without them would disagree with what the
+    /// build writes.
+    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+    pub env: BTreeMap<String, String>,
+}
+
+/// How many times, and how far apart, to retry a build's failed nodes.
+#[derive(Serialize, Deserialize, Debug, Clone, Copy, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
+pub struct DbtNodeRetry {
+    /// Extra `dbt retry` attempts for the job, spent across whichever phases
+    /// fail — a model phase that uses them all leaves none for the tests.
+    pub attempts: u32,
+    /// Seconds between attempts. A transient warehouse error is usually a lock
+    /// or a restart, so a pause is the point.
+    #[serde(default)]
+    pub delay_seconds: u64,
+}
+
+impl DbtNodeRetry {
+    /// Bounded because each attempt is a real dbt invocation inside a job that
+    /// already holds a worker slot, and the job's own deadline still applies.
+    pub const MAX_ATTEMPTS: u32 = 10;
+
+    pub fn attempts(&self) -> u32 {
+        self.attempts.min(Self::MAX_ATTEMPTS)
+    }
+}
+
+/// The dbt subcommands a run may ask for. Kept here so the signature and the
+/// worker's validation cannot drift apart.
+///
+/// An allowlist rather than a passthrough: the value becomes the dbt subcommand,
+/// and running a script needs weaker permission than editing it, so an unchecked
+/// arg would let a runner invoke `clean` or `source freshness` against the
+/// descriptor's warehouse.
+///
+/// `run` is absent because it covers models only: a project with seeds or
+/// snapshots would build a subset of what its graph claims. Narrowing what a run
+/// touches is `select`/`exclude`, which scope the graph too. Tests run as part
+/// of `build`, or as the second phase of `test_behavior: after_all`.
+///
+/// `show` writes nothing — it SELECTs from a model and returns rows. That is
+/// only admissible because a dbt run no longer dispatches: while it did, any
+/// successful job fired the script's whole deploy-time write set, so a command
+/// that built none of them woke every consumer for relations nothing touched.
+///
+/// `parse` reads no relation either: it resolves the project into a manifest and
+/// stores the graph, which is what the editor's model panel is refreshed by. It
+/// still needs a resolvable warehouse, because the profile is rendered before
+/// any dbt invocation — a misconfigured project therefore fails a refresh the way
+/// it would fail a run, which is the early feedback worth having.
+pub const DBT_COMMANDS: &[&str] = &["build", "retry", "show", "parse"];
+
+/// Rows a `show` returns unless the run asks for fewer. dbt enforces it, so the
+/// bound is not us splicing a `LIMIT` into someone's SQL.
+pub const DBT_SHOW_DEFAULT_LIMIT: u32 = 100;
+
+/// Hard ceiling on that limit. The worker buffers `dbt show`'s whole stdout to
+/// read the rows out of it, so the argument decides how much memory a caller can
+/// make it hold — and running a script needs only run permission. A preview is
+/// for looking at a few rows; anything larger is a query, which is what a SQL
+/// script is for.
+pub const DBT_SHOW_MAX_LIMIT: u32 = 1_000;
+
+/// Whether the command only reads. Such a run publishes no graph, records no
+/// materializations and runs no test phase — there is nothing it could have
+/// changed.
+pub fn is_read_only_command(command: &str) -> bool {
+    command == "show"
+}
+
+/// The command a run uses when it does not name one. Public because the worker
+/// must choose exactly what the run form's default advertises.
+pub fn default_command(d: &DbtDescriptor) -> &'static str {
+    match d.test_behavior {
+        DbtTestBehavior::Build => "build",
+        // Also `build`, with the tests excluded rather than the command
+        // narrowed to `run`: `run` covers models only, so a selection that
+        // includes a seed or a snapshot would silently not build it and the
+        // models reading it would fail — or worse, read a stale table.
+        DbtTestBehavior::AfterAll | DbtTestBehavior::None => "build",
+    }
+}
+
+impl DbtDescriptor {
+    pub fn engine(&self) -> DbtEngine {
+        self.engine.unwrap_or_default()
+    }
+}
+
+/// Names a `{{ placeholder }}` may not take. `command` is the argument holding
+/// the run's command block; the rest are the fields inside it, which the worker
+/// spreads over the run's arguments to read them — a placeholder of the same
+/// name would be shadowed there, and the script could never be run (`select` is
+/// an array, and interpolating one into a string is not something any invocation
+/// can satisfy).
+pub const RESERVED_ARG_NAMES: &[&str] = &[
+    "command",
+    "select",
+    "exclude",
+    "vars",
+    "full_refresh",
+    "dbt_command",
+    "dbt_retry_job",
+    "model",
+    "limit",
+];
+
+pub fn parse_dbt_descriptor(inner_content: &str) -> anyhow::Result<DbtDescriptor> {
+    let d = serde_yml::from_str::<DbtDescriptor>(inner_content)
+        .map_err(|e| anyhow::anyhow!("Failed to parse dbt descriptor: {e}"))?;
+    if let Some(name) = placeholders(&d)
+        .into_iter()
+        .find(|n| RESERVED_ARG_NAMES.contains(&n.as_str()))
+    {
+        return Err(anyhow::anyhow!(
+            "`{{{{ {name} }}}}` collides with the run argument `{name}` this runtime already \
+             defines ({}); rename the placeholder",
+            RESERVED_ARG_NAMES.join(", ")
+        ));
+    }
+    Ok(d)
+}
+
+/// The workspace warehouse a descriptor gets when it names none — spelled like
+/// the default lake (`ducklake://main.orders`), so one workspace concept reads
+/// the same across kinds.
+pub const DBT_DEFAULT_WAREHOUSE: &str = "main";
+
+/// The single argument holding the command and the overrides it takes. Its
+/// variant IS the command, so a run cannot carry an override the command
+/// ignores: `retry` rebuilds the failed run's nodes with the arguments that run
+/// had, and `full_refresh` means nothing to a `show`.
+pub const DBT_COMMAND_ARG: &str = "command";
+
+/// The variant discriminator, which is the key Windmill's run form tags a
+/// `oneOf` value with.
+pub const DBT_COMMAND_LABEL: &str = "label";
+
+fn list_arg(name: &str, default: &[String]) -> Arg {
+    Arg {
+        name: name.to_string(),
+        otyp: None,
+        typ: Typ::List(Box::new(Typ::Str(None))),
+        has_default: true,
+        default: Some(serde_json::json!(default)),
+        oidx: None,
+        otyp_inferred: false,
+    }
+}
+
+/// An OVERRIDE map, so its default is empty rather than a copy of the
+/// descriptor's vars. Seeding it with the descriptor would make the run form
+/// post the raw `{{ placeholder }}` text back and clobber the value the worker
+/// just interpolated for it.
+fn vars_arg() -> Arg {
+    Arg {
+        name: "vars".to_string(),
+        otyp: None,
+        typ: Typ::Object(windmill_parser::ObjectType::new(None, Some(vec![]))),
+        has_default: true,
+        default: Some(serde_json::json!({})),
+        oidx: None,
+        otyp_inferred: false,
+    }
+}
+
+/// What each command takes, in form order.
+///
+/// `show` and `parse` are absent on purpose, for the same reason: each is a thing
+/// to do to the project you are looking at rather than a job to fill a form in
+/// for. `show` previews ONE model's rows, offered by the run page's graph and the
+/// assets list where the tables are; `parse` refreshes the model graph, offered by
+/// the dbt editor over the buffer being edited. The worker still accepts
+/// `{label: show, model, limit}` and `{label: parse, vars}` from a flow, the CLI or
+/// the API (`DBT_COMMANDS`, docs/dbt-runtime.md).
+fn command_variants(d: &DbtDescriptor) -> Vec<(&'static str, Vec<Arg>)> {
+    let selection = || {
+        vec![
+            list_arg("select", &d.select),
+            list_arg("exclude", &d.exclude),
+            vars_arg(),
+        ]
+    };
+    vec![
+        (
+            "build",
+            selection()
+                .into_iter()
+                .chain([Arg {
+                    name: "full_refresh".to_string(),
+                    otyp: None,
+                    typ: Typ::Bool,
+                    has_default: true,
+                    default: Some(serde_json::json!(d.full_refresh)),
+                    oidx: None,
+                    otyp_inferred: false,
+                }])
+                .collect(),
+        ),
+        (
+            "retry",
+            // The run it resumes, named rather than implied: only the latest
+            // failure of this script is kept, so "resume the last one" would
+            // silently aim somewhere else the moment another run failed. No
+            // default, so this variant requires it.
+            vec![Arg {
+                name: "dbt_retry_job".to_string(),
+                otyp: None,
+                typ: Typ::Str(None),
+                has_default: false,
+                default: None,
+                oidx: None,
+                otyp_inferred: false,
+            }],
+        ),
+    ]
+}
+
+/// The command block a run gets when it overrides nothing: the descriptor's own
+/// selection under the descriptor's default command, so an untouched run
+/// reproduces it exactly.
+fn default_command_value(d: &DbtDescriptor) -> serde_json::Value {
+    let label = default_command(d);
+    let mut obj = serde_json::Map::new();
+    obj.insert(DBT_COMMAND_LABEL.to_string(), serde_json::json!(label));
+    for arg in command_variants(d)
+        .into_iter()
+        .find(|(l, _)| *l == label)
+        .map(|(_, args)| args)
+        .unwrap_or_default()
+    {
+        if let Some(default) = arg.default {
+            obj.insert(arg.name, default);
+        }
+    }
+    serde_json::Value::Object(obj)
+}
+
+/// Run-time arguments of a dbt script: the command block above, plus one
+/// argument per `{{ placeholder }}` the descriptor interpolates. Placeholders
+/// stay top-level — they are the project's own inputs, not a command's.
+pub fn parse_dbt_sig(inner_content: &str) -> anyhow::Result<MainArgSignature> {
+    let d = parse_dbt_descriptor(inner_content)?;
+    let mut args = vec![Arg {
+        name: DBT_COMMAND_ARG.to_string(),
+        otyp: None,
+        typ: Typ::Object(windmill_parser::ObjectType::new(None, Some(vec![]))),
+        has_default: true,
+        default: Some(default_command_value(&d)),
+        oidx: None,
+        otyp_inferred: false,
+    }];
+
+    for name in placeholders(&d) {
+        if args.iter().any(|a| a.name == name) {
+            continue;
+        }
+        args.push(Arg {
+            name,
+            otyp: None,
+            // Untyped, not `Str`: a placeholder standing alone in a var takes
+            // the argument's own JSON type, and declaring it a string makes the
+            // run form post `"false"` — truthy in Jinja — for a boolean.
+            typ: Typ::Unknown,
+            has_default: false,
+            default: None,
+            oidx: None,
+            otyp_inferred: false,
+        });
+    }
+
+    Ok(MainArgSignature {
+        star_args: false,
+        star_kwargs: false,
+        args,
+        auto_kind: None,
+        has_preprocessor: None,
+        ..Default::default()
+    })
+}
+
+/// The run form's JSON schema for a dbt descriptor.
+///
+/// Derived here rather than in the browser or the CLI: both infer a script's
+/// schema client-side through `windmill-parser-wasm`, whose published package
+/// has no dbt arm, so they leave the schema untouched. Without this a dbt
+/// script deploys with an empty schema and its run form offers none of the
+/// overrides — and an edited descriptor keeps the previous one's arguments.
+/// The command is a `oneOf` rather than an enum beside the overrides it selects:
+/// a variant carries exactly the arguments its command takes, so `dbt_retry_job`
+/// is required where it means something and absent everywhere else, and no run
+/// can submit a `full_refresh` to a command that ignores it. The run form renders
+/// it as a toggle over the variants and tags the value with `label`.
+pub fn dbt_arg_schema(inner_content: &str) -> anyhow::Result<serde_json::Value> {
+    let d = parse_dbt_descriptor(inner_content)?;
+    let sig = parse_dbt_sig(inner_content)?;
+    let mut properties = serde_json::Map::new();
+    let mut required: Vec<serde_json::Value> = vec![];
+    let mut order: Vec<serde_json::Value> = vec![];
+
+    let variants: Vec<serde_json::Value> = command_variants(&d)
+        .into_iter()
+        .map(|(label, args)| {
+            let mut props = serde_json::Map::new();
+            let mut var_required: Vec<serde_json::Value> = vec![];
+            let mut var_order: Vec<serde_json::Value> = vec![serde_json::json!(DBT_COMMAND_LABEL)];
+            // The discriminator. Single-valued, so the form's toggle is what sets
+            // it and a submitted block cannot claim one command while carrying
+            // another's fields.
+            props.insert(
+                DBT_COMMAND_LABEL.to_string(),
+                serde_json::json!({"type": "string", "enum": [label]}),
+            );
+            for arg in args {
+                if !arg.has_default {
+                    var_required.push(serde_json::json!(arg.name));
+                }
+                var_order.push(serde_json::json!(arg.name));
+                props.insert(arg.name.clone(), property_of(&arg));
+            }
+            serde_json::json!({
+                "title": label,
+                "type": "object",
+                "properties": props,
+                "order": var_order,
+                "required": var_required,
+            })
+        })
+        .collect();
+
+    for arg in &sig.args {
+        let mut prop = property_of(arg);
+        if arg.name == DBT_COMMAND_ARG {
+            if let Some(obj) = prop.as_object_mut() {
+                obj.insert(
+                    "oneOf".to_string(),
+                    serde_json::Value::Array(variants.clone()),
+                );
+                obj.insert(
+                    "description".to_string(),
+                    serde_json::json!(
+                        "`build` runs the project. `retry` resumes a failed run, rebuilding only \
+                         its failed and skipped nodes with the arguments it ran with."
+                    ),
+                );
+            }
+        }
+        if !arg.has_default {
+            required.push(serde_json::json!(arg.name));
+        }
+        order.push(serde_json::json!(arg.name));
+        properties.insert(arg.name.clone(), prop);
+    }
+    Ok(serde_json::json!({
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": properties,
+        "required": required,
+        "order": order,
+    }))
+}
+
+/// One argument as a JSON-schema property, with the description the run form
+/// shows under its label.
+fn property_of(arg: &Arg) -> serde_json::Value {
+    let mut prop = match &arg.typ {
+        Typ::Bool => serde_json::json!({"type": "boolean"}),
+        // `limit` is an integer to the worker, which clamps it; without this the
+        // generated clients and the run form offer no numeric control.
+        Typ::Int => serde_json::json!({"type": "integer"}),
+        Typ::List(_) => serde_json::json!({"type": "array", "items": {"type": "string"}}),
+        Typ::Object(_) => serde_json::json!({"type": "object"}),
+        Typ::Str(Some(variants)) => serde_json::json!({"type": "string", "enum": variants}),
+        Typ::Str(None) => serde_json::json!({"type": "string"}),
+        // A placeholder takes the JSON type of whatever is passed, so it is
+        // deliberately left untyped rather than guessed at.
+        _ => serde_json::json!({}),
+    };
+    if let Some(obj) = prop.as_object_mut() {
+        if let Some(default) = arg.default.as_ref() {
+            obj.insert("default".to_string(), default.clone());
+        }
+        let description = match arg.name.as_str() {
+            "dbt_retry_job" => Some(
+                "The failed run to resume, by run id. Its failed and skipped nodes are rebuilt \
+                 with the arguments it ran with. Resuming from that run's page fills this in.",
+            ),
+            "select" => Some(
+                "dbt selection syntax, e.g. `tag:nightly`, `stg_orders+`, \
+                 `config.materialized:incremental`. Empty runs the descriptor's own selection.",
+            ),
+            "exclude" => Some("Nodes to leave out of the selection above, same syntax."),
+            "vars" => Some(
+                "dbt `--vars`, merged over the descriptor's. A var that changes which models \
+                 exist makes this run store its own graph rather than the deployed one.",
+            ),
+            "full_refresh" => Some("Rebuild incremental models from scratch instead of appending."),
+            "model" => Some(
+                "The model to preview, by name — `stg_orders`, or `my_package.stg_orders` when \
+                 two packages share a name. Any dbt selector resolving to ONE node works.",
+            ),
+            "limit" => Some("Rows the preview returns."),
+            // A placeholder the descriptor interpolates: its meaning is the
+            // project's, so there is nothing generic to say about it.
+            _ => None,
+        };
+        if let Some(d) = description {
+            obj.insert("description".to_string(), serde_json::json!(d));
+        }
+    }
+    prop
+}
+
+/// `{{ name }}` placeholders in the interpolated descriptor fields, in a stable
+/// order. Must stay in sync with the fields the worker actually interpolates.
+fn placeholders(d: &DbtDescriptor) -> Vec<String> {
+    let mut out: Vec<String> = vec![];
+    let mut push_from = |s: &str| {
+        for caps in PLACEHOLDER_RE.captures_iter(s) {
+            let name = caps[1].to_string();
+            if !out.contains(&name) {
+                out.push(name);
+            }
+        }
+    };
+    for v in d.vars.values() {
+        for leaf in string_leaves(v) {
+            push_from(leaf);
+        }
+    }
+    out
+}
+
+/// Every string inside a var's value, at any depth — the only places a
+/// `{{ arg }}` placeholder can appear.
+pub fn string_leaves(v: &serde_json::Value) -> Vec<&str> {
+    match v {
+        serde_json::Value::String(s) => vec![s.as_str()],
+        serde_json::Value::Array(a) => a.iter().flat_map(string_leaves).collect(),
+        serde_json::Value::Object(o) => o.values().flat_map(string_leaves).collect(),
+        _ => vec![],
+    }
+}
+
+lazy_static::lazy_static! {
+    /// Same spelling as the Ansible executor's `interpolate_template`, which is
+    /// what actually performs the substitution at run time.
+    static ref PLACEHOLDER_RE: regex::Regex =
+        regex::Regex::new(r"\{\{\s*([A-Za-z_][A-Za-z0-9_]*)\s*\}\}").unwrap();
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const DESCRIPTOR: &str = r#"
+engine: dbt-core-2x
+profile:
+  warehouse: main
+  target: prod
+select: ["tag:nightly+"]
+test_behavior: after_all
+vars:
+  run_date: "{{ day }}"
+  strict: false
+threads: 8
+full_refresh: true
+"#;
+
+    // A descriptor drives warehouse writes, so a field it does not recognise is
+    // an error rather than a default. `selcet:` would otherwise leave `select`
+    // empty and build the entire project; a misspelled `target` would silently
+    // fall back to the profile's own default.
+    #[test]
+    fn an_unknown_descriptor_field_is_refused() {
+        let err = parse_dbt_descriptor("profile:\n  warehouse: main\nselcet: [a]\n")
+            .unwrap_err()
+            .to_string();
+        assert!(err.contains("selcet"), "{err}");
+        let err = parse_dbt_descriptor("profile:\n  warehouse: main\n  targt: prod\n")
+            .unwrap_err()
+            .to_string();
+        assert!(err.contains("targt"), "{err}");
+    }
+
+    // A placeholder that takes a run argument's name would be shadowed by it,
+    // leaving a descriptor no invocation can satisfy: `select` is an array and
+    // the interpolation needs a scalar. Refused at parse, so the deploy says so
+    // rather than the script becoming unrunnable after it.
+    #[test]
+    fn a_placeholder_may_not_take_a_run_argument_name() {
+        for name in RESERVED_ARG_NAMES {
+            let d = format!("profile:\n  warehouse: main\nvars:\n  v: \"{{{{ {name} }}}}\"\n");
+            let err = parse_dbt_descriptor(&d).unwrap_err().to_string();
+            assert!(err.contains(name), "{name}: {err}");
+        }
+        // A name of its own is fine.
+        assert!(
+            parse_dbt_descriptor("profile:\n  warehouse: main\nvars:\n  v: \"{{ day }}\"\n")
+                .is_ok()
+        );
+    }
+
+    // The run form is built from this schema, and nothing else can build it:
+    // the browser and the CLI both infer through a wasm parser that has no dbt
+    // arm, so a missing property here is an override the user cannot reach.
+    // The variants are what make the form show a command's own fields and only
+    // those, so each is asserted by the arguments it carries.
+    #[test]
+    fn the_schema_carries_every_run_override_and_placeholder() {
+        let schema = dbt_arg_schema(DESCRIPTOR).unwrap();
+        let props = schema["properties"].as_object().unwrap();
+        let variants = props[DBT_COMMAND_ARG]["oneOf"].as_array().unwrap();
+        let of = |label: &str| {
+            let v = variants
+                .iter()
+                .find(|v| v["title"] == label)
+                .unwrap_or_else(|| panic!("no `{label}` variant: {schema}"));
+            let mut names: Vec<String> = v["properties"]
+                .as_object()
+                .unwrap()
+                .keys()
+                .filter(|k| k.as_str() != DBT_COMMAND_LABEL)
+                .cloned()
+                .collect();
+            names.sort();
+            (v.clone(), names)
+        };
+
+        let (build, build_args) = of("build");
+        assert_eq!(build_args, ["exclude", "full_refresh", "select", "vars"]);
+        assert_eq!(build["properties"]["full_refresh"]["type"], "boolean");
+        // Defaults come from the descriptor, so an untouched run reproduces it.
+        assert_eq!(
+            build["properties"]["select"]["default"],
+            serde_json::json!(["tag:nightly+"])
+        );
+        // The discriminator takes one value per variant: the toggle sets it, and
+        // a block cannot claim one command while carrying another's fields.
+        assert_eq!(
+            build["properties"][DBT_COMMAND_LABEL]["enum"],
+            serde_json::json!(["build"])
+        );
+
+        let (retry, retry_args) = of("retry");
+        assert_eq!(retry_args, ["dbt_retry_job"]);
+        // Required where it means something, rather than required everywhere and
+        // hidden: a retry names the run it resumes.
+        assert_eq!(retry["required"], serde_json::json!(["dbt_retry_job"]));
+
+        // Neither `show` nor `parse` is a form variant: previewing one model's
+        // rows and refreshing the model graph are both things you do to the
+        // project in front of you, and the graph, the assets list and the dbt
+        // editor are where those live. The worker still accepts both
+        // programmatically, which is what makes them scriptable.
+        for hidden in ["show", "parse"] {
+            assert!(
+                !variants.iter().any(|v| v["title"] == hidden),
+                "{hidden} must not be offered in the run form: {schema}"
+            );
+            assert!(
+                DBT_COMMANDS.contains(&hidden),
+                "but the worker still takes {hidden}"
+            );
+        }
+
+        // Every `{{ placeholder }}` the descriptor interpolates is an argument a
+        // run must supply. The command block is not one: it defaults to the
+        // descriptor's own selection under the descriptor's command.
+        assert_eq!(schema["required"], serde_json::json!(["day"]));
+        assert_eq!(schema["order"], serde_json::json!([DBT_COMMAND_ARG, "day"]));
+    }
+
+    #[test]
+    fn parses_descriptor() {
+        let d = parse_dbt_descriptor(DESCRIPTOR).unwrap();
+        assert_eq!(d.engine(), DbtEngine::DbtCore2x);
+        assert_eq!(d.profile.target.as_deref(), Some("prod"));
+        assert_eq!(d.select, vec!["tag:nightly+"]);
+        assert_eq!(d.threads, Some(8));
+        assert!(d.full_refresh);
+        // dbt vars keep their YAML type: a `false` coerced to "false" is truthy
+        // in Jinja and would silently invert the condition it gates.
+        assert_eq!(d.vars["strict"], serde_json::json!(false));
+        assert_eq!(d.vars["run_date"], serde_json::json!("{{ day }}"));
+    }
+
+    #[test]
+    fn an_empty_descriptor_defaults_to_the_bundled_engine() {
+        let d = parse_dbt_descriptor("").unwrap();
+        assert_eq!(d.engine(), DbtEngine::DbtCore1x);
+    }
+
+    // The ORDER is asserted, not just the set: the schema's `order` is built from
+    // this vec and the run form follows it, so the command block leading is what
+    // puts the choice of what the run does above the project's own inputs.
+    #[test]
+    fn signature_exposes_the_command_block_and_placeholders() {
+        let sig = parse_dbt_sig(DESCRIPTOR).unwrap();
+        let names: Vec<&str> = sig.args.iter().map(|a| a.name.as_str()).collect();
+        assert_eq!(names, vec![DBT_COMMAND_ARG, "day"]);
+        // An untouched run reproduces the descriptor: its default is the whole
+        // block — the descriptor's command, carrying the descriptor's selection.
+        let cmd = sig.args.iter().find(|a| a.name == DBT_COMMAND_ARG).unwrap();
+        let default = cmd.default.clone().unwrap();
+        // `build`, not `run`: `run` covers models only, so a selection naming a
+        // seed or a snapshot would silently not build it.
+        assert_eq!(default[DBT_COMMAND_LABEL], serde_json::json!("build"));
+        assert_eq!(default["select"], serde_json::json!(["tag:nightly+"]));
+        assert_eq!(default["full_refresh"], serde_json::json!(true));
+        // `vars` is the exception: it overrides, so its default must be empty.
+        // Seeded with the descriptor, the run form would post `{{ day }}` back
+        // and overwrite the value the worker interpolated for it.
+        assert_eq!(default["vars"], serde_json::json!({}));
+        // Placeholders are required (the descriptor names no value for them)
+        // and untyped, so a `{{ }}` var can carry a boolean or a number rather
+        // than the string "false", which Jinja treats as truthy.
+        let day = sig.args.iter().find(|a| a.name == "day").unwrap();
+        assert!(!day.has_default);
+        assert_eq!(day.typ, Typ::Unknown);
+    }
+}
diff --git a/backend/parsers/windmill-parser-yaml/src/lib.rs b/backend/parsers/windmill-parser-yaml/src/lib.rs
index f2a1a2b824..e025849769 100644
--- a/backend/parsers/windmill-parser-yaml/src/lib.rs
+++ b/backend/parsers/windmill-parser-yaml/src/lib.rs
@@ -9,6 +9,13 @@ use yaml_rust::{Yaml, YamlEmitter, YamlLoader};
 pub mod asset_parser;
 pub use asset_parser::parse_assets;
 
+pub mod dbt;
+pub use dbt::{
+    dbt_arg_schema, default_command as default_dbt_command, parse_dbt_descriptor, parse_dbt_sig,
+    DbtDescriptor, DbtEngine, DbtTestBehavior, DBT_COMMANDS, DBT_COMMAND_ARG, DBT_COMMAND_LABEL,
+    DBT_DEFAULT_WAREHOUSE,
+};
+
 pub fn parse_ansible_sig(inner_content: &str) -> anyhow::Result<MainArgSignature> {
     let docs = YamlLoader::load_from_str(inner_content)
         .map_err(|e| anyhow!("Failed to parse yaml: {}", e))?;
diff --git a/backend/parsers/windmill-parser/src/asset_parser.rs b/backend/parsers/windmill-parser/src/asset_parser.rs
index de35ccdd6e..843a83a310 100644
--- a/backend/parsers/windmill-parser/src/asset_parser.rs
+++ b/backend/parsers/windmill-parser/src/asset_parser.rs
@@ -1,4 +1,5 @@
 use serde::Serialize;
+use std::borrow::Cow;
 use std::collections::BTreeMap;
 
 // Token recognized inside declared asset URIs that the runtime substitutes
@@ -28,6 +29,11 @@ pub enum AssetKind {
     Ducklake,
     DataTable,
     Volume,
+    /// A warehouse relation a dbt project builds or reads,
+    /// `dbt://<warehouse>/<schema>/<name>`, the warehouse named as the
+    /// workspace configures it. The scheme names the producer, the path stays
+    /// the relation — see `windmill_types::AssetKind::Dbt`.
+    Dbt,
 }
 
 #[derive(Serialize, Debug, PartialEq, Clone)]
@@ -714,21 +720,32 @@ pub fn asset_was_used(assets: &Vec<ParseAssetsResult>, (kind, path): (AssetKind,
     })
 }
 
-pub fn parse_asset_syntax(s: &str, enable_default_syntax: bool) -> Option<(AssetKind, &str)> {
+/// Split an asset URI into `(kind, path)`. The single point where user-written
+/// asset URIs become graph keys, and therefore where `dbt://` paths get
+/// canonicalized (see `canonicalize_table_asset_path`) — every other kind's
+/// suffix is kept verbatim and stays borrowed.
+pub fn parse_asset_syntax(
+    s: &str,
+    enable_default_syntax: bool,
+) -> Option<(AssetKind, Cow<'_, str>)> {
     if enable_default_syntax && s == "datatable" {
-        return Some((AssetKind::DataTable, "main"));
+        return Some((AssetKind::DataTable, Cow::Borrowed("main")));
     } else if enable_default_syntax && s == "ducklake" {
-        return Some((AssetKind::Ducklake, "main"));
+        return Some((AssetKind::Ducklake, Cow::Borrowed("main")));
     }
     for (prefix, kind) in ASSET_KINDS.iter() {
         if s.starts_with(prefix) {
+            let suffix = &s[prefix.len()..];
+            if *kind == AssetKind::Dbt {
+                return Some((*kind, Cow::Owned(canonicalize_table_asset_path(suffix))));
+            }
             // The suffix is kept verbatim. For S3 the path encodes the storage:
             // `s3://<storage>/<key>`, with an EMPTY storage segment for the
             // workspace default — so `s3:///key` yields `/key` (leading slash
             // significant, default storage) while `s3://secondary/key` yields
             // `secondary/key`. Stripping leading slashes here would conflate a
             // default-storage object with a named-storage one.
-            return Some((*kind, &s[prefix.len()..]));
+            return Some((*kind, Cow::Borrowed(suffix)));
         }
     }
     None
@@ -741,8 +758,123 @@ pub const ASSET_KINDS: &[(&str, AssetKind)] = &[
     ("ducklake://", AssetKind::Ducklake),
     ("datatable://", AssetKind::DataTable),
     ("volume://", AssetKind::Volume),
+    ("dbt://", AssetKind::Dbt),
 ];
 
+/// Canonical spelling of a `dbt://` path, `<warehouse>/<schema>/<name>`.
+///
+/// The whole point of keying warehouse relations on the relation rather than on
+/// the producing tool is that a dbt mart and a native script reading the same
+/// table land on one graph node. That only holds if both sides spell the key
+/// identically, and they will not by default: dbt's `manifest.json` gives
+/// `relation_name` pre-quoted (`"db"."Schema"."Tbl"`) while an annotation is
+/// written by hand, and the warehouses disagree on case (Snowflake folds
+/// unquoted identifiers up, Postgres folds them down, DuckDB compares them
+/// case-insensitively). Two spellings of one table produce two nodes, no edge,
+/// and nothing looks broken in isolation — so the rule is applied once, here,
+/// on every path that becomes a `dbt://` asset.
+///
+/// The rule: strip the quote characters the warehouses use (`"`, backtick,
+/// `[`/`]`) from the schema and name, then ASCII-lowercase them. This matches
+/// the case-insensitive identifier comparison the DuckDB paths already use
+/// (`schema_contracts::CapturedSchema::find`). The warehouse-name prefix is
+/// spelled as the workspace configures it, which is case-sensitive, and is left
+/// untouched.
+///
+/// Consequence to accept: a relation deliberately created under a quoted
+/// mixed-case identifier collides with its lowercase spelling. That is rarer
+/// than the case-fold mismatch it prevents, and it errs toward unifying nodes
+/// rather than splitting them.
+pub fn canonicalize_table_asset_path(path: &str) -> String {
+    let Some((resource, rest)) = path.rsplit_once('/').and_then(|(head, name)| {
+        head.rsplit_once('/')
+            .map(|(resource, schema)| (resource, (schema, name)))
+    }) else {
+        // Fewer than three segments: not a well-formed relation path. Leave it
+        // alone so the malformed value stays visible instead of being reshaped
+        // into something that looks valid.
+        return path.to_string();
+    };
+    let (schema, name) = rest;
+    format!(
+        "{}/{}/{}",
+        resource,
+        unquote_schema_segment(schema).to_ascii_lowercase(),
+        unquote_identifier(name).to_ascii_lowercase()
+    )
+}
+
+/// A doubled delimiter inside a quoted identifier is that delimiter, literally —
+/// the same rule the worker's `split_relation` applies to `relation_name`. Both
+/// have to decode it or one spelling of a table becomes two graph nodes: the dbt
+/// model under `sales"east`, its native consumer under `sales""east`.
+fn unquote_identifier(s: &str) -> String {
+    let s = s.trim();
+    for (open, close) in [('"', '"'), ('`', '`'), ('[', ']')] {
+        if s.len() >= 2 && s.starts_with(open) && s.ends_with(close) {
+            let inner = &s[1..s.len() - 1];
+            return inner.replace(&format!("{close}{close}"), &close.to_string());
+        }
+    }
+    s.to_string()
+}
+
+/// Unquote a schema segment, which carries a `<database>.<schema>` pair when a
+/// relation overrode its database. Each half is separately quotable, so
+/// stripping only the outer pair leaves `"Archive"."Sales"` as
+/// `Archive"."Sales` — a different key from the ingest's `archive.sales`, which
+/// silently splits the model and its native consumer into two nodes.
+///
+/// The halves go through `unquote_identifier`, which requires the quote at both
+/// ends, because this function sees both a warehouse SPELLING (from a `dbt://`
+/// annotation) and an already-DECODED identifier (from `table_asset_path`, whose
+/// callers ran `split_relation` or read the manifest) and cannot tell them apart.
+/// A lone `"` in a decoded name — `sa"les` — must survive: treated as opening a
+/// quote it would be dropped, filing the ingest's `sa"les` under `sales` while
+/// the annotation's `"sa""les"` decodes to `sa"les`, which is the split this
+/// canonicalization exists to prevent.
+fn unquote_schema_segment(s: &str) -> String {
+    let s = s.trim();
+    let mut parts: Vec<&str> = Vec::new();
+    let mut start = 0usize;
+    let mut quote: Option<char> = None;
+    let bytes: Vec<(usize, char)> = s.char_indices().collect();
+    let mut k = 0usize;
+    while k < bytes.len() {
+        let (i, c) = bytes[k];
+        match quote {
+            Some(q) => {
+                let close = if q == '[' { ']' } else { q };
+                if c == close {
+                    // Doubled: a literal delimiter, so the quote stays open.
+                    if bytes.get(k + 1).map(|(_, n)| *n) == Some(close) {
+                        k += 1;
+                    } else {
+                        quote = None;
+                    }
+                }
+            }
+            // Only a quote that OPENS the part can be a delimiter; one in the
+            // middle of a decoded identifier is part of the name.
+            None if (c == '"' || c == '`' || c == '[') && i == start => quote = Some(c),
+            // Only an UNQUOTED period separates the database from the schema;
+            // one inside an identifier is part of the name.
+            None if c == '.' => {
+                parts.push(&s[start..i]);
+                start = i + c.len_utf8();
+            }
+            None => {}
+        }
+        k += 1;
+    }
+    parts.push(&s[start..]);
+    parts
+        .into_iter()
+        .map(unquote_identifier)
+        .collect::<Vec<_>>()
+        .join(".")
+}
+
 // Tokenize a `key=value [key="quoted value"] ...` option string. Bare
 // values run until the next whitespace; quoted values consume until the
 // matching quote. Malformed pairs (missing `=` or empty key) are skipped
@@ -1555,11 +1687,11 @@ mod pipeline_annotation_tests {
         // objects and must never collapse to one identity.
         assert_eq!(
             parse_asset_syntax("s3:///exports/x", false),
-            Some((AssetKind::S3Object, "/exports/x"))
+            Some((AssetKind::S3Object, Cow::Borrowed("/exports/x")))
         );
         assert_eq!(
             parse_asset_syntax("s3://exports/x", false),
-            Some((AssetKind::S3Object, "exports/x"))
+            Some((AssetKind::S3Object, Cow::Borrowed("exports/x")))
         );
         assert_ne!(
             parse_asset_syntax("s3:///exports/x", false),
@@ -1569,28 +1701,181 @@ mod pipeline_annotation_tests {
         // The `// on` trigger annotation goes through the same function.
         assert_eq!(
             parse_asset_syntax("s3:///exports/x", true),
-            Some((AssetKind::S3Object, "/exports/x"))
+            Some((AssetKind::S3Object, Cow::Borrowed("/exports/x")))
         );
 
         assert_eq!(
             parse_asset_syntax("s3://secondary_storage/path/to/file.csv", false),
-            Some((AssetKind::S3Object, "secondary_storage/path/to/file.csv"))
+            Some((
+                AssetKind::S3Object,
+                Cow::Borrowed("secondary_storage/path/to/file.csv")
+            ))
         );
 
         // Hive-partition keys are preserved verbatim.
         assert_eq!(
             parse_asset_syntax("s3:///t/year=2024/month=01/f.parquet", false),
-            Some((AssetKind::S3Object, "/t/year=2024/month=01/f.parquet"))
+            Some((
+                AssetKind::S3Object,
+                Cow::Borrowed("/t/year=2024/month=01/f.parquet")
+            ))
         );
 
         // Non-S3 kinds also keep their suffix verbatim.
         assert_eq!(
             parse_asset_syntax("res://f/foo", false),
-            Some((AssetKind::Resource, "f/foo"))
+            Some((AssetKind::Resource, Cow::Borrowed("f/foo")))
         );
         assert_eq!(
             parse_asset_syntax("ducklake://analytics/orders", false),
-            Some((AssetKind::Ducklake, "analytics/orders"))
+            Some((AssetKind::Ducklake, Cow::Borrowed("analytics/orders")))
+        );
+    }
+
+    // A dbt mart and a native script reading the same warehouse table must land
+    // on ONE graph node. They only do if every spelling of the relation
+    // canonicalizes identically — dbt's manifest gives it pre-quoted, the
+    // annotation is hand-written, and the warehouses fold case in opposite
+    // directions. A regression here is invisible: both nodes still render, they
+    // just stop being the same node and the cross-boundary cascade never fires.
+    #[test]
+    fn table_paths_from_every_spelling_canonicalize_to_one_key() {
+        let canonical = Some((
+            AssetKind::Dbt,
+            Cow::Owned("main/analytics/orders".into()),
+        ));
+        for spelling in [
+            // Hand-written annotation.
+            "dbt://main/analytics/orders",
+            // dbt manifest `relation_name`, quoted (database segment already
+            // dropped by the ingest, which keys on the warehouse name instead).
+            "dbt://main/\"analytics\"/\"orders\"",
+            // Snowflake folds unquoted identifiers up, Postgres folds down.
+            "dbt://main/ANALYTICS/ORDERS",
+            "dbt://main/Analytics/Orders",
+            // BigQuery / Databricks backticks, SQL Server brackets.
+            "dbt://main/`analytics`/`orders`",
+            "dbt://main/[Analytics]/[Orders]",
+        ] {
+            assert_eq!(
+                parse_asset_syntax(spelling, false),
+                canonical,
+                "spelling {spelling} did not canonicalize"
+            );
+        }
+    }
+
+    // A relation that overrode its database carries `<database>.<schema>` in
+    // one segment, and each half can be quoted independently. Stripping only
+    // the outer pair leaves a key the manifest ingest never produces, so the
+    // model and a native script reading it become separate nodes.
+    #[test]
+    fn qualified_schema_segments_unquote_each_half() {
+        let canonical = Some((
+            AssetKind::Dbt,
+            Cow::Owned("main/archive.sales/orders".into()),
+        ));
+        for spelling in [
+            "dbt://main/archive.sales/orders",
+            "dbt://main/\"Archive\".\"Sales\"/\"Orders\"",
+            "dbt://main/`Archive`.`Sales`/`Orders`",
+            "dbt://main/[Archive].[Sales]/[Orders]",
+        ] {
+            assert_eq!(
+                parse_asset_syntax(spelling, false),
+                canonical,
+                "spelling {spelling} did not canonicalize"
+            );
+        }
+        // A period INSIDE one quoted identifier is part of the name, not a
+        // database qualifier.
+        assert_eq!(
+            parse_asset_syntax("dbt://main/\"sales.v2\"/orders", false),
+            Some((
+                AssetKind::Dbt,
+                Cow::Owned("main/sales.v2/orders".into())
+            ))
+        );
+    }
+
+    // Every dialect here escapes its own delimiter by doubling it, and the
+    // worker's `split_relation` decodes it — so a canonicalizer that did not
+    // would file the dbt model under `sales"east` and the native script reading
+    // it under `sales""east`, which is the split this key exists to prevent.
+    #[test]
+    fn a_doubled_delimiter_canonicalizes_like_the_relation_it_names() {
+        for (spelling, expected) in [
+            (
+                "dbt://main/\"sales\"\"east\"/\"orders\"",
+                "main/sales\"east/orders",
+            ),
+            (
+                "dbt://main/analytics/\"order\"\"s\"",
+                "main/analytics/order\"s",
+            ),
+            (
+                "dbt://main/`da``ta`/`orders`",
+                "main/da`ta/orders",
+            ),
+            (
+                "dbt://main/[my]]schema]/[orders]",
+                "main/my]schema/orders",
+            ),
+            // And in one half of a database-qualified segment.
+            (
+                "dbt://main/\"arch\"\"ive\".\"sales\"/orders",
+                "main/arch\"ive.sales/orders",
+            ),
+        ] {
+            assert_eq!(
+                parse_asset_syntax(spelling, false),
+                Some((AssetKind::Dbt, Cow::Owned(expected.into()))),
+                "spelling {spelling} did not canonicalize"
+            );
+        }
+        // The DECODED form has to land on the same key, in both halves: this
+        // function sees the warehouse's spelling from an annotation and an
+        // already-decoded identifier from the ingest, and cannot tell them
+        // apart. A lone delimiter treated as opening a quote would be dropped —
+        // `sa"les` filed as `sales` — and the two derivations would split.
+        for (decoded, spelled) in [
+            ("dbt://main/sa\"les/orders", "dbt://main/\"sa\"\"les\"/orders"),
+            ("dbt://main/analytics/order\"s", "dbt://main/analytics/\"order\"\"s\""),
+            (
+                "dbt://main/arch\"ive.sales/orders",
+                "dbt://main/\"arch\"\"ive\".\"sales\"/orders",
+            ),
+        ] {
+            assert_eq!(
+                parse_asset_syntax(decoded, false),
+                parse_asset_syntax(spelled, false),
+                "the decoded and quoted spellings of {decoded} disagree"
+            );
+        }
+    }
+
+    #[test]
+    fn table_canonicalization_leaves_the_warehouse_name_case_alone() {
+        // The warehouse-name prefix is spelled as the workspace configures it
+        // and is case-sensitive; only the two identifier segments are folded.
+        assert_eq!(
+            parse_asset_syntax("dbt://MyWarehouse/Sales/Orders", false),
+            Some((
+                AssetKind::Dbt,
+                Cow::Owned("MyWarehouse/sales/orders".into())
+            ))
+        );
+        // A database-qualified schema keeps its own case rules: the whole
+        // segment folds, dot included.
+        assert_eq!(
+            parse_asset_syntax("dbt://main/PROD.Sales/Orders", false),
+            Some((AssetKind::Dbt, Cow::Owned("main/prod.sales/orders".into())))
+        );
+        // Too few segments to be a relation: left alone rather than reshaped
+        // into something that looks well-formed.
+        assert_eq!(
+            parse_asset_syntax("dbt://Orders", false),
+            Some((AssetKind::Dbt, Cow::Owned("Orders".into())))
         );
     }
 
diff --git a/backend/parsers/windmill-parser/tests/pipeline_annotations_parity.rs b/backend/parsers/windmill-parser/tests/pipeline_annotations_parity.rs
index 1936f7ff70..9493a78606 100644
--- a/backend/parsers/windmill-parser/tests/pipeline_annotations_parity.rs
+++ b/backend/parsers/windmill-parser/tests/pipeline_annotations_parity.rs
@@ -110,6 +110,7 @@ fn kind_str(k: AssetKind) -> &'static str {
         AssetKind::Ducklake => "ducklake",
         AssetKind::DataTable => "datatable",
         AssetKind::Volume => "volume",
+        AssetKind::Dbt => "dbt",
     }
 }
 
diff --git a/backend/src/main.rs b/backend/src/main.rs
index 969fd4e94d..51febad6f0 100644
--- a/backend/src/main.rs
+++ b/backend/src/main.rs
@@ -932,46 +932,62 @@ async fn windmill_main() -> anyhow::Result<()> {
         }
 
         // Lower the worker's oom_score_adj so the OOM killer strongly prefers killing
-        // job subprocesses (oom_score_adj=1000) over the worker itself.
+        // job subprocesses (oom_score_adj=JOB_OOM_SCORE_ADJ) over the worker itself.
         // Kubernetes sets it high for burstable QoS (e.g. 937), leaving a tiny gap vs jobs.
         // Requires CAP_SYS_RESOURCE to lower it; if missing, we just warn.
         #[cfg(any(target_os = "linux"))]
-        match std::fs::read_to_string("/proc/self/oom_score_adj") {
-            Ok(current) => {
-                let current = current.trim().to_string();
-                let current_val = match current.parse::<i32>() {
-                    Ok(v) => v,
-                    Err(e) => {
-                        tracing::warn!("Could not parse oom_score_adj '{current}': {e}");
-                        0
-                    }
-                };
-                if current_val > 0 {
-                    match std::fs::write("/proc/self/oom_score_adj", "0") {
-                        Ok(_) => {
-                            tracing::info!(
-                                "Lowered worker oom_score_adj from {current} to 0 \
-                                (jobs get 1000, gap=1000)"
-                            );
+        {
+            // Badness is (memory used, in permille of host RAM) + oom_score_adj, so the gap
+            // must exceed the worker's own footprint in permille to actually steer the kill.
+            // 100 covers a worker holding up to ~10% of host RAM.
+            const MIN_OOM_SCORE_GAP: i32 = 100;
+
+            let job_adj = *windmill_common::worker::JOB_OOM_SCORE_ADJ;
+            match std::fs::read_to_string("/proc/self/oom_score_adj") {
+                Ok(current) => {
+                    let current = current.trim().to_string();
+                    match current.parse::<i32>() {
+                        Ok(mut worker_adj) => {
+                            if worker_adj > 0 {
+                                match std::fs::write("/proc/self/oom_score_adj", "0") {
+                                    Ok(_) => {
+                                        tracing::info!(
+                                            "Lowered worker oom_score_adj from {worker_adj} to 0"
+                                        );
+                                        worker_adj = 0;
+                                    }
+                                    Err(e) => {
+                                        tracing::warn!(
+                                            "Could not lower worker oom_score_adj from {worker_adj} to 0: {e}. \
+                                            Add CAP_SYS_RESOURCE to the container to fix this"
+                                        );
+                                    }
+                                }
+                            }
+                            let gap = job_adj - worker_adj;
+                            if gap >= MIN_OOM_SCORE_GAP {
+                                tracing::info!(
+                                    "Worker oom_score_adj={worker_adj}, jobs get {job_adj} (gap={gap})"
+                                );
+                            } else {
+                                tracing::warn!(
+                                    "Worker oom_score_adj={worker_adj}, jobs get {job_adj} (gap={gap}): \
+                                    too small to reliably steer the OOM killer to the job. \
+                                    Raise JOB_OOM_SCORE_ADJ or lower the worker's own score"
+                                );
+                            }
                         }
                         Err(e) => {
                             tracing::warn!(
-                                "Could not lower worker oom_score_adj from {current} to 0: {e}. \
-                                Gap to jobs is only {} — OOM killer may target the worker instead. \
-                                Add CAP_SYS_RESOURCE to the container to fix this",
-                                1000 - current_val
+                                "Could not parse worker oom_score_adj '{current}': {e}. \
+                                Cannot tell whether jobs (oom_score_adj={job_adj}) outrank the worker"
                             );
                         }
                     }
-                } else {
-                    tracing::info!(
-                        "Worker oom_score_adj={current} (jobs get 1000, gap={})",
-                        1000 - current_val
-                    );
                 }
-            }
-            Err(e) => {
-                tracing::warn!("Could not read worker oom_score_adj: {e}");
+                Err(e) => {
+                    tracing::warn!("Could not read worker oom_score_adj: {e}");
+                }
             }
         }
     }
diff --git a/backend/src/monitor.rs b/backend/src/monitor.rs
index ccff5c2c7b..a9f747cfe5 100644
--- a/backend/src/monitor.rs
+++ b/backend/src/monitor.rs
@@ -46,7 +46,7 @@ use windmill_common::otel_oss::{
 use windmill_common::{
     agent_workers::DECODED_AGENT_TOKEN,
     apps::APP_WORKSPACED_ROUTE,
-    auth::create_token_for_owner,
+    auth::{create_token_for_owner, ephemeral_script_token_label},
     ee_oss::CriticalErrorChannel,
     email_oss::send_email_if_possible,
     error,
@@ -117,17 +117,18 @@ use windmill_queue::{
     schedule::{find_unarmed_schedules, rearm_schedule, RearmOutcome},
     SameWorkerPayload,
 };
+use windmill_store::resources::MAX_RESOURCE_VERSIONS;
 use windmill_worker::{
     result_processor::handle_job_error, JobCompletedSender, JobIsolationLevel,
-    OtelTracingProxySettings, SameWorkerSender, WorkspaceRegistryMap, BUNFIG_INSTALL_SCOPES,
-    BUN_INSTALL_MIN_RELEASE_AGE, CARGO_REGISTRIES, INSTANCE_PYTHON_VERSION, JAVA_HOME_DIR,
-    JOB_DEFAULT_TIMEOUT, JOB_ISOLATION, KEEP_JOB_DIR, MAVEN_REPOS, MAVEN_SETTINGS_XML,
-    NO_DEFAULT_MAVEN, NPMRC, NPM_CONFIG_REGISTRY, NSJAIL_AVAILABLE, NSJAIL_TMPFS_SIZE_MB,
-    NSJAIL_TMP_BACKING, NUGET_CONFIG, OTEL_TRACING_PROXY_SETTINGS, PIP_EXTRA_INDEX_URL,
-    PIP_INDEX_URL, POWERSHELL_REPO_PAT, POWERSHELL_REPO_URL, SANDBOX_IMAGE_CACHE_MAX_MB,
-    SANDBOX_IMAGE_DEFAULT_REGISTRY, SANDBOX_IMAGE_MAX_SIZE_MB, SANDBOX_IMAGE_PULL_POLICY,
-    SANDBOX_REGISTRY_AUTH, UNSHARE_PATH, UV_EXCLUDE_NEWER, UV_INDEX_STRATEGY,
-    UV_PYTHON_INSTALL_MIRROR, WORKSPACE_REGISTRIES,
+    OtelTracingProxySettings, SameWorkerSender, StepFailureKind, WorkspaceRegistryMap,
+    BUNFIG_INSTALL_SCOPES, BUN_INSTALL_MIN_RELEASE_AGE, CARGO_REGISTRIES, INSTANCE_PYTHON_VERSION,
+    JAVA_HOME_DIR, JOB_DEFAULT_TIMEOUT, JOB_ISOLATION, KEEP_JOB_DIR, MAVEN_REPOS,
+    MAVEN_SETTINGS_XML, NO_DEFAULT_MAVEN, NPMRC, NPM_CONFIG_REGISTRY, NSJAIL_AVAILABLE,
+    NSJAIL_TMPFS_SIZE_MB, NSJAIL_TMP_BACKING, NUGET_CONFIG, OTEL_TRACING_PROXY_SETTINGS,
+    PIP_EXTRA_INDEX_URL, PIP_INDEX_URL, POWERSHELL_REPO_PAT, POWERSHELL_REPO_URL,
+    SANDBOX_IMAGE_CACHE_MAX_MB, SANDBOX_IMAGE_DEFAULT_REGISTRY, SANDBOX_IMAGE_MAX_SIZE_MB,
+    SANDBOX_IMAGE_PULL_POLICY, SANDBOX_REGISTRY_AUTH, UNSHARE_PATH, UV_EXCLUDE_NEWER,
+    UV_INDEX_STRATEGY, UV_PYTHON_INSTALL_MIRROR, WORKSPACE_REGISTRIES,
 };
 
 #[cfg(feature = "parquet")]
@@ -1258,6 +1259,39 @@ async fn report_token_expiration(db: &DB, token: &TokenRow, expired: bool) {
     }
 }
 
+/// Trim resource version history down to the per-path cap.
+///
+/// Deliberately not part of `delete_expired_items` (which runs every monitor tick): this is a
+/// full pass over `resource_version`, and the cap only has to hold eventually, so the call site
+/// gates it to the same rare cadence as the other heavy sweeps.
+pub async fn trim_resource_versions(db: &DB) -> () {
+    let trimmed = sqlx::query_scalar!(
+        "DELETE FROM resource_version rv
+         USING (
+             SELECT id FROM (
+                 SELECT id, row_number() OVER (
+                     PARTITION BY workspace_id, path ORDER BY id DESC
+                 ) AS rn
+                 FROM resource_version
+             ) ranked WHERE rn > $1
+         ) over_cap
+         WHERE rv.id = over_cap.id
+         RETURNING rv.id",
+        MAX_RESOURCE_VERSIONS,
+    )
+    .fetch_all(db)
+    .await;
+
+    match trimmed {
+        Ok(ids) => {
+            if ids.len() > 0 {
+                tracing::info!("trimmed {} resource versions past the cap", ids.len())
+            }
+        }
+        Err(e) => tracing::error!("Error trimming resource versions: {}", e.to_string()),
+    }
+}
+
 pub async fn delete_expired_items(db: &DB) -> () {
     let expired_tokens_r = sqlx::query_as!(
         TokenRow,
@@ -3177,6 +3211,15 @@ pub async fn monitor_db(
         }
     };
 
+    // run every 120 iterations (~20min at the default LISTEN_NEW_EVENTS_INTERVAL_SEC)
+    let trim_resource_versions_f = async {
+        if server_mode && iteration.is_some() && iteration.as_ref().unwrap().should_run(120) {
+            if let Some(db) = conn.as_sql() {
+                trim_resource_versions(&db).await;
+            }
+        }
+    };
+
     // run every hour
     let vacuum_queue_f = async {
         if server_mode && iteration.is_some() && iteration.as_ref().unwrap().should_run(60) {
@@ -3450,6 +3493,7 @@ pub async fn monitor_db(
         expired_items_f,
         zombie_jobs_f,
         stale_jobs_f,
+        trim_resource_versions_f,
         vacuum_queue_f,
         expose_queue_metrics_f,
         verify_license_key_f,
@@ -4662,13 +4706,7 @@ async fn handle_zombie_jobs(db: &Pool<Postgres>, base_internal_url: &str, node_n
             continue;
         }
         if let Some(job) = job.unwrap() {
-            let label = if job.permissioned_as != format!("u/{}", job.created_by)
-                && job.permissioned_as != job.created_by
-            {
-                format!("ephemeral-script-end-user-{}", job.created_by)
-            } else {
-                "ephemeral-script".to_string()
-            };
+            let label = ephemeral_script_token_label(&job.permissioned_as, &job.created_by);
             let token = create_token_for_owner(
                 &db,
                 &job.workspace_id,
@@ -4706,7 +4744,12 @@ async fn handle_zombie_jobs(db: &Pool<Postgres>, base_internal_url: &str, node_n
                 memory_peak,
                 None,
                 error::Error::ExecutionErr(error_message.clone()),
-                matches!(error_kind, ErrorMessage::SameWorker), // unrecoverable if the job is a same worker zombie
+                // a same worker zombie means the worker itself is gone
+                if matches!(error_kind, ErrorMessage::SameWorker) {
+                    StepFailureKind::Unrecoverable
+                } else {
+                    StepFailureKind::Normal
+                },
                 Some(&same_worker_tx_never_used),
                 "",
                 node_name,
diff --git a/backend/summarized_schema.txt b/backend/summarized_schema.txt
index b47a6556cd..44b62ca51e 100644
--- a/backend/summarized_schema.txt
+++ b/backend/summarized_schema.txt
@@ -3,7 +3,7 @@
 ## ENUMs
 action_kind: create, update, delete, execute
 asset_access_type: r, w, rw
-asset_kind: s3object, resource, variable, ducklake, datatable
+asset_kind: s3object, resource, variable, ducklake, datatable, table
 asset_usage_kind: script, flow, job
 authentication_method: none, windmill, api_key, basic_http, custom_script, signature
 autoscaling_event_type: full_scaleout, scalein, scaleout
@@ -19,6 +19,7 @@ job_status: success, failure, canceled, skipped
 job_trigger_kind: webhook, http, websocket, kafka, email, nats, schedule, app, ui, postgres, sqs, gcp, mqtt, nextcloud, ci_test
 log_mode: standalone, server, worker, agent, indexer, mcp
 login_type: password, github
+materialization_status: running, materialized, failed
 message_type: user, assistant, tool
 metric_kind: scalar_int, scalar_float, timeseries_int, timeseries_float
 mqtt_client_version: v3, v5
@@ -26,7 +27,7 @@ native_trigger_service: nextcloud
 request_type: sync, async, sync_sse
 runnable_type: ScriptHash, ScriptPath, FlowPath
 script_kind: script, trigger, failure, command, approval, preprocessor
-script_lang: python3, deno, go, bash, postgresql, nativets, bun, mysql, bigquery, snowflake, graphql, powershell, mssql, php, bunnative, rust, ansible, csharp, oracledb, nu, java, duckdb, ruby, rlang
+script_lang: python3, deno, go, bash, postgresql, nativets, bun, mysql, bigquery, snowflake, graphql, powershell, mssql, php, bunnative, rust, ansible, csharp, oracledb, nu, java, duckdb, ruby, rlang, dbt
 trigger_kind: webhook, http, websocket, kafka, email, nats, postgres, sqs, mqtt, gcp, default_email, nextcloud
 trigger_mode: enabled, disabled, suspended
 workspace_key_kind: cloud
@@ -65,6 +66,16 @@ ci_test_reference: workspace_id(char), test_script_path(char), test_script_hash(
 concurrency_settings: hash(bigint), concurrency_key(char), concurrent_limit(int), concurrency_time_window_s(int)
 config: name(char), config(jsonb)
 custom_concurrency_key_ended: key(char), ended_at(ts)
+dbt_edge: workspace_id(char), script_path(char), script_hash(bigint), job_id(uuid), parent_unique_id(text), child_unique_id(text), ingested_at(ts)
+  FK: (workspace_id) -> workspace(id), (workspace_id, script_hash) -> script(workspace_id, hash)
+dbt_graph_snapshot: workspace_id(char), script_path(char), script_hash(bigint), job_id(uuid), digest(text), relation_root_at_last_ingest(text), ingested_at(ts), permissioned_as(char)
+  FK: (workspace_id) -> workspace(id), (workspace_id, script_hash) -> script(workspace_id, hash)
+dbt_node: workspace_id(char), script_path(char), script_hash(bigint), job_id(uuid), unique_id(text), resource_type(text), name(text), asset_path(text), materialized(text), materialize_strategy(text), unique_key(text), tags(text[]), description(text), test_kind(text), test_column(text), test_args(jsonb), severity(text), attached_node(text), columns(jsonb), freshness(jsonb), raw_code(text), original_file_path(text), ingested_at(ts)
+  FK: (workspace_id) -> workspace(id), (workspace_id, script_hash) -> script(workspace_id, hash)
+dbt_run_progress: workspace_id(char), job_id(uuid), asset_kind(asset_kind), asset_path(char), status(materialization_status), row_count(bigint), error(text), updated_at(ts)
+  FK: (workspace_id) -> workspace(id)
+dbt_run_state: workspace_id(char), script_path(char), permissioned_as(char), identity(text), args(jsonb), run_results(text), job_id(uuid), retryable(bool), updated_at(ts)
+  FK: (workspace_id) -> workspace(id)
 debounce_key: key(char), job_id(uuid), previous_job_id(uuid), first_started_at(ts), debounced_times(int)
 debounce_stale_data: job_id(uuid), to_relock(text[])
 debouncing_settings: hash(bigint), debounce_key(char), debounce_delay_s(int), max_total_debouncing_time(int), max_total_debounces_amount(int), debounce_args_to_accumulate(text[])
@@ -76,7 +87,7 @@ draft: workspace_id(char), path(char), typ(draft_type), value(json), created_at(
 email_to_igroup: email(char), igroup(char)
 email_trigger: path(char), local_part(char), workspaced_local_part(bool), script_path(char), is_flow(bool), workspace_id(char), edited_by(char), email(char), edited_at(ts), extra_perms(jsonb), error_handler_path(char), error_handler_args(jsonb), retry(jsonb), mode(trigger_mode), labels(text[])
 favorite: usr(char), workspace_id(char), path(char), favorite_kind(favorite_kind)
-flow: workspace_id(char), path(char), summary(text), description(text), value(jsonb), edited_by(char), edited_at(ts), archived(bool), schema(json), extra_perms(jsonb), dependency_job(uuid), draft_only(bool), tag(char), ws_error_handler_muted(bool), dedicated_worker(bool), timeout(int), visible_to_runner_only(bool), concurrency_key(char), versions(bigint[]), on_behalf_of_email(text), lock_error_logs(text), labels(text[])
+flow: workspace_id(char), path(char), summary(text), description(text), value(jsonb), edited_by(char), edited_at(ts), archived(bool), schema(json), extra_perms(jsonb), dependency_job(uuid), draft_only(bool), tag(char), ws_error_handler_muted(bool), dedicated_worker(bool), timeout(int), visible_to_runner_only(bool), concurrency_key(char), versions(bigint[]), on_behalf_of(varchar), on_behalf_of_email(text), lock_error_logs(text), labels(text[])
   FK: (workspace_id) -> workspace(id)
 flow_conversation: id(uuid), workspace_id(char), flow_path(char), title(char), created_at(ts), updated_at(ts), created_by(char)
   FK: (workspace_id) -> workspace(id)
@@ -153,7 +164,7 @@ resume_job: id(uuid), job(uuid), flow(uuid), created_at(ts), value(jsonb), appro
 runnable_settings: hash(bigint), debouncing_settings(bigint), concurrency_settings(bigint)
 schedule: workspace_id(char), path(char), edited_by(char), edited_at(ts), schedule(char), enabled(bool), script_path(char), args(jsonb), extra_perms(jsonb), is_flow(bool), email(char), error(text), timezone(char), on_failure(char), on_recovery(char), on_failure_times(int), on_failure_exact(bool), on_failure_extra_args(jsonb), on_recovery_times(int), on_recovery_extra_args(jsonb), ws_error_handler_muted(bool), retry(jsonb), summary(char), no_flow_overlap(bool), tag(char), paused_until(ts), on_success(char), on_success_extra_args(jsonb), cron_version(text), description(text), dynamic_skip(char), labels(text[])
   FK: (workspace_id) -> workspace(id)
-script: workspace_id(char), hash(bigint), path(char), parent_hashes(bigint[]), summary(text), description(text), content(text), created_by(char), created_at(ts), archived(bool), schema(json), deleted(bool), is_template(bool), extra_perms(jsonb), lock(text), lock_error_logs(text), language(script_lang), kind(script_kind), tag(char), draft_only(bool), envs(char), concurrent_limit(int), concurrency_time_window_s(int), cache_ttl(int), dedicated_worker(bool), ws_error_handler_muted(bool), priority(smallint), timeout(int), delete_after_use(bool), restart_unless_cancelled(bool), concurrency_key(char), visible_to_runner_only(bool), auto_kind(varchar), codebase(char), has_preprocessor(bool), on_behalf_of_email(text), schema_validation(bool), assets(jsonb), debounce_key(char), debounce_delay_s(int), cache_ignore_s3_path(bool), runnable_settings_handle(bigint), labels(text[])
+script: workspace_id(char), hash(bigint), path(char), parent_hashes(bigint[]), summary(text), description(text), content(text), created_by(char), created_at(ts), archived(bool), schema(json), deleted(bool), is_template(bool), extra_perms(jsonb), lock(text), lock_error_logs(text), language(script_lang), kind(script_kind), tag(char), draft_only(bool), envs(char), concurrent_limit(int), concurrency_time_window_s(int), cache_ttl(int), dedicated_worker(bool), ws_error_handler_muted(bool), priority(smallint), timeout(int), delete_after_use(bool), restart_unless_cancelled(bool), concurrency_key(char), visible_to_runner_only(bool), auto_kind(varchar), codebase(char), has_preprocessor(bool), schema_validation(bool), assets(jsonb), debounce_key(char), debounce_delay_s(int), cache_ignore_s3_path(bool), runnable_settings_handle(bigint), labels(text[]), on_behalf_of(varchar), on_behalf_of_email(text)
   FK: (workspace_id) -> workspace(id)
 skip_workspace_diff_tally: workspace_id(char), added_at(ts)
 sqs_trigger: path(char), queue_url(char), aws_resource_path(char), message_attributes(text[]), script_path(char), is_flow(bool), workspace_id(char), edited_by(char), email(char), edited_at(ts), extra_perms(jsonb), error(text), server_id(char), last_server_ping(ts), aws_auth_resource_type(aws_auth_resource_type), error_handler_path(char), error_handler_args(jsonb), retry(jsonb), mode(trigger_mode), labels(text[])
@@ -204,7 +215,7 @@ workspace_protection_rule: workspace_id(char), name(char), rules(int), bypass_gr
   FK: (workspace_id) -> workspace(id)
 workspace_runnable_dependencies: flow_path(char), runnable_path(char), script_hash(bigint), runnable_is_flow(bool), workspace_id(char), app_path(char)
   FK: (app_path, workspace_id) -> app(path, workspace_id) | (flow_path, workspace_id) -> flow(path, workspace_id)
-workspace_settings: workspace_id(char), slack_team_id(char), slack_name(char), slack_command_script(char), slack_email(char), customer_id(char), plan(char), webhook(text), ai_config(jsonb), large_file_storage(jsonb), git_sync(jsonb), default_app(char), default_scripts(jsonb), deploy_ui(jsonb), mute_critical_alerts(bool), color(char), operator_settings(jsonb), teams_command_script(text), teams_team_id(text), teams_team_name(text), git_app_installations(jsonb), ducklake(jsonb), slack_oauth_client_id(char), slack_oauth_client_secret(char), datatable(jsonb), teams_team_guid(text), auto_invite(jsonb), error_handler(jsonb), success_handler(jsonb), public_app_execution_limit_per_minute(int)
+workspace_settings: workspace_id(char), slack_team_id(char), slack_name(char), slack_command_script(char), slack_email(char), customer_id(char), plan(char), webhook(text), ai_config(jsonb), large_file_storage(jsonb), git_sync(jsonb), default_app(char), default_scripts(jsonb), deploy_ui(jsonb), mute_critical_alerts(bool), color(char), operator_settings(jsonb), teams_command_script(text), teams_team_id(text), teams_team_name(text), git_app_installations(jsonb), ducklake(jsonb), slack_oauth_client_id(char), slack_oauth_client_secret(char), datatable(jsonb), teams_team_guid(text), auto_invite(jsonb), error_handler(jsonb), success_handler(jsonb), public_app_execution_limit_per_minute(int), dbt_warehouses(jsonb)
   FK: (workspace_id) -> workspace(id)
 zombie_job_counter: job_id(uuid), counter(int)
   FK: (job_id) -> v2_job(id)
diff --git a/backend/tests/app_anonymous_execution_mode.rs b/backend/tests/app_anonymous_execution_mode.rs
index a40d880f1b..286581c042 100644
--- a/backend/tests/app_anonymous_execution_mode.rs
+++ b/backend/tests/app_anonymous_execution_mode.rs
@@ -282,8 +282,8 @@ async fn test_restrict_anonymous_app_deployment_rule(db: Pool<Postgres>) -> anyh
 async fn seed_script(db: &Pool<Postgres>, path: &str, content: &str) -> anyhow::Result<()> {
     sqlx::query(
         r#"INSERT INTO script (workspace_id, hash, path, summary, description, content,
-                                created_by, on_behalf_of_email, language, tag, lock)
-           VALUES ('test-workspace', hashtext($2)::bigint, $1, '', '', $2, 'test-user', 'test@windmill.dev',
+                                created_by, on_behalf_of, language, tag, lock)
+           VALUES ('test-workspace', hashtext($2)::bigint, $1, '', '', $2, 'test-user', 'u/test-user',
                    'deno'::script_lang, 'deno', '')"#,
     )
     .bind(path)
diff --git a/backend/tests/app_preview_auth.rs b/backend/tests/app_preview_auth.rs
index 2a69004a7b..cd84e6f278 100644
--- a/backend/tests/app_preview_auth.rs
+++ b/backend/tests/app_preview_auth.rs
@@ -22,7 +22,9 @@
 //!   - run mode against a deployed Viewer app rejects caller-supplied inline
 //!     `raw_code` whose sha is not publisher-pinned (CVE-2026-22683 residual:
 //!     the Viewer default-triggerable fallback let any caller / an operator run
-//!     arbitrary code as themselves, bypassing the content-hash pin).
+//!     arbitrary code as themselves, bypassing the content-hash pin), and
+//!   - a path-qualified `apps:run|write:<path>` token reaches only that app
+//!     (the route layer is resource-blind, so the handler must path-check).
 
 use serde_json::json;
 use sqlx::{Pool, Postgres};
@@ -344,5 +346,47 @@ async fn test_app_preview_authorization(db: Pool<Postgres>) -> anyhow::Result<()
         "rejection must be the content-hash pin (unpinned app_script sha), got: {body}"
     );
 
+    // 12. Path confinement: the scope picker mints `apps:run:<path>` /
+    //     `apps:write:<path>`, but the route layer matches domain + action only, so the
+    //     handler is the only place the path is enforced. A token scoped to `vapp` must
+    //     not execute another app's components — those run under that app's identity.
+    for token in ["APPS_RUN_VAPP_TOKEN", "APPS_WRITE_VAPP_TOKEN"] {
+        let resp = authed(client().post(format!("{base}/u/test-user/private")), token)
+            .json(&json!({ "args": {}, "component": "comp", "path": "script/u/test-user/private" }))
+            .send()
+            .await?;
+        let status = resp.status();
+        let body = resp.text().await?;
+        assert_eq!(
+            status, 403,
+            "{token} must not execute an app outside its scope path (got {status}): {body}"
+        );
+        assert!(
+            body.contains("apps:run:u/test-user/private"),
+            "rejection must be the app path scope gate, got: {body}"
+        );
+    }
+
+    // 13. ...and must not over-block the app it IS scoped to: both tokens clear the
+    //     scope gate for `vapp` and reach the policy (which then rejects the unpinned
+    //     code, as in step 9). `apps:write` covering run is what keeps an app-editor
+    //     token working without it also holding `apps:run`.
+    for token in ["APPS_RUN_VAPP_TOKEN", "APPS_WRITE_VAPP_TOKEN"] {
+        let resp = authed(client().post(format!("{base}/u/test-user/vapp")), token)
+            .json(&run_mode_raw_code)
+            .send()
+            .await?;
+        let status = resp.status();
+        let body = resp.text().await?;
+        assert_eq!(
+            status, 400,
+            "{token} must clear the scope gate for its own app and reach the policy (got {status}): {body}"
+        );
+        assert!(
+            body.contains("forbidden by policy"),
+            "{token} must be stopped by the policy, not the scope gate, got: {body}"
+        );
+    }
+
     Ok(())
 }
diff --git a/backend/tests/app_s3_onbehalf.rs b/backend/tests/app_s3_onbehalf.rs
index 7b233b505d..c11c94be1e 100644
--- a/backend/tests/app_s3_onbehalf.rs
+++ b/backend/tests/app_s3_onbehalf.rs
@@ -505,8 +505,8 @@ async fn seed_script(db: &Pool<Postgres>, path: &str, content: &str) -> anyhow::
     }
     sqlx::query(
         r#"INSERT INTO script (workspace_id, hash, path, summary, description, content,
-                                created_by, on_behalf_of_email, language, tag, lock)
-           VALUES ('test-workspace', $1, $2, '', '', $3, 'test-user-2', 'test2@windmill.dev',
+                                created_by, on_behalf_of, language, tag, lock)
+           VALUES ('test-workspace', $1, $2, '', '', $3, 'test-user-2', 'u/test-user-2',
                    'deno'::script_lang, 'deno', '')
            ON CONFLICT DO NOTHING"#,
     )
diff --git a/backend/tests/dependency_map.rs b/backend/tests/dependency_map.rs
index 0d58615be0..4520cae848 100644
--- a/backend/tests/dependency_map.rs
+++ b/backend/tests/dependency_map.rs
@@ -447,6 +447,7 @@ def main():
                 deployment_message: None,
                 visible_to_runner_only: None,
                 on_behalf_of_email: None,
+                on_behalf_of: None,
                 preserve_on_behalf_of: None,
                 ws_error_handler_muted: None,
                 labels: None,
@@ -514,6 +515,7 @@ def main():
                 preserve_on_behalf_of: None,
                 labels: None,
                 skip_draft_deletion: None,
+                allow_kind_change: None,
             })
             .send()
             .await
diff --git a/backend/tests/end_user_email.rs b/backend/tests/end_user_email.rs
index 539eeaaa6e..366c220c62 100644
--- a/backend/tests/end_user_email.rs
+++ b/backend/tests/end_user_email.rs
@@ -153,6 +153,72 @@ async fn create_raw_app_with_inline_script(port: u16, path: &str) -> anyhow::Res
     Ok(())
 }
 
+/// Create an app whose policy allows triggering the fixture flow
+async fn create_app_triggering_flow(port: u16, path: &str, flow_path: &str) -> anyhow::Result<()> {
+    let url = format!("http://localhost:{}/api/w/test-workspace/apps/create", port);
+    let resp = authed(client().post(&url), SAME_WS_TOKEN)
+        .json(&json!({
+            "path": path,
+            "summary": "Test app running a flow for WM_END_USER_EMAIL",
+            "value": {
+                "type": "app",
+                "grid": [],
+                "subgrids": {},
+                "hiddenInlineScripts": []
+            },
+            "policy": {
+                "execution_mode": "anonymous",
+                "on_behalf_of": null,
+                "on_behalf_of_email": null,
+                "triggerables_v2": {
+                    flow_path: {
+                        "static_inputs": {},
+                        "one_of_inputs": {}
+                    }
+                }
+            }
+        }))
+        .send()
+        .await?;
+    if !resp.status().is_success() {
+        anyhow::bail!(
+            "create app failed: {} - {}",
+            resp.status(),
+            resp.text().await?
+        );
+    }
+    Ok(())
+}
+
+async fn run_app_flow(
+    port: u16,
+    token: &str,
+    app_path: &str,
+    flow_path: &str,
+) -> anyhow::Result<String> {
+    let url = format!(
+        "http://localhost:{}/api/w/test-workspace/apps_u/execute_component/{}",
+        port, app_path
+    );
+    let resp = authed(client().post(&url), token)
+        .json(&json!({
+            "args": {},
+            "component": "run_flow",
+            "path": flow_path
+        }))
+        .send()
+        .await?;
+    if !resp.status().is_success() {
+        anyhow::bail!(
+            "app flow run failed: {} - {}",
+            resp.status(),
+            resp.text().await?
+        );
+    }
+    let job_id = resp.text().await?;
+    wait_for_job_result(port, token, &job_id).await
+}
+
 async fn run_app_inline_script(
     port: u16,
     token: &str,
@@ -328,6 +394,42 @@ async fn test_app_wm_end_user_email(db: Pool<Postgres>) -> anyhow::Result<()> {
     Ok(())
 }
 
+/// Every flow step must see the same end user as the flow itself: `end_user_email` is only
+/// stamped on the job the app pushes, so it has to be forwarded down to each step. The
+/// fixture flow has two steps on purpose - the first one is pushed from the freshly pulled
+/// flow job, every later one from a flow job re-fetched without its `job_perms`.
+#[cfg(feature = "deno_core")]
+#[sqlx::test(fixtures("base", "end_user_email"))]
+async fn test_app_flow_step_wm_end_user_email(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    set_jwt_secret().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    let app_path = "f/test/email_flow_app";
+    let flow_path = "flow/f/test/get_end_user_email_flow";
+
+    in_test_worker(
+        Connection::Sql(db.clone()),
+        async move {
+            create_app_triggering_flow(port, app_path, flow_path).await?;
+
+            // The flow result is its last step's result.
+            let result = run_app_flow(port, OTHER_WS_TOKEN, app_path, flow_path).await?;
+            assert_eq!(
+                result, OTHER_WS_EMAIL,
+                "every flow step should see the end user email, not the app publisher's"
+            );
+
+            Ok::<(), anyhow::Error>(())
+        },
+        port,
+    )
+    .await?;
+
+    Ok(())
+}
+
 #[cfg(feature = "deno_core")]
 #[sqlx::test(fixtures("base", "end_user_email"))]
 async fn test_raw_app_wm_end_user_email(db: Pool<Postgres>) -> anyhow::Result<()> {
diff --git a/backend/tests/fixtures/app_preview_auth.sql b/backend/tests/fixtures/app_preview_auth.sql
index b94e08f3fd..62173d687c 100644
--- a/backend/tests/fixtures/app_preview_auth.sql
+++ b/backend/tests/fixtures/app_preview_auth.sql
@@ -19,6 +19,13 @@ INSERT INTO token(token_hash, token_prefix, token, email, label, super_admin) VA
 INSERT INTO token(token_hash, token_prefix, token, email, label, super_admin, scopes) VALUES
 	(encode(sha256('APPS_RUN_TOKEN'::bytea), 'hex'), 'APPS_RUN_T', 'APPS_RUN_TOKEN', 'test2@windmill.dev', 'apps:run scoped token', false, '{apps:run}');
 
+-- Path-qualified app scopes, as the token scope picker mints them. Both must be
+-- confined to `u/test-user/vapp` on the execution route (`apps:write` covers run
+-- for the same app, never for another one).
+INSERT INTO token(token_hash, token_prefix, token, email, label, super_admin, scopes) VALUES
+	(encode(sha256('APPS_RUN_VAPP_TOKEN'::bytea), 'hex'), 'APPS_RUN_V', 'APPS_RUN_VAPP_TOKEN', 'test2@windmill.dev', 'apps:run path-scoped token', false, '{apps:run:u/test-user/vapp}'),
+	(encode(sha256('APPS_WRITE_VAPP_TOKEN'::bytea), 'hex'), 'APPS_WRIT_', 'APPS_WRITE_VAPP_TOKEN', 'test2@windmill.dev', 'apps:write path-scoped token', false, '{apps:write:u/test-user/vapp}');
+
 -- A private app owned by `test-user` with a persisted inline script. Used to
 -- assert that `test-user-2` cannot preview-execute another app's app_script id.
 INSERT INTO app (id, workspace_id, path, summary, policy, versions) VALUES
diff --git a/backend/tests/fixtures/end_user_email.sql b/backend/tests/fixtures/end_user_email.sql
index 17d459f7de..596d34e3e3 100644
--- a/backend/tests/fixtures/end_user_email.sql
+++ b/backend/tests/fixtures/end_user_email.sql
@@ -51,7 +51,7 @@ INSERT INTO flow (workspace_id, summary, description, path, versions, schema, va
 VALUES (
     'test-workspace', 'Returns WM_END_USER_EMAIL', '', 'f/test/get_end_user_email_flow', '{900002}',
     '{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{},"required":[],"type":"object"}',
-    '{"modules": [{"id": "a", "value": {"type": "rawscript", "language": "deno", "content": "export function main() { return Deno.env.get(\"WM_END_USER_EMAIL\") || \"\"; }", "input_transforms": {}}}]}',
+    '{"modules": [{"id": "a", "value": {"type": "rawscript", "language": "deno", "content": "export function main() { return Deno.env.get(\"WM_END_USER_EMAIL\") || \"\"; }", "input_transforms": {}}}, {"id": "b", "value": {"type": "rawscript", "language": "deno", "content": "export function main() { return Deno.env.get(\"WM_END_USER_EMAIL\") || \"\"; }", "input_transforms": {}}}]}',
     'test-user',
     '{"g/all": true}'
 );
@@ -60,6 +60,6 @@ INSERT INTO flow_version (id, workspace_id, path, schema, value, created_by)
 VALUES (
     900002, 'test-workspace', 'f/test/get_end_user_email_flow',
     '{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{},"required":[],"type":"object"}',
-    '{"modules": [{"id": "a", "value": {"type": "rawscript", "language": "deno", "content": "export function main() { return Deno.env.get(\"WM_END_USER_EMAIL\") || \"\"; }", "input_transforms": {}}}]}',
+    '{"modules": [{"id": "a", "value": {"type": "rawscript", "language": "deno", "content": "export function main() { return Deno.env.get(\"WM_END_USER_EMAIL\") || \"\"; }", "input_transforms": {}}}, {"id": "b", "value": {"type": "rawscript", "language": "deno", "content": "export function main() { return Deno.env.get(\"WM_END_USER_EMAIL\") || \"\"; }", "input_transforms": {}}}]}',
     'test-user'
 );
diff --git a/backend/tests/fixtures/resource_versioning.sql b/backend/tests/fixtures/resource_versioning.sql
new file mode 100644
index 0000000000..81c1dc4549
--- /dev/null
+++ b/backend/tests/fixtures/resource_versioning.sql
@@ -0,0 +1,24 @@
+-- Fixture for the resource version-history regression test.
+-- Just a workspace + admin user + token; the test drives the real resource
+-- endpoints and asserts what does and does not land in resource_version.
+
+INSERT INTO workspace (id, name, owner) VALUES
+    ('rver-ws', 'RVER WS', 'rver-admin');
+
+INSERT INTO workspace_key (workspace_id, kind, key) VALUES
+    ('rver-ws', 'cloud', 'rver-key');
+
+INSERT INTO workspace_settings (workspace_id) VALUES
+    ('rver-ws');
+
+INSERT INTO group_ (workspace_id, name, summary, extra_perms) VALUES
+    ('rver-ws', 'all', 'All users', '{}');
+
+INSERT INTO password(email, password_hash, login_type, super_admin, verified, name, username)
+    VALUES ('rver-admin@windmill.dev', 'x', 'password', true, true, 'RVER Admin', 'rver-admin');
+
+INSERT INTO usr(workspace_id, email, username, is_admin, role) VALUES
+    ('rver-ws', 'rver-admin@windmill.dev', 'rver-admin', true, 'Admin');
+
+INSERT INTO token(token_hash, token_prefix, token, email, label, super_admin)
+    VALUES (encode(sha256('RVER_ADMIN_TOKEN'::bytea), 'hex'), 'RVER_ADMIN', 'RVER_ADMIN_TOKEN', 'rver-admin@windmill.dev', 't', true);
diff --git a/backend/tests/fixtures/schedule_push.sql b/backend/tests/fixtures/schedule_push.sql
index 9312d0bbd9..5dcc9e1528 100644
--- a/backend/tests/fixtures/schedule_push.sql
+++ b/backend/tests/fixtures/schedule_push.sql
@@ -22,13 +22,13 @@ VALUES (
     'Test script', '', 'f/system/test_script', 100001, 'deno', '', 'script'
 );
 
--- A script with on_behalf_of_email
-INSERT INTO script (workspace_id, created_by, content, schema, summary, description, path, hash, language, lock, kind, on_behalf_of_email)
+-- A script with an on-behalf-of identity
+INSERT INTO script (workspace_id, created_by, content, schema, summary, description, path, hash, language, lock, kind, on_behalf_of)
 VALUES (
     'test-workspace', 'test-user',
     'export async function main() { return "obo"; }',
     '{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{},"required":[],"type":"object"}',
-    'OBO script', '', 'f/system/obo_script', 100002, 'deno', '', 'script', 'obo@windmill.dev'
+    'OBO script', '', 'f/system/obo_script', 100002, 'deno', '', 'script', 'u/obo-user'
 );
 
 -- A script with a tag
@@ -66,13 +66,13 @@ VALUES (
     'test-user'
 );
 
--- A flow with on_behalf_of_email
-INSERT INTO flow (workspace_id, summary, description, path, versions, schema, value, edited_by, on_behalf_of_email)
+-- A flow with an on-behalf-of identity
+INSERT INTO flow (workspace_id, summary, description, path, versions, schema, value, edited_by, on_behalf_of)
 VALUES (
     'test-workspace', 'OBO flow', '', 'f/system/obo_flow', '{200002}',
     '{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{},"required":[],"type":"object"}',
     '{"modules": [{"id": "a", "value": {"path": "f/system/test_script", "type": "script", "input_transforms": {}}}]}',
-    'test-user', 'obo@windmill.dev'
+    'test-user', 'u/obo-user'
 );
 
 INSERT INTO flow_version (id, workspace_id, path, schema, value, created_by)
diff --git a/backend/tests/fixtures/session_workspace_status.sql b/backend/tests/fixtures/session_workspace_status.sql
new file mode 100644
index 0000000000..1d6dbee738
--- /dev/null
+++ b/backend/tests/fixtures/session_workspace_status.sql
@@ -0,0 +1,15 @@
+-- Extends base.sql with two workspaces `test@windmill.dev` (the instance superadmin) has no
+-- `usr` row in: one live, one soft-deleted. The third no-membership case, `admins`, is
+-- created by migration with no `usr` rows at all and needs no fixture.
+
+INSERT INTO workspace (id, name, owner, deleted) VALUES
+	('foreign-workspace', 'foreign-workspace', 'someone-else', false),
+	('archived-workspace', 'archived-workspace', 'someone-else', true);
+
+INSERT INTO workspace_key(workspace_id, kind, key) VALUES
+	('foreign-workspace', 'cloud', 'test-key'),
+	('archived-workspace', 'cloud', 'test-key');
+
+INSERT INTO workspace_settings (workspace_id) VALUES
+	('foreign-workspace'),
+	('archived-workspace');
diff --git a/backend/tests/folder_default_permissioned_as.rs b/backend/tests/folder_default_permissioned_as.rs
index 1e71202595..7aa4f0a003 100644
--- a/backend/tests/folder_default_permissioned_as.rs
+++ b/backend/tests/folder_default_permissioned_as.rs
@@ -475,17 +475,24 @@ async fn test_folder_default_permissioned_as(db: Pool<Postgres>) -> anyhow::Resu
         resp.text().await?
     );
     let flow = sqlx::query!(
-        "SELECT on_behalf_of_email FROM flow WHERE path = $1 AND workspace_id = $2",
+        "SELECT on_behalf_of FROM flow WHERE path = $1 AND workspace_id = $2",
         "f/prodfolder/jobs/flow_admin_match",
         "test-workspace"
     )
     .fetch_one(&db)
     .await?;
     assert_eq!(
-        flow.on_behalf_of_email.as_deref(),
-        Some("group-wm_deployers@windmill.dev"),
+        flow.on_behalf_of.as_deref(),
+        Some("g/wm_deployers"),
         "flow should resolve folder default to group email"
     );
+    // The group email is synthetic and resolves back to nobody, so the group can
+    // only survive as the stored permissioned_as.
+    assert_eq!(
+        flow.on_behalf_of.as_deref(),
+        Some("g/wm_deployers"),
+        "flow should run as the group the folder rule names"
+    );
 
     // 5b. Admin, reports/* rule (email directly as permissioned_as)
     let resp = authed(
@@ -502,16 +509,16 @@ async fn test_folder_default_permissioned_as(db: Pool<Postgres>) -> anyhow::Resu
         resp.text().await?
     );
     let flow = sqlx::query!(
-        "SELECT on_behalf_of_email FROM flow WHERE path = $1 AND workspace_id = $2",
+        "SELECT on_behalf_of FROM flow WHERE path = $1 AND workspace_id = $2",
         "f/prodfolder/reports/weekly",
         "test-workspace"
     )
     .fetch_one(&db)
     .await?;
     assert_eq!(
-        flow.on_behalf_of_email.as_deref(),
-        Some("original@windmill.dev"),
-        "email rule should pass through as-is"
+        flow.on_behalf_of.as_deref(),
+        Some("u/original-user"),
+        "a rule naming an address stores the principal it names, which is what carries that          user's groups and folders"
     );
 
     // 5c. Non-matching flow path — no default
@@ -524,14 +531,14 @@ async fn test_folder_default_permissioned_as(db: Pool<Postgres>) -> anyhow::Resu
     .await?;
     assert_eq!(resp.status(), 201);
     let flow = sqlx::query!(
-        "SELECT on_behalf_of_email FROM flow WHERE path = $1 AND workspace_id = $2",
+        "SELECT on_behalf_of FROM flow WHERE path = $1 AND workspace_id = $2",
         "f/prodfolder/dev/flow_no_match",
         "test-workspace"
     )
     .fetch_one(&db)
     .await?;
     assert_eq!(
-        flow.on_behalf_of_email, None,
+        flow.on_behalf_of, None,
         "no folder default ⇒ no on_behalf_of_email written"
     );
 
@@ -545,14 +552,14 @@ async fn test_folder_default_permissioned_as(db: Pool<Postgres>) -> anyhow::Resu
     .await?;
     assert_eq!(resp.status(), 201);
     let flow = sqlx::query!(
-        "SELECT on_behalf_of_email FROM flow WHERE path = $1 AND workspace_id = $2",
+        "SELECT on_behalf_of FROM flow WHERE path = $1 AND workspace_id = $2",
         "u/test-user/outside_flow",
         "test-workspace"
     )
     .fetch_one(&db)
     .await?;
     assert_eq!(
-        flow.on_behalf_of_email, None,
+        flow.on_behalf_of, None,
         "paths outside folders are never touched"
     );
 
@@ -575,15 +582,15 @@ async fn test_folder_default_permissioned_as(db: Pool<Postgres>) -> anyhow::Resu
         resp.text().await?
     );
     let script = sqlx::query!(
-        "SELECT on_behalf_of_email FROM script WHERE path = $1 AND workspace_id = $2 ORDER BY created_at DESC LIMIT 1",
+        "SELECT on_behalf_of FROM script WHERE path = $1 AND workspace_id = $2 ORDER BY created_at DESC LIMIT 1",
         "f/prodfolder/jobs/new_script",
         "test-workspace"
     )
     .fetch_one(&db)
     .await?;
     assert_eq!(
-        script.on_behalf_of_email.as_deref(),
-        Some("group-wm_deployers@windmill.dev"),
+        script.on_behalf_of.as_deref(),
+        Some("g/wm_deployers"),
         "new script at matching path gets folder default"
     );
 
diff --git a/backend/tests/jobs_read_auth.rs b/backend/tests/jobs_read_auth.rs
index e95748d8de..317b1c6866 100644
--- a/backend/tests/jobs_read_auth.rs
+++ b/backend/tests/jobs_read_auth.rs
@@ -83,6 +83,32 @@ async fn post(base: &str, path: &str, token: Option<&str>) -> (reqwest::StatusCo
     (status, body)
 }
 
+async fn post_json(
+    url: &str,
+    token: Option<&str>,
+    body: serde_json::Value,
+) -> (reqwest::StatusCode, String) {
+    let mut req = client().post(url).json(&body);
+    if let Some(token) = token {
+        req = req.header("Authorization", format!("Bearer {token}"));
+    }
+    let resp = req.send().await.expect("request");
+    let status = resp.status();
+    let body = resp.text().await.expect("body");
+    (status, body)
+}
+
+async fn delete(url: &str, token: Option<&str>) -> (reqwest::StatusCode, String) {
+    let mut req = client().delete(url);
+    if let Some(token) = token {
+        req = req.header("Authorization", format!("Bearer {token}"));
+    }
+    let resp = req.send().await.expect("request");
+    let status = resp.status();
+    let body = resp.text().await.expect("body");
+    (status, body)
+}
+
 #[sqlx::test(fixtures("base", "jobs_read_auth"))]
 async fn test_single_job_read_authorization(db: Pool<Postgres>) -> anyhow::Result<()> {
     initialize_tracing().await;
@@ -92,6 +118,8 @@ async fn test_single_job_read_authorization(db: Pool<Postgres>) -> anyhow::Resul
     let base = format!("http://localhost:{port}/api/w/test-workspace/jobs_u");
     // result_by_id / get_otel_traces live on the authed `/jobs` service, not `/jobs_u`.
     let authed_base = format!("http://localhost:{port}/api/w/test-workspace/jobs");
+    let rules_url =
+        format!("http://localhost:{port}/api/w/test-workspace/workspaces/protection_rules");
 
     // The endpoints that return the victim job's sensitive data by UUID.
     let endpoints = [
@@ -507,6 +535,161 @@ async fn test_single_job_read_authorization(db: Pool<Postgres>) -> anyhow::Resul
         "a non-reader must not be able to mint a share token (got {status})"
     );
 
+    // ---- PUBLIC SHARE READ LINK (public view_token) ----
+    // A member-audience token must never turn into a public one: links already handed
+    // out stay confined to logged-in members.
+    let (status, body) = get(
+        &base,
+        &format!("completed/get_result/{VICTIM}?view_token={token}"),
+        None,
+    )
+    .await;
+    assert_eq!(
+        status,
+        reqwest::StatusCode::BAD_REQUEST,
+        "a member view_token must not grant unauthenticated read (got {status}): {body}"
+    );
+    assert!(
+        !body.contains(RESULT_SECRET),
+        "unauth body must not leak with a member token: {body}"
+    );
+
+    // The owner mints the public flavor for the top flow.
+    let (status, mint_body) = get(
+        &authed_base,
+        &format!("job_public_view_token/{TOP_SECRET_FLOW}"),
+        Some("SECRET_TOKEN_2"),
+    )
+    .await;
+    assert!(
+        status.is_success(),
+        "owner must be able to mint a public share token (got {status}): {mint_body}"
+    );
+    let public_token = mint_body.trim().trim_matches('"').to_string();
+
+    // It grants a logged-out visitor the shared job and its whole flow subtree.
+    for path in [
+        format!("get/{TOP_SECRET_FLOW}?view_token={public_token}"),
+        format!("get_args/{TOP_SECRET_FLOW}?view_token={public_token}"),
+        format!("getupdate/{TOP_SECRET_FLOW}?view_token={public_token}"),
+        format!("completed/get_result/{DEEP_LEAF_JOB}?view_token={public_token}"),
+        format!("get_logs/{DEEP_LEAF_JOB}?view_token={public_token}"),
+    ] {
+        let (status, body) = get(&base, &path, None).await;
+        assert!(
+            status.is_success(),
+            "a public view_token must grant unauthenticated read of {path} (got {status}): {body}"
+        );
+    }
+
+    // Same scoping as the member flavor: another job, and a tampered signature, are refused.
+    for path in [
+        format!("get/{VICTIM}?view_token={public_token}"),
+        format!("get/{TOP_SECRET_FLOW}?view_token={TOP_SECRET_FLOW}.deadbeef"),
+    ] {
+        let (status, body) = get(&base, &path, None).await;
+        assert_eq!(
+            status,
+            reqwest::StatusCode::BAD_REQUEST,
+            "an out-of-scope or forged public token must not grant read of {path} (got {status}): {body}"
+        );
+    }
+
+    // The public audience is a superset of the member one: it must also satisfy the
+    // authenticated ACL check, so a viewer handed a public link is not worse off.
+    let (status, body) = get(
+        &base,
+        &format!("completed/get_result/{DEEP_LEAF_JOB}?view_token={public_token}"),
+        Some("SECRET_TOKEN_3"),
+    )
+    .await;
+    assert!(
+        status.is_success(),
+        "a public view_token must also grant an authenticated member read (got {status}): {body}"
+    );
+
+    // Tag-scoped caller, job inside its scope: the member flavor is allowed (asserted
+    // further down), the public one must not be — i.e. strictly stricter.
+    let (status, body) = get(
+        &authed_base,
+        &format!("job_public_view_token/{VICTIM}"),
+        Some("SCOPED_DENO_TOKEN"),
+    )
+    .await;
+    assert_eq!(
+        status,
+        reqwest::StatusCode::FORBIDDEN,
+        "a tag-scoped token must NOT mint a public link, even for an in-scope job (got {status}): {body}"
+    );
+
+    // Minting the public flavor takes the same read access as the member one.
+    let (status, _) = get(
+        &authed_base,
+        &format!("job_public_view_token/{TOP_SECRET_FLOW}"),
+        Some("SECRET_TOKEN_3"),
+    )
+    .await;
+    assert_eq!(
+        status,
+        reqwest::StatusCode::FORBIDDEN,
+        "a non-reader must not be able to mint a public share token (got {status})"
+    );
+
+    // Publishing a run is gated by `RestrictPublicRunSharing`, so a wrong bitflag or
+    // rule-kind arm would silently let a restricted member expose one. Admins bypass, and
+    // the member flavor is untouched by the rule.
+    let (status, body) = post_json(
+        &rules_url,
+        Some("SECRET_TOKEN"),
+        serde_json::json!({
+            "name": "no-public-runs",
+            "rules": ["RestrictPublicRunSharing"],
+            "bypass_users": [],
+            "bypass_groups": []
+        }),
+    )
+    .await;
+    assert!(
+        status.is_success(),
+        "admin should create the protection rule (got {status}): {body}"
+    );
+    let (status, body) = get(
+        &authed_base,
+        &format!("job_public_view_token/{TOP_SECRET_FLOW}"),
+        Some("SECRET_TOKEN_2"),
+    )
+    .await;
+    assert_eq!(
+        status,
+        reqwest::StatusCode::FORBIDDEN,
+        "the rule must block a non-admin owner from minting a public link (got {status}): {body}"
+    );
+    let (status, body) = get(
+        &authed_base,
+        &format!("job_view_token/{TOP_SECRET_FLOW}"),
+        Some("SECRET_TOKEN_2"),
+    )
+    .await;
+    assert!(
+        status.is_success(),
+        "the rule must NOT affect the member flavor (got {status}): {body}"
+    );
+    let (status, body) = get(
+        &authed_base,
+        &format!("job_public_view_token/{TOP_SECRET_FLOW}"),
+        Some("SECRET_TOKEN"),
+    )
+    .await;
+    assert!(
+        status.is_success(),
+        "an admin must bypass the rule (got {status}): {body}"
+    );
+
+    // Later assertions in this test mint public tokens; drop the rule so they see the
+    // same workspace state as before.
+    let (status, _) = delete(&format!("{rules_url}/no-public-runs"), Some("SECRET_TOKEN")).await;
+    assert!(status.is_success(), "admin should delete the rule");
+
     // ---- TAG-SCOPED token must not mint a token outside its allowed tags ----
     // SCOPED_DENO_TOKEN (test-user-2, scope `if_jobs:filter_tags:deno`) can read both
     // VICTIM (tag deno) and FLOW_JOB (tag flow) by RLS, but minting must honor the
@@ -618,6 +801,36 @@ async fn test_single_job_read_authorization(db: Pool<Postgres>) -> anyhow::Resul
             "viewer must not cancel another user's job ({path}, got {status}): {body}"
         );
     }
+    // A public share link grants read, never the right to kill the run: cancelling stays
+    // confined to anonymously-created jobs for a logged-out caller.
+    let (status, mint_body) = get(
+        &authed_base,
+        &format!("job_public_view_token/{RUNNING_JOB}"),
+        Some("SECRET_TOKEN_2"),
+    )
+    .await;
+    assert!(status.is_success(), "owner mints for the running job");
+    let running_public = mint_body.trim().trim_matches('"').to_string();
+    let (status, body) = get(
+        &base,
+        &format!("get/{RUNNING_JOB}?view_token={running_public}"),
+        None,
+    )
+    .await;
+    assert!(
+        status.is_success(),
+        "the public token must grant the anonymous read it is for (got {status}): {body}"
+    );
+    let (status, body) = post(
+        &base,
+        &format!("queue/cancel/{RUNNING_JOB}?view_token={running_public}"),
+        None,
+    )
+    .await;
+    assert!(
+        !status.is_success(),
+        "a public token must not let an anonymous caller cancel the run (got {status}): {body}"
+    );
     // The owner still cancels their own job (no over-blocking). Keep this last: it
     // takes RUNNING_JOB out of the queue.
     let (status, body) = post(
diff --git a/backend/tests/nativets_stress.rs b/backend/tests/nativets_stress.rs
index 1a8827b486..32057b41d2 100644
--- a/backend/tests/nativets_stress.rs
+++ b/backend/tests/nativets_stress.rs
@@ -171,6 +171,7 @@ async fn push_job(db: &Pool<Postgres>, content: &str, args: &serde_json::Value)
         /* email */ "test@windmill.dev",
         /* permissioned_as */ "u/test-user".to_string(),
         /* token_prefix */ None,
+        /* audit_end_user */ None,
         /* scheduled_for */ None,
         /* schedule_path */ None,
         /* parent_job */ None,
diff --git a/backend/tests/on_behalf_of.rs b/backend/tests/on_behalf_of.rs
new file mode 100644
index 0000000000..8576bcdfe8
--- /dev/null
+++ b/backend/tests/on_behalf_of.rs
@@ -0,0 +1,391 @@
+//! A script's on-behalf-of identity must drive the permissions of the jobs it produces, not
+//! just their address. The principal is the only stored half; the address is derived from it,
+//! so a request naming one, the other, or a mismatched pair all resolve to one account.
+
+use serde_json::json;
+use sqlx::{Pool, Postgres};
+use windmill_test_utils::*;
+
+fn client() -> reqwest::Client {
+    reqwest::Client::new()
+}
+
+fn authed(builder: reqwest::RequestBuilder, token: &str) -> reqwest::RequestBuilder {
+    builder.header("Authorization", format!("Bearer {}", token))
+}
+
+fn script_body(path: &str, on_behalf_of: Option<&str>) -> serde_json::Value {
+    let mut body = json!({
+        "path": path,
+        "summary": "",
+        "description": "",
+        "content": "export async function main() { return 42; }",
+        "language": "deno",
+        "on_behalf_of_email": "original@windmill.dev",
+        "preserve_on_behalf_of": true,
+        "auto_parent": true,
+    });
+    if let Some(permissioned_as) = on_behalf_of {
+        body["on_behalf_of"] = json!(permissioned_as);
+    }
+    body
+}
+
+/// Deploys as `test-user` (admin) so the recorded identity is nobody's default: neither
+/// the caller's nor the deployer's. Returns the hex hash the run-by-hash route parses.
+async fn create_script(
+    base: &str,
+    path: &str,
+    on_behalf_of: Option<&str>,
+) -> anyhow::Result<String> {
+    let resp = authed(
+        client().post(format!("{base}/scripts/create")),
+        "SECRET_TOKEN",
+    )
+    .json(&script_body(path, on_behalf_of))
+    .send()
+    .await?;
+    let status = resp.status();
+    let hash = resp.text().await?;
+    assert_eq!(status, 201, "creating {path}: {hash}");
+    Ok(hash.trim().trim_matches('"').to_string())
+}
+
+async fn run_by_hash(base: &str, hash: &str) -> anyhow::Result<uuid::Uuid> {
+    let resp = authed(
+        client().post(format!("{base}/jobs/run/h/{hash}")),
+        "SECRET_TOKEN",
+    )
+    .json(&json!({}))
+    .send()
+    .await?;
+    let status = resp.status();
+    let body = resp.text().await?;
+    assert_eq!(status, 201, "running {hash}: {body}");
+    Ok(uuid::Uuid::parse_str(body.trim().trim_matches('"'))?)
+}
+
+async fn stored_permissioned_as(
+    db: &Pool<Postgres>,
+    table: &str,
+    path: &str,
+) -> anyhow::Result<Option<String>> {
+    // `table` is a literal from this test, never caller input.
+    Ok(sqlx::query_scalar(&format!(
+        "SELECT on_behalf_of FROM {table} \
+         WHERE path = $1 AND workspace_id = 'test-workspace' AND NOT archived"
+    ))
+    .bind(path)
+    .fetch_one(db)
+    .await?)
+}
+
+#[sqlx::test(fixtures("preserve_on_behalf_of"))]
+async fn test_on_behalf_of_drives_job_identity(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let base = format!(
+        "http://localhost:{}/api/w/test-workspace",
+        server.addr.port()
+    );
+
+    let recorded =
+        create_script(&base, "u/test-user/obo_recorded", Some("u/original-user")).await?;
+    assert_eq!(
+        stored_permissioned_as(&db, "script", "u/test-user/obo_recorded")
+            .await?
+            .as_deref(),
+        Some("u/original-user")
+    );
+
+    // Workers predating this release read only the address, and they are expected to lag the
+    // server, so a deploy keeps filling it in until every live worker is new.
+    assert_eq!(
+        sqlx::query_scalar!(
+            "SELECT on_behalf_of_email FROM script WHERE path = 'u/test-user/obo_recorded' AND workspace_id = 'test-workspace'"
+        )
+        .fetch_one(&db)
+        .await?
+        .as_deref(),
+        Some("original@windmill.dev"),
+    );
+
+    // A client that predates the field names only the email; deriving the principal from
+    // it is what stops a routine redeploy from handing the script to whoever deploys it.
+    let derived = create_script(&base, "u/test-user/obo_derived", None).await?;
+    assert_eq!(
+        stored_permissioned_as(&db, "script", "u/test-user/obo_derived")
+            .await?
+            .as_deref(),
+        Some("u/original-user")
+    );
+
+    let recorded_job = run_by_hash(&base, &recorded).await?;
+    let derived_job = run_by_hash(&base, &derived).await?;
+
+    let jobs = sqlx::query!(
+        "SELECT id, permissioned_as, permissioned_as_email FROM v2_job WHERE id = ANY($1)",
+        &[recorded_job, derived_job][..]
+    )
+    .fetch_all(&db)
+    .await?;
+    let identity = |id: uuid::Uuid| {
+        let job = jobs.iter().find(|j| j.id == id).expect("job was pushed");
+        (
+            job.permissioned_as.clone(),
+            job.permissioned_as_email.clone(),
+        )
+    };
+
+    assert_eq!(
+        identity(recorded_job),
+        (
+            "u/original-user".to_string(),
+            "original@windmill.dev".to_string()
+        ),
+        "a recorded permissioned_as must be what the job runs as"
+    );
+    assert_eq!(
+        identity(derived_job),
+        (
+            "u/original-user".to_string(),
+            "original@windmill.dev".to_string()
+        ),
+        "a principal derived from the address drives the job the same way an explicit one does"
+    );
+
+    // A superadmin acting outside their workspaces has no `usr` row. Dropping them on an
+    // email-only redeploy would keep their superadmin email next to the deployer's
+    // permissions — the hybrid identity this whole change exists to remove.
+    let resp = authed(
+        client().post(format!("{base}/scripts/create")),
+        "SECRET_TOKEN",
+    )
+    .json(&json!({
+        "path": "u/test-user/obo_superadmin",
+        "summary": "",
+        "description": "",
+        "content": "export async function main() { return 42; }",
+        "language": "deno",
+        "on_behalf_of_email": "superadmin-external@windmill.dev",
+        "preserve_on_behalf_of": true,
+    }))
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 201, "creating: {}", resp.text().await?);
+    assert_eq!(
+        stored_permissioned_as(&db, "script", "u/test-user/obo_superadmin")
+            .await?
+            .as_deref(),
+        Some("u/superadmin-external")
+    );
+
+    // The synthetic group namespace is not reserved, so a real account holding such an
+    // address must win over the like-named group — otherwise an email-only deploy would
+    // hand the runnable that group's folder access.
+    sqlx::query!(
+        "INSERT INTO group_ (workspace_id, name, summary, extra_perms) \
+         VALUES ('test-workspace', 'ops', '', '{}') ON CONFLICT DO NOTHING"
+    )
+    .execute(&db)
+    .await?;
+    sqlx::query!(
+        "UPDATE usr SET email = 'group-ops@windmill.dev' WHERE workspace_id = 'test-workspace' \
+         AND username = 'test-user-2'"
+    )
+    .execute(&db)
+    .await?;
+    let resp = authed(
+        client().post(format!("{base}/scripts/create")),
+        "SECRET_TOKEN",
+    )
+    .json(&json!({
+        "path": "u/test-user/obo_group_collision",
+        "summary": "",
+        "description": "",
+        "content": "export async function main() { return 42; }",
+        "language": "deno",
+        "on_behalf_of_email": "group-ops@windmill.dev",
+        "preserve_on_behalf_of": true,
+    }))
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 201, "creating: {}", resp.text().await?);
+    assert_eq!(
+        stored_permissioned_as(&db, "script", "u/test-user/obo_group_collision")
+            .await?
+            .as_deref(),
+        Some("u/test-user-2"),
+        "a real account must win over the like-named group"
+    );
+
+    // An address is the principal only for an account whose username is that address; for
+    // anybody else it is canonicalized, since the bare form carries neither their groups nor
+    // their folders.
+    let resp = authed(
+        client().post(format!("{base}/scripts/create")),
+        "SECRET_TOKEN",
+    )
+    .json(&script_body(
+        "u/test-user/obo_bare_address",
+        Some("original@windmill.dev"),
+    ))
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 201, "creating: {}", resp.text().await?);
+    assert_eq!(
+        stored_permissioned_as(&db, "script", "u/test-user/obo_bare_address")
+            .await?
+            .as_deref(),
+        Some("u/original-user")
+    );
+
+    // A job row carries a narrower identity column than the runnable it comes from, so an
+    // address too long to be enqueued is refused at deploy rather than at the first run —
+    // whether it is preserved from someone else or is the deployer's own.
+    const LONG_ADDRESS: &str = "a-very-long-superadmin-address-for-this-test@windmill.dev";
+    sqlx::query!(
+        "INSERT INTO password(email, password_hash, login_type, super_admin, verified, name)
+         VALUES ($1, '', 'password', true, true, '')",
+        LONG_ADDRESS
+    )
+    .execute(&db)
+    .await?;
+    sqlx::query!(
+        "INSERT INTO token(token_hash, token_prefix, token, email, label, super_admin)
+         VALUES (encode(sha256('LONG_TOKEN'::bytea), 'hex'), 'LONG_TOKEN', 'LONG_TOKEN', $1, 'long', true)",
+        LONG_ADDRESS
+    )
+    .execute(&db)
+    .await?;
+
+    let too_long = |path: &str| {
+        json!({
+            "path": path,
+            "summary": "",
+            "description": "",
+            "content": "export async function main() { return 42; }",
+            "language": "deno",
+            "on_behalf_of_email": LONG_ADDRESS,
+            "preserve_on_behalf_of": true,
+        })
+    };
+    let resp = authed(
+        client().post(format!("{base}/scripts/create")),
+        "SECRET_TOKEN",
+    )
+    .json(&too_long("u/test-user/obo_too_long"))
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 400, "an unenqueueable identity must be rejected");
+
+    // Picking "me" does not preserve anyone, so it takes the branch that stores the caller's
+    // own principal — which for an account acting without a `usr` row is their address.
+    let mut own = too_long("u/test-user/obo_too_long_self");
+    own["preserve_on_behalf_of"] = json!(false);
+    let resp = authed(
+        client().post(format!("{base}/scripts/create")),
+        "LONG_TOKEN",
+    )
+    .json(&own)
+    .send()
+    .await?;
+    let status = resp.status();
+    let body = resp.text().await?;
+    assert_eq!(status, 400, "{body}");
+    assert!(
+        body.contains("characters a job can carry"),
+        "the caller's own identity has to be refused by the same check, not by a column \
+         overflow further down: {body}"
+    );
+
+    // A pair naming two different principals would run as a composite of both.
+    let resp = authed(
+        client().post(format!("{base}/scripts/create")),
+        "SECRET_TOKEN",
+    )
+    .json(&script_body(
+        "u/test-user/obo_mismatch",
+        Some("u/test-user-2"),
+    ))
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 400, "a mismatched pair must be rejected");
+
+    // The identity a no-op push is compared against is the stored principal, so a push that
+    // names it by address alone still has to read as unchanged — otherwise every idempotent
+    // CLI push of a configured script would cut a version and a phantom git-sync commit.
+    async fn push_noop_guarded(base: &str, body: serde_json::Value) -> anyhow::Result<String> {
+        let resp = authed(
+            client().post(format!("{base}/scripts/create?skip_if_noop=true")),
+            "SECRET_TOKEN",
+        )
+        .json(&body)
+        .send()
+        .await?;
+        let status = resp.status();
+        let hash = resp.text().await?;
+        assert_eq!(status, 201, "creating: {hash}");
+        Ok(hash.trim().trim_matches('"').to_string())
+    }
+    // The no-op check compares every field, so the body has to carry the values a deploy
+    // fills in by itself, or it would be rejected before reaching the identity comparison.
+    let noop_body = |permissioned_as| {
+        let mut body = script_body("u/test-user/obo_noop", permissioned_as);
+        body["ws_error_handler_muted"] = json!(false);
+        body["assets"] = json!([]);
+        body
+    };
+    let first = push_noop_guarded(&base, noop_body(Some("u/original-user"))).await?;
+    let again = push_noop_guarded(&base, noop_body(None)).await?;
+    assert_eq!(
+        first, again,
+        "an identical push naming the same identity by address must not cut a new version"
+    );
+
+    // Flows resolve the same way, but through their own UPDATE — which must not drop the
+    // principal when the body names only the email.
+    let flow = json!({
+        "path": "u/test-user/obo_flow",
+        "summary": "",
+        "value": { "modules": [] },
+        "on_behalf_of_email": "original@windmill.dev",
+        "on_behalf_of": "u/original-user",
+        "preserve_on_behalf_of": true,
+    });
+    let resp = authed(
+        client().post(format!("{base}/flows/create")),
+        "SECRET_TOKEN",
+    )
+    .json(&flow)
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 201, "creating flow: {}", resp.text().await?);
+
+    let mut update = flow.clone();
+    update["summary"] = json!("edited");
+    update
+        .as_object_mut()
+        .unwrap()
+        .remove("on_behalf_of");
+    let resp = authed(
+        client().post(format!("{base}/flows/update/u/test-user/obo_flow")),
+        "SECRET_TOKEN",
+    )
+    .json(&update)
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 200, "updating flow: {}", resp.text().await?);
+    assert_eq!(
+        stored_permissioned_as(&db, "flow", "u/test-user/obo_flow")
+            .await?
+            .as_deref(),
+        Some("u/original-user"),
+        "an update that names only the email must not drop the flow's principal"
+    );
+
+    Ok(())
+}
diff --git a/backend/tests/postgres_trigger_scope.rs b/backend/tests/postgres_trigger_scope.rs
index 1172e03ab6..cf98a1e6de 100644
--- a/backend/tests/postgres_trigger_scope.rs
+++ b/backend/tests/postgres_trigger_scope.rs
@@ -20,6 +20,8 @@ fn scoped_authed(scopes: Vec<&str>) -> ApiAuthed {
         folders: vec![],
         scopes: Some(scopes.into_iter().map(str::to_string).collect()),
         username_override: None,
+        username_override_is_token_label: false,
+        is_session_token: false,
         token_prefix: None,
         read_only: false,
     }
diff --git a/backend/tests/preserve_on_behalf_of.rs b/backend/tests/preserve_on_behalf_of.rs
index d808348937..e696de44ea 100644
--- a/backend/tests/preserve_on_behalf_of.rs
+++ b/backend/tests/preserve_on_behalf_of.rs
@@ -214,15 +214,15 @@ async fn test_preserve_on_behalf_of(db: Pool<Postgres>) -> anyhow::Result<()> {
     );
 
     let script = sqlx::query!(
-        "SELECT on_behalf_of_email FROM script WHERE path = $1 AND workspace_id = $2",
+        "SELECT on_behalf_of FROM script WHERE path = $1 AND workspace_id = $2",
         "u/test-user/script_admin_preserve",
         "test-workspace"
     )
     .fetch_one(&db)
     .await?;
     assert_eq!(
-        script.on_behalf_of_email.as_deref(),
-        Some("original@windmill.dev"),
+        script.on_behalf_of.as_deref(),
+        Some("u/original-user"),
         "Admin should preserve on_behalf_of_email"
     );
 
@@ -249,15 +249,15 @@ async fn test_preserve_on_behalf_of(db: Pool<Postgres>) -> anyhow::Result<()> {
     );
 
     let script = sqlx::query!(
-        "SELECT on_behalf_of_email FROM script WHERE path = $1 AND workspace_id = $2",
+        "SELECT on_behalf_of FROM script WHERE path = $1 AND workspace_id = $2",
         "u/deployer-user/script_deployer_preserve",
         "test-workspace"
     )
     .fetch_one(&db)
     .await?;
     assert_eq!(
-        script.on_behalf_of_email.as_deref(),
-        Some("original@windmill.dev"),
+        script.on_behalf_of.as_deref(),
+        Some("u/original-user"),
         "Deployer should preserve on_behalf_of_email"
     );
 
@@ -284,15 +284,15 @@ async fn test_preserve_on_behalf_of(db: Pool<Postgres>) -> anyhow::Result<()> {
     );
 
     let script = sqlx::query!(
-        "SELECT on_behalf_of_email FROM script WHERE path = $1 AND workspace_id = $2",
+        "SELECT on_behalf_of FROM script WHERE path = $1 AND workspace_id = $2",
         "u/test-user-2/script_no_preserve",
         "test-workspace"
     )
     .fetch_one(&db)
     .await?;
     assert_eq!(
-        script.on_behalf_of_email.as_deref(),
-        Some("test2@windmill.dev"),
+        script.on_behalf_of.as_deref(),
+        Some("u/test-user-2"),
         "Non-admin should have their own email as on_behalf_of_email"
     );
 
@@ -319,15 +319,15 @@ async fn test_preserve_on_behalf_of(db: Pool<Postgres>) -> anyhow::Result<()> {
     );
 
     let flow = sqlx::query!(
-        "SELECT on_behalf_of_email FROM flow WHERE path = $1 AND workspace_id = $2",
+        "SELECT on_behalf_of FROM flow WHERE path = $1 AND workspace_id = $2",
         "u/test-user/flow_admin_preserve",
         "test-workspace"
     )
     .fetch_one(&db)
     .await?;
     assert_eq!(
-        flow.on_behalf_of_email.as_deref(),
-        Some("original@windmill.dev"),
+        flow.on_behalf_of.as_deref(),
+        Some("u/original-user"),
         "Admin should preserve flow on_behalf_of_email"
     );
 
@@ -354,15 +354,15 @@ async fn test_preserve_on_behalf_of(db: Pool<Postgres>) -> anyhow::Result<()> {
     );
 
     let flow = sqlx::query!(
-        "SELECT on_behalf_of_email FROM flow WHERE path = $1 AND workspace_id = $2",
+        "SELECT on_behalf_of FROM flow WHERE path = $1 AND workspace_id = $2",
         "u/deployer-user/flow_deployer_preserve",
         "test-workspace"
     )
     .fetch_one(&db)
     .await?;
     assert_eq!(
-        flow.on_behalf_of_email.as_deref(),
-        Some("original@windmill.dev"),
+        flow.on_behalf_of.as_deref(),
+        Some("u/original-user"),
         "Deployer should preserve flow on_behalf_of_email"
     );
 
@@ -389,15 +389,15 @@ async fn test_preserve_on_behalf_of(db: Pool<Postgres>) -> anyhow::Result<()> {
     );
 
     let flow = sqlx::query!(
-        "SELECT on_behalf_of_email FROM flow WHERE path = $1 AND workspace_id = $2",
+        "SELECT on_behalf_of FROM flow WHERE path = $1 AND workspace_id = $2",
         "u/test-user-2/flow_no_preserve",
         "test-workspace"
     )
     .fetch_one(&db)
     .await?;
     assert_eq!(
-        flow.on_behalf_of_email.as_deref(),
-        Some("test2@windmill.dev"),
+        flow.on_behalf_of.as_deref(),
+        Some("u/test-user-2"),
         "Non-admin should have their own email as flow on_behalf_of_email"
     );
 
@@ -745,15 +745,15 @@ async fn test_preserve_on_behalf_of(db: Pool<Postgres>) -> anyhow::Result<()> {
     );
 
     let script = sqlx::query!(
-        "SELECT on_behalf_of_email FROM script WHERE path = $1 AND workspace_id = $2",
+        "SELECT on_behalf_of FROM script WHERE path = $1 AND workspace_id = $2",
         "u/test-user/script_no_flag",
         "test-workspace"
     )
     .fetch_one(&db)
     .await?;
     assert_eq!(
-        script.on_behalf_of_email.as_deref(),
-        Some("test@windmill.dev"),
+        script.on_behalf_of.as_deref(),
+        Some("u/test-user"),
         "Without preserve flag, admin's email should be used"
     );
 
@@ -841,15 +841,15 @@ async fn test_script_update_preserves_on_behalf_of(db: Pool<Postgres>) -> anyhow
     );
 
     let script = sqlx::query!(
-        "SELECT on_behalf_of_email FROM script WHERE path = $1 AND workspace_id = $2 ORDER BY created_at DESC LIMIT 1",
+        "SELECT on_behalf_of FROM script WHERE path = $1 AND workspace_id = $2 ORDER BY created_at DESC LIMIT 1",
         "u/original-user/script_to_update",
         "test-workspace"
     )
     .fetch_one(&db)
     .await?;
     assert_eq!(
-        script.on_behalf_of_email.as_deref(),
-        Some("original@windmill.dev"),
+        script.on_behalf_of.as_deref(),
+        Some("u/original-user"),
         "Admin update should preserve script on_behalf_of_email"
     );
 
@@ -896,15 +896,15 @@ async fn test_script_update_preserves_on_behalf_of(db: Pool<Postgres>) -> anyhow
     );
 
     let script = sqlx::query!(
-        "SELECT on_behalf_of_email FROM script WHERE path = $1 AND workspace_id = $2 ORDER BY created_at DESC LIMIT 1",
+        "SELECT on_behalf_of FROM script WHERE path = $1 AND workspace_id = $2 ORDER BY created_at DESC LIMIT 1",
         "u/deployer-user/script_deploy_update",
         "test-workspace"
     )
     .fetch_one(&db)
     .await?;
     assert_eq!(
-        script.on_behalf_of_email.as_deref(),
-        Some("original@windmill.dev"),
+        script.on_behalf_of.as_deref(),
+        Some("u/original-user"),
         "Deployer update should preserve script on_behalf_of_email"
     );
 
@@ -951,15 +951,15 @@ async fn test_script_update_preserves_on_behalf_of(db: Pool<Postgres>) -> anyhow
     );
 
     let script = sqlx::query!(
-        "SELECT on_behalf_of_email FROM script WHERE path = $1 AND workspace_id = $2 ORDER BY created_at DESC LIMIT 1",
+        "SELECT on_behalf_of FROM script WHERE path = $1 AND workspace_id = $2 ORDER BY created_at DESC LIMIT 1",
         "u/test-user-2/script_nonadmin_update",
         "test-workspace"
     )
     .fetch_one(&db)
     .await?;
     assert_eq!(
-        script.on_behalf_of_email.as_deref(),
-        Some("test2@windmill.dev"),
+        script.on_behalf_of.as_deref(),
+        Some("u/test-user-2"),
         "Non-admin update should overwrite script on_behalf_of_email with their own"
     );
 
@@ -1025,15 +1025,15 @@ async fn test_flow_update_preserves_on_behalf_of(db: Pool<Postgres>) -> anyhow::
     );
 
     let flow = sqlx::query!(
-        "SELECT on_behalf_of_email FROM flow WHERE path = $1 AND workspace_id = $2",
+        "SELECT on_behalf_of FROM flow WHERE path = $1 AND workspace_id = $2",
         "u/original-user/flow_to_update",
         "test-workspace"
     )
     .fetch_one(&db)
     .await?;
     assert_eq!(
-        flow.on_behalf_of_email.as_deref(),
-        Some("original@windmill.dev"),
+        flow.on_behalf_of.as_deref(),
+        Some("u/original-user"),
         "Admin update should preserve flow on_behalf_of_email"
     );
 
@@ -1091,15 +1091,15 @@ async fn test_flow_update_preserves_on_behalf_of(db: Pool<Postgres>) -> anyhow::
     );
 
     let flow = sqlx::query!(
-        "SELECT on_behalf_of_email FROM flow WHERE path = $1 AND workspace_id = $2",
+        "SELECT on_behalf_of FROM flow WHERE path = $1 AND workspace_id = $2",
         "u/deployer-user/flow_deploy_update",
         "test-workspace"
     )
     .fetch_one(&db)
     .await?;
     assert_eq!(
-        flow.on_behalf_of_email.as_deref(),
-        Some("original@windmill.dev"),
+        flow.on_behalf_of.as_deref(),
+        Some("u/original-user"),
         "Deployer update should preserve flow on_behalf_of_email"
     );
 
@@ -1157,15 +1157,15 @@ async fn test_flow_update_preserves_on_behalf_of(db: Pool<Postgres>) -> anyhow::
     );
 
     let flow = sqlx::query!(
-        "SELECT on_behalf_of_email FROM flow WHERE path = $1 AND workspace_id = $2",
+        "SELECT on_behalf_of FROM flow WHERE path = $1 AND workspace_id = $2",
         "u/test-user-2/flow_nonadmin_update",
         "test-workspace"
     )
     .fetch_one(&db)
     .await?;
     assert_eq!(
-        flow.on_behalf_of_email.as_deref(),
-        Some("test2@windmill.dev"),
+        flow.on_behalf_of.as_deref(),
+        Some("u/test-user-2"),
         "Non-admin update should overwrite flow on_behalf_of_email with their own"
     );
 
diff --git a/backend/tests/preview_native_tag.rs b/backend/tests/preview_native_tag.rs
index 29aefa588a..eba686396a 100644
--- a/backend/tests/preview_native_tag.rs
+++ b/backend/tests/preview_native_tag.rs
@@ -56,6 +56,7 @@ async fn push_preview_and_get_row(
         /* email */ "test@windmill.dev",
         /* permissioned_as */ "u/test-user".to_string(),
         /* token_prefix */ None,
+        /* audit_end_user */ None,
         /* scheduled_for */ None,
         /* schedule_path */ None,
         /* parent_job */ None,
diff --git a/backend/tests/protection_rules.rs b/backend/tests/protection_rules.rs
index 69873bf158..6714b24801 100644
--- a/backend/tests/protection_rules.rs
+++ b/backend/tests/protection_rules.rs
@@ -421,3 +421,268 @@ async fn test_restrict_deploy_to_deployers(db: Pool<Postgres>) -> anyhow::Result
 
     Ok(())
 }
+
+/// The dev-workspace pairing owns `dev_workspace_lock` by name: attaching creates it, detaching
+/// deletes it. Only those two ends of the name are reserved. Updating the rule has to stay open,
+/// since relaxing a restriction from the rulesets UI is the only way an admin can loosen a pairing's
+/// lock without detaching the dev workspace outright.
+///
+/// Reads the row directly rather than through `list_protection_rules`, which goes via the
+/// process-wide PROTECTION_RULES_CACHE that other tests in this file share.
+#[sqlx::test(fixtures("base"))]
+async fn test_dev_workspace_lock_rule_reservation(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base = format!("http://localhost:{port}/api/w/test-workspace");
+    let name = windmill_common::workspaces::DEV_WORKSPACE_LOCK_RULE_NAME;
+
+    let resp = authed(
+        client().post(format!("{base}/workspaces/protection_rules")),
+        "SECRET_TOKEN",
+    )
+    .json(&json!({
+        "name": name,
+        "rules": ["DisableDirectDeployment"],
+        "bypass_users": [],
+        "bypass_groups": []
+    }))
+    .send()
+    .await?;
+    assert_eq!(
+        resp.status(),
+        400,
+        "creating the reserved rule by hand should be refused"
+    );
+
+    // Stands in for an attach, which is what really creates the rule. 3 = DisableDirectDeployment |
+    // DisableWorkspaceForking, the pairing's default lock.
+    sqlx::query(
+        "INSERT INTO workspace_protection_rule (workspace_id, name, rules, bypass_groups, bypass_users)
+         VALUES ('test-workspace', $1, 3, '{}', '{}')",
+    )
+    .bind(name)
+    .execute(&db)
+    .await?;
+
+    let resp = authed(
+        client().post(format!("{base}/workspaces/protection_rules/{name}")),
+        "SECRET_TOKEN",
+    )
+    .json(&json!({
+        "rules": ["DisableWorkspaceForking"],
+        "bypass_users": [],
+        "bypass_groups": []
+    }))
+    .send()
+    .await?;
+    assert_eq!(
+        resp.status(),
+        200,
+        "an admin must be able to drop a restriction from the reserved rule: {}",
+        resp.text().await?
+    );
+
+    let rules: i32 = sqlx::query_scalar(
+        "SELECT rules FROM workspace_protection_rule WHERE workspace_id = 'test-workspace' AND name = $1",
+    )
+    .bind(name)
+    .fetch_one(&db)
+    .await?;
+    assert_eq!(rules, 2, "only DisableWorkspaceForking should remain");
+
+    // Renaming it away would strand the pairing's lock, which is located by name.
+    let resp = authed(
+        client().post(format!("{base}/workspaces/protection_rules/{name}")),
+        "SECRET_TOKEN",
+    )
+    .json(&json!({
+        "name": "renamed-lock",
+        "rules": ["DisableWorkspaceForking"],
+        "bypass_users": [],
+        "bypass_groups": []
+    }))
+    .send()
+    .await?;
+    assert_eq!(
+        resp.status(),
+        400,
+        "renaming the reserved rule should be refused"
+    );
+
+    let resp = authed(
+        client().delete(format!("{base}/workspaces/protection_rules/{name}")),
+        "SECRET_TOKEN",
+    )
+    .send()
+    .await?;
+    assert_eq!(
+        resp.status(),
+        400,
+        "deleting the reserved rule should stay refused: detaching the dev workspace removes it"
+    );
+
+    Ok(())
+}
+
+/// The name is half the row's primary key, so a rename has to move the row: the update applies the
+/// name from the body, not just the one in the path. Collisions and the reserved name are refused,
+/// and a name submitted unchanged is left exactly as stored.
+#[sqlx::test(fixtures("base"))]
+async fn test_protection_rule_rename(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base = format!("http://localhost:{port}/api/w/test-workspace");
+
+    for name in ["before-rename", "occupied"] {
+        let resp = authed(
+            client().post(format!("{base}/workspaces/protection_rules")),
+            "SECRET_TOKEN",
+        )
+        .json(&json!({
+            "name": name,
+            "rules": ["DisableDirectDeployment"],
+            "bypass_users": [],
+            "bypass_groups": []
+        }))
+        .send()
+        .await?;
+        assert_eq!(resp.status(), 200, "setup: create '{}'", name);
+    }
+
+    let resp = authed(
+        client().post(format!("{base}/workspaces/protection_rules/before-rename")),
+        "SECRET_TOKEN",
+    )
+    .json(&json!({
+        "name": "after-rename",
+        "rules": ["DisableWorkspaceForking"],
+        "bypass_users": [],
+        "bypass_groups": []
+    }))
+    .send()
+    .await?;
+    assert_eq!(
+        resp.status(),
+        200,
+        "rename should succeed: {}",
+        resp.text().await?
+    );
+
+    let names: Vec<String> = sqlx::query_scalar(
+        "SELECT name FROM workspace_protection_rule WHERE workspace_id = 'test-workspace' ORDER BY name",
+    )
+    .fetch_all(&db)
+    .await?;
+    assert_eq!(
+        names,
+        vec!["after-rename".to_string(), "occupied".to_string()],
+        "the row should have moved to the new name, not been duplicated"
+    );
+
+    for (target, why) in [
+        (
+            "occupied",
+            "renaming onto an existing rule should be refused",
+        ),
+        (
+            windmill_common::workspaces::DEV_WORKSPACE_LOCK_RULE_NAME,
+            "renaming onto the reserved name should be refused",
+        ),
+    ] {
+        let resp = authed(
+            client().post(format!("{base}/workspaces/protection_rules/after-rename")),
+            "SECRET_TOKEN",
+        )
+        .json(&json!({
+            "name": target,
+            "rules": ["DisableWorkspaceForking"],
+            "bypass_users": [],
+            "bypass_groups": []
+        }))
+        .send()
+        .await?;
+        assert_eq!(resp.status(), 400, "{}", why);
+    }
+
+    // Names are stored verbatim and the editor submits the current name on every save, so a padded
+    // name has to survive a restrictions-only edit rather than being trimmed into a rename.
+    let padded = " padded-name ";
+    let resp = authed(
+        client().post(format!("{base}/workspaces/protection_rules")),
+        "SECRET_TOKEN",
+    )
+    .json(&json!({
+        "name": padded,
+        "rules": ["DisableDirectDeployment"],
+        "bypass_users": [],
+        "bypass_groups": []
+    }))
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 200, "setup: create the padded rule");
+
+    let resp = authed(
+        client().post(format!(
+            "{base}/workspaces/protection_rules/%20padded-name%20"
+        )),
+        "SECRET_TOKEN",
+    )
+    .json(&json!({
+        "name": padded,
+        "rules": ["DisableWorkspaceForking"],
+        "bypass_users": [],
+        "bypass_groups": []
+    }))
+    .send()
+    .await?;
+    assert_eq!(
+        resp.status(),
+        200,
+        "restrictions-only edit of a padded name should succeed: {}",
+        resp.text().await?
+    );
+
+    let still_there: bool = sqlx::query_scalar(
+        "SELECT EXISTS(SELECT 1 FROM workspace_protection_rule WHERE workspace_id = 'test-workspace' AND name = $1)",
+    )
+    .bind(padded)
+    .fetch_one(&db)
+    .await?;
+    assert!(
+        still_there,
+        "the padded name must not have been trimmed into a rename"
+    );
+
+    // The mirror case: a name differing only in surrounding whitespace is a real rename, applied
+    // verbatim rather than collapsing into a success that changed nothing.
+    let resp = authed(
+        client().post(format!("{base}/workspaces/protection_rules/after-rename")),
+        "SECRET_TOKEN",
+    )
+    .json(&json!({
+        "name": " after-rename ",
+        "rules": ["DisableWorkspaceForking"],
+        "bypass_users": [],
+        "bypass_groups": []
+    }))
+    .send()
+    .await?;
+    assert_eq!(
+        resp.status(),
+        200,
+        "whitespace-only rename should apply: {}",
+        resp.text().await?
+    );
+    let renamed: bool = sqlx::query_scalar(
+        "SELECT EXISTS(SELECT 1 FROM workspace_protection_rule WHERE workspace_id = 'test-workspace' AND name = ' after-rename ')",
+    )
+    .fetch_one(&db)
+    .await?;
+    assert!(renamed, "the padded form should now be the stored name");
+
+    Ok(())
+}
diff --git a/backend/tests/resource_versioning.rs b/backend/tests/resource_versioning.rs
new file mode 100644
index 0000000000..c4b0bcdc02
--- /dev/null
+++ b/backend/tests/resource_versioning.rs
@@ -0,0 +1,215 @@
+//! Regression tests for resource value history.
+//!
+//! Four properties that a later refactor could plausibly undo, each with a cost
+//! that is invisible until it bites:
+//!  - `state` and `cache` resources are excluded. They are rewritten by every job
+//!    that calls `setState` or caches a result, so versioning them would grow the
+//!    table without bound and without anyone asking for it.
+//!  - an unchanged value mints nothing, which is what keeps no-op saves, renames and
+//!    description edits out of the history.
+//!  - restore appends the old value as a new version rather than rewinding, so the
+//!    history stays append-only and the restore is itself attributable.
+//!  - writes that never touch the resource handlers are still recorded. Variable
+//!    renames, workspace forks and native integrations all write `resource` directly,
+//!    and a rename that changes path and value in one statement used to leave the
+//!    newest version holding the pre-rename value while the UI labelled it "Current".
+//!    This is why recording lives in a database trigger rather than the handlers.
+
+use serde_json::{json, Value};
+use sqlx::{Pool, Postgres};
+
+use windmill_test_utils::*;
+
+fn client() -> reqwest::Client {
+    reqwest::Client::new()
+}
+
+fn authed(b: reqwest::RequestBuilder) -> reqwest::RequestBuilder {
+    b.header("Authorization", "Bearer RVER_ADMIN_TOKEN")
+}
+
+async fn history(base: &str, path: &str) -> anyhow::Result<Vec<Value>> {
+    let body: Value = authed(client().get(format!("{base}/resources/history/p/{path}")))
+        .send()
+        .await?
+        .json()
+        .await?;
+    Ok(body["versions"].as_array().cloned().unwrap_or_default())
+}
+
+#[sqlx::test(fixtures("resource_versioning"))]
+async fn test_resource_version_history(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let base = format!("http://localhost:{}/api/w/rver-ws", server.addr.port());
+    let path = "u/rver-admin/db";
+
+    let resp = authed(client().post(format!("{base}/resources/create")))
+        .json(&json!({
+            "path": path,
+            "value": {"host": "one"},
+            "resource_type": "postgresql"
+        }))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 201, "create should succeed");
+    assert_eq!(history(&base, path).await?.len(), 1, "create mints v1");
+
+    authed(client().post(format!("{base}/resources/update_value/{path}")))
+        .json(&json!({"value": {"host": "two"}}))
+        .send()
+        .await?;
+    let versions = history(&base, path).await?;
+    assert_eq!(versions.len(), 2, "a changed value mints a version");
+
+    authed(client().post(format!("{base}/resources/update_value/{path}")))
+        .json(&json!({"value": {"host": "two"}}))
+        .send()
+        .await?;
+    assert_eq!(
+        history(&base, path).await?.len(),
+        2,
+        "re-saving an identical value must not mint a version"
+    );
+
+    // Restore the oldest version: the value goes back, the history grows.
+    let oldest = versions.last().unwrap()["id"].as_i64().unwrap();
+    let resp = authed(client().post(format!("{base}/resources/history/restore/v/{oldest}")))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 200, "restore should succeed");
+
+    let restored: Value = authed(client().get(format!("{base}/resources/get_value/{path}")))
+        .send()
+        .await?
+        .json()
+        .await?;
+    assert_eq!(restored["host"], "one", "restore brings the old value back");
+    assert_eq!(
+        history(&base, path).await?.len(),
+        3,
+        "restore appends rather than rewinding"
+    );
+
+    // Machine-written resource types stay out of the history entirely.
+    for internal in ["state", "cache"] {
+        let internal_path = format!("u/rver-admin/{internal}_item");
+        authed(client().post(format!("{base}/resources/create")))
+            .json(&json!({
+                "path": internal_path,
+                "value": {"a": 1},
+                "resource_type": internal
+            }))
+            .send()
+            .await?;
+        assert_eq!(
+            history(&base, &internal_path).await?.len(),
+            0,
+            "{internal} resources must not be versioned"
+        );
+    }
+
+    Ok(())
+}
+
+/// A version's reported dangling references. Pins that `$jsonvar:` is matched on its own prefix
+/// rather than colliding with `$var:` — the two share a suffix, so a check written with a
+/// substring test instead of a prefix test would report every `$jsonvar:` as missing.
+#[sqlx::test(fixtures("resource_versioning"))]
+async fn test_missing_references(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let base = format!("http://localhost:{}/api/w/rver-ws", server.addr.port());
+    let path = "u/rver-admin/refs";
+
+    authed(client().post(format!("{base}/variables/create")))
+        .json(&json!({
+            "path": "u/rver-admin/present",
+            "value": "v",
+            "is_secret": false,
+            "description": ""
+        }))
+        .send()
+        .await?;
+
+    authed(client().post(format!("{base}/resources/create")))
+        .json(&json!({
+            "path": path,
+            "value": {
+                "a": "$jsonvar:u/rver-admin/present",
+                "b": "$jsonvar:u/rver-admin/absent",
+                "c": "$var:u/rver-admin/present",
+                "d": "$res:u/rver-admin/absent"
+            },
+            "resource_type": "postgresql"
+        }))
+        .send()
+        .await?;
+
+    let id = history(&base, path).await?[0]["id"].as_i64().unwrap();
+    let version: Value = authed(client().get(format!("{base}/resources/history/v/{id}")))
+        .send()
+        .await?
+        .json()
+        .await?;
+    let mut missing: Vec<&str> = version["missing_references"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .map(|v| v.as_str().unwrap())
+        .collect();
+    missing.sort();
+
+    assert_eq!(
+        missing,
+        vec!["$jsonvar:u/rver-admin/absent", "$res:u/rver-admin/absent"],
+        "only the references that do not resolve should be reported"
+    );
+
+    Ok(())
+}
+
+/// Writes that bypass the resource handlers entirely. A variable rename changes a linked
+/// resource's path and value in one statement; the cascading FK moves the history to the new
+/// path, so without trigger-level recording the newest row would keep the pre-rename value and
+/// disagree with the resource it describes.
+#[sqlx::test(fixtures("resource_versioning"))]
+async fn test_direct_writes_are_recorded(db: Pool<Postgres>) -> anyhow::Result<()> {
+    let path = "u/rver-admin/direct";
+    sqlx::query(
+        "INSERT INTO resource (workspace_id, path, value, resource_type, created_by, edited_at)
+         VALUES ('rver-ws', $1, '{\"h\":\"one\"}', 'postgresql', 'rver-admin', now())",
+    )
+    .bind(path)
+    .execute(&db)
+    .await?;
+
+    let renamed = "u/rver-admin/direct_renamed";
+    sqlx::query(
+        "UPDATE resource SET path = $1, value = '{\"h\":\"two\"}', edited_at = now()
+         WHERE workspace_id = 'rver-ws' AND path = $2",
+    )
+    .bind(renamed)
+    .bind(path)
+    .execute(&db)
+    .await?;
+
+    let (count, newest): (i64, Option<String>) = sqlx::query_as(
+        "SELECT count(*), (SELECT value->>'h' FROM resource_version
+                            WHERE workspace_id = 'rver-ws' AND path = $1
+                            ORDER BY id DESC LIMIT 1)
+           FROM resource_version WHERE workspace_id = 'rver-ws' AND path = $1",
+    )
+    .bind(renamed)
+    .fetch_one(&db)
+    .await?;
+
+    assert_eq!(count, 2, "the direct insert and the rename both record");
+    assert_eq!(
+        newest.as_deref(),
+        Some("two"),
+        "newest version must match the live value after a rename that also changed it"
+    );
+
+    Ok(())
+}
diff --git a/backend/tests/session_workspace_status.rs b/backend/tests/session_workspace_status.rs
new file mode 100644
index 0000000000..b4fc98da5e
--- /dev/null
+++ b/backend/tests/session_workspace_status.rs
@@ -0,0 +1,62 @@
+//! `POST /workspaces/session_workspace_status` is what the client uses to decide whether to
+//! keep or destroy an AI session, so its notion of "reachable" must match what the authed
+//! extractor actually grants. Membership is not the only path: a superadmin is authed into
+//! any existing workspace without a `usr` row, and `admins` has no `usr` rows at all, so
+//! answering from `usr` alone reports live workspaces as unresolvable and the client deletes
+//! sessions that still work.
+
+use serde_json::json;
+use sqlx::{Pool, Postgres};
+use std::collections::HashMap;
+use windmill_test_utils::*;
+
+async fn status(port: u16, token: &str, ids: &[&str]) -> anyhow::Result<HashMap<String, String>> {
+    let resp = reqwest::Client::new()
+        .post(format!(
+            "http://localhost:{port}/api/workspaces/session_workspace_status"
+        ))
+        .header("Authorization", format!("Bearer {token}"))
+        .json(&json!({ "workspace_ids": ids }))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 200, "{}", resp.text().await?);
+    Ok(resp.json().await?)
+}
+
+#[sqlx::test(fixtures("base", "session_workspace_status"))]
+async fn test_superadmin_reaches_workspaces_without_a_usr_row(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    let ids = [
+        "admins",
+        "foreign-workspace",
+        "archived-workspace",
+        "test-workspace",
+        "no-such-workspace",
+    ];
+
+    // test@windmill.dev is an instance superadmin, and a member of test-workspace only.
+    let sa = status(port, "SECRET_TOKEN", &ids).await?;
+    assert_eq!(sa["admins"], "active");
+    assert_eq!(sa["foreign-workspace"], "active");
+    // Reachable, but soft-deleted: superadmins must not bypass the archived state.
+    assert_eq!(sa["archived-workspace"], "archived");
+    assert_eq!(sa["test-workspace"], "active");
+    // A workspace that never existed stays unresolvable — the superadmin arm must not
+    // swallow the hard-deleted case, or those sessions would linger forever.
+    assert_eq!(sa["no-such-workspace"], "deleted");
+
+    // test2@windmill.dev is not a superadmin, and a member of test-workspace only.
+    let usr = status(port, "SECRET_TOKEN_2", &ids).await?;
+    assert_eq!(usr["admins"], "deleted");
+    assert_eq!(usr["foreign-workspace"], "deleted");
+    assert_eq!(usr["archived-workspace"], "deleted");
+    assert_eq!(usr["test-workspace"], "active");
+    assert_eq!(usr["no-such-workspace"], "deleted");
+
+    Ok(())
+}
diff --git a/backend/tests/suspend_resume.rs b/backend/tests/suspend_resume.rs
index 29fe38d2c3..d112ca0b96 100644
--- a/backend/tests/suspend_resume.rs
+++ b/backend/tests/suspend_resume.rs
@@ -235,6 +235,88 @@ mod suspend_resume {
         Ok(())
     }
 
+    /// A suspend gate that ends without approval leaves the worker that ran the approval step
+    /// alive, so the error handler it routes to must stay pinned to that worker rather than
+    /// being unpinned and routed by tag — which would break the `./shared` contract of a
+    /// `same_worker` flow.
+    #[cfg(feature = "deno_core")]
+    #[sqlx::test(fixtures("base"))]
+    async fn disapproved_suspend_keeps_same_worker_pin(db: Pool<Postgres>) -> anyhow::Result<()> {
+        initialize_tracing().await;
+
+        let server = ApiServer::start(db.clone()).await?;
+        let port = server.addr.port();
+
+        let value: FlowValue = serde_json::from_value(json!({
+            "same_worker": true,
+            "modules": [{
+                "id": "a",
+                "value": {
+                    "input_transforms": {
+                        "port": { "type": "javascript", "expr": "flow_input.port" },
+                    },
+                    "type": "rawscript",
+                    "language": "deno",
+                    "content": "\
+                        export async function main(port) {\
+                            const job = Deno.env.get('WM_JOB_ID');\
+                            const token = Deno.env.get('WM_TOKEN');\
+                            const secret = await (await fetch(\
+                                `http://localhost:${port}/api/w/test-workspace/jobs/job_signature/${job}/0?token=${token}&approver=ruben`,\
+                                { headers: { 'Authorization': `Bearer ${token}` } }\
+                            )).text();\
+                            await fetch(\
+                                `http://localhost:${port}/api/w/test-workspace/jobs_u/cancel/${job}/0/${secret}?approver=ruben`,\
+                                { method: 'POST', body: JSON.stringify('from job'), headers: { 'content-type': 'application/json' } }\
+                            );\
+                            return 'a ran';\
+                        }",
+                },
+                "suspend": { "required_events": 1 },
+            }, {
+                "id": "b",
+                "value": {
+                    "input_transforms": {},
+                    "type": "rawscript",
+                    "language": "deno",
+                    "content": "export function main() { return 'b ran' }",
+                },
+                // The gate holds `b` back, so `b` never runs and its error policy describes
+                // nothing: honouring it here would skip `b` instead of reaching the handler.
+                "continue_on_error": true,
+            }],
+            "failure_module": {
+                "id": "failure",
+                "value": {
+                    "input_transforms": {},
+                    "type": "rawscript",
+                    "language": "deno",
+                    "content": "export function main() { return 'handled' }",
+                },
+            },
+        }))?;
+
+        let completed =
+            RunJob::from(JobPayload::RawFlow { value, path: None, restarted_from: None })
+                .arg("port", json!(port))
+                .run_until_complete(&db, false, port)
+                .await;
+
+        server.close().await.unwrap();
+
+        assert_eq!(json!("handled"), completed.json_result().unwrap());
+
+        let same_worker: Option<bool> = sqlx::query_scalar(
+            "SELECT same_worker FROM v2_job WHERE parent_job = $1 AND flow_step_id = 'failure'",
+        )
+        .bind(completed.id)
+        .fetch_one(&db)
+        .await?;
+        assert_eq!(Some(true), same_worker);
+
+        Ok(())
+    }
+
     /// Test that self-approval is blocked when self_approval_disabled is true.
     ///
     /// This test verifies that when a flow has an approval step with self_approval_disabled=true,
diff --git a/backend/tests/trigger_listener_queries.rs b/backend/tests/trigger_listener_queries.rs
index c3f6357d4c..52088557ac 100644
--- a/backend/tests/trigger_listener_queries.rs
+++ b/backend/tests/trigger_listener_queries.rs
@@ -173,6 +173,8 @@ fn make_authed() -> windmill_api_auth::ApiAuthed {
         folders: vec![],
         scopes: None,
         username_override: None,
+        username_override_is_token_label: false,
+        is_session_token: false,
         token_prefix: None,
         read_only: false,
     }
diff --git a/backend/tests/worker.rs b/backend/tests/worker.rs
index 3140cd2d7f..67aac0503e 100644
--- a/backend/tests/worker.rs
+++ b/backend/tests/worker.rs
@@ -587,6 +587,69 @@ async fn test_deno_flow_same_worker(db: Pool<Postgres>) -> anyhow::Result<()> {
     );
     Ok(())
 }
+
+#[cfg(feature = "deno_core")]
+#[sqlx::test(fixtures("base"))]
+async fn test_same_worker_survives_empty_branch(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+
+    let server: ApiServer = ApiServer::start(db.clone()).await?;
+
+    // No branch matches and the default is empty, so `a` completes without spawning a job and
+    // hands the flow back over the UpdateFlow channel. `b` must still be pinned to the worker.
+    let flow: FlowValue = serde_json::from_value(json!({
+        "same_worker": true,
+        "modules": [
+            {
+                "id": "a",
+                "value": {
+                    "type": "branchone",
+                    "branches": [{
+                        "expr": "false",
+                        "modules": [{
+                            "id": "c",
+                            "value": {
+                                "type": "rawscript",
+                                "language": "deno",
+                                "content": "export function main(){ return 1 }",
+                            }
+                        }]
+                    }],
+                    "default": []
+                }
+            },
+            {
+                "id": "b",
+                "value": {
+                    "type": "rawscript",
+                    "language": "deno",
+                    "content": "export function main(){ return 42 }",
+                }
+            }
+        ]
+    }))
+    .unwrap();
+
+    let job = run_job_in_new_worker_until_complete(
+        &db,
+        false,
+        JobPayload::RawFlow { value: flow, path: None, restarted_from: None },
+        server.addr.port(),
+    )
+    .await;
+    assert_eq!(job.json_result().unwrap(), json!(42));
+
+    let same_worker: Option<bool> = sqlx::query_scalar(
+        "SELECT same_worker FROM v2_job WHERE parent_job = $1 AND flow_step_id = 'b'",
+    )
+    .bind(job.id)
+    .fetch_one(&db)
+    .await?;
+    assert_eq!(same_worker, Some(true));
+
+    Ok(())
+}
+
 #[sqlx::test(fixtures("base"))]
 async fn test_flow_result_by_id(db: Pool<Postgres>) -> anyhow::Result<()> {
     initialize_tracing().await;
@@ -3992,7 +4055,7 @@ async fn test_failure_module(db: Pool<Postgres>) -> anyhow::Result<()> {
 
 /// Push `flow`, run it on a real worker until its first step is running, then simulate
 /// `monitor::handle_zombie_jobs` reaping that step unrecoverably (its worker crashed/OOM'd)
-/// by calling `handle_job_error(..., unrecoverable = true, ...)` exactly as the monitor does.
+/// by calling `handle_job_error(..., StepFailureKind::Unrecoverable, ...)` exactly as the monitor does.
 /// Returns the flow's completed result.
 #[cfg(feature = "deno_core")]
 async fn run_flow_until_step_running_then_fail_unrecoverably(
@@ -4007,7 +4070,7 @@ async fn run_flow_until_step_running_then_fail_unrecoverably(
     use windmill_common::client::AuthedClient;
     use windmill_common::KillpillSender;
     use windmill_queue::{get_queued_job_v2, MiniCompletedJob, SameWorkerPayload};
-    use windmill_worker::{JobCompletedSender, SameWorkerSender};
+    use windmill_worker::{JobCompletedSender, SameWorkerSender, StepFailureKind};
 
     let flow_id =
         RunJob::from(JobPayload::RawFlow { value: flow, path: None, restarted_from: None })
@@ -4072,7 +4135,7 @@ async fn run_flow_until_step_running_then_fail_unrecoverably(
                 windmill_common::error::Error::ExecutionErr(
                     "simulated worker OOM crash".to_string(),
                 ),
-                true, // unrecoverable
+                StepFailureKind::Unrecoverable,
                 Some(&sw_tx),
                 "",
                 "test-monitor",
diff --git a/backend/windmill-ai/src/providers/anthropic.rs b/backend/windmill-ai/src/providers/anthropic.rs
index aafbcfb1df..6ebc555da6 100644
--- a/backend/windmill-ai/src/providers/anthropic.rs
+++ b/backend/windmill-ai/src/providers/anthropic.rs
@@ -866,6 +866,7 @@ mod tests {
             user_message: "hello",
             attachments: None,
             has_websearch: false,
+            prompt_cache_key: None,
         };
 
         AnthropicQueryBuilder::new(AIProvider::Anthropic, AIPlatform::Standard)
diff --git a/backend/windmill-ai/src/providers/openai.rs b/backend/windmill-ai/src/providers/openai.rs
index fd28281864..34185a8852 100644
--- a/backend/windmill-ai/src/providers/openai.rs
+++ b/backend/windmill-ai/src/providers/openai.rs
@@ -218,6 +218,12 @@ pub struct ResponsesApiRequest<'a> {
     pub max_output_tokens: Option<u32>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub text: Option<ResponsesApiTextFormat>,
+    /// From `gpt-5.6` on, the prefix hash alone no longer reliably matches a cached
+    /// prefix: the key is combined with it to route the request. Omitting it costs the
+    /// read discount and, since these models bill cache writes, pays to re-write the
+    /// prefix on every miss.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub prompt_cache_key: Option<&'a str>,
 }
 
 #[derive(Serialize, Debug)]
@@ -434,6 +440,7 @@ impl OpenAIQueryBuilder {
                 .map(|effort| ResponsesApiReasoning { effort: effort.to_string() }),
             max_output_tokens: args.max_tokens,
             text,
+            prompt_cache_key: args.prompt_cache_key,
         };
 
         serde_json::to_string(&request)
@@ -490,6 +497,8 @@ impl OpenAIQueryBuilder {
             reasoning: None, // Image generation models don't take a reasoning effort
             max_output_tokens: args.max_tokens,
             text: None, // No structured output for image generation
+            // A one-shot image prompt has no reusable prefix to route to a cache
+            prompt_cache_key: None,
         };
 
         serde_json::to_string(&request)
@@ -609,6 +618,7 @@ mod tests {
     use crate::query_builder::QueryBuilder;
 
     const SYSTEM_PROMPT: &str = "You are a helpful assistant";
+    const PROMPT_CACHE_KEY: &str = "test-workspace:f/agent:step_1";
 
     fn client() -> AuthedClient {
         AuthedClient::new(
@@ -641,6 +651,7 @@ mod tests {
             user_message: "hello",
             attachments: None,
             has_websearch: false,
+            prompt_cache_key: Some(PROMPT_CACHE_KEY),
         };
 
         OpenAIQueryBuilder::new(AIProvider::OpenAI)
@@ -712,4 +723,16 @@ mod tests {
 
         assert!(request.get("instructions").is_none());
     }
+
+    /// `gpt-5.6` and later only match a cached prefix reliably when the request carries
+    /// the routing key, so dropping it from the body silently forfeits the cache.
+    #[tokio::test]
+    async fn sends_the_prompt_cache_key() {
+        let messages = vec![message("user", "hi")];
+
+        let body = build_text_body(&messages, None).await;
+        let request: serde_json::Value = serde_json::from_str(&body).unwrap();
+
+        assert_eq!(request["prompt_cache_key"], PROMPT_CACHE_KEY);
+    }
 }
diff --git a/backend/windmill-ai/src/query_builder.rs b/backend/windmill-ai/src/query_builder.rs
index 5a4cecac87..c8f5fbb092 100644
--- a/backend/windmill-ai/src/query_builder.rs
+++ b/backend/windmill-ai/src/query_builder.rs
@@ -22,6 +22,11 @@ pub struct BuildRequestArgs<'a> {
     pub user_message: &'a str,
     pub attachments: Option<&'a [S3Object]>,
     pub has_websearch: bool,
+    /// Routing hint for the provider's prompt cache. Requests sharing a prompt prefix
+    /// must reuse one key to land on the same cache, so it is derived from what pins
+    /// the prefix (the step), never from the request. `None` retries a key the
+    /// endpoint rejected.
+    pub prompt_cache_key: Option<&'a str>,
 }
 
 /// Response from AI provider
diff --git a/backend/windmill-api-assets/Cargo.toml b/backend/windmill-api-assets/Cargo.toml
index c75715a3ac..62bc3d9c8d 100644
--- a/backend/windmill-api-assets/Cargo.toml
+++ b/backend/windmill-api-assets/Cargo.toml
@@ -21,3 +21,7 @@ serde.workspace = true
 serde_json.workspace = true
 sqlx.workspace = true
 tracing.workspace = true
+uuid.workspace = true
+
+[dev-dependencies]
+tokio = { workspace = true }
diff --git a/backend/windmill-api-assets/src/lib.rs b/backend/windmill-api-assets/src/lib.rs
index 3a2bf83097..09720b2203 100644
--- a/backend/windmill-api-assets/src/lib.rs
+++ b/backend/windmill-api-assets/src/lib.rs
@@ -605,9 +605,16 @@ async fn list_favorites(
 // frontend aggregates into nodes and edges.
 
 #[derive(Deserialize)]
-struct GraphQuery {
+pub struct GraphQuery {
     pub asset_kinds: Option<String>,
     pub folder: Option<String>,
+    /// Render a dbt project as a given deployed version rather than as it is
+    /// now. A run page passes the version its job ran, so an old run shows the
+    /// models, SQL and `ref()` lineage of that deploy instead of today's.
+    /// Absent — the usual case — means the newest live version per path.
+    /// Hex, like every other script-hash parameter — `ScriptHash` deserializes
+    /// it, so the run page can pass `job.script_hash` verbatim.
+    pub dbt_script_hash: Option<windmill_common::scripts::ScriptHash>,
 }
 
 #[derive(Serialize, Debug)]
@@ -629,6 +636,70 @@ struct GraphAssetNode {
     // `AssetGraphAssetNode.derived_from`.
     #[serde(skip_serializing_if = "Option::is_none")]
     derived_from: Option<String>,
+    // Set on a `dbt://` asset produced (or, for a source, consumed) by a dbt
+    // script: which dbt node it is and what dbt says about it. A dbt project is
+    // one runnable node with many model assets, so per-model metadata belongs
+    // here rather than on the script (docs/dbt-runtime.md, decision 15).
+    // Lockstep with TS `AssetGraphAssetNode.dbt`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    dbt: Option<DbtAssetProvenance>,
+}
+
+#[derive(Serialize, Debug, Clone)]
+struct DbtAssetProvenance {
+    unique_id: String,
+    // `model` | `snapshot` | `seed` | `source` — a source is read, not written,
+    // and the canvas distinguishes them.
+    resource_type: String,
+    // dbt's own word (`table`, `view`, `incremental`, `snapshot`), kept because
+    // `view` and `ephemeral` have no Windmill write-strategy analogue.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    materialized: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    materialize_strategy: Option<String>,
+    #[serde(skip_serializing_if = "Vec::is_empty")]
+    tags: Vec<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    description: Option<String>,
+    #[serde(skip_serializing_if = "Vec::is_empty")]
+    data_tests: Vec<DbtDataTest>,
+    /// Declared column metadata (name -> description). NOT column lineage —
+    /// `manifest.json` carries none (docs/dbt-runtime.md, decision 14).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    columns: Option<serde_json::Value>,
+    /// A source's declared freshness policy, for the staleness chip.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    freshness: Option<serde_json::Value>,
+    /// The model's SQL as written. Read-only in Windmill — the file lives in
+    /// the producing script's bundle, and this is the copy captured when the
+    /// graph being read was parsed: at deploy, or by a refresh from the
+    /// editor's buffer.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    raw_code: Option<String>,
+    /// Its path inside the repo, e.g. `models/staging/stg_orders.sql`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    original_file_path: Option<String>,
+}
+
+#[derive(Serialize, Debug, Clone, PartialEq)]
+struct DbtDataTest {
+    // `unique` | `not_null` | `accepted_values` | `relationships` — the four
+    // generic tests, one-for-one with the `// data_test` kinds — or a package
+    // test's namespaced name (`dbt_utils.accepted_range`).
+    kind: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    column: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    args: Option<serde_json::Value>,
+    // Lowercased. dbt's own severity decides whether a failure fails the run,
+    // so the canvas shows it rather than assuming every test is blocking.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    severity: Option<String>,
+}
+
+#[derive(Serialize, Debug, Clone)]
+struct DbtRunnableProvenance {
+    model_count: usize,
 }
 
 #[derive(Serialize, Debug)]
@@ -691,6 +762,11 @@ struct GraphRunnableNode {
     // signature list. Lockstep with TS `AssetGraphRunnableNode.macros`.
     #[serde(skip_serializing_if = "Vec::is_empty", default)]
     macros: Vec<MacroInfo>,
+    // Set on a `ScriptLang::Dbt` script: it owns a whole dbt project, so the
+    // node says how many models it materializes rather than pretending to be a
+    // single-output script. Lockstep with TS `AssetGraphRunnableNode.dbt`.
+    #[serde(skip_serializing_if = "Option::is_none", default)]
+    dbt: Option<DbtRunnableProvenance>,
 }
 
 // One macro of a `// macros` library, as surfaced on its graph node.
@@ -831,7 +907,7 @@ struct TestEdge {
 }
 
 #[derive(Serialize, Debug)]
-struct AssetGraphResponse {
+pub struct AssetGraphResponse {
     assets: Vec<GraphAssetNode>,
     runnables: Vec<GraphRunnableNode>,
     edges: Vec<GraphEdge>,
@@ -840,6 +916,34 @@ struct AssetGraphResponse {
     macro_edges: Vec<MacroEdge>,
     #[serde(skip_serializing_if = "Vec::is_empty", default)]
     test_edges: Vec<TestEdge>,
+    /// `ref()` lineage BETWEEN two dbt models. Without it every model hangs off
+    /// the one dbt runnable, which reads as a flat source-to-model fan-out
+    /// instead of the project's actual shape.
+    #[serde(skip_serializing_if = "Vec::is_empty", default)]
+    dbt_edges: Vec<DbtLineageEdge>,
+    /// The job whose snapshot the dbt half was resolved from, when one was
+    /// asked for and found. A run page polls the graph while its job runs
+    /// because a dynamic descriptor's snapshot is written mid-run, and this is
+    /// what tells it to stop: without it the page cannot distinguish "the
+    /// snapshot has not been written yet" from "this run has none", and either
+    /// polls forever or gives up before the ingest.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    dbt_snapshot_job: Option<uuid::Uuid>,
+    /// When the dbt half was parsed, for a graph pinned to a job. What the
+    /// editor labels its provenance with: a buffer refresh and the deployed
+    /// version's graph are drawn identically, so without saying which one is on
+    /// screen the ambiguity the explicit refresh removes just moves into the
+    /// editor.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    dbt_graph_ingested_at: Option<chrono::DateTime<chrono::Utc>>,
+}
+
+/// One `ref()`/`source()` edge, in the terms the canvas draws: the two
+/// relations, not dbt's node ids.
+#[derive(Serialize, Debug, PartialEq, Eq, PartialOrd, Ord)]
+struct DbtLineageEdge {
+    from_asset_path: String,
+    to_asset_path: String,
 }
 
 async fn asset_graph(
@@ -849,15 +953,81 @@ async fn asset_graph(
     Extension(db): Extension<windmill_common::DB>,
     Query(q): Query<GraphQuery>,
 ) -> JsonResult<AssetGraphResponse> {
-    let mut tx = user_db.begin(&authed).await?;
+    // `None`: pinning the graph to one run is job-scoped and this endpoint is
+    // authorized as `assets:read`. See `asset_graph_for`.
+    asset_graph_for(&authed, &w_id, user_db, db, q, None).await
+}
 
-    let kind_filter: Option<Vec<AssetKind>> = q.asset_kinds.as_ref().map(|s| {
-        s.split(',')
-            .filter_map(|k| {
-                serde_json::from_value::<AssetKind>(Value::String(k.trim().into())).ok()
-            })
-            .collect()
-    });
+/// A run the caller is already authorized to read, and the deployed version it
+/// ran. Path and hash come from the job row rather than the query, so a graph
+/// cannot be pointed at one project's version while claiming another's run.
+pub struct PinnedRun {
+    pub job_id: uuid::Uuid,
+    pub script_path: String,
+    /// `None` for a job that names no deployed version: a `parse` of the
+    /// EDITOR's buffer, whose graph belongs to that job alone. Such a job pins
+    /// only because it stored one — every other preview answers with the
+    /// workspace graph, as before.
+    pub script_hash: Option<i64>,
+}
+
+/// The asset graph, optionally as one run saw it.
+///
+/// AUTHORIZES NOTHING BY ITSELF. Every caller owes it two checks, because the
+/// answer is workspace asset data reached through a route whose own URL segment
+/// decides the scope domain: `assets:read` always, and `require_job_read_access`
+/// for the job when passing `Some(pinned)` — which is then taken as already
+/// done, since the pinned path and hash come from that job's row.
+pub async fn asset_graph_for(
+    authed: &ApiAuthed,
+    w_id: &str,
+    user_db: UserDB,
+    db: windmill_common::DB,
+    q: GraphQuery,
+    pinned: Option<PinnedRun>,
+) -> JsonResult<AssetGraphResponse> {
+    let dbt_job_id = pinned.as_ref().map(|p| p.job_id);
+    // The version is the job's own, not the caller's `dbt_script_hash` — and
+    // that holds when the job names NONE, so the parameter cannot supply a
+    // version for a graph that has no business claiming one.
+    let dbt_script_hash = match pinned.as_ref() {
+        Some(p) => p.script_hash,
+        None => q.dbt_script_hash.map(|h| h.0),
+    };
+    // Set only for a pinned run, where it lets `live` resolve without reading
+    // `script`: a share-link viewer is entitled to the run but usually has no
+    // grant on the script, and RLS there would empty the graph. `raw_code` has
+    // its own `script` check, so the body stays hidden either way.
+    let pinned_path = pinned.as_ref().map(|p| p.script_path.as_str());
+    let w_id = w_id.to_string();
+    let mut tx = user_db.begin(authed).await?;
+    // Built once: a scoped token's `scripts:read` paths decide whether a dbt
+    // node's SQL body may be returned, independently of the `assets:read` scope
+    // that authorizes this endpoint.
+    let dbt_source_scope = build_scope_path_predicate(authed, "scripts", "read");
+
+    // REFUSED, not dropped: a caller that asks for a kind this server does not
+    // know has asked for something, and answering with the other kinds returns a
+    // graph missing exactly what they came for — silently. That is how a rename
+    // of one kind emptied three callers' graphs with nothing logged.
+    let kind_filter: Option<Vec<AssetKind>> = q
+        .asset_kinds
+        .as_ref()
+        .map(|s| {
+            s.split(',')
+                .map(|k| {
+                    serde_json::from_value::<AssetKind>(Value::String(k.trim().into())).map_err(
+                        |_| {
+                            windmill_common::error::Error::BadRequest(format!(
+                                "`{}` is not an asset kind",
+                                k.trim()
+                            ))
+                        },
+                    )
+                })
+                .collect::<Result<Vec<_>, _>>()
+        })
+        .transpose()?;
     let kind_filter_ref = kind_filter.as_deref();
 
     let folder_filter = q.folder.as_deref().map(|f| format!("f/{}/%", f));
@@ -1066,6 +1236,267 @@ async fn asset_graph(
     .fetch_all(&mut *tx)
     .await?;
 
+    // dbt provenance. A dbt script is one runnable node whose models are many
+    // `dbt://` asset nodes (decision 15), so the per-model metadata has to
+    // hang off the assets, not off the script. It describes the RELATION, not a
+    // producer: several dbt scripts (different selections of one project) can
+    // materialize the same model, and the producer edges already name them.
+    //
+    // Scoped to the relations this graph actually renders, so a workspace with
+    // many dbt projects does not pay for all of them on every request. Not
+    // scoped by the script's folder: an out-of-folder dbt script still has to
+    // explain a model an in-scope consumer reads, same as macro definitions.
+    // Tests come along via `attached_node` — they carry no `asset_path` of
+    // their own.
+    let dbt_rows = sqlx::query!(
+        r#"WITH live AS (
+             -- The graph is stored per deployed VERSION, so this endpoint — which
+             -- describes the project as it is now — takes the newest live one per
+             -- path. Resolved once here rather than per row: a correlated lookup
+             -- on every node is what makes these queries fall over.
+             SELECT * FROM (
+               SELECT DISTINCT ON (s.path) s.path, s.hash
+                 FROM script s
+                WHERE $5::text IS NULL AND s.workspace_id = $1 AND s.language = 'dbt'
+                  AND ($3::bigint IS NULL OR s.hash = $3)
+                  -- A pinned version may be archived by now; that is precisely
+                  -- the case a historical run needs, so the liveness filter
+                  -- applies only when picking the current one.
+                  AND ($3::bigint IS NOT NULL OR (s.deleted = false AND s.archived = false))
+                ORDER BY s.path, s.created_at DESC
+             ) cur
+             UNION ALL
+             -- A pinned run names its own version, so `script` is not consulted:
+             -- under RLS it would answer for the CALLER's grants on the project,
+             -- emptying the graph for a share-link viewer who is entitled to the
+             -- run but not the script. A NULL hash here is a job that names no
+             -- version at all — an editor buffer parse — and matches only the
+             -- version-less rows that parse stored.
+             SELECT $5::text, $3::bigint WHERE $5::text IS NOT NULL
+           ),
+           -- The run's own snapshot when it left one, the version's graph
+           -- otherwise. A static descriptor never snapshots, so all of its runs
+           -- fall through to the same rows. Existence comes from the marker, not
+           -- from a node row: a dynamic run that disabled every model has a
+           -- snapshot whose graph is legitimately empty.
+           chosen AS (
+             -- No visibility check on the job here: reaching this with a job at
+             -- all means the caller passed `require_job_read_access` for it, and
+             -- re-deciding it under plain RLS can only DISAGREE with that answer
+             -- — silently, by falling back to the deployed graph rather than
+             -- erroring. A share-link viewer is entitled to the run and would be
+             -- shown a different run's model set. See `asset_graph_for`.
+             SELECT CASE WHEN $4::uuid IS NOT NULL AND EXISTS (
+                      SELECT 1 FROM dbt_graph_snapshot g
+                       WHERE g.workspace_id = $1 AND g.job_id = $4)
+                    THEN $4::uuid
+                    ELSE '00000000-0000-0000-0000-000000000000'::uuid END AS job_id
+           ),
+           scoped AS (
+             SELECT n.script_path, n.unique_id FROM dbt_node n
+              -- `=` still, with the NULL-to-NULL case spelled out and gated on
+              -- the pin: a version-less row's hash is NULL on both sides, which
+              -- `=` never matches, but `IS NOT DISTINCT FROM` would cost the
+              -- equality its index bound on the UNPINNED workspace graph — the
+              -- hot path. Unpinned, `$5` is NULL and the second arm folds away.
+              JOIN live l ON l.path = n.script_path
+                         AND (n.script_hash = l.hash
+                              OR ($5::text IS NOT NULL AND l.hash IS NULL
+                                  AND n.script_hash IS NULL))
+              JOIN chosen ch ON ch.job_id = n.job_id
+              WHERE n.workspace_id = $1 AND n.asset_path IS NOT NULL
+                -- Unpinned, the scope is the relations in view: `asset` says
+                -- which of them this folder touches. Pinned, that table is the
+                -- WRONG scope — it holds one row set per path, describing the
+                -- current deploy, so a model this version had and the current one
+                -- dropped would be filtered out of its own run's graph. The
+                -- pinned graph's nodes are the scope. Keyed on the pin rather
+                -- than on the hash: an editor parse pins without naming one, and
+                -- its models are precisely the ones `asset` does not know yet.
+                AND ($3::bigint IS NOT NULL OR $5::text IS NOT NULL
+                     OR n.asset_path IN (
+                  SELECT path FROM asset
+                   WHERE workspace_id = $1 AND kind = 'dbt'
+                     AND ($2::text IS NULL OR usage_path LIKE $2)))
+           )
+           SELECT n.script_path AS "script_path!", n.unique_id AS "unique_id!",
+                  n.resource_type AS "resource_type!", n.name AS "name!", n.asset_path,
+                  n.materialized, n.materialize_strategy, n.tags AS "tags!", n.description,
+                  n.test_kind, n.test_column, n.test_args, n.severity, n.attached_node,
+                  n.columns, n.freshness,
+                  n.raw_code, n.original_file_path,
+                  -- Whether the caller may read the project this row describes.
+                  -- The query deliberately reaches outside the requested folder
+                  -- so an in-scope consumer can explain the relation it reads,
+                  -- and `dbt_node` carries no RLS of its own; the relation's
+                  -- SHAPE is fine to answer that way, everything the project's
+                  -- author WROTE is not. Applied in Rust, over one predicate, so
+                  -- the fields it covers are named in one place. This runs in the
+                  -- authed transaction, so `script`'s RLS answers it. Matched on
+                  -- the HASH as well: `extra_perms` is per row, so a path
+                  -- recreated with narrower ones leaves the archived version
+                  -- readable, and a path-only probe would answer for THAT grant
+                  -- while returning this version's source.
+                  --
+                  -- A version-less row has no `script` row to ask, and needs
+                  -- none: it exists only because this caller's own parse job
+                  -- created it from a buffer they wrote, and the unpinned `live`
+                  -- branch — fed from `script` — can never join to one.
+                  (n.script_hash IS NULL OR EXISTS (
+                      SELECT 1 FROM script sc
+                       WHERE sc.workspace_id = n.workspace_id AND sc.path = n.script_path
+                         AND sc.hash = n.script_hash
+                  )) AS "script_visible!"
+             FROM dbt_node n
+             JOIN live l ON l.path = n.script_path
+                        AND (n.script_hash = l.hash
+                             OR ($5::text IS NOT NULL AND l.hash IS NULL
+                                 AND n.script_hash IS NULL))
+             -- Every join onto `dbt_node` needs this, not just the scoping CTE:
+             -- `job_id` is part of the key, so without it each model comes back
+             -- once per retained snapshot plus once for the version's graph.
+             JOIN chosen ch ON ch.job_id = n.job_id
+            WHERE n.workspace_id = $1
+              -- Joined on BOTH columns: a dbt `unique_id` is project-local, so
+              -- two projects with the same model name would otherwise pull each
+              -- other's rows.
+              AND (EXISTS (SELECT 1 FROM scoped s
+                            WHERE s.script_path = n.script_path
+                              AND s.unique_id = n.unique_id)
+                   OR EXISTS (SELECT 1 FROM scoped s
+                               WHERE s.script_path = n.script_path
+                                 AND s.unique_id = n.attached_node))
+            ORDER BY n.script_path, n.unique_id"#,
+        &w_id,
+        folder_filter.as_deref(),
+        dbt_script_hash,
+        dbt_job_id,
+        pinned_path,
+    )
+    .fetch_all(&mut *tx)
+    .await?;
+
+    // `ref()` lineage between two models, resolved to the relations they
+    // produce. Joined to `dbt_node` on both key columns because a dbt
+    // `unique_id` is only unique within its project.
+    let dbt_edge_rows = sqlx::query!(
+        r#"WITH live AS (
+             SELECT * FROM (
+               SELECT DISTINCT ON (s.path) s.path, s.hash
+                 FROM script s
+                WHERE $5::text IS NULL AND s.workspace_id = $1 AND s.language = 'dbt'
+                  AND ($3::bigint IS NULL OR s.hash = $3)
+                  AND ($3::bigint IS NOT NULL OR (s.deleted = false AND s.archived = false))
+                ORDER BY s.path, s.created_at DESC
+             ) cur
+             UNION ALL
+             SELECT $5::text, $3::bigint WHERE $5::text IS NOT NULL
+           ),
+           -- The run's own snapshot when it left one, the version's graph
+           -- otherwise. A static descriptor never snapshots, so all of its runs
+           -- fall through to the same rows. Existence comes from the marker, not
+           -- from a node row: a dynamic run that disabled every model has a
+           -- snapshot whose graph is legitimately empty.
+           chosen AS (
+             -- No visibility check on the job here: reaching this with a job at
+             -- all means the caller passed `require_job_read_access` for it, and
+             -- re-deciding it under plain RLS can only DISAGREE with that answer
+             -- — silently, by falling back to the deployed graph rather than
+             -- erroring. A share-link viewer is entitled to the run and would be
+             -- shown a different run's model set. See `asset_graph_for`.
+             SELECT CASE WHEN $4::uuid IS NOT NULL AND EXISTS (
+                      SELECT 1 FROM dbt_graph_snapshot g
+                       WHERE g.workspace_id = $1 AND g.job_id = $4)
+                    THEN $4::uuid
+                    ELSE '00000000-0000-0000-0000-000000000000'::uuid END AS job_id
+           )
+           SELECT p.asset_path AS "from_path!", c.asset_path AS "to_path!"
+             FROM dbt_edge e
+             JOIN live l ON l.path = e.script_path
+                        AND (e.script_hash = l.hash
+                             OR ($5::text IS NOT NULL AND l.hash IS NULL
+                                 AND e.script_hash IS NULL))
+             JOIN chosen ch ON ch.job_id = e.job_id
+             -- Gated the same way as the `live` joins above, and for the same
+             -- reason twice over: unpinned this folds to a plain equality the
+             -- versioned key can bound, and pinned it is the only way an editor
+             -- graph's NULL-to-NULL hashes meet at all.
+             JOIN dbt_node p ON p.workspace_id = e.workspace_id
+                            AND p.script_path = e.script_path
+                            AND (p.script_hash = e.script_hash
+                                 OR ($5::text IS NOT NULL AND e.script_hash IS NULL
+                                     AND p.script_hash IS NULL))
+                            AND p.job_id = ch.job_id
+                            AND p.unique_id = e.parent_unique_id
+             JOIN dbt_node c ON c.workspace_id = e.workspace_id
+                            AND c.script_path = e.script_path
+                            AND (c.script_hash = e.script_hash
+                                 OR ($5::text IS NOT NULL AND e.script_hash IS NULL
+                                     AND c.script_hash IS NULL))
+                            AND c.job_id = ch.job_id
+                            AND c.unique_id = e.child_unique_id
+            WHERE e.workspace_id = $1
+              AND p.asset_path IS NOT NULL AND c.asset_path IS NOT NULL
+              -- Tests attach to their model as a badge, not as a lineage edge.
+              AND c.resource_type <> 'test'
+              -- Scoped by the RELATIONS, like the node provenance above, not by
+              -- the producing script's folder: two tables consumed in this
+              -- folder but produced by a dbt project outside it would otherwise
+              -- both render with their `ref()` edge missing.
+              -- Same as the node scope: pinned, `asset` describes the CURRENT
+              -- deploy, so gating on it drops the edges of models this version
+              -- had and a later one removed. The pinned graph's own edges are
+              -- the answer.
+              AND ($3::bigint IS NOT NULL OR $5::text IS NOT NULL OR EXISTS (
+                SELECT 1 FROM asset a
+                 WHERE a.workspace_id = $1 AND a.kind = 'dbt'
+                   AND a.path = c.asset_path
+                   AND ($2::text IS NULL OR a.usage_path LIKE $2)))"#,
+        &w_id,
+        folder_filter.as_deref(),
+        dbt_script_hash,
+        dbt_job_id,
+        pinned_path,
+    )
+    .fetch_all(&mut *tx)
+    .await?;
+
+    // The marker `chosen` resolved to, answered once for the caller: its
+    // EXISTENCE is what lets a run page stop polling, and its timestamp is what
+    // an editor labels the graph's provenance with — "parsed from the editor at
+    // 14:32" against "as of last deploy". No `v2_job` recheck, for the reason
+    // `chosen` gives — disagreeing with the route's decision here would leave a
+    // share-link viewer with the right graph and a null marker, polling it 40
+    // times over.
+    let dbt_marker = match (dbt_job_id, pinned_path) {
+        (Some(job), Some(path)) => {
+            sqlx::query!(
+                "SELECT g.job_id, g.ingested_at FROM dbt_graph_snapshot g
+                  WHERE g.workspace_id = $1 AND g.script_path = $2
+                    AND g.script_hash IS NOT DISTINCT FROM $3
+                    AND g.job_id = CASE WHEN EXISTS (
+                          SELECT 1 FROM dbt_graph_snapshot s
+                           WHERE s.workspace_id = $1 AND s.job_id = $4)
+                        THEN $4::uuid
+                        ELSE '00000000-0000-0000-0000-000000000000'::uuid END
+                  LIMIT 1",
+                &w_id,
+                path,
+                dbt_script_hash,
+                job,
+            )
+            .fetch_optional(&mut *tx)
+            .await?
+        }
+        _ => None,
+    };
+    // Only a graph of the RUN's own, never the version's fallback: the run page
+    // compares this against its job id to decide whether to keep polling.
+    let dbt_snapshot_job = dbt_marker
+        .as_ref()
+        .map(|m| m.job_id)
+        .filter(|j| !j.is_nil());
+    let dbt_graph_ingested_at = dbt_marker.as_ref().map(|m| m.ingested_at);
     tx.commit().await?;
 
     // Parse each pipeline member's body once into its badge annotations, keyed
@@ -1110,6 +1541,138 @@ async fn asset_graph(
             (r.path.clone(), lineage)
         })
         .collect();
+    // Model → its provenance, and script → how many models it owns. Tests are
+    // folded onto the model they are attached to, which is what makes dbt's
+    // four generic tests render through the existing data-test node.
+    let mut dbt_by_asset_path: std::collections::HashMap<String, DbtAssetProvenance> =
+        Default::default();
+    let mut dbt_model_count: std::collections::HashMap<String, usize> = Default::default();
+    // Which relations each dbt script actually BUILDS. The sidecar also holds a
+    // row for a parent kept only to anchor a cross-selection edge, which the
+    // script reads rather than materializes — counting those would make a script
+    // selecting one mart claim the staging models upstream of it, and the badge
+    // says "materializes N models".
+    let dbt_writes: std::collections::HashSet<(&str, &str)> = rows
+        .iter()
+        .filter(|r| {
+            r.asset_kind == AssetKind::Dbt
+                && matches!(r.access_type.as_deref(), Some("w") | Some("rw"))
+        })
+        .map(|r| (r.usage_path.as_str(), r.asset_path.as_str()))
+        .collect();
+    // Keyed by (script_path, unique_id) — the sidecar's own primary key — since
+    // a dbt `unique_id` is only unique within its project.
+    let dbt_asset_path_by_unique_id: std::collections::HashMap<(&str, &str), &str> = dbt_rows
+        .iter()
+        .filter_map(|r| {
+            Some((
+                (r.script_path.as_str(), r.unique_id.as_str()),
+                r.asset_path.as_deref()?,
+            ))
+        })
+        .collect();
+    for r in &dbt_rows {
+        let Some(asset_path) = r.asset_path.as_deref() else {
+            continue;
+        };
+        if r.resource_type != "source" && dbt_writes.contains(&(r.script_path.as_str(), asset_path))
+        {
+            *dbt_model_count.entry(r.script_path.clone()).or_default() += 1;
+        }
+        // What the project's author WROTE — the model's SQL, its path in the
+        // repo, the prose and labels around it — as opposed to the shape of the
+        // relation it produces. RLS says whether the caller may see the script,
+        // but not whether a scoped token may: this endpoint is authorized as
+        // `assets:read`, so a token deliberately narrowed to it would otherwise
+        // read a project outside its `scripts:read` paths. Both answers gate the
+        // same set of fields, because a share-link viewer entitled to the RUN is
+        // not thereby entitled to the documentation of a project they cannot
+        // open.
+        let source_allowed = r.script_visible && dbt_source_scope(&r.script_path);
+        let candidate = DbtAssetProvenance {
+            raw_code: r.raw_code.clone().filter(|_| source_allowed),
+            original_file_path: r.original_file_path.clone().filter(|_| source_allowed),
+            unique_id: r.unique_id.clone(),
+            resource_type: r.resource_type.clone(),
+            materialized: r.materialized.clone(),
+            materialize_strategy: r.materialize_strategy.clone(),
+            tags: if source_allowed {
+                r.tags.clone()
+            } else {
+                vec![]
+            },
+            description: r.description.clone().filter(|_| source_allowed),
+            data_tests: vec![],
+            columns: r.columns.clone().filter(|_| source_allowed),
+            freshness: r.freshness.clone().filter(|_| source_allowed),
+        };
+        // One relation can carry rows from several projects — typically a model
+        // in one and a source declaring it in another. The producer describes
+        // the relation and the source only names it, so which one wins must not
+        // depend on script-path ordering. The source's freshness policy is
+        // still worth keeping, so it fills in rather than overwrites.
+        let existing = dbt_by_asset_path
+            .entry(asset_path.to_string())
+            .or_insert_with(|| candidate.clone());
+        if existing.unique_id == candidate.unique_id {
+            continue;
+        }
+        let wins = match (
+            existing.resource_type.as_str(),
+            candidate.resource_type.as_str(),
+        ) {
+            ("source", t) if t != "source" => true,
+            (t, "source") if t != "source" => false,
+            // Two rows of the same nature: pick by id so the graph does not
+            // change shape between requests.
+            _ => candidate.unique_id < existing.unique_id,
+        };
+        let freshness = existing
+            .freshness
+            .clone()
+            .or_else(|| candidate.freshness.clone());
+        if wins {
+            *existing = candidate;
+        }
+        existing.freshness = freshness;
+    }
+    // Tests fold onto the model they assert, which is what makes dbt's four
+    // generic tests render through the existing data-test node. A separate pass
+    // because rows arrive in `unique_id` order, so a test can precede its model.
+    for r in &dbt_rows {
+        if r.resource_type != "test" {
+            continue;
+        }
+        let Some(target) = r
+            .attached_node
+            .as_deref()
+            .and_then(|n| dbt_asset_path_by_unique_id.get(&(r.script_path.as_str(), n)))
+        else {
+            continue;
+        };
+        let Some(entry) = dbt_by_asset_path.get_mut(*target) else {
+            continue;
+        };
+        let test = DbtDataTest {
+            kind: r.test_kind.clone().unwrap_or_else(|| r.name.clone()),
+            column: r.test_column.clone(),
+            // The test's kind and column are the badge's shape, already spelled
+            // out by its `unique_id`. Its arguments are authored data — an
+            // `accepted_values` list is a column's domain — so they follow the
+            // same gate as the model's own source.
+            args: r
+                .test_args
+                .clone()
+                .filter(|_| r.script_visible && dbt_source_scope(&r.script_path)),
+            // dbt-core 1.x echoes the author's casing, 2.x uppercases; fold so
+            // the badge reads the same whichever engine deployed the script.
+            severity: r.severity.as_deref().map(|s| s.to_ascii_lowercase()),
+        };
+        if !entry.data_tests.contains(&test) {
+            entry.data_tests.push(test);
+        }
+    }
+
     let last_success_by_path: std::collections::HashMap<String, chrono::DateTime<chrono::Utc>> =
         last_success_rows
             .into_iter()
@@ -1132,6 +1695,18 @@ async fn asset_graph(
 
     let mut edges = Vec::with_capacity(rows.len());
     let mut asset_set: std::collections::HashSet<(AssetKind, String)> = Default::default();
+    // Pinned, the relations come from that graph's own nodes. The `asset` rows
+    // above are path-keyed — one set per script, always the current deploy — so
+    // a model this version had and a later one dropped would be missing from its
+    // own run's graph, and an editor buffer's new models would be missing
+    // outright, `asset` having never heard of them.
+    if dbt_script_hash.is_some() || pinned_path.is_some() {
+        for r in &dbt_rows {
+            if let Some(p) = r.asset_path.as_deref() {
+                asset_set.insert((AssetKind::Dbt, p.to_string()));
+            }
+        }
+    }
     let mut runnable_set: std::collections::HashSet<(AssetUsageKind, String)> = Default::default();
 
     // Every pipeline member in scope goes into the graph, even when the parser
@@ -1491,6 +2066,9 @@ async fn asset_graph(
                 })
                 .flatten(),
             derived_from: scd2_current_base.get(&(kind, path.clone())).cloned(),
+            dbt: (kind == AssetKind::Dbt)
+                .then(|| dbt_by_asset_path.get(&path).cloned())
+                .flatten(),
             kind,
             path,
         })
@@ -1562,6 +2140,10 @@ async fn asset_graph(
                     .flatten()
                     .cloned()
                     .unwrap_or_default(),
+                dbt: (usage_kind == AssetUsageKind::Script)
+                    .then(|| dbt_model_count.get(&path))
+                    .flatten()
+                    .map(|n| DbtRunnableProvenance { model_count: *n }),
                 path,
                 usage_kind,
             }
@@ -1569,6 +2151,22 @@ async fn asset_graph(
         .collect();
     runnables.sort_by(|a, b| a.path.cmp(&b.path));
 
+    // Only between relations this graph actually renders — an edge to a node
+    // that is not here has nothing to draw.
+    let rendered: std::collections::HashSet<&str> =
+        assets.iter().map(|a| a.path.as_str()).collect();
+    let mut dbt_edges: Vec<DbtLineageEdge> = dbt_edge_rows
+        .into_iter()
+        .filter(|r| {
+            r.from_path != r.to_path
+                && rendered.contains(r.from_path.as_str())
+                && rendered.contains(r.to_path.as_str())
+        })
+        .map(|r| DbtLineageEdge { from_asset_path: r.from_path, to_asset_path: r.to_path })
+        .collect();
+    dbt_edges.sort();
+    dbt_edges.dedup();
+
     Ok(Json(AssetGraphResponse {
         assets,
         runnables,
@@ -1576,6 +2174,9 @@ async fn asset_graph(
         triggers,
         macro_edges,
         test_edges,
+        dbt_edges,
+        dbt_snapshot_job,
+        dbt_graph_ingested_at,
     }))
 }
 
diff --git a/backend/windmill-api-assets/tests/dbt_pinned_graph.rs b/backend/windmill-api-assets/tests/dbt_pinned_graph.rs
new file mode 100644
index 0000000000..82e32797d0
--- /dev/null
+++ b/backend/windmill-api-assets/tests/dbt_pinned_graph.rs
@@ -0,0 +1,444 @@
+//! What a caller who cannot see a dbt script gets from a run of it.
+//!
+//! The share-link case: `require_job_read_access` has already let them through
+//! to the job, so `asset_graph_for` is handed the run — but the project itself
+//! is not theirs to read. The graph's SHAPE must survive that and its model SQL
+//! must not, and the two are decided by different predicates. Resolving the
+//! version from the caller's `script` access instead of from the job emptied the
+//! whole dbt half, and every later fix in this area re-touched one of the two.
+
+use sqlx::{Pool, Postgres};
+use windmill_api_assets::{asset_graph_for, GraphQuery, PinnedRun};
+use windmill_api_auth::ApiAuthed;
+use windmill_common::db::UserDB;
+
+const WS: &str = "test-workspace";
+const PATH: &str = "f/private/proj";
+const HASH: i64 = 42;
+
+/// A member of the workspace with no grant on `f/private` — the reason someone
+/// is sent a share link in the first place.
+fn outsider() -> ApiAuthed {
+    ApiAuthed {
+        email: "outsider@windmill.dev".to_string(),
+        username: "outsider".to_string(),
+        is_admin: false,
+        is_operator: false,
+        groups: vec![],
+        folders: vec![],
+        scopes: None,
+        username_override: None,
+        username_override_is_token_label: false,
+        is_session_token: false,
+        token_prefix: None,
+        read_only: false,
+    }
+}
+
+async fn seed(db: &Pool<Postgres>, job: uuid::Uuid) {
+    sqlx::query!(
+        "INSERT INTO folder (workspace_id, name, display_name, owners, extra_perms)
+         VALUES ($1, 'private', 'private', '{}', '{}')",
+        WS
+    )
+    .execute(db)
+    .await
+    .unwrap();
+    sqlx::query!(
+        "INSERT INTO script (workspace_id, hash, path, summary, description, content,
+                             created_by, language, lock)
+         VALUES ($1, $2, $3, '', '', 'profile: {}', 'test-user', 'dbt', '')",
+        WS,
+        HASH,
+        PATH,
+    )
+    .execute(db)
+    .await
+    .unwrap();
+    sqlx::query!(
+        "INSERT INTO dbt_graph_snapshot (workspace_id, script_path, script_hash, job_id, digest)
+         VALUES ($1, $2, $3, $4, 'd')",
+        WS,
+        PATH,
+        HASH,
+        job
+    )
+    .execute(db)
+    .await
+    .unwrap();
+    sqlx::query!(
+        r#"INSERT INTO dbt_node (workspace_id, script_path, script_hash, job_id, unique_id,
+                                 resource_type, name, asset_path, raw_code, tags, description,
+                                 columns, freshness)
+           VALUES ($1, $2, $3, $4, 'model.p.orders', 'model', 'orders',
+                   'u/a/wh/analytics/orders', 'select 1', '{finance}', 'daily order facts',
+                   '{"order_id": {"description": "natural key"}}'::jsonb,
+                   '{"warn_after": {"count": 12, "period": "hour"}}'::jsonb)"#,
+        WS,
+        PATH,
+        HASH,
+        job
+    )
+    .execute(db)
+    .await
+    .unwrap();
+    // A test node, for the arguments it carries: `accepted_values` spells out a
+    // column's domain.
+    sqlx::query!(
+        r#"INSERT INTO dbt_node (workspace_id, script_path, script_hash, job_id, unique_id,
+                                 resource_type, name, tags, test_kind, test_column, test_args,
+                                 attached_node)
+           VALUES ($1, $2, $3, $4, 'test.p.accepted_values_orders_status', 'test',
+                   'accepted_values_orders_status', '{}', 'accepted_values', 'status',
+                   '{"values": ["gold", "silver"]}'::jsonb, 'model.p.orders')"#,
+        WS,
+        PATH,
+        HASH,
+        job
+    )
+    .execute(db)
+    .await
+    .unwrap();
+}
+
+/// Everything on a node that the project's author wrote, rather than the shape
+/// of the relation it produces.
+const AUTHORED: [&str; 5] = [
+    "select 1",
+    "daily order facts",
+    "finance",
+    "natural key",
+    "gold",
+];
+
+fn query() -> GraphQuery {
+    GraphQuery { asset_kinds: Some("dbt".to_string()), folder: None, dbt_script_hash: None }
+}
+
+/// Pinned to a run they are entitled to, the outsider gets the model — and
+/// nothing its author wrote. Both halves matter: dropping the first is the blank
+/// Models panel under working progress rows, dropping the second hands the
+/// project's source and documentation to anyone holding a link.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn a_pinned_run_survives_no_access_to_its_script(db: Pool<Postgres>) {
+    let job = uuid::Uuid::from_u128(7);
+    seed(&db, job).await;
+
+    let pinned = PinnedRun { job_id: job, script_path: PATH.to_string(), script_hash: Some(HASH) };
+    let res = asset_graph_for(
+        &outsider(),
+        WS,
+        UserDB::new(db.clone()),
+        db.clone(),
+        query(),
+        Some(pinned),
+    )
+    .await
+    .unwrap();
+    let body = serde_json::to_value(&res.0).unwrap();
+
+    let nodes = body["dbt_nodes"]
+        .as_array()
+        .or(body["assets"].as_array())
+        .unwrap();
+    assert!(
+        !nodes.is_empty(),
+        "a run the caller may read must render, whatever their access to the project: {body}"
+    );
+    assert_eq!(
+        body["dbt_snapshot_job"],
+        serde_json::json!(job),
+        "and the marker must agree with it, or the page polls the graph 40 times"
+    );
+    for authored in AUTHORED {
+        assert!(
+            !body.to_string().contains(authored),
+            "`{authored}` is the project's, and stays behind access to it: {body}"
+        );
+    }
+    assert!(
+        body.to_string().contains("u/a/wh/analytics/orders"),
+        "while the relation the run wrote is what the page is for: {body}"
+    );
+
+    // The same read by someone who may open the project: the gate has to be the
+    // caller's access, not a field this endpoint stopped serving.
+    let seen = asset_graph_for(
+        &ApiAuthed { is_admin: true, ..outsider() },
+        WS,
+        UserDB::new(db.clone()),
+        db.clone(),
+        query(),
+        Some(PinnedRun { job_id: job, script_path: PATH.to_string(), script_hash: Some(HASH) }),
+    )
+    .await
+    .unwrap();
+    let seen = serde_json::to_value(&seen.0).unwrap().to_string();
+    for authored in AUTHORED {
+        assert!(
+            seen.contains(authored),
+            "`{authored}` renders for a reader of the project: {seen}"
+        );
+    }
+}
+
+/// Unpinned, the same caller sees nothing of the project: the workspace graph
+/// answers for their own access, and this one is not theirs. This is the half
+/// that must NOT be relaxed by making the pinned case work.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn without_a_run_the_same_caller_sees_no_dbt_nodes(db: Pool<Postgres>) {
+    let job = uuid::Uuid::from_u128(7);
+    seed(&db, job).await;
+
+    let res = asset_graph_for(
+        &outsider(),
+        WS,
+        UserDB::new(db.clone()),
+        db.clone(),
+        query(),
+        None,
+    )
+    .await
+    .unwrap();
+    let body = serde_json::to_value(&res.0).unwrap();
+    assert!(
+        !body.to_string().contains("orders"),
+        "an unpinned graph is the caller's own view of the workspace: {body}"
+    );
+}
+
+/// Archiving retires the script; it must not retire the runs that already
+/// happened. The pinned read resolves versions through a CTE that skips archived
+/// rows, so nothing about the CURRENT workspace graph depends on the sidecar
+/// surviving — which is exactly why deleting it looks safe and is not.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn archiving_the_script_leaves_its_finished_runs_renderable(db: Pool<Postgres>) {
+    let job = uuid::Uuid::from_u128(7);
+    seed(&db, job).await;
+    sqlx::query!(
+        "UPDATE script SET archived = true WHERE workspace_id = $1 AND hash = $2",
+        WS,
+        HASH
+    )
+    .execute(&db)
+    .await
+    .unwrap();
+
+    let admin = ApiAuthed { is_admin: true, ..outsider() };
+    let pinned = PinnedRun { job_id: job, script_path: PATH.to_string(), script_hash: Some(HASH) };
+    let res = asset_graph_for(
+        &admin,
+        WS,
+        UserDB::new(db.clone()),
+        db.clone(),
+        query(),
+        Some(pinned),
+    )
+    .await
+    .unwrap();
+    assert!(
+        serde_json::to_value(&res.0)
+            .unwrap()
+            .to_string()
+            .contains("orders"),
+        "a completed run of an archived version still renders its models"
+    );
+
+    let now = asset_graph_for(
+        &admin,
+        WS,
+        UserDB::new(db.clone()),
+        db.clone(),
+        query(),
+        None,
+    )
+    .await
+    .unwrap();
+    assert!(
+        !serde_json::to_value(&now.0)
+            .unwrap()
+            .to_string()
+            .contains("model.p.orders"),
+        "while the workspace graph, which describes what is live, drops it"
+    );
+}
+
+/// `extra_perms` is a grant on a ROW, so a path recreated with narrower ones
+/// leaves the old version readable to whoever the old row named. The source
+/// probe therefore has to name the version it is about to return: matched on
+/// the path alone, that stale grant answered for the pinned version's SQL and
+/// handed a viewer the body of a project they were never given.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn an_old_grant_at_the_same_path_does_not_expose_a_newer_version(db: Pool<Postgres>) {
+    const V2: i64 = 43;
+    let v1_job = uuid::Uuid::from_u128(7);
+    let v2_job = uuid::Uuid::from_u128(8);
+    seed(&db, v1_job).await;
+
+    // The version the outsider WAS granted, archived — the shape the grant
+    // outlives the deploy in.
+    sqlx::query!(
+        r#"UPDATE script SET archived = true, extra_perms = '{"u/outsider": true}'::jsonb
+            WHERE workspace_id = $1 AND hash = $2"#,
+        WS,
+        HASH
+    )
+    .execute(&db)
+    .await
+    .unwrap();
+
+    // The version they were not.
+    sqlx::query!(
+        "INSERT INTO script (workspace_id, hash, path, summary, description, content,
+                             created_by, language, lock)
+         VALUES ($1, $2, $3, '', '', 'profile: {}', 'test-user', 'dbt', '')",
+        WS,
+        V2,
+        PATH,
+    )
+    .execute(&db)
+    .await
+    .unwrap();
+    sqlx::query!(
+        "INSERT INTO dbt_graph_snapshot (workspace_id, script_path, script_hash, job_id, digest)
+         VALUES ($1, $2, $3, $4, 'd2')",
+        WS,
+        PATH,
+        V2,
+        v2_job
+    )
+    .execute(&db)
+    .await
+    .unwrap();
+    sqlx::query!(
+        "INSERT INTO dbt_node (workspace_id, script_path, script_hash, job_id, unique_id,
+                               resource_type, name, asset_path, raw_code, tags)
+         VALUES ($1, $2, $3, $4, 'model.p.orders', 'model', 'orders',
+                 'u/a/wh/analytics/orders', 'select 2', '{}')",
+        WS,
+        PATH,
+        V2,
+        v2_job
+    )
+    .execute(&db)
+    .await
+    .unwrap();
+
+    let pinned = PinnedRun { job_id: v2_job, script_path: PATH.to_string(), script_hash: Some(V2) };
+    let res = asset_graph_for(
+        &outsider(),
+        WS,
+        UserDB::new(db.clone()),
+        db.clone(),
+        query(),
+        Some(pinned),
+    )
+    .await
+    .unwrap();
+    let body = serde_json::to_value(&res.0).unwrap().to_string();
+
+    assert!(
+        body.contains("orders"),
+        "the run they were given still renders its models: {body}"
+    );
+    assert!(
+        !body.contains("select 2"),
+        "but not the SQL of a version their grant never covered: {body}"
+    );
+}
+
+/// The editor's own graph, keyed to the parse job and to no version.
+async fn seed_editor_graph(db: &Pool<Postgres>, job: uuid::Uuid) {
+    sqlx::query!(
+        "INSERT INTO dbt_graph_snapshot (workspace_id, script_path, script_hash, job_id, digest)
+         VALUES ($1, $2, NULL, $3, 'd')",
+        WS,
+        PATH,
+        job
+    )
+    .execute(db)
+    .await
+    .unwrap();
+    sqlx::query!(
+        r#"INSERT INTO dbt_node (workspace_id, script_path, script_hash, job_id, unique_id,
+                                 resource_type, name, asset_path, raw_code, tags)
+           VALUES ($1, $2, NULL, $3, 'model.p.draft', 'model', 'draft',
+                   'u/a/wh/analytics/draft', 'select 3', '{}')"#,
+        WS,
+        PATH,
+        job
+    )
+    .execute(db)
+    .await
+    .unwrap();
+}
+
+/// A buffer parse is the third provenance: no deployed version behind it, and
+/// its models are ones no `asset` row has heard of. It renders when pinned to
+/// the job that produced it — the only way in — and its SQL comes with it, since
+/// it exists because this caller's own parse job wrote the buffer.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn an_editor_graph_renders_only_through_its_own_job(db: Pool<Postgres>) {
+    let job = uuid::Uuid::from_u128(7);
+    seed(&db, job).await;
+    let parse = uuid::Uuid::from_u128(9);
+    seed_editor_graph(&db, parse).await;
+
+    let admin = ApiAuthed { is_admin: true, ..outsider() };
+    let pinned = asset_graph_for(
+        &admin,
+        WS,
+        UserDB::new(db.clone()),
+        db.clone(),
+        query(),
+        Some(PinnedRun { job_id: parse, script_path: PATH.to_string(), script_hash: None }),
+    )
+    .await
+    .unwrap();
+    let body = serde_json::to_value(&pinned.0).unwrap();
+    assert!(
+        body.to_string().contains("u/a/wh/analytics/draft"),
+        "the buffer's own models render: {body}"
+    );
+    assert!(
+        body.to_string().contains("select 3"),
+        "and their SQL, which is what the caller just wrote: {body}"
+    );
+    assert_eq!(
+        body["dbt_snapshot_job"],
+        serde_json::json!(parse),
+        "labelled as a graph of its own, so the editor can say where it came from"
+    );
+    assert!(
+        !body.to_string().contains("select 1"),
+        "and the deployed version's models are not mixed into it: {body}"
+    );
+
+    // Through the PATH — which is what the workspace graph and every run of the
+    // deployed version ask for — a buffer parse must not appear at all. It
+    // describes an editor's unsaved state, not what the script owns.
+    let workspace = asset_graph_for(&admin, WS, UserDB::new(db.clone()), db.clone(), query(), None)
+        .await
+        .unwrap();
+    let workspace = serde_json::to_value(&workspace.0).unwrap().to_string();
+    assert!(
+        !workspace.contains("u/a/wh/analytics/draft"),
+        "an editor's buffer is not part of the workspace graph: {workspace}"
+    );
+
+    let deployed_run = asset_graph_for(
+        &admin,
+        WS,
+        UserDB::new(db.clone()),
+        db.clone(),
+        query(),
+        Some(PinnedRun { job_id: job, script_path: PATH.to_string(), script_hash: Some(HASH) }),
+    )
+    .await
+    .unwrap();
+    let deployed_run = serde_json::to_value(&deployed_run.0).unwrap().to_string();
+    assert!(
+        !deployed_run.contains("u/a/wh/analytics/draft"),
+        "nor of a run of the deployed version: {deployed_run}"
+    );
+}
diff --git a/backend/windmill-api-assets/tests/fixtures/base.sql b/backend/windmill-api-assets/tests/fixtures/base.sql
new file mode 100644
index 0000000000..412fa1029f
--- /dev/null
+++ b/backend/windmill-api-assets/tests/fixtures/base.sql
@@ -0,0 +1,146 @@
+-- used for backend automated testing
+-- https://docs.rs/sqlx/latest/sqlx/attr.test.html
+
+INSERT INTO workspace
+            (id,               name,             owner)
+     VALUES ('test-workspace', 'test-workspace', 'test-user');
+
+INSERT INTO usr(workspace_id, email, username, is_admin, role) VALUES
+	('test-workspace', 'test@windmill.dev', 'test-user', true, 'Admin');
+
+INSERT INTO workspace_key(workspace_id, kind, key) VALUES
+	('test-workspace', 'cloud', 'test-key');
+
+
+INSERT INTO workspace_settings (workspace_id) VALUES
+	('test-workspace');
+
+INSERT INTO group_ (workspace_id, name, summary, extra_perms) VALUES
+	('test-workspace', 'all', 'All users', '{}');
+
+INSERT INTO password(email, password_hash, login_type, super_admin, verified, name, username)
+    VALUES ('test@windmill.dev', 'not-a-real-hash', 'password', true, true, 'Test User', 'test-user');
+
+INSERT INTO password(email, password_hash, login_type, super_admin, verified, name)
+    VALUES ('test2@windmill.dev', 'not-a-real-hash', 'password', false, true, 'Test User 2');
+
+INSERT INTO password(email, password_hash, login_type, super_admin, verified, name)
+    VALUES ('test3@windmill.dev', 'not-a-real-hash', 'password', false, true, 'Test User 3');
+
+INSERT INTO usr(workspace_id, email, username, is_admin, role) VALUES
+	('test-workspace', 'test2@windmill.dev', 'test-user-2', false, 'User');
+
+INSERT INTO usr(workspace_id, email, username, is_admin, role) VALUES
+	('test-workspace', 'test3@windmill.dev', 'test-user-3', false, 'User');
+
+insert INTO token(token_hash, token_prefix, token, email, label, super_admin) VALUES (encode(sha256('SECRET_TOKEN'::bytea), 'hex'), 'SECRET_TOK', 'SECRET_TOKEN', 'test@windmill.dev', 'test token', true);
+insert INTO token(token_hash, token_prefix, token, email, label, super_admin) VALUES (encode(sha256('SECRET_TOKEN_2'::bytea), 'hex'), 'SECRET_TOK', 'SECRET_TOKEN_2', 'test2@windmill.dev', 'test token 2', false);
+insert INTO token(token_hash, token_prefix, token, email, label, super_admin) VALUES (encode(sha256('SECRET_TOKEN_3'::bytea), 'hex'), 'SECRET_TOK', 'SECRET_TOKEN_3', 'test3@windmill.dev', 'test token 3', false);
+
+GRANT ALL PRIVILEGES ON TABLE workspace_key TO windmill_admin;
+GRANT ALL PRIVILEGES ON TABLE workspace_key TO windmill_user;
+
+CREATE FUNCTION "notify_insert_on_completed_job" ()
+RETURNS TRIGGER AS $$
+BEGIN
+    PERFORM pg_notify('completed', NEW.id::text);
+    RETURN NEW;
+END;
+$$ LANGUAGE PLPGSQL;
+
+  CREATE TRIGGER "notify_insert_on_completed_job"
+ AFTER INSERT ON "v2_job_completed"
+    FOR EACH ROW
+EXECUTE FUNCTION "notify_insert_on_completed_job" ();
+
+
+CREATE FUNCTION "notify_queue" ()
+RETURNS TRIGGER AS $$
+BEGIN
+    PERFORM pg_notify('queued', NEW.id::text);
+    RETURN NEW;
+END;
+$$ LANGUAGE PLPGSQL;
+
+  CREATE TRIGGER "notify_queue_after_insert"
+ AFTER INSERT ON "v2_job_queue"
+    FOR EACH ROW
+EXECUTE FUNCTION "notify_queue" ();
+
+  CREATE TRIGGER "notify_queue_after_flow_status_update"
+ AFTER UPDATE ON "v2_job_status"
+    FOR EACH ROW
+            WHEN (NEW.flow_status IS DISTINCT FROM OLD.flow_status)
+EXECUTE FUNCTION "notify_queue" ();
+
+-- Apply phase 4:
+DROP FUNCTION IF EXISTS v2_job_after_update CASCADE;
+DROP FUNCTION IF EXISTS v2_job_completed_before_insert CASCADE;
+DROP FUNCTION IF EXISTS v2_job_completed_before_update CASCADE;
+DROP FUNCTION IF EXISTS v2_job_queue_after_insert CASCADE;
+DROP FUNCTION IF EXISTS v2_job_queue_before_insert CASCADE;
+DROP FUNCTION IF EXISTS v2_job_queue_before_update CASCADE;
+DROP FUNCTION IF EXISTS v2_job_runtime_before_insert CASCADE;
+DROP FUNCTION IF EXISTS v2_job_runtime_before_update CASCADE;
+DROP FUNCTION IF EXISTS v2_job_status_before_insert CASCADE;
+DROP FUNCTION IF EXISTS v2_job_status_before_update CASCADE;
+
+DROP VIEW IF EXISTS completed_job, completed_job_view, job, queue, queue_view CASCADE;
+
+ALTER TABLE v2_job_queue
+    DROP COLUMN IF EXISTS __parent_job CASCADE,
+    DROP COLUMN IF EXISTS __created_by CASCADE,
+    DROP COLUMN IF EXISTS __script_hash CASCADE,
+    DROP COLUMN IF EXISTS __script_path CASCADE,
+    DROP COLUMN IF EXISTS __args CASCADE,
+    DROP COLUMN IF EXISTS __logs CASCADE,
+    DROP COLUMN IF EXISTS __raw_code CASCADE,
+    DROP COLUMN IF EXISTS __canceled CASCADE,
+    DROP COLUMN IF EXISTS __last_ping CASCADE,
+    DROP COLUMN IF EXISTS __job_kind CASCADE,
+    DROP COLUMN IF EXISTS __env_id CASCADE,
+    DROP COLUMN IF EXISTS __schedule_path CASCADE,
+    DROP COLUMN IF EXISTS __permissioned_as CASCADE,
+    DROP COLUMN IF EXISTS __flow_status CASCADE,
+    DROP COLUMN IF EXISTS __raw_flow CASCADE,
+    DROP COLUMN IF EXISTS __is_flow_step CASCADE,
+    DROP COLUMN IF EXISTS __language CASCADE,
+    DROP COLUMN IF EXISTS __same_worker CASCADE,
+    DROP COLUMN IF EXISTS __raw_lock CASCADE,
+    DROP COLUMN IF EXISTS __pre_run_error CASCADE,
+    DROP COLUMN IF EXISTS __email CASCADE,
+    DROP COLUMN IF EXISTS __visible_to_owner CASCADE,
+    DROP COLUMN IF EXISTS __mem_peak CASCADE,
+    DROP COLUMN IF EXISTS __root_job CASCADE,
+    DROP COLUMN IF EXISTS __leaf_jobs CASCADE,
+    DROP COLUMN IF EXISTS __concurrent_limit CASCADE,
+    DROP COLUMN IF EXISTS __concurrency_time_window_s CASCADE,
+    DROP COLUMN IF EXISTS __timeout CASCADE,
+    DROP COLUMN IF EXISTS __flow_step_id CASCADE,
+    DROP COLUMN IF EXISTS __cache_ttl CASCADE;
+
+LOCK TABLE v2_job_queue IN ACCESS EXCLUSIVE MODE;
+ALTER TABLE v2_job_completed
+    DROP COLUMN IF EXISTS __parent_job CASCADE,
+    DROP COLUMN IF EXISTS __created_by CASCADE,
+    DROP COLUMN IF EXISTS __created_at CASCADE,
+    DROP COLUMN IF EXISTS __success CASCADE,
+    DROP COLUMN IF EXISTS __script_hash CASCADE,
+    DROP COLUMN IF EXISTS __script_path CASCADE,
+    DROP COLUMN IF EXISTS __args CASCADE,
+    DROP COLUMN IF EXISTS __logs CASCADE,
+    DROP COLUMN IF EXISTS __raw_code CASCADE,
+    DROP COLUMN IF EXISTS __canceled CASCADE,
+    DROP COLUMN IF EXISTS __job_kind CASCADE,
+    DROP COLUMN IF EXISTS __env_id CASCADE,
+    DROP COLUMN IF EXISTS __schedule_path CASCADE,
+    DROP COLUMN IF EXISTS __permissioned_as CASCADE,
+    DROP COLUMN IF EXISTS __raw_flow CASCADE,
+    DROP COLUMN IF EXISTS __is_flow_step CASCADE,
+    DROP COLUMN IF EXISTS __language CASCADE,
+    DROP COLUMN IF EXISTS __is_skipped CASCADE,
+    DROP COLUMN IF EXISTS __raw_lock CASCADE,
+    DROP COLUMN IF EXISTS __email CASCADE,
+    DROP COLUMN IF EXISTS __visible_to_owner CASCADE,
+    DROP COLUMN IF EXISTS __tag CASCADE,
+    DROP COLUMN IF EXISTS __priority CASCADE;
diff --git a/backend/windmill-api-auth/src/auth.rs b/backend/windmill-api-auth/src/auth.rs
index 5219b41e9b..b3ad811b7f 100644
--- a/backend/windmill-api-auth/src/auth.rs
+++ b/backend/windmill-api-auth/src/auth.rs
@@ -26,7 +26,8 @@ use windmill_common::DB;
 
 use windmill_common::{
     auth::{
-        get_folders_for_user, get_groups_for_user, hash_token, safe_token_prefix, JWTAuthClaims,
+        get_folders_for_user, get_groups_for_user, hash_token, is_session_label, safe_token_prefix,
+        JWTAuthClaims,
     },
     error::{Error, JsonResult},
     jwt,
@@ -196,7 +197,9 @@ impl AuthCache {
                             tracing::error!("JWT auth error: workspace_id mismatch");
                             return None;
                         }
-                        let username_override = username_override_from_label(claims.label);
+                        let is_session_token = is_session_label(claims.label.as_deref());
+                        let (username_override, username_override_is_token_label) =
+                            username_override_from_label(claims.label);
 
                         let authed = ApiAuthed {
                             email: claims.email,
@@ -211,6 +214,8 @@ impl AuthCache {
                             // WM_TOKEN) keeps full user privileges as before.
                             scopes: claims.scopes,
                             username_override,
+                            username_override_is_token_label,
+                            is_session_token,
                             token_prefix: claims.audit_span,
                             read_only: false,
                         };
@@ -265,7 +270,9 @@ impl AuthCache {
                             (Some(owner), Some(email), super_admin, _, label, read_only)
                                 if w_id.is_some() =>
                             {
-                                let username_override = username_override_from_label(label);
+                                let is_session_token = is_session_label(label.as_deref());
+                                let (username_override, username_override_is_token_label) =
+                                    username_override_from_label(label);
                                 if let Some((prefix, name)) = owner.split_once('/') {
                                     if prefix == "u" {
                                         let lookup = if super_admin {
@@ -308,6 +315,8 @@ impl AuthCache {
                                                 folders,
                                                 scopes: None,
                                                 username_override,
+                                                username_override_is_token_label,
+                                                is_session_token,
                                                 token_prefix: Some(safe_token_prefix(token)),
                                                 read_only,
                                             })
@@ -358,6 +367,8 @@ impl AuthCache {
                                                 folders,
                                                 scopes: None,
                                                 username_override,
+                                                username_override_is_token_label,
+                                                is_session_token,
                                                 token_prefix: Some(safe_token_prefix(token)),
                                                 read_only,
                                             })
@@ -386,7 +397,9 @@ impl AuthCache {
                                 }
                             }
                             (_, Some(email), super_admin, scopes, label, read_only) => {
-                                let username_override = username_override_from_label(label);
+                                let is_session_token = is_session_label(label.as_deref());
+                                let (username_override, username_override_is_token_label) =
+                                    username_override_from_label(label);
                                 if w_id.is_some() {
                                     let row_o = sqlx::query!(
                                         "SELECT username, is_admin, operator FROM usr WHERE
@@ -429,6 +442,8 @@ impl AuthCache {
                                                 folders,
                                                 scopes,
                                                 username_override,
+                                                username_override_is_token_label,
+                                                is_session_token,
                                                 token_prefix: Some(safe_token_prefix(token)),
                                                 read_only,
                                             })
@@ -450,6 +465,8 @@ impl AuthCache {
                                                     folders: vec![],
                                                     scopes,
                                                     username_override,
+                                                    username_override_is_token_label,
+                                                    is_session_token,
                                                     token_prefix: Some(safe_token_prefix(token)),
                                                     read_only,
                                                 }),
@@ -473,6 +490,8 @@ impl AuthCache {
                                         folders: Vec::new(),
                                         scopes,
                                         username_override,
+                                        username_override_is_token_label,
+                                        is_session_token,
                                         token_prefix: Some(safe_token_prefix(token)),
                                         read_only,
                                     })
@@ -508,6 +527,8 @@ impl AuthCache {
                         folders: Vec::new(),
                         scopes: None,
                         username_override: None,
+                        username_override_is_token_label: false,
+                        is_session_token: false,
                         token_prefix: Some(safe_token_prefix(token)),
                         read_only: false,
                     };
@@ -715,6 +736,8 @@ fn no_auth_admin_authed() -> ApiAuthed {
         folders: Vec::new(),
         scopes: None,
         username_override: None,
+        username_override_is_token_label: false,
+        is_session_token: false,
         token_prefix: None,
         read_only: false,
     }
@@ -835,27 +858,47 @@ pub async fn resolve_opt_job_authed(
     Err((Error::NotAuthorized("Unauthorized".to_string()), parts))
 }
 
-fn username_override_from_label(label: Option<String>) -> Option<String> {
+/// Returns the override and whether it names the token's *label* rather than the entity that
+/// fired the request. Callers must not re-derive the second element from the first: the
+/// `ephemeral-script-end-user-` arm forwards a `created_by` verbatim, and `created_by` is
+/// unconstrained, so it may itself look like any of these shapes.
+///
+/// Only namespaces `create_token` rejects (`is_server_minted_label`) are trusted to name the
+/// entity acting, so the label can only have come from a server-side mint. Tokens minted
+/// before that guard existed are the remaining hole; closing it needs the token row to record
+/// who minted it rather than inferring it from the label.
+///
+/// Note that a trigger whose identity is set server-side — the SMTP one builds an `email-*`
+/// override directly — does not rely on this at all, so its prefix must not be trusted here.
+pub(crate) fn username_override_from_label(label: Option<String>) -> (Option<String>, bool) {
     match label {
+        Some(label) if label.starts_with("ephemeral-webhook-") => (Some(label), false),
+        Some(label) if label.starts_with("ephemeral-script-end-user-") => (
+            Some(
+                label
+                    .trim_start_matches("ephemeral-script-end-user-")
+                    .to_string(),
+            ),
+            false,
+        ),
+        // User-mintable, so they name nobody in particular — the trigger panels merely
+        // pre-fill `webhook-`/`http-`, and the editor mints the lsp one. The override keeps
+        // its value because `require_job_read_access` matches it against the `created_by` of
+        // jobs launched under it, which these shapes produced while they were trusted.
+        Some(label) if label == "Ephemeral lsp token" => (Some("lsp".to_string()), true),
         Some(label)
-            if label.starts_with("ephemeral-webhook-")
-                || label.starts_with("webhook-")
+            if label.starts_with("webhook-")
                 || label.starts_with("http-")
                 || label.starts_with("email-")
                 || label.starts_with("ws-") =>
         {
-            Some(label)
+            (Some(label), true)
         }
-        Some(label) if label.starts_with("ephemeral-script-end-user-") => Some(
-            label
-                .trim_start_matches("ephemeral-script-end-user-")
-                .to_string(),
+        Some(label) if label != "ephemeral-script" && label != "session" && !label.is_empty() => (
+            Some(format!("{}{label}", crate::GENERIC_TOKEN_LABEL_PREFIX)),
+            true,
         ),
-        Some(label) if label == "Ephemeral lsp token" => Some("lsp".to_string()),
-        Some(label) if label != "ephemeral-script" && label != "session" && !label.is_empty() => {
-            Some(format!("label-{label}"))
-        }
-        _ => None,
+        _ => (None, false),
     }
 }
 
diff --git a/backend/windmill-api-auth/src/lib.rs b/backend/windmill-api-auth/src/lib.rs
index 8120c16605..d92c3a5f2d 100644
--- a/backend/windmill-api-auth/src/lib.rs
+++ b/backend/windmill-api-auth/src/lib.rs
@@ -23,6 +23,8 @@ use windmill_common::{
     },
     db::{Authable, Authed, AuthedRef},
     error::{self, Error, Result},
+    jobs::JobTriggerKind,
+    triggers::TriggerMetadata,
     users::username_to_permissioned_as,
     DB,
 };
@@ -37,6 +39,11 @@ pub use auth::{
 
 // ------------ ApiAuthed & OptJobAuthed types ------------
 
+/// Prefix `username_override_from_label` puts on the label of a generic user token. The
+/// override keeps this form even though `display_username` skips it: `require_job_read_access`
+/// matches it against `created_by` to let a token re-read the jobs it launched.
+pub const GENERIC_TOKEN_LABEL_PREFIX: &str = "label-";
+
 #[derive(Default, Clone, Debug)]
 pub struct OptJobAuthed {
     pub job_id: Option<uuid::Uuid>,
@@ -54,6 +61,15 @@ pub struct ApiAuthed {
     pub folders: Vec<(String, bool, bool)>,
     pub scopes: Option<Vec<String>>,
     pub username_override: Option<String>,
+    /// Whether `username_override` is a generic user-token label rather than a name that
+    /// identifies the requester. It cannot be recovered from the value: the ephemeral
+    /// end-user override passes a `created_by` through verbatim, and that may itself be a
+    /// `label-*` string. Only `username_override_from_label` sets it.
+    pub username_override_is_token_label: bool,
+    /// Whether the request authenticated with the session token minted at browser login.
+    /// Only `trigger_or_fallback` reads it — see `is_session_label` for why it attributes
+    /// rather than proves, and must not gate authority.
+    pub is_session_token: bool,
     pub token_prefix: Option<String>,
     pub read_only: bool,
 }
@@ -72,8 +88,43 @@ impl ApiAuthed {
         }
     }
 
+    /// The name a run triggered by this principal is credited to (`v2_job.created_by`). A
+    /// trigger-token override names the entity that fired the request and wins; a generic
+    /// token label does not, so the token owner is credited and stays traceable even when
+    /// `permissioned_as` is an on-behalf-of identity. The audit `end_user` is the override
+    /// itself, label included, so the two diverge for a labeled token.
     pub fn display_username(&self) -> &str {
-        self.username_override.as_ref().unwrap_or(&self.username)
+        match self.username_override.as_deref() {
+            Some(o) if !self.username_override_is_token_label => o,
+            _ => &self.username,
+        }
+    }
+
+    /// Set an override that names the entity acting, e.g. a trigger. Assigning
+    /// `username_override` on its own would keep the provenance flag of whatever this authed
+    /// was built from, and a stale `true` makes `display_username` ignore the new value.
+    pub fn set_acting_username_override(&mut self, username_override: Option<String>) {
+        self.username_override = username_override;
+        self.username_override_is_token_label = false;
+    }
+
+    /// The `trigger_kind` a run started through a `/jobs/run*` route is stamped with: a trigger
+    /// that built its own metadata always wins, and a run driven by any other token — webhooks,
+    /// the CLI, the SDKs — is `webhook`, matching the `wm_trigger.kind` the preprocessor already
+    /// reports for these routes. Derived from the token, never from the request, because the
+    /// column is authority-bearing for other kinds (`app` marks a file as app-produced).
+    ///
+    /// A browser session is left unstamped rather than marked [`JobTriggerKind::Ui`]: that label
+    /// is one a worker built before this release cannot decode, and it would strand the jobs
+    /// carrying it. `webhook` has always been decodable, so it is safe to write today.
+    pub fn trigger_or_fallback(&self, trigger: Option<TriggerMetadata>) -> Option<TriggerMetadata> {
+        if trigger.is_some() {
+            return trigger;
+        }
+        if self.is_session_token {
+            return None;
+        }
+        Some(TriggerMetadata::new(None, JobTriggerKind::Webhook))
     }
 }
 
@@ -103,6 +154,8 @@ impl From<Authed> for ApiAuthed {
             folders: value.folders,
             scopes: value.scopes,
             username_override: None,
+            username_override_is_token_label: false,
+            is_session_token: false,
             token_prefix: value.token_prefix,
             read_only: false,
         }
@@ -414,6 +467,9 @@ fn scope_contains(caller: &ScopeDefinition, requested: &ScopeDefinition) -> bool
     // write subsumes read; otherwise the action must match exactly.
     match (caller.action.as_str(), requested.action.as_str()) {
         (c, r) if c == r || (c == "write" && r == "read") => {}
+        // Apps only: `write` covers `run` (see `ScopeDefinition::includes`), so an
+        // app-editor token can mint the narrower run-only credential.
+        ("write", "run") if caller.domain == "apps" => {}
         _ => return false,
     }
 
@@ -852,6 +908,8 @@ pub async fn fetch_api_authed_from_permissioned_as(
                 folders: authed.folders,
                 scopes: authed.scopes,
                 username_override: None,
+                username_override_is_token_label: false,
+                is_session_token: false,
                 token_prefix: authed.token_prefix,
                 read_only: false,
             };
@@ -869,7 +927,8 @@ pub async fn fetch_api_authed_from_permissioned_as(
         }
     };
 
-    api_authed.username_override = username_override;
+    // Callers pass a trigger or app identity here, never a token label.
+    api_authed.set_acting_username_override(username_override);
     Ok(api_authed)
 }
 
@@ -1194,6 +1253,114 @@ mod tests {
         }
     }
 
+    /// `display_username` is what `push` credits a run to, so a token label standing in for
+    /// it erases the caller from `created_by` and from the audit trail — irrecoverably when
+    /// `permissioned_as` is an on-behalf-of identity that also takes the `username` slot.
+    #[test]
+    fn generic_token_label_credits_the_token_owner() {
+        let owner_of = |label: &str| {
+            let (username_override, username_override_is_token_label) =
+                auth::username_override_from_label(Some(label.to_string()));
+            ApiAuthed {
+                username: "alice".into(),
+                username_override,
+                username_override_is_token_label,
+                ..Default::default()
+            }
+        };
+
+        // Arbitrary user-chosen labels, and the auto-generated MCP OAuth one.
+        assert_eq!(owner_of("my-personal-token").display_username(), "alice");
+        assert_eq!(
+            owner_of("mcp-oauth-mcp-client-9f3a1c").display_username(),
+            "alice"
+        );
+
+        // A trigger-*shaped* label is just as user-settable as any other, so it is credited
+        // the same way. Its value is still kept as the override, for `require_job_read_access`.
+        let webhookish = owner_of("webhook-f/svc/my_script");
+        assert_eq!(webhookish.display_username(), "alice");
+        assert_eq!(
+            webhookish.username_override.as_deref(),
+            Some("webhook-f/svc/my_script")
+        );
+
+        // Only labels `create_token` refuses to mint name the entity that fired the request.
+        assert_eq!(
+            owner_of("ephemeral-webhook-google-abc12").display_username(),
+            "ephemeral-webhook-google-abc12"
+        );
+
+        // Minted by the editor through the public handler, so it names no principal either.
+        assert_eq!(owner_of("Ephemeral lsp token").display_username(), "alice");
+
+        // The SMTP trigger sets its `email-*` identity server-side rather than through a
+        // label, so a token carrying that prefix is just a user token.
+        assert_eq!(owner_of("email-f/team/inbox").display_username(), "alice");
+        assert_eq!(
+            owner_of("ephemeral-script-end-user-enduser42").display_username(),
+            "enduser42"
+        );
+
+        // The end-user token forwards a `created_by` verbatim, and `created_by` is not
+        // constrained to a username — a job launched before the owner was credited still
+        // carries `label-*`. That is an end user, not this token's label, so it stands.
+        assert_eq!(
+            owner_of("ephemeral-script-end-user-label-alice").display_username(),
+            "label-alice"
+        );
+    }
+
+    /// A browser session is the one shape left unstamped, so the Runs page can say "a token
+    /// started this" without claiming the converse. Every other label — every shape a member
+    /// can pass to `create_token` — is `webhook`.
+    #[test]
+    fn only_a_browser_session_is_left_unstamped() {
+        let kind_of = |label: Option<&str>| {
+            ApiAuthed {
+                is_session_token: windmill_common::auth::is_session_label(label),
+                ..Default::default()
+            }
+            .trigger_or_fallback(None)
+            .map(|t| t.trigger_kind.to_string())
+        };
+
+        assert_eq!(kind_of(Some("session")), None);
+
+        for label in [
+            Some("my-personal-token"),
+            Some("webhook-f/svc/my_script"),
+            Some("Ephemeral lsp token"),
+            Some("ephemeral-script"),
+            Some("ephemeral-webhook-google-abc12"),
+            Some("mcp-oauth-mcp-client-9f3a1c"),
+            Some(""),
+            // A label-less token: the job WM_TOKEN, and any token created without one.
+            None,
+        ] {
+            assert_eq!(
+                kind_of(label).as_deref(),
+                Some("webhook"),
+                "label {label:?}"
+            );
+        }
+    }
+
+    /// A trigger that built its own metadata must survive the fallback, or a scheduled or
+    /// routed run started under a personal token would be re-attributed to a webhook.
+    #[test]
+    fn a_real_trigger_wins_over_the_token_fallback() {
+        let authed = ApiAuthed::default();
+        let schedule = TriggerMetadata::new(
+            Some("u/alice/nightly".to_string()),
+            JobTriggerKind::Schedule,
+        );
+
+        let kept = authed.trigger_or_fallback(Some(schedule)).unwrap();
+        assert_eq!(kept.trigger_kind.to_string(), "schedule");
+        assert_eq!(kept.trigger_path.as_deref(), Some("u/alice/nightly"));
+    }
+
     // Regression tests for the Preview path traversal: a Preview's path skips the
     // DB `proper_id` CHECK and reaches the worker, where it builds on-disk module
     // dirs. Traversal must be rejected even for admins, who otherwise bypass the
@@ -1484,6 +1651,25 @@ mod tests {
             opt_scopes(Some(vec!["users:read", "if_jobs:filter_tags:default"])).as_deref()
         )
         .is_ok());
+        // Apps `write` covers `run`, so an app-editor token can mint the run-only
+        // credential for the same app — but only within its own resource subtree,
+        // and the equivalence stays Apps-only.
+        let app_editor = authed_with_scopes(Some(vec!["apps:write:u/me/a", "jobs:write"]));
+        assert!(ensure_scopes_within_caller(
+            &app_editor,
+            opt_scopes(Some(vec!["apps:run:u/me/a"])).as_deref()
+        )
+        .is_ok());
+        assert!(ensure_scopes_within_caller(
+            &app_editor,
+            opt_scopes(Some(vec!["apps:run:u/me/b"])).as_deref()
+        )
+        .is_err());
+        assert!(ensure_scopes_within_caller(
+            &app_editor,
+            opt_scopes(Some(vec!["jobs:run"])).as_deref()
+        )
+        .is_err());
     }
 
     #[test]
diff --git a/backend/windmill-api-auth/src/scopes.rs b/backend/windmill-api-auth/src/scopes.rs
index 75cbc104ac..ed273c7d15 100644
--- a/backend/windmill-api-auth/src/scopes.rs
+++ b/backend/windmill-api-auth/src/scopes.rs
@@ -120,6 +120,10 @@ impl ScopeDefinition {
 
         match (self.action.as_str(), other.action.as_str()) {
             (a, b) if (a == "write" && b == "read") || (a == b) => {}
+            // Apps only: `write` can rewrite the app and its policy, so it also covers
+            // running its components. Not general — `jobs:write` must not grant
+            // `jobs:run`. The resource check below still confines it to the same app.
+            ("write", "run") if self.domain == "apps" => {}
             _ => return false,
         }
 
@@ -489,6 +493,25 @@ pub fn check_route_access(
         }
     }
 
+    // Each declared scope must grant what its prompt said and no more:
+    // `jobs:run` only deployed runnables, `users:read` only the viewer's identity.
+    if has_raw_app_sdk_sentinel(Some(token_scopes)) {
+        if let Some(suffix) = route_suffix.as_deref() {
+            if is_request_supplied_code_route(suffix) {
+                return Err(Error::PermissionDenied(
+                    "Access denied. A raw app frontend SDK token cannot run request-supplied code."
+                        .to_string(),
+                ));
+            }
+            if required_domain == ScopeDomain::Users && suffix != "users/whoami" {
+                return Err(Error::PermissionDenied(
+                    "Access denied. A raw app frontend SDK token can only read the viewer's own identity."
+                        .to_string(),
+                ));
+            }
+        }
+    }
+
     // MCP scopes (mcp:all, mcp:favorites, mcp:hub:*, etc.) use a custom format
     // that doesn't fit the standard domain:action model. Verify the token has at
     // least one mcp: scope; MCP handlers do their own fine-grained checking.
@@ -701,6 +724,34 @@ pub fn has_app_embed_sentinel(scopes: Option<&[String]>) -> bool {
     scopes.is_some_and(|s| s.iter().any(|x| x == APP_EMBED_SENTINEL))
 }
 
+/// Sentinel in raw-app SDK tokens. Grants nothing; `check_route_access` uses it
+/// to narrow the declared scopes to what the viewer's prompt promised.
+pub const RAW_APP_SDK_SENTINEL: &str = "raw_app_sdk";
+
+pub fn has_raw_app_sdk_sentinel(scopes: Option<&[String]>) -> bool {
+    scopes.is_some_and(|s| s.iter().any(|x| x == RAW_APP_SDK_SENTINEL))
+}
+
+/// Endpoints that run code the caller supplies or names by job id (the latter
+/// with no ownership check). Their jobs get an unscoped credential as the viewer,
+/// so reaching one would make a captured SDK token a full account takeover.
+fn is_request_supplied_code_route(suffix: &str) -> bool {
+    // Prefixes, so the `_async` variants are covered too.
+    const CODE_ROUTES: [&str; 10] = [
+        "jobs/run/preview",
+        "jobs/run_inline/preview",
+        "jobs/run_wait_result/preview",
+        "jobs/run/preview_bundle",
+        "jobs/run/preview_flow",
+        "jobs/run_wait_result/preview_flow",
+        "jobs/run/dependencies",
+        "jobs/run/flow_dependencies",
+        "jobs/run/workflow_as_code",
+        "jobs/restart/f",
+    ];
+    CODE_ROUTES.iter().any(|p| suffix.starts_with(p))
+}
+
 /// Routes an app embed token (sentinel) is denied. Its broad scopes (`apps:run`,
 /// `jobs:read`, `users:read`, `folders:read`) exist only for a fixed set of routes a
 /// running app uses, but the whole `/apps`, `/jobs`, `/users`, `/folders` routers are
@@ -802,6 +853,15 @@ fn scope_grants_access(
             && route_path.is_some_and(resource_metadata_route_allowed));
     }
 
+    // Apps `write` covers `run` (see `ScopeDefinition::includes`). Like every domain
+    // here this layer is resource-blind; the Run handlers path-check the app.
+    if scope_domain == ScopeDomain::Apps
+        && scope_action == ScopeAction::Write
+        && required_action == ScopeAction::Run
+    {
+        return Ok(true);
+    }
+
     if !scope_action.includes(&required_action)
         && !(scope_domain == ScopeDomain::Jobs
             && required_action == ScopeAction::Read
@@ -1016,6 +1076,29 @@ mod tests {
         assert!(check_route_access(&sc, "/api/w/test/data_metrics/list", "GET").is_err());
     }
 
+    /// `apps_u/execute_component` (and the S3 upload the same components drive) is a
+    /// Run action, so a scoped token needs `apps:run`. `apps:write` must keep reaching
+    /// it too: it can rewrite the app and its policy, so withholding execution from it
+    /// protects nothing while breaking every app-scoped token.
+    #[test]
+    fn apps_run_routes_accept_run_and_write_scopes() {
+        let execute = "/api/w/test/apps_u/execute_component/u/admin/app";
+        for scope in ["apps:run", "apps:write"] {
+            assert!(
+                check_route_access(&[scope.to_string()], execute, "POST").is_ok(),
+                "{scope} must reach execute_component"
+            );
+        }
+        assert!(check_route_access(&["apps:read".to_string()], execute, "POST").is_err());
+        // The write-satisfies-run allowance is confined to the apps domain.
+        assert!(check_route_access(
+            &["jobs:write".to_string()],
+            "/api/w/test/jobs/run/p/u/admin/script",
+            "POST"
+        )
+        .is_err());
+    }
+
     #[test]
     fn test_new_domain_parsing() {
         // Test that new domains are properly parsed
diff --git a/backend/windmill-api-debug/Cargo.toml b/backend/windmill-api-debug/Cargo.toml
index 8531407416..c262ac3d32 100644
--- a/backend/windmill-api-debug/Cargo.toml
+++ b/backend/windmill-api-debug/Cargo.toml
@@ -8,6 +8,10 @@ edition.workspace = true
 name = "windmill_api_debug"
 path = "src/lib.rs"
 
+[features]
+default = []
+enterprise = []
+
 [dependencies]
 windmill-api-auth.workspace = true
 windmill-common = { workspace = true, default-features = false }
diff --git a/backend/windmill-api-debug/src/lib.rs b/backend/windmill-api-debug/src/lib.rs
index 3b43a04ad1..7b2f569821 100644
--- a/backend/windmill-api-debug/src/lib.rs
+++ b/backend/windmill-api-debug/src/lib.rs
@@ -20,15 +20,21 @@
 //! - A job entry in v2_job (kind=preview) for traceability
 //! - A completed job entry in v2_job_completed
 //! - An audit log entry identical to script preview runs
+//!
+//! The same signature is what authorizes the debugger's requests back to the API:
+//! /api/debug/registry_config serves the instance's dependency-registry settings, which the
+//! debugger cannot read for itself, to sessions whose token carries the `registry_config`
+//! claim.
 
 use axum::{
     extract::Path,
+    http::HeaderMap,
     routing::{get, post},
     Extension, Json, Router,
 };
 use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine};
 use chrono::Utc;
-use ed25519_dalek::{Signer, SigningKey};
+use ed25519_dalek::{Signature, Signer, SigningKey};
 use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
 use sqlx::types::Json as SqlxJson;
@@ -37,8 +43,18 @@ use tokio::sync::RwLock;
 use uuid::Uuid;
 use windmill_audit::{audit_oss::audit_log, ActionKind};
 use windmill_common::{
-    db::UserDB, error::JsonResult, jobs::JobKind, jwt::JWT_SECRET, scripts::ScriptLang,
+    db::UserDB,
+    error::{Error, JsonResult},
+    global_settings::{
+        BUNFIG_INSTALL_SCOPES_SETTING, EXTRA_PIP_INDEX_URL_SETTING, NPMRC_SETTING,
+        NPM_CONFIG_REGISTRY_SETTING, PIP_INDEX_URL_SETTING, UV_INDEX_STRATEGY_SETTING,
+        WORKSPACE_REGISTRIES_SETTING,
+    },
+    jobs::JobKind,
+    jwt::JWT_SECRET,
+    scripts::ScriptLang,
     users::username_to_permissioned_as,
+    DB,
 };
 
 use windmill_api_auth::ApiAuthed;
@@ -112,7 +128,9 @@ pub async fn reload_debug_signing_key() {
 }
 
 pub fn global_service() -> Router {
-    Router::new().route("/jwks", get(get_jwks))
+    Router::new()
+        .route("/jwks", get(get_jwks))
+        .route("/registry_config", get(get_registry_config))
 }
 
 pub fn workspaced_service() -> Router {
@@ -168,6 +186,220 @@ async fn get_jwks() -> JsonResult<DebugJwks> {
     }))
 }
 
+/// The instance's dependency-registry configuration, as `windmill prepare-deps` consumes it.
+/// Field names are the `global_settings` keys, so the debug service forwards this object to
+/// the CLI as-is.
+#[derive(Serialize, Default)]
+pub struct DebugRegistryConfig {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub npm_config_registry: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub npmrc: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub bunfig_install_scopes: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub pip_index_url: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub pip_extra_index_url: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub uv_index_strategy: Option<String>,
+    /// Why configured settings were withheld, for the debug service to show the user.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub message: Option<String>,
+}
+
+/// Placeholder an EE instance puts in an index URL for a token minted per install by
+/// `EPHEMERAL_TOKEN_CMD` (`windmill-worker`'s `handle_ephemeral_token`).
+const EPHEMERAL_TOKEN_MARKER: &str = "EPHEMERAL_TOKEN";
+
+/// Every `global_settings` key [`get_registry_config`] reads, in one query. A setting
+/// resolved there but missing here reads as unset, whatever the instance has stored.
+const REGISTRY_SETTINGS: [&str; 7] = [
+    NPM_CONFIG_REGISTRY_SETTING,
+    NPMRC_SETTING,
+    BUNFIG_INSTALL_SCOPES_SETTING,
+    PIP_INDEX_URL_SETTING,
+    EXTRA_PIP_INDEX_URL_SETTING,
+    UV_INDEX_STRATEGY_SETTING,
+    WORKSPACE_REGISTRIES_SETTING,
+];
+
+/// Which half of the settings a session installs with, from the language its token was signed
+/// for: a session is served only what its own installer runs on, so a token minted for one
+/// language cannot be replayed to read the other's credentials. Every language the debugger
+/// accepts (`isDebuggableLanguage` in the frontend) has to appear here, or its sessions
+/// silently install from the public registries.
+fn registry_settings_for_language(language: &str) -> (bool, bool) {
+    match language {
+        "bun" | "typescript" | "deno" | "nativets" => (true, false),
+        "python3" | "python" => (false, true),
+        _ => (false, false),
+    }
+}
+
+/// Resolve one setting the way a worker resolves it: a workspace override wins over the
+/// instance value, which is `FORCE_<env>` > `global_settings` > `<env>` (the server's
+/// `load_option_setting_value`). A blank value means unset from either source, so a
+/// workspace can blank one out.
+fn resolve_registry_setting(
+    stored: &std::collections::HashMap<String, serde_json::Value>,
+    workspace_overrides: Option<&serde_json::Value>,
+    key: &str,
+    env_var: &str,
+) -> Option<String> {
+    let as_str = |v: Option<&serde_json::Value>| v.and_then(|v| v.as_str()).map(|s| s.to_string());
+    let instance_value = std::env::var(format!("FORCE_{env_var}"))
+        .ok()
+        .or_else(|| as_str(stored.get(key)))
+        .or_else(|| std::env::var(env_var).ok());
+    as_str(workspace_overrides.and_then(|w| w.get(key)))
+        .or(instance_value)
+        .filter(|v| !v.trim().is_empty())
+}
+
+/// Serve the dependency-registry settings to the debug service.
+///
+/// `windmill prepare-deps` installs a debug session's imports without a database
+/// connection, so the service fetches the settings here and passes them down over the
+/// CLI's stdin request. They stop there: a private index URL embeds credentials and the
+/// debugged script can read its own process, so nothing served here reaches the session's
+/// environment (see `debugger/README.md`).
+///
+/// Authorized by the launch token the service verified for that session, and only when the
+/// token carries the `registry_config` claim (see [`sign_debug_request`] for what it means).
+async fn get_registry_config(
+    Extension(db): Extension<DB>,
+    headers: HeaderMap,
+) -> JsonResult<DebugRegistryConfig> {
+    let token = headers
+        .get("authorization")
+        .and_then(|v| v.to_str().ok())
+        .and_then(|v| v.strip_prefix("Bearer "))
+        .ok_or_else(|| Error::NotAuthorized("Missing debug token".to_string()))?;
+
+    let claims = verify_debug_token(token).await?;
+    if !claims.registry_config {
+        return Err(Error::NotAuthorized(
+            "This debug session is not allowed to read the registry configuration".to_string(),
+        ));
+    }
+
+    let names = REGISTRY_SETTINGS.map(String::from);
+    let stored = sqlx::query!(
+        "SELECT name, value FROM global_settings WHERE name = ANY($1)",
+        &names[..]
+    )
+    .fetch_all(&db)
+    .await?
+    .into_iter()
+    .map(|r| (r.name, r.value))
+    .collect::<std::collections::HashMap<_, _>>();
+
+    let workspace_overrides = stored
+        .get(WORKSPACE_REGISTRIES_SETTING)
+        .and_then(|v| v.get(&claims.workspace_id));
+    let (npm, python) = registry_settings_for_language(&claims.language);
+    let resolve = |serve: bool, key: &str, env_var: &str| {
+        serve
+            .then(|| resolve_registry_setting(&stored, workspace_overrides, key, env_var))
+            .flatten()
+    };
+
+    let mut config = DebugRegistryConfig {
+        npm_config_registry: resolve(npm, NPM_CONFIG_REGISTRY_SETTING, "NPM_CONFIG_REGISTRY"),
+        npmrc: resolve(npm, NPMRC_SETTING, "NPMRC"),
+        bunfig_install_scopes: resolve(
+            npm,
+            BUNFIG_INSTALL_SCOPES_SETTING,
+            "BUNFIG_INSTALL_SCOPES",
+        ),
+        pip_index_url: resolve(python, PIP_INDEX_URL_SETTING, "PIP_INDEX_URL"),
+        pip_extra_index_url: resolve(python, EXTRA_PIP_INDEX_URL_SETTING, "PIP_EXTRA_INDEX_URL"),
+        // Not a private-registry setting: a worker reads it on any edition, so it is
+        // served below the Enterprise gate too.
+        uv_index_strategy: resolve(python, UV_INDEX_STRATEGY_SETTING, "UV_INDEX_STRATEGY"),
+        message: None,
+    };
+
+    if cfg!(feature = "enterprise") {
+        // A worker substitutes this marker with the output of `EPHEMERAL_TOKEN_CMD`
+        // (`handle_ephemeral_token`), a command the debug service has no way to run. Serving
+        // the placeholder would install with a literal token, so the value is withheld and
+        // the service falls back to the index URL in its own environment.
+        let ephemeral = |url: &Option<String>| {
+            url.as_ref()
+                .is_some_and(|u| u.contains(EPHEMERAL_TOKEN_MARKER))
+        };
+        if ephemeral(&config.pip_index_url) || ephemeral(&config.pip_extra_index_url) {
+            config.pip_index_url = None;
+            config.pip_extra_index_url = None;
+            config.message = Some(format!(
+                "Python index configuration ignored: an {EPHEMERAL_TOKEN_MARKER} index URL can only be resolved on a worker"
+            ));
+        }
+    } else {
+        // A private registry is an Enterprise feature, and `read_ee_registry` drops these
+        // same settings on a CE worker, so a CE debug session installs from the public registries
+        // and says why, instead of gaining a capability jobs on that instance don't have.
+        let configured = config.npm_config_registry.is_some()
+            || config.npmrc.is_some()
+            || config.bunfig_install_scopes.is_some()
+            || config.pip_index_url.is_some()
+            || config.pip_extra_index_url.is_some();
+        config.npm_config_registry = None;
+        config.npmrc = None;
+        config.bunfig_install_scopes = None;
+        config.pip_index_url = None;
+        config.pip_extra_index_url = None;
+        if configured {
+            config.message = Some(
+                "Private registry configuration ignored: this feature requires Windmill Enterprise Edition"
+                    .to_string(),
+            );
+        }
+    }
+
+    Ok(Json(config))
+}
+
+/// Verify a token minted by [`sign_debug_request`] and return its claims.
+///
+/// The debug service verifies the same token itself against the JWKS public key; this is
+/// the server-side half, for the requests the service makes back on a session's behalf.
+async fn verify_debug_token(token: &str) -> Result<DebugTokenClaims, Error> {
+    let key_guard = DEBUG_SIGNING_KEY.read().await;
+    let signing_key = key_guard
+        .as_ref()
+        .ok_or_else(|| Error::InternalErr("Debug signing key not initialized".to_string()))?;
+
+    let invalid = || Error::NotAuthorized("Invalid debug token".to_string());
+    let mut parts = token.split('.');
+    let (header_b64, claims_b64, signature_b64) =
+        match (parts.next(), parts.next(), parts.next(), parts.next()) {
+            (Some(header), Some(claims), Some(signature), None) => (header, claims, signature),
+            _ => return Err(invalid()),
+        };
+
+    let signature = Signature::from_slice(
+        &URL_SAFE_NO_PAD
+            .decode(signature_b64)
+            .map_err(|_| invalid())?,
+    )
+    .map_err(|_| invalid())?;
+    signing_key
+        .verifying_key()
+        .verify_strict(format!("{header_b64}.{claims_b64}").as_bytes(), &signature)
+        .map_err(|_| invalid())?;
+
+    let claims: DebugTokenClaims =
+        serde_json::from_slice(&URL_SAFE_NO_PAD.decode(claims_b64).map_err(|_| invalid())?)
+            .map_err(|_| invalid())?;
+    if Utc::now().timestamp() > claims.exp {
+        return Err(Error::NotAuthorized("Debug token expired".to_string()));
+    }
+    Ok(claims)
+}
+
 #[derive(Deserialize)]
 pub struct SignDebugRequest {
     /// The code to be debugged
@@ -193,6 +425,11 @@ pub struct DebugTokenClaims {
     pub exp: i64,
     /// Job ID for traceability
     pub job_id: String,
+    /// Whether this session may be served the instance's dependency-registry settings
+    /// (see [`get_registry_config`]). Defaults to `false` so a token that predates the
+    /// claim is refused rather than silently trusted.
+    #[serde(default)]
+    pub registry_config: bool,
 }
 
 #[derive(Serialize)]
@@ -248,6 +485,14 @@ async fn sign_debug_request(
         iat: now_ts,
         exp,
         job_id: job_id.to_string(),
+        // The registry settings embed credentials, and the token reaches the browser, so they
+        // are only served for a session whose author can already install with them: someone
+        // who can run a preview job. For npm that discloses nothing new, since a worker leaves
+        // the same `.npmrc` / `bunfig.toml` in the directory the previewed script runs in; the
+        // Python index URL only ever appears as uv's argv, so serving it here does widen what
+        // a member of the workspace can read. Operators cannot run previews at all, so their
+        // sessions install from the public registries.
+        registry_config: !authed.is_operator,
     };
 
     // Create JWT manually with Ed25519 signature
@@ -504,3 +749,107 @@ async fn sign_multiplayer(
 
     Ok(Json(SignedMultiplayerPayload { token }))
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Sign `claims` the way [`sign_debug_request`] does, with a key only this test knows.
+    async fn signed(claims: &DebugTokenClaims) -> String {
+        let key = derive_signing_key_from_jwt_secret("test-secret");
+        *DEBUG_SIGNING_KEY.write().await = Some(key.clone());
+        let header = URL_SAFE_NO_PAD.encode(r#"{"alg":"EdDSA","typ":"JWT"}"#);
+        let payload = URL_SAFE_NO_PAD.encode(serde_json::to_string(claims).unwrap());
+        let message = format!("{header}.{payload}");
+        let signature = URL_SAFE_NO_PAD.encode(key.sign(message.as_bytes()).to_bytes());
+        format!("{message}.{signature}")
+    }
+
+    fn claims(exp_in: i64) -> DebugTokenClaims {
+        DebugTokenClaims {
+            code_hash: "0".repeat(32),
+            language: "bun".to_string(),
+            workspace_id: "test".to_string(),
+            email: "user@windmill.dev".to_string(),
+            iat: Utc::now().timestamp(),
+            exp: Utc::now().timestamp() + exp_in,
+            job_id: Uuid::nil().to_string(),
+            registry_config: true,
+        }
+    }
+
+    /// The registry settings are credentials, and this signature is the only thing standing
+    /// between them and any caller of `/api/debug/registry_config`. Each rejection here is a
+    /// way in if it stops being checked: an edited claim, a session whose author may not read
+    /// them, or a token replayed long after its session.
+    #[tokio::test]
+    async fn only_an_unexpired_token_with_the_claim_verifies() {
+        let token = signed(&claims(60)).await;
+        assert!(verify_debug_token(&token).await.is_ok());
+
+        let no_claim = signed(&DebugTokenClaims { registry_config: false, ..claims(60) }).await;
+        assert!(!verify_debug_token(&no_claim).await.unwrap().registry_config);
+
+        let expired = signed(&claims(-1)).await;
+        assert!(verify_debug_token(&expired).await.is_err());
+
+        // Re-signing is the only way to change a claim: swapping the payload of a valid token
+        // for one that grants itself the claim must not verify.
+        let (header, rest) = token.split_once('.').unwrap();
+        let (_, signature) = rest.split_once('.').unwrap();
+        let forged = URL_SAFE_NO_PAD.encode(
+            serde_json::to_string(&DebugTokenClaims { exp: i64::MAX, ..claims(60) }).unwrap(),
+        );
+        assert!(
+            verify_debug_token(&format!("{header}.{forged}.{signature}"))
+                .await
+                .is_err()
+        );
+    }
+
+    /// Every language the debugger can start a session for installs dependencies, so each one
+    /// has to name the settings its installer reads. A language missing here is not a refusal:
+    /// its sessions quietly install from the public registries instead.
+    #[test]
+    fn every_debuggable_language_is_served_its_own_settings() {
+        // Mirrors `isDebuggableLanguage` in frontend/src/lib/components/debug/debugUtils.ts.
+        for language in ["bun", "typescript", "deno", "nativets"] {
+            assert_eq!(registry_settings_for_language(language), (true, false));
+        }
+        assert_eq!(registry_settings_for_language("python3"), (false, true));
+        assert_eq!(registry_settings_for_language("go"), (false, false));
+    }
+
+    /// A debug session must resolve a registry setting to what a job in the same workspace
+    /// resolves it to (`read_ee_registry_with_workspace_override`): the workspace override
+    /// replaces the instance value, and a blank value from either source means unset, which
+    /// is how a workspace opts out of an instance-wide registry.
+    #[test]
+    fn workspace_override_replaces_the_instance_value() {
+        let stored = [(
+            NPM_CONFIG_REGISTRY_SETTING.to_string(),
+            serde_json::json!("https://instance.example/"),
+        )]
+        .into_iter()
+        .collect::<std::collections::HashMap<_, _>>();
+        // Never set, so the environment fallback stays out of the comparison.
+        let env_var = "WM_TEST_DEBUG_REGISTRY_UNSET";
+        let resolve = |overrides: Option<&serde_json::Value>| {
+            resolve_registry_setting(&stored, overrides, NPM_CONFIG_REGISTRY_SETTING, env_var)
+        };
+
+        assert_eq!(resolve(None).as_deref(), Some("https://instance.example/"));
+        let workspace = serde_json::json!({ "npm_config_registry": "https://workspace.example/" });
+        assert_eq!(
+            resolve(Some(&workspace)).as_deref(),
+            Some("https://workspace.example/")
+        );
+        let blanked = serde_json::json!({ "npm_config_registry": "  " });
+        assert_eq!(resolve(Some(&blanked)), None);
+        let unrelated = serde_json::json!({ "npmrc": "//other/:_authToken=x" });
+        assert_eq!(
+            resolve(Some(&unrelated)).as_deref(),
+            Some("https://instance.example/")
+        );
+    }
+}
diff --git a/backend/windmill-api-flows/Cargo.toml b/backend/windmill-api-flows/Cargo.toml
index 231c00a159..3fc2c7b572 100644
--- a/backend/windmill-api-flows/Cargo.toml
+++ b/backend/windmill-api-flows/Cargo.toml
@@ -10,8 +10,9 @@ path = "src/lib.rs"
 
 [features]
 default = []
-enterprise = ["windmill-common/enterprise"]
+enterprise = ["windmill-common/enterprise", "windmill-native-triggers?/enterprise"]
 private = ["windmill-common/private", "windmill-dep-map/private"]
+native_trigger = ["dep:windmill-native-triggers", "windmill-native-triggers/native_trigger"]
 [dependencies]
 windmill-common = { workspace = true, default-features = false }
 windmill-api-auth.workspace = true
@@ -19,6 +20,7 @@ windmill-queue.workspace = true
 windmill-audit.workspace = true
 windmill-git-sync.workspace = true
 windmill-dep-map.workspace = true
+windmill-native-triggers = { workspace = true, optional = true }
 
 axum.workspace = true
 hyper.workspace = true
diff --git a/backend/windmill-api-flows/src/flows.rs b/backend/windmill-api-flows/src/flows.rs
index ca3d65b2ce..71b98b22bd 100644
--- a/backend/windmill-api-flows/src/flows.rs
+++ b/backend/windmill-api-flows/src/flows.rs
@@ -50,6 +50,7 @@ use windmill_common::{
     flows::{EditFlow, Flow, FlowWithStarred, ListFlowQuery, ListableFlow, NewFlow},
     jobs::JobPayload,
     schedule::Schedule,
+    triggers::MovedNativeTrigger,
     utils::{http_get_from_hub, not_found_if_none, paginate, Pagination, RunnableKind, StripPath},
 };
 use windmill_dep_map::scoped_dependency_map::ScopedDependencyMap;
@@ -577,17 +578,17 @@ async fn create_flow(
 
     // Apply folder default_permissioned_as on create when the caller did not
     // explicitly preserve a value and the user can preserve.
-    let explicit_preserve = nf.on_behalf_of_email.is_some()
+    let explicit_preserve = (nf.on_behalf_of_email.is_some()
+        || nf.on_behalf_of.is_some())
         && nf.preserve_on_behalf_of.unwrap_or(false)
         && windmill_common::can_preserve_on_behalf_of(&authed);
     if !explicit_preserve && windmill_common::can_preserve_on_behalf_of(&authed) {
-        if let Some(default_email) =
-            windmill_common::folders::resolve_folder_default_on_behalf_of_email(
-                &db, &w_id, &nf.path,
-            )
-            .await?
+        if let Some((default_email, default_permissioned_as)) =
+            windmill_common::folders::resolve_folder_default_on_behalf_of(&db, &w_id, &nf.path)
+                .await?
         {
             nf.on_behalf_of_email = Some(default_email);
+            nf.on_behalf_of = Some(default_permissioned_as);
             nf.preserve_on_behalf_of = Some(true);
         }
     }
@@ -598,19 +599,35 @@ async fn create_flow(
     check_schedule_conflict(&mut tx, &w_id, &nf.path).await?;
 
     let schema_str = nf.schema.and_then(|x| serde_json::to_string(&x.0).ok());
+    let resolved_on_behalf_of =
+        windmill_common::resolve_on_behalf_of(
+            nf.on_behalf_of_email.as_deref(),
+            nf.on_behalf_of.as_deref(),
+            nf.preserve_on_behalf_of.unwrap_or(false),
+            &authed,
+            &w_id,
+            &db,
+        )
+        .await?;
+    // Written beside the principal only while a worker that still reads it may be live.
+    let legacy_on_behalf_of_email =
+        windmill_common::legacy_on_behalf_of_email(resolved_on_behalf_of.as_deref(), &w_id, &db)
+            .await?;
     sqlx::query!(
         r#"INSERT INTO flow (
         workspace_id, path, summary, description,
         dependency_job, lock_error_logs, tag,
-        dedicated_worker, visible_to_runner_only, on_behalf_of_email,
+        dedicated_worker, visible_to_runner_only,
         ws_error_handler_muted,
-        value, schema, edited_by, edited_at, labels
+        value, schema, edited_by, edited_at, labels,
+        on_behalf_of, on_behalf_of_email
     ) VALUES (
         $1, $2, $3, $4,
         NULL, '', $5,
-        $6, $7, $8,
-        $9,
-        $10, $11::text::json, $12, now(), $13
+        $6, $7,
+        $8,
+        $9, $10::text::json, $11, now(), $12,
+        $13, $14
     )"#,
         w_id,
         nf.path,
@@ -619,16 +636,13 @@ async fn create_flow(
         nf.tag,
         nf.dedicated_worker,
         nf.visible_to_runner_only.unwrap_or(false),
-        windmill_common::resolve_on_behalf_of_email(
-            nf.on_behalf_of_email.as_deref(),
-            nf.preserve_on_behalf_of.unwrap_or(false),
-            &authed,
-        ),
         nf.ws_error_handler_muted.unwrap_or(false),
         sqlx::types::Json(&nf.value) as _,
         schema_str,
         &authed.username,
         nf.labels.as_deref() as Option<&[String]>,
+        resolved_on_behalf_of,
+        legacy_on_behalf_of_email,
     )
     .execute(&mut *tx)
     .await?;
@@ -684,10 +698,10 @@ async fn create_flow(
     )
     .await?;
     if let Some(on_behalf_of) = windmill_common::check_on_behalf_of_preservation(
-        nf.on_behalf_of_email.as_deref(),
+        resolved_on_behalf_of.as_deref(),
         nf.preserve_on_behalf_of.unwrap_or(false),
         &authed,
-        &authed.email,
+        &windmill_common::users::username_to_permissioned_as(&authed.username),
     ) {
         audit_log(
             &mut *tx,
@@ -728,6 +742,7 @@ async fn create_flow(
         &authed.email,
         windmill_common::users::username_to_permissioned_as(&authed.username),
         authed.token_prefix.as_deref(),
+        authed.username_override.as_deref(),
         None,
         None,
         None,
@@ -863,8 +878,27 @@ async fn get_latest_version(
     Ok(Json(version))
 }
 
+/// `on_behalf_of_email` is derived rather than selected: the read paths fill it from the
+/// principal so clients written against the address keep working. The column itself still
+/// exists for the workers that read it — see `legacy_on_behalf_of_email`.
+async fn derived_on_behalf_of_email(
+    db: &DB,
+    w_id: &str,
+    flow: &Flow,
+) -> error::Result<Option<String>> {
+    let Some(permissioned_as) = flow.on_behalf_of.as_deref() else {
+        return Ok(None);
+    };
+    // Uncached, for the reason given on `prefetch_cached_script`: this pair is round-tripped.
+    Ok(Some(
+        windmill_common::users::get_email_from_permissioned_as_uncached(permissioned_as, w_id, db)
+            .await?,
+    ))
+}
+
 async fn get_flow_version(
     authed: ApiAuthed,
+    Extension(db): Extension<DB>,
     Extension(user_db): Extension<UserDB>,
     Path((w_id, version, path)): Path<(String, i64, StripPath)>,
 ) -> JsonResult<Flow> {
@@ -873,26 +907,28 @@ async fn get_flow_version(
     let mut tx = user_db.begin(&authed).await?;
 
     let flow = sqlx::query_as::<_, Flow>(
-        "SELECT flow.workspace_id, flow.path, flow.summary, flow.description, flow.archived, flow.extra_perms, flow.dedicated_worker, flow.tag, flow.ws_error_handler_muted, flow.timeout, flow.visible_to_runner_only, flow.on_behalf_of_email, flow.labels, flow_version.schema, flow_version.value, flow_version.created_at as edited_at, flow_version.created_by as edited_by
+        "SELECT flow.workspace_id, flow.path, flow.summary, flow.description, flow.archived, flow.extra_perms, flow.dedicated_worker, flow.tag, flow.ws_error_handler_muted, flow.timeout, flow.visible_to_runner_only, flow.on_behalf_of, flow.labels, flow_version.schema, flow_version.value, flow_version.created_at as edited_at, flow_version.created_by as edited_by
         FROM flow
         LEFT JOIN flow_version ON flow_version.path = flow.path AND flow_version.workspace_id = flow.workspace_id
         WHERE flow.path = $1 AND flow.workspace_id = $2 AND flow_version.id = $3",
     )
     .bind(path)
-    .bind(w_id)
+    .bind(&w_id)
     .bind(version)
     .fetch_optional(&mut *tx)
     .await?;
 
     tx.commit().await?;
 
-    let flow = not_found_if_none(flow, "Flow version", version.to_string())?;
+    let mut flow = not_found_if_none(flow, "Flow version", version.to_string())?;
+    flow.on_behalf_of_email = derived_on_behalf_of_email(&db, &w_id, &flow).await?;
 
     Ok(Json(flow))
 }
 
 async fn get_flow_version_by_id(
     authed: ApiAuthed,
+    Extension(db): Extension<DB>,
     Extension(user_db): Extension<UserDB>,
     Path((w_id, version)): Path<(String, i64)>,
 ) -> JsonResult<Flow> {
@@ -929,7 +965,7 @@ async fn get_flow_version_by_id(
             flow.ws_error_handler_muted,
             flow.timeout,
             flow.visible_to_runner_only,
-            flow.on_behalf_of_email,
+            flow.on_behalf_of,
             flow.labels,
             flow_version.schema,
             flow_version.value,
@@ -948,11 +984,12 @@ async fn get_flow_version_by_id(
 
     tx.commit().await?;
 
-    let flow = not_found_if_none(
+    let mut flow = not_found_if_none(
         flow,
         "Flow",
         format!("for version {} (flow may have been deleted)", version),
     )?;
+    flow.on_behalf_of_email = derived_on_behalf_of_email(&db, &w_id, &flow).await?;
 
     Ok(Json(flow))
 }
@@ -1002,6 +1039,35 @@ async fn update_flow_history(
     Ok(())
 }
 
+/// Re-point the webhooks of the native triggers a rename carried onto the new path.
+///
+/// Runs after the deploy transaction commits — repointing a webhook is not undoable — and off the
+/// request, because it waits on a third-party service that may be slow or gone, and a deploy that
+/// already committed must not look like it failed. The rename itself marked these rows
+/// `REREGISTRATION_PENDING`, so nothing is lost silently if this never finishes.
+fn reregister_moved_native_triggers(
+    db: &DB,
+    authed: &ApiAuthed,
+    w_id: &str,
+    moved: Vec<MovedNativeTrigger>,
+) {
+    if moved.is_empty() {
+        return;
+    }
+    #[cfg(feature = "native_trigger")]
+    {
+        let (db, authed, w_id) = (db.clone(), authed.clone(), w_id.to_string());
+        tokio::spawn(async move {
+            windmill_native_triggers::rename::reregister_triggers_after_rename(
+                &db, &authed, &w_id, &moved,
+            )
+            .await;
+        });
+    }
+    #[cfg(not(feature = "native_trigger"))]
+    let _ = (db, authed, w_id, moved);
+}
+
 async fn update_flow(
     authed: ApiAuthed,
     Extension(user_db): Extension<UserDB>,
@@ -1021,6 +1087,13 @@ async fn update_flow(
     // A `<= 0` flow timeout is "unset", not a 0-second limit (see create_flow).
     nf.timeout = windmill_common::runnable_settings::none_if_non_positive(nf.timeout);
     check_scopes(&authed, || format!("flows:write:{}", flow_path))?;
+    // A rename writes the destination as much as the source, so a path-scoped token needs both.
+    // Checking only the source would let it move a flow onto a path it has no say over — and
+    // everything that follows the rename, native triggers included, is then acting on a path this
+    // caller was never authorized for. `create_script` already scopes against its destination.
+    if nf.path != flow_path {
+        check_scopes(&authed, || format!("flows:write:{}", nf.path))?;
+    }
 
     if let RuleCheckResult::Blocked(msg) = check_deploy_rules(
         &w_id,
@@ -1053,6 +1126,20 @@ async fn update_flow(
     let old_dep_job = not_found_if_none(old_dep_job, "Flow", flow_path)?;
     let is_new_path = nf.path != flow_path;
     let schema_str = schema.and_then(|x| serde_json::to_string(&x).ok());
+    let resolved_on_behalf_of =
+        windmill_common::resolve_on_behalf_of(
+            nf.on_behalf_of_email.as_deref(),
+            nf.on_behalf_of.as_deref(),
+            nf.preserve_on_behalf_of.unwrap_or(false),
+            &authed,
+            &w_id,
+            &db,
+        )
+        .await?;
+    // Written beside the principal only while a worker that still reads it may be live.
+    let legacy_on_behalf_of_email =
+        windmill_common::legacy_on_behalf_of_email(resolved_on_behalf_of.as_deref(), &w_id, &db)
+            .await?;
 
     sqlx::query!(
         "
@@ -1067,26 +1154,22 @@ async fn update_flow(
             tag = $4,
             dedicated_worker = $5,
             visible_to_runner_only = $6,
-            on_behalf_of_email = $7,
-            ws_error_handler_muted = $8,
-            value = $9,
-            schema = $10::text::json,
-            edited_by = $11,
+            ws_error_handler_muted = $7,
+            value = $8,
+            schema = $9::text::json,
+            edited_by = $10,
             edited_at = now(),
-            labels = COALESCE($14, labels)
+            labels = COALESCE($13, labels),
+            on_behalf_of = $14,
+            on_behalf_of_email = $15
         WHERE
-            path = $12 AND workspace_id = $13",
+            path = $11 AND workspace_id = $12",
         if is_new_path { flow_path } else { &nf.path },
         nf.summary,
         nf.description.as_deref().unwrap_or(""),
         nf.tag,
         nf.dedicated_worker,
         nf.visible_to_runner_only.unwrap_or(false),
-        windmill_common::resolve_on_behalf_of_email(
-            nf.on_behalf_of_email.as_deref(),
-            nf.preserve_on_behalf_of.unwrap_or(false),
-            &authed,
-        ),
         nf.ws_error_handler_muted.unwrap_or(false),
         sqlx::types::Json(&nf.value) as _,
         schema_str,
@@ -1094,6 +1177,8 @@ async fn update_flow(
         flow_path,
         w_id,
         nf.labels.as_deref() as Option<&[String]>,
+        resolved_on_behalf_of,
+        legacy_on_behalf_of_email,
     )
     .execute(&mut *tx)
     .await
@@ -1105,8 +1190,8 @@ async fn update_flow(
         // if new path, must clone flow to new path and delete old flow for flow_version foreign key constraint
         sqlx::query!(
             "INSERT INTO flow
-                (workspace_id, path, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, labels)
-            SELECT workspace_id, $1, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, labels
+                (workspace_id, path, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, labels)
+            SELECT workspace_id, $1, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, labels
                 FROM flow
                 WHERE path = $2 AND workspace_id = $3",
             nf.path,
@@ -1237,8 +1322,9 @@ async fn update_flow(
         }
     }
 
+    let mut moved_native_triggers = Vec::new();
     if is_new_path {
-        windmill_common::triggers::update_triggers_script_path(
+        moved_native_triggers = windmill_common::triggers::update_triggers_script_path(
             &mut tx, &nf.path, &flow_path, &w_id, true,
         )
         .await
@@ -1280,10 +1366,10 @@ async fn update_flow(
     )
     .await?;
     if let Some(on_behalf_of) = windmill_common::check_on_behalf_of_preservation(
-        nf.on_behalf_of_email.as_deref(),
+        resolved_on_behalf_of.as_deref(),
         nf.preserve_on_behalf_of.unwrap_or(false),
         &authed,
-        &authed.email,
+        &windmill_common::users::username_to_permissioned_as(&authed.username),
     ) {
         audit_log(
             &mut *tx,
@@ -1335,6 +1421,7 @@ async fn update_flow(
         &authed.email,
         windmill_common::users::username_to_permissioned_as(&authed.username),
         authed.token_prefix.as_deref(),
+        authed.username_override.as_deref(),
         None,
         None,
         None,
@@ -1410,6 +1497,21 @@ async fn update_flow(
 
     new_tx.commit().await?;
 
+    // See `tally_rename_vacated_path`.
+    if flow_path != nf.path {
+        if let Err(e) = windmill_git_sync::tally_rename_vacated_path(
+            &db,
+            &w_id,
+            DeployedObject::Flow { path: flow_path.to_string(), parent_path: None, version },
+        )
+        .await
+        {
+            tracing::error!(%e, "error tallying the path renamed away from");
+        }
+    }
+
+    reregister_moved_native_triggers(&db, &authed, &w_id, moved_native_triggers);
+
     // Trigger CI tests for items that reference this flow
     {
         let db2 = db.clone();
@@ -1512,7 +1614,7 @@ async fn get_flow_by_path(
             flow.ws_error_handler_muted, 
             flow.timeout, 
             flow.visible_to_runner_only, 
-            flow.on_behalf_of_email,
+            flow.on_behalf_of,
             flow.labels,
             folder_labels(flow.workspace_id, flow.path) AS inherited_labels,
             flow_version.id AS version_id,
@@ -1553,7 +1655,7 @@ async fn get_flow_by_path(
             flow.ws_error_handler_muted, 
             flow.timeout, 
             flow.visible_to_runner_only, 
-            flow.on_behalf_of_email,
+            flow.on_behalf_of,
             flow.labels,
             folder_labels(flow.workspace_id, flow.path) AS inherited_labels,
             flow_version.id AS version_id,
@@ -1576,6 +1678,13 @@ async fn get_flow_by_path(
 
     tx.commit().await?;
 
+    // The primary GET is what the CLI reads before a preserving push, so it must carry the
+    // derived address: without it the push sends neither half and the identity is cleared.
+    let mut flow_o = flow_o;
+    if let Some(fws) = flow_o.as_mut() {
+        fws.flow.on_behalf_of_email = derived_on_behalf_of_email(&db, &w_id, &fws.flow).await?;
+    }
+
     // No deployed row + `get_draft`: fall back to the draft table; see scripts.rs.
     let overlay = overlay_or_draft_only(
         &db,
diff --git a/backend/windmill-api-integration-tests/tests/apps.rs b/backend/windmill-api-integration-tests/tests/apps.rs
index 3d70c09ce1..c5b18c61fd 100644
--- a/backend/windmill-api-integration-tests/tests/apps.rs
+++ b/backend/windmill-api-integration-tests/tests/apps.rs
@@ -335,3 +335,192 @@ async fn test_public_app_by_custom_path(db: Pool<Postgres>) -> anyhow::Result<()
 
     Ok(())
 }
+
+/// A raw app's kind lives on its version row, so a value deployed through the
+/// low-code endpoint used to convert the app in place and strand its bundle.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_raw_app_kind_is_not_flipped_by_update(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base = format!("http://localhost:{port}/api/w/test-workspace/apps");
+    let raw_path = "u/test-user/raw_app";
+    let low_code_path = "u/test-user/low_code_app";
+
+    let raw_app_form = |path: &str| {
+        reqwest::multipart::Form::new()
+            .text(
+                "app",
+                json!({
+                    "path": path,
+                    "summary": "Raw app",
+                    "value": { "files": { "index.ts": "export {}" }, "runnables": {} },
+                    "policy": { "execution_mode": "publisher", "triggerables_v2": {} }
+                })
+                .to_string(),
+            )
+            .part(
+                "js",
+                reqwest::multipart::Part::bytes(b"console.log(1)".to_vec()),
+            )
+    };
+
+    let resp = authed(client().post(format!("{base}/create_raw")))
+        .multipart(raw_app_form(raw_path))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 201, "create_raw: {}", resp.text().await?);
+
+    let resp = authed(client().post(format!("{base}/create")))
+        .json(&new_app(low_code_path, "Low code app"))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 201, "create: {}", resp.text().await?);
+
+    let versions_of = |path: &'static str| async move {
+        let resp = authed_get(port, "get/p", path).await;
+        let body = resp.json::<serde_json::Value>().await.unwrap();
+        body["versions"].as_array().unwrap().len()
+    };
+    let raw_versions = versions_of(raw_path).await;
+
+    // Neither endpoint may deploy a value onto an app of the other kind.
+    let resp = authed(client().post(format!("{base}/update/{raw_path}")))
+        .json(&json!({ "value": { "grid": [] } }))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 400);
+    assert!(
+        resp.text().await?.contains("is a raw app"),
+        "expected the low-code update of a raw app to be refused"
+    );
+    // The refusal has to land before the version insert, not roll one back.
+    assert_eq!(versions_of(raw_path).await, raw_versions);
+
+    let resp = authed(client().post(format!("{base}/update_raw/{low_code_path}")))
+        .multipart(raw_app_form(low_code_path))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 400);
+    assert!(
+        resp.text().await?.contains("is a low-code app"),
+        "expected the raw update of a low-code app to be refused"
+    );
+
+    // Nor may the source endpoints compile a value that isn't a raw app's: both
+    // refuse up front, without queueing a bundle job no worker would pick up here.
+    let resp = authed(client().post(format!("{base}/create_raw_source")))
+        .json(&json!({
+            "path": "u/test-user/from_source",
+            "summary": "",
+            "value": { "grid": [] },
+            "policy": { "execution_mode": "publisher" }
+        }))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 400);
+    assert!(
+        resp.text().await?.contains("no `files` to bundle"),
+        "expected a low-code value to be refused before bundling"
+    );
+
+    // The source endpoint refuses the same mismatch up front — it must not queue
+    // a bundle job (which no worker would pick up here) to find that out.
+    let resp = authed(client().post(format!("{base}/update_raw_source/{low_code_path}")))
+        .json(&json!({ "value": { "files": { "/index.tsx": "export {}" } } }))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 400);
+    assert!(
+        resp.text().await?.contains("is a low-code app"),
+        "expected the source deploy of a low-code app to be refused"
+    );
+
+    // Metadata-only updates and same-kind deploys still go through.
+    let resp = authed(client().post(format!("{base}/update/{raw_path}")))
+        .json(&json!({ "summary": "Renamed" }))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200, "update summary: {}", resp.text().await?);
+
+    let resp = authed(client().post(format!("{base}/update_raw/{raw_path}")))
+        .multipart(raw_app_form(raw_path))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200, "update_raw: {}", resp.text().await?);
+
+    let resp = authed_get(port, "get/p", raw_path).await;
+    assert_eq!(resp.json::<serde_json::Value>().await?["raw_app"], true);
+
+    // A caller that means to convert says so, which is how an app converted by
+    // accident gets restored to what it was.
+    let resp = authed(client().post(format!("{base}/update/{raw_path}")))
+        .json(&json!({ "value": { "grid": [] }, "allow_kind_change": true }))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200, "update: {}", resp.text().await?);
+
+    let resp = authed_get(port, "get/p", raw_path).await;
+    assert_eq!(resp.json::<serde_json::Value>().await?["raw_app"], false);
+
+    Ok(())
+}
+
+/// Who may create at a path is the app table's answer, not a rule restated in the
+/// handler: a non-admin member of `g/<group>` writes there, and nowhere a
+/// non-member does. Both are decided before the sources are compiled, so an empty
+/// `files` is enough to say which side of that check the request reached.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_create_raw_source_write_check_follows_app_rls(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    sqlx::query(
+        "INSERT INTO usr_to_group (workspace_id, usr, group_) VALUES
+         ('test-workspace', 'test-user-2', 'all')",
+    )
+    .execute(&db)
+    .await?;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base = format!("http://localhost:{port}/api/w/test-workspace/apps");
+    let create_as_member = |path: &'static str| {
+        client()
+            .post(format!("{base}/create_raw_source"))
+            .header("Authorization", "Bearer SECRET_TOKEN_2")
+            .json(&json!({
+                "path": path,
+                "summary": "",
+                "value": { "files": {} },
+                "policy": { "execution_mode": "publisher" }
+            }))
+            .send()
+    };
+
+    let resp = create_as_member("g/all/from_source").await.unwrap();
+    assert_eq!(
+        resp.status(),
+        400,
+        "a group member must reach the compile: {}",
+        resp.text().await?
+    );
+
+    let resp = create_as_member("u/test-user/from_source").await.unwrap();
+    assert_eq!(
+        resp.status(),
+        403,
+        "expected another user's path to be refused"
+    );
+
+    Ok(())
+}
diff --git a/backend/windmill-api-integration-tests/tests/audit.rs b/backend/windmill-api-integration-tests/tests/audit.rs
index 31994d8165..81c3ae70be 100644
--- a/backend/windmill-api-integration-tests/tests/audit.rs
+++ b/backend/windmill-api-integration-tests/tests/audit.rs
@@ -33,3 +33,105 @@ async fn test_audit_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
 
     Ok(())
 }
+
+/// A run fired by a labeled token must be findable both by the token that fired it and by the
+/// caller who fired it. `push` builds its own audit author from `(user, permissioned_as)` rather
+/// than from the `ApiAuthed`, so the label only reaches the row through the explicit end-user
+/// argument; and when the runnable declares `on_behalf_of`, the run-as identity takes `username`,
+/// so the caller only stays searchable through the `created_by` parameter.
+///
+/// EE-only: the OSS `audit_log` writes nothing, and a lesser plan redacts the `parameters` this
+/// matches on.
+#[cfg(all(feature = "enterprise", feature = "private"))]
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_job_run_is_searchable_by_token_and_by_caller(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    use serde_json::json;
+
+    initialize_tracing().await;
+
+    // The recorded identity makes a run against this take `u/test-user-2` as its
+    // permissioned_as, so the audit `username` slot goes to it rather than to the caller.
+    sqlx::query(
+        "INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by,
+             on_behalf_of, schema, summary, description, lock, extra_perms)
+         VALUES ('test-workspace', 900101, 'u/test-user-2/onbehalf', 'export function main() {}',
+             'deno', 'script', 'test-user-2', 'u/test-user-2', '{}', '', '', '', '{\"g/all\": true}')",
+    )
+    .execute(&db)
+    .await?;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    let resp = authed(client().post(format!("http://localhost:{port}/api/users/tokens/create")))
+        .json(&json!({ "label": "audit-probe" }))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 201);
+    let token = resp.text().await?;
+    let bearer = |b: reqwest::RequestBuilder| b.header("Authorization", format!("Bearer {token}"));
+
+    let resp = bearer(client().post(format!(
+        "http://localhost:{port}/api/w/test-workspace/jobs/run/preview"
+    )))
+    .json(&json!({
+        "content": "export function main() { return 1; }",
+        "language": "deno",
+        "args": {}
+    }))
+    .send()
+    .await?;
+    assert_2xx(
+        resp.status().as_u16(),
+        &resp.text().await?,
+        "POST /jobs/run/preview",
+    );
+
+    let resp = bearer(client().post(format!(
+        "http://localhost:{port}/api/w/test-workspace/jobs/run/p/u/test-user-2/onbehalf"
+    )))
+    .json(&json!({}))
+    .send()
+    .await?;
+    assert_2xx(
+        resp.status().as_u16(),
+        &resp.text().await?,
+        "POST /jobs/run/p/u/test-user-2/onbehalf",
+    );
+
+    let search = |q: &str| {
+        let url = format!("http://localhost:{port}/api/w/test-workspace/audit/list?username={q}");
+        async move {
+            let resp = authed(client().get(url)).send().await.unwrap();
+            assert_eq!(resp.status(), 200);
+            resp.json::<Vec<serde_json::Value>>().await.unwrap()
+        }
+    };
+
+    let by_token = search("label-audit-probe").await;
+    assert!(
+        by_token
+            .iter()
+            .any(|l| l["operation"] == "jobs.run.preview"),
+        "the run must be searchable by token label, got {by_token:?}"
+    );
+    assert!(
+        by_token
+            .iter()
+            .any(|l| l["operation"] == "jobs.run.script" && l["username"] == "test-user-2"),
+        "the on-behalf run must be searchable by token label, got {by_token:?}"
+    );
+
+    // `username` is `test-user-2` on that row, so this can only match through `created_by`.
+    let by_caller = search("test-user").await;
+    assert!(
+        by_caller
+            .iter()
+            .any(|l| l["operation"] == "jobs.run.script" && l["username"] == "test-user-2"),
+        "the on-behalf run must stay searchable by the caller who fired it, got {by_caller:?}"
+    );
+
+    Ok(())
+}
diff --git a/backend/windmill-api-integration-tests/tests/fixtures/nested_dev_workspace.sql b/backend/windmill-api-integration-tests/tests/fixtures/nested_dev_workspace.sql
new file mode 100644
index 0000000000..76f266bb0f
--- /dev/null
+++ b/backend/windmill-api-integration-tests/tests/fixtures/nested_dev_workspace.sql
@@ -0,0 +1,76 @@
+-- Seven families for the nested dev-workspace (dev of a dev) guards.
+--
+-- Family A is rooted at `test-workspace` (base fixture) and is the one a nested dev is attached to:
+--   test-workspace -> tw-dev ('dev')
+-- plus two standalone attach candidates, one of which already owns a 'dev'-labelled dev workspace.
+--
+-- Family B carries a `wm-fork-` workspace re-designated as a dev workspace, which is the shape that
+-- returns to being a throwaway fork on detach:
+--   prod-b -> wm-fork-redev ('dev') -> redev-dev ('staging')
+--
+-- Family C is the ordinary prefix-less nesting. Detaching its middle workspace is fine (it returns
+-- to standalone and goes on hosting `c-dev-dev`), but archiving it is not:
+--   prod-c -> c-dev ('dev') -> c-dev-dev ('staging')
+--
+-- Family E has no nested dev yet, so both "give `wm-fork-edev` a dev" and "detach `wm-fork-edev`"
+-- pass their own checks — the pair that must not both commit:
+--   prod-e -> wm-fork-edev ('dev'), plus the standalone candidate `e-cand`
+--
+-- Family F is three standalone workspaces, so "attach f-mid under prod-f" and "attach f-leaf under
+-- f-mid" both pass on their own — adjacent attaches whose labels only collide once both land:
+--   prod-f, f-mid, f-leaf
+--
+-- Family G already nests, so two attaches at opposite ends of it touch no workspace in common —
+-- their labels only collide once both land, three dev workspaces deep:
+--   prod-g (root), g-mid -> g-sub ('dev'), and the standalone `g-leaf`
+--
+-- Family H is a standalone that already owns a dev: archiving it resolves as "no pairing involved"
+-- while still being an operation the pairing lock has to cover:
+--   h-cand -> h-sub ('dev')
+
+
+INSERT INTO workspace (id, name, owner, parent_workspace_id, is_dev_workspace, dev_workspace_label) VALUES
+	('tw-dev', 'dev of test-workspace', 'test@windmill.dev', 'test-workspace', true, 'dev'),
+	('standalone', 'standalone', 'test@windmill.dev', NULL, false, NULL),
+	('standalone-dev', 'dev of standalone', 'test@windmill.dev', 'standalone', true, 'dev'),
+	('spare', 'spare standalone', 'test@windmill.dev', NULL, false, NULL),
+	('prod-b', 'prod b', 'test@windmill.dev', NULL, false, NULL),
+	('wm-fork-redev', 'redesignated fork', 'test@windmill.dev', 'prod-b', true, 'dev'),
+	('redev-dev', 'dev of the redesignated fork', 'test@windmill.dev', 'wm-fork-redev', true, 'staging'),
+	('prod-c', 'prod c', 'test@windmill.dev', NULL, false, NULL),
+	('c-dev', 'dev of prod-c', 'test@windmill.dev', 'prod-c', true, 'dev'),
+	('c-dev-dev', 'dev of c-dev', 'test@windmill.dev', 'c-dev', true, 'staging'),
+	('prod-e', 'prod e', 'test@windmill.dev', NULL, false, NULL),
+	('wm-fork-edev', 'redesignated fork with no dev yet', 'test@windmill.dev', 'prod-e', true, 'dev'),
+	('e-cand', 'attach candidate', 'test@windmill.dev', NULL, false, NULL),
+	('prod-f', 'prod f', 'test@windmill.dev', NULL, false, NULL),
+	('f-mid', 'middle attach candidate', 'test@windmill.dev', NULL, false, NULL),
+	('f-leaf', 'leaf attach candidate', 'test@windmill.dev', NULL, false, NULL),
+	('prod-g', 'prod g', 'test@windmill.dev', NULL, false, NULL),
+	('g-mid', 'standalone with a dev of its own', 'test@windmill.dev', NULL, false, NULL),
+	('g-sub', 'dev of g-mid', 'test@windmill.dev', 'g-mid', true, 'dev'),
+	('g-leaf', 'leaf attach candidate', 'test@windmill.dev', NULL, false, NULL),
+	('h-cand', 'standalone owning a dev', 'test@windmill.dev', NULL, false, NULL),
+	('h-sub', 'dev of h-cand', 'test@windmill.dev', 'h-cand', true, 'dev');
+
+CREATE TEMP VIEW new_workspaces AS SELECT unnest(ARRAY[
+	'tw-dev', 'standalone', 'standalone-dev', 'spare', 'prod-b', 'wm-fork-redev', 'redev-dev',
+	'prod-c', 'c-dev', 'c-dev-dev', 'prod-e', 'wm-fork-edev', 'e-cand',
+	'prod-f', 'f-mid', 'f-leaf', 'prod-g', 'g-mid', 'g-sub', 'g-leaf',
+	'h-cand', 'h-sub'
+]) AS id;
+
+INSERT INTO workspace_settings (workspace_id)
+	SELECT id FROM new_workspaces;
+
+INSERT INTO workspace_key (workspace_id, kind, key)
+	SELECT id, 'cloud', 'test-key' FROM new_workspaces;
+
+INSERT INTO group_ (workspace_id, name, summary, extra_perms)
+	SELECT id, 'all', 'All users', '{}' FROM new_workspaces;
+
+INSERT INTO usr (workspace_id, email, username, is_admin, role)
+	SELECT id, 'test@windmill.dev', 'test-user', true, 'Admin'
+	FROM new_workspaces;
+
+DROP VIEW new_workspaces;
diff --git a/backend/windmill-api-integration-tests/tests/fork_clone_on_behalf_of.rs b/backend/windmill-api-integration-tests/tests/fork_clone_on_behalf_of.rs
new file mode 100644
index 0000000000..93c9f5adaf
--- /dev/null
+++ b/backend/windmill-api-integration-tests/tests/fork_clone_on_behalf_of.rs
@@ -0,0 +1,118 @@
+use serde_json::json;
+use sqlx::{Pool, Postgres};
+
+use windmill_test_utils::*;
+
+/// A principal only means something in the workspace whose `usr`/`group_` rows define it, and a
+/// fork copies the creator and the groups but not the rest of the membership. Carrying one over
+/// blindly would leave a runnable naming somebody who cannot authenticate there; dropping them
+/// all would silently hand every configured runnable in the fork to whoever runs it.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_fork_keeps_only_resolvable_on_behalf_of(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base_url = format!("http://localhost:{port}/api");
+
+    // A superadmin with no `usr` row anywhere: they authenticate from `password` alone, so
+    // their principal resolves in the fork as much as it did in the parent.
+    sqlx::query!(
+        "INSERT INTO password(email, password_hash, login_type, super_admin, verified, name, username)
+         VALUES ('sa@windmill.dev', 'not-a-real-hash', 'password', true, true, 'Ext', 'ext-sa')"
+    )
+    .execute(&db)
+    .await?;
+
+    sqlx::query!(
+        "INSERT INTO script (workspace_id, path, hash, content, summary, description, language, created_by, created_at, on_behalf_of, on_behalf_of_email)
+         VALUES
+         ('test-workspace', 'u/test-user/obo_member', 91001, 'def main(): pass', '', '', 'python3', 'test-user', NOW(), 'u/test-user', 'test@windmill.dev'),
+         ('test-workspace', 'u/test-user/obo_stranger', 91002, 'def main(): pass', '', '', 'python3', 'test-user', NOW(), 'u/test-user-2', 'test2@windmill.dev'),
+         ('test-workspace', 'u/test-user/obo_group', 91003, 'def main(): pass', '', '', 'python3', 'test-user', NOW(), 'g/all', 'group-all@windmill.dev'),
+         ('test-workspace', 'u/test-user/obo_superadmin', 91004, 'def main(): pass', '', '', 'python3', 'test-user', NOW(), 'u/ext-sa', 'sa@windmill.dev'),
+         ('test-workspace', 'u/test-user/obo_address_only', 91005, 'def main(): pass', '', '', 'python3', 'test-user', NOW(), NULL, 'test2@windmill.dev')"
+    )
+    .execute(&db)
+    .await?;
+
+    sqlx::query!(
+        "INSERT INTO flow (workspace_id, path, summary, description, value, edited_by, edited_at, on_behalf_of, on_behalf_of_email)
+         VALUES ('test-workspace', 'u/test-user/obo_flow', '', '', $1, 'test-user', NOW(), 'u/test-user-2', 'test2@windmill.dev')",
+        json!({"modules": []})
+    )
+    .execute(&db)
+    .await?;
+
+    let resp = reqwest::Client::new()
+        .post(format!(
+            "{base_url}/w/test-workspace/workspaces/create_fork"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&json!({ "id": "wm-fork-obo", "name": "Fork", "color": "#0000ff" }))
+        .send()
+        .await?;
+    assert!(
+        resp.status().is_success(),
+        "creating the fork: {}",
+        resp.text().await?
+    );
+
+    let cloned = sqlx::query!(
+        "SELECT path, on_behalf_of, on_behalf_of_email FROM script WHERE workspace_id = 'wm-fork-obo' ORDER BY path"
+    )
+    .fetch_all(&db)
+    .await?;
+    let identity = |path: &str| {
+        cloned
+            .iter()
+            .find(|r| r.path == path)
+            .unwrap_or_else(|| panic!("{path} was cloned"))
+            .on_behalf_of
+            .clone()
+    };
+
+    // The creator is the one member the fork always gets, so their principal still resolves.
+    assert_eq!(
+        identity("u/test-user/obo_member").as_deref(),
+        Some("u/test-user")
+    );
+    // Groups are cloned wholesale, so a group principal resolves too.
+    assert_eq!(identity("u/test-user/obo_group").as_deref(), Some("g/all"));
+    assert_eq!(
+        identity("u/test-user/obo_superadmin").as_deref(),
+        Some("u/ext-sa")
+    );
+    // `test-user-2` is not carried into the fork, so nothing there can run as them — and the
+    // address has to go with the principal, or a worker that reads only the address still would.
+    assert_eq!(identity("u/test-user/obo_stranger"), None);
+    // A row a server predating this release wrote carries the address alone; the clone must not
+    // mistake it for one it orphaned, because that address is all a later re-derivation has.
+    assert_eq!(
+        cloned
+            .iter()
+            .find(|r| r.path == "u/test-user/obo_address_only")
+            .and_then(|r| r.on_behalf_of_email.as_deref()),
+        Some("test2@windmill.dev"),
+    );
+
+    let orphaned = cloned
+        .iter()
+        .filter(|r| {
+            r.on_behalf_of.is_none()
+                && r.on_behalf_of_email.is_some()
+                && r.path != "u/test-user/obo_address_only"
+        })
+        .count();
+    assert_eq!(orphaned, 0, "a dropped principal leaves no address behind");
+    assert_eq!(
+        sqlx::query_scalar!(
+            "SELECT on_behalf_of FROM flow WHERE workspace_id = 'wm-fork-obo'"
+        )
+        .fetch_one(&db)
+        .await?,
+        None
+    );
+
+    Ok(())
+}
diff --git a/backend/windmill-api-integration-tests/tests/mcp_protocol_versions.rs b/backend/windmill-api-integration-tests/tests/mcp_protocol_versions.rs
new file mode 100644
index 0000000000..e684e3ee14
--- /dev/null
+++ b/backend/windmill-api-integration-tests/tests/mcp_protocol_versions.rs
@@ -0,0 +1,221 @@
+//! Protocol-version negotiation for the MCP endpoint.
+//!
+//! The endpoint is dual-era: legacy revisions keep the `initialize` handshake,
+//! while `2026-07-28` carries its version as per-request metadata and is served
+//! statelessly. Both are answered on the same URL, so a bump of the rmcp SDK
+//! must not silently drop either side.
+#![cfg(feature = "mcp")]
+
+use serde_json::{json, Value};
+use sqlx::{Pool, Postgres};
+
+use windmill_test_utils::*;
+
+/// Every revision the server advertises, oldest first.
+const SUPPORTED: [&str; 5] = [
+    "2024-11-05",
+    "2025-03-26",
+    "2025-06-18",
+    "2025-11-25",
+    "2026-07-28",
+];
+
+const MODERN: &str = "2026-07-28";
+
+async fn insert_mcp_token(db: &Pool<Postgres>) -> anyhow::Result<()> {
+    sqlx::query(
+        "INSERT INTO token (token_hash, token_prefix, token, email, label, super_admin, scopes)
+         VALUES (encode(sha256('MCP_TOKEN'::bytea), 'hex'), 'MCP_TOK', 'MCP_TOKEN', 'test@windmill.dev', 'mcp token', true, ARRAY['mcp:all'])",
+    )
+    .execute(db)
+    .await?;
+    Ok(())
+}
+
+/// POST one JSON-RPC message and return the HTTP status plus the decoded body.
+/// The endpoint answers either `application/json` or a single-event SSE stream,
+/// so strip the `data: ` framing before parsing.
+async fn post(
+    port: u16,
+    headers: &[(&str, &str)],
+    body: Value,
+) -> anyhow::Result<(reqwest::StatusCode, Value)> {
+    let mut req = reqwest::Client::new()
+        .post(format!(
+            "http://localhost:{port}/api/mcp/w/test-workspace/mcp"
+        ))
+        .header("Authorization", "Bearer MCP_TOKEN")
+        .header("Accept", "application/json, text/event-stream")
+        .json(&body);
+    for (k, v) in headers {
+        req = req.header(*k, *v);
+    }
+    let resp = req.send().await?;
+    let status = resp.status();
+    let text = resp.text().await?;
+    let payload = text
+        .lines()
+        .find_map(|l| l.strip_prefix("data: "))
+        .unwrap_or(text.trim());
+    let parsed = serde_json::from_str(payload)
+        .map_err(|e| anyhow::anyhow!("status {status}, unparseable body {text:?}: {e}"))?;
+    Ok((status, parsed))
+}
+
+fn modern_meta() -> Value {
+    json!({
+        "io.modelcontextprotocol/protocolVersion": MODERN,
+        "io.modelcontextprotocol/clientInfo": { "name": "test-client", "version": "0.0.1" },
+        "io.modelcontextprotocol/clientCapabilities": {},
+    })
+}
+
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_mcp_legacy_initialize_negotiates_requested_version(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    set_jwt_secret().await;
+    insert_mcp_token(&db).await?;
+    let server = ApiServer::start_mcp(db.clone()).await?;
+    let port = server.addr.port();
+
+    // A legacy client must be answered with the revision it asked for, not with
+    // whatever the SDK happens to call `LATEST`.
+    for version in SUPPORTED.iter().filter(|v| **v != MODERN) {
+        let (status, body) = post(
+            port,
+            &[("MCP-Protocol-Version", version)],
+            json!({
+                "jsonrpc": "2.0", "id": 1, "method": "initialize",
+                "params": {
+                    "protocolVersion": version,
+                    "capabilities": {},
+                    "clientInfo": { "name": "test-client", "version": "0.0.1" },
+                }
+            }),
+        )
+        .await?;
+
+        assert_eq!(status, 200, "initialize {version} failed: {body}");
+        assert_eq!(
+            body["result"]["protocolVersion"], *version,
+            "initialize {version} negotiated the wrong revision: {body}"
+        );
+        // `Implementation::from_build_env()` expands its `env!` inside rmcp, so
+        // the obvious constructor makes the server introduce itself as the SDK.
+        assert_eq!(
+            body["result"]["serverInfo"]["name"], "windmill",
+            "server must identify itself, not the SDK: {body}"
+        );
+    }
+
+    Ok(())
+}
+
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_mcp_modern_requests_are_served_without_initialize(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    set_jwt_secret().await;
+    insert_mcp_token(&db).await?;
+    let server = ApiServer::start_mcp(db.clone()).await?;
+    let port = server.addr.port();
+
+    // `server/discover` is the modern replacement for the handshake: it must
+    // exist and advertise exactly the revisions the server implements.
+    let (status, body) = post(
+        port,
+        &[
+            ("MCP-Protocol-Version", MODERN),
+            ("Mcp-Method", "server/discover"),
+        ],
+        json!({
+            "jsonrpc": "2.0", "id": 1, "method": "server/discover",
+            "params": { "_meta": modern_meta() }
+        }),
+    )
+    .await?;
+    assert_eq!(status, 200, "server/discover failed: {body}");
+    assert_eq!(
+        body["result"]["supportedVersions"],
+        json!(SUPPORTED),
+        "server/discover advertised the wrong revisions: {body}"
+    );
+
+    // A modern call carries its version in `_meta` and needs no prior session.
+    let (status, body) = post(
+        port,
+        &[
+            ("MCP-Protocol-Version", MODERN),
+            ("Mcp-Method", "tools/list"),
+        ],
+        json!({
+            "jsonrpc": "2.0", "id": 2, "method": "tools/list",
+            "params": { "_meta": modern_meta() }
+        }),
+    )
+    .await?;
+    assert_eq!(status, 200, "modern tools/list failed: {body}");
+    assert!(
+        body["result"]["tools"]
+            .as_array()
+            .is_some_and(|t| !t.is_empty()),
+        "modern tools/list returned no tools: {body}"
+    );
+
+    // SEP-2549 cache hints are required at 2026-07-28 and rmcp omits them unless
+    // set, which makes strict clients (e.g. the Python SDK) reject the whole
+    // response rather than degrade.
+    assert!(
+        body["result"]["ttlMs"].is_number(),
+        "modern tools/list is missing ttlMs: {body}"
+    );
+    assert_eq!(
+        body["result"]["cacheScope"], "private",
+        "tools/list must not be cached across callers: {body}"
+    );
+
+    Ok(())
+}
+
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_mcp_unsupported_version_lists_supported_ones(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    set_jwt_secret().await;
+    insert_mcp_token(&db).await?;
+    let server = ApiServer::start_mcp(db.clone()).await?;
+    let port = server.addr.port();
+
+    // The client's only way forward is the `supported` list, so an unknown
+    // version must fail with it rather than with a generic error.
+    let (status, body) = post(
+        port,
+        &[
+            ("MCP-Protocol-Version", "1900-01-01"),
+            ("Mcp-Method", "tools/list"),
+        ],
+        json!({
+            "jsonrpc": "2.0", "id": 1, "method": "tools/list",
+            "params": { "_meta": {
+                "io.modelcontextprotocol/protocolVersion": "1900-01-01",
+                "io.modelcontextprotocol/clientInfo": { "name": "test-client", "version": "0.0.1" },
+                "io.modelcontextprotocol/clientCapabilities": {},
+            }}
+        }),
+    )
+    .await?;
+
+    assert_eq!(status, 400, "expected 400 for unknown version: {body}");
+    assert_eq!(body["error"]["code"], -32022, "wrong error code: {body}");
+    assert_eq!(
+        body["error"]["data"]["supported"],
+        json!(SUPPORTED),
+        "error did not advertise the supported revisions: {body}"
+    );
+
+    Ok(())
+}
diff --git a/backend/windmill-api-integration-tests/tests/native_triggers.rs b/backend/windmill-api-integration-tests/tests/native_triggers.rs
index 1d809ae526..c86ba3154f 100644
--- a/backend/windmill-api-integration-tests/tests/native_triggers.rs
+++ b/backend/windmill-api-integration-tests/tests/native_triggers.rs
@@ -11,13 +11,21 @@
 use serde_json::json;
 use sqlx::{Pool, Postgres};
 
+use axum::http::StatusCode;
 use windmill_api_auth::ApiAuthed;
-use windmill_common::variables::{build_crypt, encrypt};
+use windmill_common::{
+    error::Error,
+    variables::{build_crypt, encrypt},
+};
 use windmill_native_triggers::{
-    decrypt_oauth_data, delete_native_trigger, delete_workspace_integration,
-    get_workspace_integration,
+    classify_read_failure, decrypt_oauth_data, delete_native_trigger,
+    delete_workspace_integration, get_workspace_integration,
+    github::GitHub,
     google::{parse_stop_channel_params, should_renew_channel},
-    require_native_integration_use, store_native_trigger, store_workspace_integration,
+    http_error_status, list_native_triggers, map_external_error,
+    nextcloud::NextCloud,
+    grant_refused, require_native_integration_use, store_native_trigger,
+    store_workspace_integration, External, ExternalReadFailure, HttpRequestError,
     NativeTriggerConfig, OAuthConfig, ServiceName,
 };
 
@@ -50,6 +58,8 @@ fn test_authed() -> ApiAuthed {
         folders: vec![],
         scopes: None,
         username_override: None,
+        username_override_is_token_label: false,
+        is_session_token: false,
         token_prefix: None,
         read_only: false,
     }
@@ -569,6 +579,92 @@ async fn test_cleanup_preserves_triggers(db: Pool<Postgres>) -> anyhow::Result<(
     Ok(())
 }
 
+// ============================================================================
+// 5. Runnable rename
+// ============================================================================
+
+/// A rename has to carry the trigger row onto the new path and report it as moved: listings only
+/// return rows whose runnable still exists, so one left behind on the old path disappears from the
+/// UI for good, and one not reported keeps a webhook aimed at the old path.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_rename_moves_native_trigger(db: Pool<Postgres>) -> anyhow::Result<()> {
+    insert_test_script(&db, "f/test/before").await?;
+    store_native_trigger(
+        &db,
+        "test-workspace",
+        ServiceName::Nextcloud,
+        "ext-1",
+        &NativeTriggerConfig {
+            script_path: "f/test/before".to_string(),
+            is_flow: false,
+            webhook_token: "abcdefghij1234567890".to_string(),
+        },
+        json!({"event": "OCP\\Files\\Events\\Node\\NodeCreatedEvent"}),
+        None,
+    )
+    .await?;
+    // An unrelated trigger already sitting on the target path must not be reported as moved.
+    insert_test_script(&db, "f/test/after").await?;
+    store_native_trigger(
+        &db,
+        "test-workspace",
+        ServiceName::Nextcloud,
+        "ext-2",
+        &NativeTriggerConfig {
+            script_path: "f/test/after".to_string(),
+            is_flow: false,
+            webhook_token: "0987654321jihgfedcba".to_string(),
+        },
+        json!({"event": "OCP\\Files\\Events\\Node\\NodeCreatedEvent"}),
+        None,
+    )
+    .await?;
+
+    let mut tx = db.begin().await?;
+    sqlx::query!(
+        "UPDATE script SET path = $1 WHERE workspace_id = 'test-workspace' AND path = $2",
+        "f/test/after",
+        "f/test/before",
+    )
+    .execute(&mut *tx)
+    .await?;
+    let moved = windmill_common::triggers::update_triggers_script_path(
+        &mut tx,
+        "f/test/after",
+        "f/test/before",
+        "test-workspace",
+        false,
+    )
+    .await?;
+    tx.commit().await?;
+
+    assert_eq!(
+        moved
+            .iter()
+            .map(|t| (t.service_name.as_str(), t.external_id.as_str()))
+            .collect::<Vec<_>>(),
+        vec![("nextcloud", "ext-1")]
+    );
+
+    let triggers = list_native_triggers(
+        &db,
+        "test-workspace",
+        ServiceName::Nextcloud,
+        None,
+        None,
+        Some("f/test/after"),
+        Some(false),
+    )
+    .await?;
+    assert_eq!(
+        triggers.len(),
+        2,
+        "the moved trigger should be listed under the new path"
+    );
+
+    Ok(())
+}
+
 // --- parse_stop_channel_params ---
 
 #[test]
@@ -622,3 +718,133 @@ fn test_parse_stop_channel_params_missing_resource_id() {
     assert!(channel_id.is_none());
     assert_eq!(resource_id, "");
 }
+
+// --- provider error reporting ---
+
+fn nextcloud_error(status: StatusCode, body: &str) -> Error {
+    NextCloud.external_api_error(HttpRequestError::ApiError { status, body: body.to_string() })
+}
+
+/// A rejection has to reach the user as the service's own sentence plus what to do about it,
+/// never as an internal error carrying the raw envelope.
+#[test]
+fn test_provider_rejection_is_readable_and_not_internal() {
+    let err = nextcloud_error(
+        StatusCode::FORBIDDEN,
+        r#"{"ocs":{"meta":{"status":"failure","statuscode":403,"message":"Logged in account must be an admin, a sub admin or gotten special right to access this setting"},"data":[]}}"#,
+    );
+
+    let message = map_external_error(err).to_string();
+    assert!(
+        message.contains("Logged in account must be an admin"),
+        "message={message}"
+    );
+    assert!(
+        !message.contains("\"ocs\""),
+        "the envelope should not reach the user: {message}"
+    );
+    assert!(
+        message.contains("Workspace settings > Integrations"),
+        "the hint should say what to do: {message}"
+    );
+}
+
+/// Both the "trigger is gone on the service" path and the delete that tolerates an
+/// already-removed webhook branch on this status.
+#[test]
+fn test_provider_404_is_recognized() {
+    let err = nextcloud_error(StatusCode::NOT_FOUND, "{}");
+    assert_eq!(http_error_status(&err), Some(StatusCode::NOT_FOUND));
+    assert!(
+        matches!(map_external_error(err), Error::NotFound(_)),
+        "a missing external trigger must map to NotFound"
+    );
+    assert!(matches!(
+        classify_read_failure(nextcloud_error(StatusCode::NOT_FOUND, "{}")),
+        ExternalReadFailure::Missing
+    ));
+}
+
+/// Sending a user to reconnect their integration is only right when the token endpoint refused
+/// the grant; a busy or broken endpoint has them fix credentials that are fine.
+#[test]
+fn test_refresh_failures_blame_only_the_grant_they_refuse() {
+    let refused = |code: u16| grant_refused(Some(StatusCode::from_u16(code).unwrap()), "");
+    for code in [400, 401, 403] {
+        assert!(refused(code), "{code} refuses the grant");
+    }
+    for code in [404, 408, 429, 500, 503] {
+        assert!(!refused(code), "{code} says nothing about the grant");
+    }
+    assert!(!grant_refused(None, ""));
+
+    // GitHub answers `bad_refresh_token` with HTTP 200, so the body is the only tell.
+    let ok = Some(StatusCode::OK);
+    assert!(grant_refused(ok, r#"{"error":"bad_refresh_token"}"#));
+    assert!(grant_refused(ok, r#"{"error":"invalid_grant"}"#));
+    assert!(!grant_refused(ok, r#"{"access_token":"t","token_type":"bearer"}"#));
+}
+
+/// A service that is busy or broken has not refused anything, and callers react differently to
+/// the two. GitHub and Google spend a 403 on throttling, where advice about permissions sends
+/// the reader after a problem they do not have.
+#[test]
+fn test_transient_service_failures_are_not_refusals() {
+    for transient in [408, 429, 503] {
+        let err = nextcloud_error(StatusCode::from_u16(transient).unwrap(), "{}");
+        assert!(
+            matches!(map_external_error(err), Error::BadGateway(_)),
+            "{transient} should read as the service failing to serve, not refusing"
+        );
+    }
+
+    // GitHub words its throttle two ways, and neither is a permission problem.
+    for wording in [
+        "API rate limit exceeded for user ID 1.",
+        "You have exceeded a secondary rate limit.",
+        "You have triggered an abuse detection mechanism.",
+    ] {
+        let throttled = GitHub.external_api_error(HttpRequestError::ApiError {
+            status: StatusCode::FORBIDDEN,
+            body: format!(r#"{{"message":"{wording}"}}"#),
+        });
+        let throttled = map_external_error(throttled);
+        assert!(
+            matches!(throttled, Error::BadGateway(_)),
+            "a throttled 403 is the service failing to serve: {throttled:?}"
+        );
+        assert!(
+            !throttled.to_string().contains("admin rights"),
+            "a throttled 403 must not advise about permissions: {throttled}"
+        );
+    }
+
+    let refused = GitHub.external_api_error(HttpRequestError::ApiError {
+        status: StatusCode::FORBIDDEN,
+        body: r#"{"message":"Must have admin rights to Repository."}"#.to_string(),
+    });
+    assert!(
+        map_external_error(refused).to_string().contains("admin rights"),
+        "a real 403 keeps its guidance"
+    );
+}
+
+/// A service read degrades to the stored configuration, but only for the service's own
+/// failures: `External::get` also runs queries, and reporting one of those as the service's
+/// word would hide a Windmill outage behind a 200.
+#[test]
+fn test_only_service_failures_degrade_the_read() {
+    assert!(matches!(
+        classify_read_failure(nextcloud_error(StatusCode::FORBIDDEN, "{}")),
+        ExternalReadFailure::Unreadable(_)
+    ));
+    assert!(matches!(
+        classify_read_failure(Error::internal_err("connection pool timed out")),
+        ExternalReadFailure::Internal(_)
+    ));
+    let internal = Error::internal_err("connection pool timed out");
+    assert!(
+        matches!(map_external_error(internal), Error::InternalErrLoc { .. }),
+        "a non-provider error must pass through unmapped"
+    );
+}
diff --git a/backend/windmill-api-integration-tests/tests/nested_dev_workspace.rs b/backend/windmill-api-integration-tests/tests/nested_dev_workspace.rs
new file mode 100644
index 0000000000..a9549b91a8
--- /dev/null
+++ b/backend/windmill-api-integration-tests/tests/nested_dev_workspace.rs
@@ -0,0 +1,444 @@
+//! A dev workspace may itself be paired with one (a "dev of a dev"). The guards that keep that
+//! shape well-formed are what these tests pin: a chain must stay acyclic, and no two dev workspaces
+//! in it may carry the same environment label — they inherit the same git-sync repositories, so an
+//! equal label means both deploy to one branch.
+
+use serde_json::json;
+use sqlx::{Pool, Postgres};
+
+use windmill_test_utils::*;
+
+const ADMIN_TOKEN: &str = "SECRET_TOKEN";
+
+async fn attach(port: u16, prod: &str, body: serde_json::Value) -> (reqwest::StatusCode, String) {
+    let resp = reqwest::Client::new()
+        .post(format!(
+            "http://localhost:{port}/api/w/{prod}/workspaces/attach_dev_workspace"
+        ))
+        .header("Authorization", format!("Bearer {ADMIN_TOKEN}"))
+        .json(&body)
+        .send()
+        .await
+        .unwrap();
+    let status = resp.status();
+    (status, resp.text().await.unwrap())
+}
+
+async fn detach(port: u16, prod: &str, dev: &str) -> (reqwest::StatusCode, String) {
+    let resp = reqwest::Client::new()
+        .post(format!(
+            "http://localhost:{port}/api/w/{prod}/workspaces/detach_dev_workspace"
+        ))
+        .header("Authorization", format!("Bearer {ADMIN_TOKEN}"))
+        .json(&json!({ "dev_workspace_id": dev }))
+        .send()
+        .await
+        .unwrap();
+    let status = resp.status();
+    (status, resp.text().await.unwrap())
+}
+
+#[sqlx::test(migrations = "../migrations", fixtures("base", "nested_dev_workspace"))]
+async fn test_nested_dev_workspace_attach_guards(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    // The family root is an ancestor of the dev workspace: reparenting it below would close a
+    // parent<->child cycle and hang every hierarchy walk.
+    let (status, body) = attach(
+        port,
+        "tw-dev",
+        json!({ "dev_workspace_id": "test-workspace", "dev_workspace_label": "staging" }),
+    )
+    .await;
+    assert!(
+        status.is_client_error(),
+        "cycle attach returned {status}: {body}"
+    );
+    assert!(body.contains("ancestor"), "unexpected error: {body}");
+
+    // `tw-dev` is itself the 'dev' workspace of the root, so a dev nested under it cannot be one too.
+    let (status, body) = attach(
+        port,
+        "tw-dev",
+        json!({ "dev_workspace_id": "spare", "dev_workspace_label": "dev" }),
+    )
+    .await;
+    assert!(
+        status.is_client_error(),
+        "label reuse returned {status}: {body}"
+    );
+    assert!(body.contains("tw-dev"), "unexpected error: {body}");
+
+    // `standalone` brings its own 'dev'-labelled dev workspace into the chain, which collides with
+    // `tw-dev` whatever label the candidate itself is given.
+    let (status, body) = attach(
+        port,
+        "tw-dev",
+        json!({ "dev_workspace_id": "standalone", "dev_workspace_label": "staging" }),
+    )
+    .await;
+    assert!(
+        status.is_client_error(),
+        "subtree label reuse returned {status}: {body}"
+    );
+    assert!(body.contains("standalone-dev"), "unexpected error: {body}");
+
+    // With a free label and nothing conflicting underneath, the nested pairing goes through.
+    let (status, body) = attach(
+        port,
+        "tw-dev",
+        json!({ "dev_workspace_id": "spare", "dev_workspace_label": "staging" }),
+    )
+    .await;
+    assert!(
+        status.is_success(),
+        "nested attach returned {status}: {body}"
+    );
+    // Runtime-checked (not `query!`): a macro here would need its own `.sqlx` entry, which
+    // `cargo sqlx prepare --workspace` does not produce for test targets.
+    let (parent, is_dev, label): (Option<String>, bool, Option<String>) = sqlx::query_as(
+        "SELECT parent_workspace_id, is_dev_workspace, dev_workspace_label FROM workspace WHERE id = 'spare'",
+    )
+    .fetch_one(&db)
+    .await?;
+    assert_eq!(parent.as_deref(), Some("tw-dev"));
+    assert!(is_dev);
+    assert_eq!(label.as_deref(), Some("staging"));
+
+    // A chain runs as deep as there are distinct labels to give it, not two:
+    // `test-workspace` -> `tw-dev` ('dev') -> `spare` ('staging') -> `e-cand` ('uat').
+    let (status, body) = attach(
+        port,
+        "spare",
+        json!({ "dev_workspace_id": "e-cand", "dev_workspace_label": "uat" }),
+    )
+    .await;
+    assert!(
+        status.is_success(),
+        "third-label attach returned {status}: {body}"
+    );
+
+    Ok(())
+}
+
+async fn archive(port: u16, w_id: &str) -> (reqwest::StatusCode, String) {
+    let resp = reqwest::Client::new()
+        .post(format!(
+            "http://localhost:{port}/api/w/{w_id}/workspaces/archive"
+        ))
+        .header("Authorization", format!("Bearer {ADMIN_TOKEN}"))
+        .send()
+        .await
+        .unwrap();
+    let status = resp.status();
+    (status, resp.text().await.unwrap())
+}
+
+#[sqlx::test(migrations = "../migrations", fixtures("base", "nested_dev_workspace"))]
+async fn test_teardown_refuses_to_strand_a_nested_dev(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    // A `wm-fork-` workspace keeps its parent when it stops being a dev workspace, so it returns to
+    // being a throwaway fork — which hosts no pairing, leaving `redev-dev` attached with no way to
+    // reach it. Detach and archive both clear the flag, so both have to refuse.
+    let (status, body) = detach(port, "prod-b", "wm-fork-redev").await;
+    assert!(
+        status.is_client_error(),
+        "stranding detach returned {status}: {body}"
+    );
+    assert!(body.contains("redev-dev"), "unexpected error: {body}");
+
+    let (status, body) = archive(port, "wm-fork-redev").await;
+    assert!(
+        status.is_client_error(),
+        "stranding archive returned {status}: {body}"
+    );
+    assert!(body.contains("redev-dev"), "unexpected error: {body}");
+
+    // Archive soft-deletes whatever the id looks like, so a prefix-less dev workspace strands its
+    // own dev too — even though detaching that same workspace is fine (it returns to standalone).
+    let (status, body) = archive(port, "c-dev").await;
+    assert!(
+        status.is_client_error(),
+        "prefix-less stranding archive returned {status}: {body}"
+    );
+    assert!(body.contains("c-dev-dev"), "unexpected error: {body}");
+    let (status, body) = detach(port, "prod-c", "c-dev").await;
+    assert!(
+        status.is_success(),
+        "prefix-less detach returned {status}: {body}"
+    );
+
+    // Bottom-up is the supported order.
+    let (status, body) = detach(port, "wm-fork-redev", "redev-dev").await;
+    assert!(status.is_success(), "leaf detach returned {status}: {body}");
+    let (status, body) = detach(port, "prod-b", "wm-fork-redev").await;
+    assert!(
+        status.is_success(),
+        "detach after cleanup returned {status}: {body}"
+    );
+
+    Ok(())
+}
+
+/// Giving a workspace a dev and clearing its own dev flag each decide on state the other mutates, so
+/// checked outside a common lock both commit and leave `e-cand` under a throwaway fork. Fired
+/// together: whichever lands second must see the first and be rejected.
+///
+/// Repeated, because how far each handler gets before the other's mutation lands is timing-dependent
+/// — one pass caught an unlocked build only about a fifth of the time, and the runs are cheap.
+#[sqlx::test(migrations = "../migrations", fixtures("base", "nested_dev_workspace"))]
+async fn test_nested_attach_and_detach_cannot_both_commit(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    for round in 0..12 {
+        // Back to `prod-e -> wm-fork-edev ('dev')` with `e-cand` standalone, the state in which both
+        // requests pass their own checks.
+        sqlx::query(
+            "UPDATE workspace SET parent_workspace_id = 'prod-e', is_dev_workspace = true,
+                    dev_workspace_label = 'dev' WHERE id = 'wm-fork-edev'",
+        )
+        .execute(&db)
+        .await?;
+        sqlx::query(
+            "UPDATE workspace SET parent_workspace_id = NULL, is_dev_workspace = false,
+                    dev_workspace_label = NULL WHERE id = 'e-cand'",
+        )
+        .execute(&db)
+        .await?;
+
+        let (attached, detached) = tokio::join!(
+            attach(
+                port,
+                "wm-fork-edev",
+                json!({ "dev_workspace_id": "e-cand", "dev_workspace_label": "staging" }),
+            ),
+            detach(port, "prod-e", "wm-fork-edev"),
+        );
+        assert!(
+            attached.0.is_success() != detached.0.is_success(),
+            "round {round}: exactly one must win, got attach={} detach={}\n{}\n{}",
+            attached.0,
+            detached.0,
+            attached.1,
+            detached.1
+        );
+
+        // Whichever won, `wm-fork-edev` is never left a throwaway fork with a dev workspace beneath it.
+        let (is_dev, cand_parent): (bool, Option<String>) = sqlx::query_as(
+            "SELECT (SELECT is_dev_workspace FROM workspace WHERE id = 'wm-fork-edev'),
+                    (SELECT parent_workspace_id FROM workspace WHERE id = 'e-cand')",
+        )
+        .fetch_one(&db)
+        .await?;
+        assert!(
+            is_dev || cand_parent.is_none(),
+            "round {round}: stranded — wm-fork-edev is_dev={is_dev}, e-cand parent={cand_parent:?}"
+        );
+    }
+    Ok(())
+}
+
+/// Two adjacent attaches — `f-mid` under `prod-f` and `f-leaf` under `f-mid` — each see a chain that
+/// does not yet contain the other's dev workspace, so both pass their label check. Committing both
+/// puts two `dev` workspaces in one chain, deploying to the same branch. Repeated for the same
+/// reason as the detach race above.
+#[sqlx::test(migrations = "../migrations", fixtures("base", "nested_dev_workspace"))]
+async fn test_adjacent_attaches_cannot_both_claim_a_label(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    for round in 0..12 {
+        sqlx::query(
+            "UPDATE workspace SET parent_workspace_id = NULL, is_dev_workspace = false,
+                    dev_workspace_label = NULL WHERE id IN ('f-mid', 'f-leaf')",
+        )
+        .execute(&db)
+        .await?;
+
+        let (upper, lower) = tokio::join!(
+            attach(
+                port,
+                "prod-f",
+                json!({ "dev_workspace_id": "f-mid", "dev_workspace_label": "dev" }),
+            ),
+            attach(
+                port,
+                "f-mid",
+                json!({ "dev_workspace_id": "f-leaf", "dev_workspace_label": "dev" }),
+            ),
+        );
+        assert!(
+            upper.0.is_success() != lower.0.is_success(),
+            "round {round}: exactly one must win, got upper={} lower={}\n{}\n{}",
+            upper.0,
+            lower.0,
+            upper.1,
+            lower.1
+        );
+
+        // Never both: that is the chain prod-f -> f-mid('dev') -> f-leaf('dev').
+        let chained: bool = sqlx::query_scalar(
+            "SELECT EXISTS(
+                 SELECT 1 FROM workspace mid
+                 JOIN workspace leaf ON leaf.parent_workspace_id = mid.id
+                 WHERE mid.id = 'f-mid' AND leaf.id = 'f-leaf'
+                   AND mid.is_dev_workspace AND leaf.is_dev_workspace
+                   AND mid.parent_workspace_id = 'prod-f'
+             )",
+        )
+        .fetch_one(&db)
+        .await?;
+        assert!(!chained, "round {round}: both attaches committed");
+    }
+    Ok(())
+}
+
+/// Attaching `g-mid` under `prod-g` and attaching `g-leaf` under `g-sub` touch no workspace in
+/// common — `g-sub` already sits under `g-mid`, so the two operations are two hops apart. Each sees
+/// a two-workspace chain with a free label; together they make a four-deep one that repeats
+/// `staging`. Locking the endpoints alone leaves them free to both commit, which is why the pairing
+/// lock covers every workspace its checks read.
+#[sqlx::test(migrations = "../migrations", fixtures("base", "nested_dev_workspace"))]
+async fn test_attaches_two_hops_apart_cannot_both_claim_a_label(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    for round in 0..12 {
+        sqlx::query(
+            "UPDATE workspace SET parent_workspace_id = NULL, is_dev_workspace = false,
+                    dev_workspace_label = NULL WHERE id IN ('g-mid', 'g-leaf')",
+        )
+        .execute(&db)
+        .await?;
+
+        let (upper, lower) = tokio::join!(
+            attach(
+                port,
+                "prod-g",
+                json!({ "dev_workspace_id": "g-mid", "dev_workspace_label": "staging" }),
+            ),
+            attach(
+                port,
+                "g-sub",
+                json!({ "dev_workspace_id": "g-leaf", "dev_workspace_label": "staging" }),
+            ),
+        );
+        assert!(
+            upper.0.is_success() != lower.0.is_success(),
+            "round {round}: exactly one must win, got upper={} lower={}\n{}\n{}",
+            upper.0,
+            lower.0,
+            upper.1,
+            lower.1
+        );
+
+        // No chain may carry one label twice. Walk every dev workspace up to its root and count.
+        let duplicated: Option<String> = sqlx::query_scalar(
+            "WITH RECURSIVE chain AS (
+                 SELECT id AS leaf, id, parent_workspace_id, is_dev_workspace,
+                        COALESCE(dev_workspace_label, 'dev') AS label, 0 AS depth
+                 FROM workspace WHERE is_dev_workspace AND NOT deleted
+                 UNION ALL
+                 SELECT c.leaf, w.id, w.parent_workspace_id, w.is_dev_workspace,
+                        COALESCE(w.dev_workspace_label, 'dev'), c.depth + 1
+                 FROM workspace w JOIN chain c ON w.id = c.parent_workspace_id
+                 WHERE c.depth < 20
+             )
+             SELECT leaf FROM chain WHERE is_dev_workspace
+             GROUP BY leaf, label HAVING count(*) > 1 LIMIT 1",
+        )
+        .fetch_optional(&db)
+        .await?;
+        assert!(
+            duplicated.is_none(),
+            "round {round}: a chain repeats a label, below {duplicated:?}"
+        );
+    }
+    Ok(())
+}
+
+/// The pairing lock covers the chains an operation touches, not every pairing on the instance: a
+/// transaction holding one family's nodes must not hold up another family's. Pinned because the
+/// obvious way to make the races above safe — one key for the whole operation class — would serialize
+/// dev-workspace creation database-wide, and creation holds its transaction across a full clone.
+#[sqlx::test(migrations = "../migrations", fixtures("base", "nested_dev_workspace"))]
+async fn test_pairing_lock_does_not_span_unrelated_families(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    // Hold family F's nodes the way an in-flight attach on it would, then act on family E.
+    let mut held = db.begin().await?;
+    for node in ["prod-f", "f-mid", "f-leaf"] {
+        sqlx::query("SELECT pg_advisory_xact_lock(hashtext('dev_workspace_pairing:' || $1))")
+            .bind(node)
+            .execute(&mut *held)
+            .await?;
+    }
+    // Also the un-suffixed key. Nothing takes it today, so holding it costs the passing case
+    // nothing — but a lock narrowed back to one key for every family would take it, and without
+    // this the test would sail through that exact regression.
+    sqlx::query("SELECT pg_advisory_xact_lock(hashtext('dev_workspace_pairing'))")
+        .execute(&mut *held)
+        .await?;
+
+    let (status, body) = tokio::time::timeout(
+        std::time::Duration::from_secs(20),
+        detach(port, "prod-e", "wm-fork-edev"),
+    )
+    .await
+    .map_err(|_| anyhow::anyhow!("an unrelated family's pairing blocked on family F's locks"))?;
+    assert!(
+        status.is_success(),
+        "unrelated detach returned {status}: {body}"
+    );
+
+    held.rollback().await?;
+    Ok(())
+}
+
+/// Archive resolves the workspace's pairing state before its transaction, so it takes the pairing
+/// lock before reading that state again rather than on the strength of it — an attach can be turning
+/// the workspace into a dev in the meantime. `h-cand` is standalone, the shape whose resolved state
+/// says no pairing is involved: its archive must wait on the lock all the same.
+#[sqlx::test(migrations = "../migrations", fixtures("base", "nested_dev_workspace"))]
+async fn test_archive_takes_the_pairing_lock_for_a_standalone_workspace(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    let mut held = db.begin().await?;
+    sqlx::query("SELECT pg_advisory_xact_lock(hashtext('dev_workspace_pairing:' || $1))")
+        .bind("h-cand")
+        .execute(&mut *held)
+        .await?;
+
+    let finished =
+        tokio::time::timeout(std::time::Duration::from_secs(5), archive(port, "h-cand")).await;
+    assert!(
+        finished.is_err(),
+        "archive of a standalone workspace completed while its pairing lock was held: {finished:?}"
+    );
+
+    held.rollback().await?;
+    Ok(())
+}
diff --git a/backend/windmill-api-integration-tests/tests/offboarding.rs b/backend/windmill-api-integration-tests/tests/offboarding.rs
index be7a94d655..4434e6a2b5 100644
--- a/backend/windmill-api-integration-tests/tests/offboarding.rs
+++ b/backend/windmill-api-integration-tests/tests/offboarding.rs
@@ -80,6 +80,16 @@ async fn test_offboard_to_user(db: Pool<Postgres>) -> anyhow::Result<()> {
     .execute(&db)
     .await?;
 
+    // A shared-path script that runs as the departing user. Both halves of its identity have to
+    // move: a worker predating MIN_VERSION_SUPPORTS_ON_BEHALF_OF_PRINCIPAL reads the address and
+    // nothing else, so a stale one keeps running it under someone who has just been offboarded.
+    sqlx::query!(
+        "INSERT INTO script (workspace_id, path, hash, content, summary, description, language, created_by, created_at, on_behalf_of, on_behalf_of_email)
+         VALUES ('test-workspace', 'f/shared/obo', 1099, 'def main(): pass', '', '', 'python3', 'test-user', NOW(), 'u/test-user-2', 'test2@windmill.dev')"
+    )
+    .execute(&db)
+    .await?;
+
     let resp = authed(client().post(ws_url(port, "offboard/test-user-2")))
         .json(&json!({
             "reassign_to": "u/test-user",
@@ -101,6 +111,17 @@ async fn test_offboard_to_user(db: Pool<Postgres>) -> anyhow::Result<()> {
     assert!(summary["variables_reassigned"].as_i64().unwrap() > 0);
     assert!(summary["schedules_reassigned"].as_i64().unwrap() > 0);
 
+    let obo = sqlx::query!(
+        "SELECT on_behalf_of, on_behalf_of_email FROM script WHERE path = 'f/shared/obo' AND workspace_id = 'test-workspace'"
+    )
+    .fetch_one(&db)
+    .await?;
+    assert_eq!(
+        (obo.on_behalf_of.as_deref(), obo.on_behalf_of_email.as_deref()),
+        (Some("u/test-user"), Some("test@windmill.dev")),
+        "the reassignment moves the whole identity, not just the half this release reads"
+    );
+
     // Verify scripts moved
     let moved = sqlx::query_scalar!(
         "SELECT COUNT(*) FROM script WHERE path LIKE 'u/test-user/%' AND workspace_id = 'test-workspace' AND NOT archived AND NOT deleted"
diff --git a/backend/windmill-api-integration-tests/tests/resources.rs b/backend/windmill-api-integration-tests/tests/resources.rs
index 3cc59be473..07afbb3442 100644
--- a/backend/windmill-api-integration-tests/tests/resources.rs
+++ b/backend/windmill-api-integration-tests/tests/resources.rs
@@ -756,37 +756,26 @@ async fn test_mcp_client_get_job_and_logs(db: Pool<Postgres>) -> anyhow::Result<
     .auth_header("MCP_TOKEN");
     let transport = StreamableHttpClientTransport::from_config(config);
 
-    let client_info = ClientInfo {
-        protocol_version: Default::default(),
-        capabilities: ClientCapabilities::default(),
-        client_info: Implementation {
-            name: "test-client".to_string(),
-            title: None,
-            version: "0.0.1".to_string(),
-            description: None,
-            website_url: None,
-            icons: None,
-        },
-        meta: None,
-    };
+    let client_info = ClientInfo::new(
+        ClientCapabilities::default(),
+        Implementation::new("test-client", "0.0.1"),
+    );
 
     let client: RunningService<RoleClient, InitializeRequestParams> =
         client_info.serve(transport).await?;
 
     // --- Test getJob ---
     let result = client
-        .call_tool(CallToolRequestParams {
-            name: "getJob".into(),
-            arguments: Some(serde_json::from_value(json!({ "id": job_id.to_string() }))?),
-            task: None,
-            meta: None,
-        })
+        .call_tool(
+            CallToolRequestParams::new("getJob")
+                .with_arguments(serde_json::from_value(json!({ "id": job_id.to_string() }))?),
+        )
         .await?;
 
     let text = result
         .content
         .first()
-        .and_then(|c| c.raw.as_text())
+        .and_then(|c| c.as_text())
         .expect("getJob should return text content");
     let job: serde_json::Value = serde_json::from_str(&text.text)?;
     assert_eq!(job["id"], job_id.to_string());
@@ -800,18 +789,16 @@ async fn test_mcp_client_get_job_and_logs(db: Pool<Postgres>) -> anyhow::Result<
 
     // --- Test getJobLogs ---
     let result = client
-        .call_tool(CallToolRequestParams {
-            name: "getJobLogs".into(),
-            arguments: Some(serde_json::from_value(json!({ "id": job_id.to_string() }))?),
-            task: None,
-            meta: None,
-        })
+        .call_tool(
+            CallToolRequestParams::new("getJobLogs")
+                .with_arguments(serde_json::from_value(json!({ "id": job_id.to_string() }))?),
+        )
         .await?;
 
     let text = result
         .content
         .first()
-        .and_then(|c| c.raw.as_text())
+        .and_then(|c| c.as_text())
         .expect("getJobLogs should return text content");
     // The logs endpoint returns text/plain, which gets wrapped as a JSON string by call_endpoint
     let logs: String = serde_json::from_str(&text.text)?;
diff --git a/backend/windmill-api-integration-tests/tests/token_hash.rs b/backend/windmill-api-integration-tests/tests/token_hash.rs
index 45d324a3d4..285f15a9c6 100644
--- a/backend/windmill-api-integration-tests/tests/token_hash.rs
+++ b/backend/windmill-api-integration-tests/tests/token_hash.rs
@@ -343,10 +343,17 @@ async fn test_rotate_webhook_token(db: Pool<Postgres>) -> anyhow::Result<()> {
     .execute(&db)
     .await?;
 
-    // Rotate the token
-    let rotated = rotate_webhook_token(&db, &original_hash, ServiceName::Google)
-        .await?
-        .expect("rotate must return Some for existing token");
+    // Rotate onto a different runnable than the original token was minted for: a rename moves the
+    // trigger, and rotation has to follow it rather than carry the old scopes forward.
+    let renamed_scopes = vec!["jobs:run:flows:f/test/renamed".to_string()];
+    let rotated = rotate_webhook_token(
+        &db,
+        &original_hash,
+        ServiceName::Google,
+        renamed_scopes.clone(),
+    )
+    .await?
+    .expect("rotate must return Some for existing token");
 
     // New token should be different
     assert_ne!(rotated.new_token, original_token);
@@ -355,7 +362,7 @@ async fn test_rotate_webhook_token(db: Pool<Postgres>) -> anyhow::Result<()> {
     // New token's hash should exist in DB with the per-service label and expiration
     let new_hash = hash_token(&rotated.new_token);
     let new_row = sqlx::query!(
-        "SELECT label, expiration FROM token WHERE token_hash = $1",
+        "SELECT label, expiration, scopes FROM token WHERE token_hash = $1",
         new_hash
     )
     .fetch_optional(&db)
@@ -373,6 +380,13 @@ async fn test_rotate_webhook_token(db: Pool<Postgres>) -> anyhow::Result<()> {
         new_row.expiration.is_some(),
         "rotated Google token must carry an expiration"
     );
+    // Carrying the old token's scopes here is what made every post-rename retry mint a token no
+    // callback could use, while reporting success.
+    assert_eq!(
+        new_row.scopes.as_deref(),
+        Some(renamed_scopes.as_slice()),
+        "rotation must scope the new token to the runnable it was rotated for"
+    );
 
     // Old token should still exist (deletion deferred to caller)
     let old_exists: bool = sqlx::query_scalar!(
@@ -402,7 +416,7 @@ async fn test_rotate_webhook_token(db: Pool<Postgres>) -> anyhow::Result<()> {
     assert!(!old_gone, "old token must be gone after explicit deletion");
 
     // Rotating a non-existent hash should return None
-    let result = rotate_webhook_token(&db, "nonexistent_hash", ServiceName::Google).await?;
+    let result = rotate_webhook_token(&db, "nonexistent_hash", ServiceName::Google, vec![]).await?;
     assert!(
         result.is_none(),
         "rotating a non-existent token must return None"
diff --git a/backend/windmill-api-integration-tests/tests/token_label_idor.rs b/backend/windmill-api-integration-tests/tests/token_label_idor.rs
index 92dada92c2..ddec1a481a 100644
--- a/backend/windmill-api-integration-tests/tests/token_label_idor.rs
+++ b/backend/windmill-api-integration-tests/tests/token_label_idor.rs
@@ -179,6 +179,9 @@ async fn test_trigger_token_labels_still_creatable(db: Pool<Postgres>) -> anyhow
         "http-test-user-2-cd34",
         "email-test-user-2-ef56",
         "my-ci-token",
+        // Minted client-side by the editor (every TypeScript editor load) and the debugger.
+        "Ephemeral lsp token",
+        "debugger-token",
     ] {
         let resp = create_token_with_label(port, "SECRET_TOKEN_2", label).await;
         assert_eq!(
@@ -190,3 +193,31 @@ async fn test_trigger_token_labels_still_creatable(db: Pool<Postgres>) -> anyhow
 
     Ok(())
 }
+
+/// The mirror of the above: reserved namespaces must NOT be mintable. `username_override_from_label`
+/// trusts these shapes to name the entity acting, so a forged one would stamp an arbitrary
+/// name onto `v2_job.created_by` and the audit `end_user` — on an `on_behalf_of` runnable,
+/// which also takes the `username`/`email` columns, that leaves no trace of the real caller.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_reserved_token_labels_not_creatable(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    for label in [
+        "ephemeral-webhook-forged",
+        "ephemeral-script-end-user-svcaccount",
+        "ephemeral-script",
+        "session",
+        "mcp-oauth-forged",
+    ] {
+        let resp = create_token_with_label(port, "SECRET_TOKEN_2", label).await;
+        assert_eq!(
+            resp.status(),
+            400,
+            "creating a token with reserved label {label:?} must be rejected"
+        );
+    }
+
+    Ok(())
+}
diff --git a/backend/windmill-api-integration-tests/tests/users.rs b/backend/windmill-api-integration-tests/tests/users.rs
index 7b3457cde1..fb64d9eb77 100644
--- a/backend/windmill-api-integration-tests/tests/users.rs
+++ b/backend/windmill-api-integration-tests/tests/users.rs
@@ -512,6 +512,84 @@ async fn test_user_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
     Ok(())
 }
 
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_list_addable_instance_users(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base = format!("http://localhost:{port}/api/w/test-workspace/users/list_addable");
+
+    // The three fixture accounts are all members of test-workspace already.
+    sqlx::query(
+        "INSERT INTO password(email, password_hash, login_type, verified, username, disabled) VALUES
+         ('addable@windmill.dev', 'x', 'password', true, 'addable-user', false),
+         ('with_underscore@windmill.dev', 'x', 'password', true, 'underscored', false),
+         ('gone@windmill.dev', 'x', 'password', true, 'gone-user', true)"
+    )
+    .execute(&db)
+    .await?;
+    sqlx::query(
+        "INSERT INTO usr(workspace_id, email, username, is_admin, role, is_service_account)
+         VALUES ('test-workspace', 'sa@creator.test-workspace.sa.wm.dev', 'sa', false, 'User', true)"
+    )
+    .execute(&db)
+    .await?;
+
+    let emails = |query: &str| {
+        let url = format!("{base}?{query}");
+        async move {
+            let resp = authed(client().get(url)).send().await.unwrap();
+            assert_eq!(resp.status(), 200);
+            resp.json::<Vec<serde_json::Value>>()
+                .await
+                .unwrap()
+                .into_iter()
+                .map(|u| u["email"].as_str().unwrap().to_string())
+                .collect::<Vec<_>>()
+        }
+    };
+
+    // Members, disabled accounts and service accounts are all out; a service account has no
+    // `password` row at all, so it can never reach the picker.
+    assert_eq!(
+        emails("").await,
+        vec![
+            "addable@windmill.dev",
+            // seeded by the migrations, not a member of test-workspace
+            "admin@windmill.dev",
+            "with_underscore@windmill.dev"
+        ]
+    );
+
+    // The exclusions are part of the query, so the limit counts addable accounts only — a
+    // workspace whose members sort first must not swallow the whole page.
+    assert_eq!(emails("per_page=1").await, vec!["addable@windmill.dev"]);
+
+    // Search matches the instance username as well as the email.
+    assert_eq!(
+        emails("search=addable-user").await,
+        vec!["addable@windmill.dev"]
+    );
+
+    // Wildcards in the search are matched literally rather than expanded.
+    assert_eq!(
+        emails("search=_").await,
+        vec!["with_underscore@windmill.dev"]
+    );
+    assert!(emails("search=%25").await.is_empty());
+
+    // Listing instance-wide accounts is superadmin-only, workspace admin is not enough.
+    let resp = client()
+        .get(&base)
+        .header("Authorization", "Bearer SECRET_TOKEN_3")
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 401);
+
+    Ok(())
+}
+
 #[sqlx::test(migrations = "../migrations", fixtures("base"))]
 async fn test_change_user_email(db: Pool<Postgres>) -> anyhow::Result<()> {
     initialize_tracing().await;
@@ -660,3 +738,175 @@ async fn test_change_user_email(db: Pool<Postgres>) -> anyhow::Result<()> {
 
     Ok(())
 }
+
+/// A superadmin acting outside every workspace has no username of their own, so their runnables
+/// name them by their address — and an address may contain a `/`, which every reader of a
+/// principal splits on. Moving such an account has to leave behind the form that decodes back to
+/// them rather than one that reads as a group.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_change_user_email_to_slash_address(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let global_base = format!("http://localhost:{}/api/users", server.addr.port());
+
+    sqlx::query!(
+        "INSERT INTO password(email, password_hash, login_type, super_admin, verified, name)
+         VALUES ('ext@windmill.dev', 'not-a-real-hash', 'password', true, true, 'Ext')"
+    )
+    .execute(&db)
+    .await?;
+    sqlx::query!(
+        "INSERT INTO script (workspace_id, path, hash, content, summary, description, language, created_by, created_at, on_behalf_of)
+         VALUES ('test-workspace', 'u/test-user/s', 93001, 'def main(): pass', '', '', 'python3', 'test-user', NOW(), 'ext@windmill.dev')"
+    )
+    .execute(&db)
+    .await?;
+
+    // The principal follows the address, and a job row carries it in a narrower column than the
+    // runnable does, so a move that would make it unenqueueable is refused rather than silently
+    // leaving runnables that look configured and cannot start.
+    let resp = authed(client().post(format!("{global_base}/change_email/ext@windmill.dev")))
+        .json(&json!({ "new_email": "a-very-long-superadmin-address-for-this-test@windmill.dev" }))
+        .send()
+        .await?;
+    let status = resp.status();
+    let body = resp.text().await?;
+    assert_eq!(status, 400, "{body}");
+    assert!(body.contains("characters a job can carry"), "{body}");
+
+    let resp = authed(client().post(format!("{global_base}/change_email/ext@windmill.dev")))
+        .json(&json!({ "new_email": "ops/alice@windmill.dev" }))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 200, "change_email: {}", resp.text().await?);
+
+    assert_eq!(
+        sqlx::query_scalar!(
+            "SELECT on_behalf_of FROM script WHERE path = 'u/test-user/s' AND workspace_id = 'test-workspace'"
+        )
+        .fetch_one(&db)
+        .await?
+        .as_deref(),
+        Some("u/ops/alice@windmill.dev"),
+        "left bare, the new address would come back as group 'alice@windmill.dev'"
+    );
+
+    Ok(())
+}
+
+/// A group's synthetic address (`group-{name}@windmill.dev`) can also be a real user's, and a
+/// runnable configured for the *group* carries that address next to `g/{name}`. Moving the
+/// colliding user's account must leave it alone: rewriting one half of the pair would leave it
+/// naming two different people, which the deploy path rejects.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_change_user_email_leaves_group_identities(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let global_base = format!("http://localhost:{}/api/users", server.addr.port());
+
+    sqlx::query!("UPDATE password SET email = 'group-ops@windmill.dev' WHERE email = 'test2@windmill.dev'")
+        .execute(&db)
+        .await?;
+    sqlx::query!("UPDATE usr SET email = 'group-ops@windmill.dev' WHERE email = 'test2@windmill.dev'")
+        .execute(&db)
+        .await?;
+    sqlx::query!(
+        "INSERT INTO group_(workspace_id, name, summary, extra_perms) VALUES ('test-workspace', 'ops', '', '{}')"
+    )
+    .execute(&db)
+    .await?;
+
+    // An email change never moves a username, so the principal these rows hold stays put. What
+    // moves is the address beside it — kept for the workers that still read it — and in every
+    // pair a group-owned identity keeps the group's synthetic address even though a real account
+    // now holds it: rewriting one half leaves the pair naming two accounts.
+    sqlx::query!(
+        "INSERT INTO app(workspace_id, path, summary, policy, versions)
+         VALUES ('test-workspace', 'u/test-user/g', '', '{\"on_behalf_of\": \"g/ops\", \"on_behalf_of_email\": \"group-ops@windmill.dev\"}'::jsonb, '{}'),
+                ('test-workspace', 'u/test-user/u', '', '{\"on_behalf_of\": \"u/test-user-2\", \"on_behalf_of_email\": \"group-ops@windmill.dev\"}'::jsonb, '{}')"
+    )
+    .execute(&db)
+    .await?;
+
+    sqlx::query!(
+        "INSERT INTO script (workspace_id, path, hash, content, summary, description, language, created_by, created_at, on_behalf_of, on_behalf_of_email)
+         VALUES ('test-workspace', 'u/test-user/sg', 95001, 'def main(): pass', '', '', 'python3', 'test-user', NOW(), 'g/ops', 'group-ops@windmill.dev'),
+                ('test-workspace', 'u/test-user/su', 95002, 'def main(): pass', '', '', 'python3', 'test-user', NOW(), 'u/test-user-2', 'group-ops@windmill.dev')"
+    )
+    .execute(&db)
+    .await?;
+
+    sqlx::query!(
+        "INSERT INTO draft(workspace_id, path, typ, value, email)
+         VALUES ('test-workspace', 'u/test-user/dg', 'script', '{\"on_behalf_of\": \"g/ops\", \"on_behalf_of_email\": \"group-ops@windmill.dev\"}'::json, 'test@windmill.dev'),
+                ('test-workspace', 'u/test-user/du', 'script', '{\"on_behalf_of\": \"u/test-user-2\", \"on_behalf_of_email\": \"group-ops@windmill.dev\"}'::json, 'test@windmill.dev')"
+    )
+    .execute(&db)
+    .await?;
+
+    let resp = authed(client().post(format!("{global_base}/change_email/group-ops@windmill.dev")))
+        .json(&json!({ "new_email": "renamed@windmill.dev" }))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 200, "change_email: {}", resp.text().await?);
+
+    let apps = sqlx::query!(
+        "SELECT path, policy->>'on_behalf_of_email' AS email FROM app WHERE workspace_id = 'test-workspace' ORDER BY path"
+    )
+    .fetch_all(&db)
+    .await?;
+    assert_eq!(
+        apps.iter()
+            .map(|r| (r.path.as_str(), r.email.as_deref()))
+            .collect::<Vec<_>>(),
+        vec![
+            ("u/test-user/g", Some("group-ops@windmill.dev")),
+            ("u/test-user/u", Some("renamed@windmill.dev")),
+        ],
+        "the group-owned app keeps the group's address; the user-owned one moves"
+    );
+
+    let scripts = sqlx::query!(
+        "SELECT path, on_behalf_of_email AS email FROM script WHERE workspace_id = 'test-workspace' AND path LIKE 'u/test-user/s%' ORDER BY path"
+    )
+    .fetch_all(&db)
+    .await?;
+    assert_eq!(
+        scripts
+            .iter()
+            .map(|r| (r.path.as_str(), r.email.as_deref()))
+            .collect::<Vec<_>>(),
+        vec![
+            ("u/test-user/sg", Some("group-ops@windmill.dev")),
+            ("u/test-user/su", Some("renamed@windmill.dev")),
+        ],
+        "the group-owned script keeps the group's address; the user-owned one moves"
+    );
+
+    let drafts = sqlx::query!(
+        "SELECT path, value->>'on_behalf_of_email' AS email, value->>'on_behalf_of' AS principal FROM draft WHERE workspace_id = 'test-workspace' ORDER BY path"
+    )
+    .fetch_all(&db)
+    .await?;
+    assert_eq!(
+        drafts
+            .iter()
+            .map(|r| (r.path.as_str(), r.principal.as_deref(), r.email.as_deref()))
+            .collect::<Vec<_>>(),
+        vec![
+            (
+                "u/test-user/dg",
+                Some("g/ops"),
+                Some("group-ops@windmill.dev")
+            ),
+            (
+                "u/test-user/du",
+                Some("u/test-user-2"),
+                Some("renamed@windmill.dev")
+            ),
+        ],
+        "a draft's pair moves as a whole or not at all — either half left behind is a 400 on deploy"
+    );
+
+    Ok(())
+}
diff --git a/backend/windmill-api-integration-tests/tests/workspace_comparison.rs b/backend/windmill-api-integration-tests/tests/workspace_comparison.rs
index 392f43d410..11c731d75c 100644
--- a/backend/windmill-api-integration-tests/tests/workspace_comparison.rs
+++ b/backend/windmill-api-integration-tests/tests/workspace_comparison.rs
@@ -1754,6 +1754,83 @@ async fn test_compare_workspaces_phantom_trigger_shortfuse(
     Ok(())
 }
 
+/// A source-only row is offered to the fork whatever its counters say, so it can
+/// carry `behind = 0` — a `behind`-derived tally never sees it, and hiding one must
+/// still be reported to the update direction. The merge direction does not carry
+/// such a row at all, so hiding one withholds nothing from that side.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_compare_workspaces_hidden_source_only_no_behind(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base_url = format!("http://localhost:{port}/api");
+    let non_admin = windmill_api_client::create_client(
+        &format!("http://localhost:{port}"),
+        "SECRET_TOKEN_2".to_string(),
+    );
+
+    sqlx::query!(
+        "INSERT INTO workspace (id, name, owner, parent_workspace_id)
+         VALUES ('wm-fork-test-workspace', 'Fork', 'test-user', 'test-workspace')"
+    )
+    .execute(&db)
+    .await?;
+    sqlx::query!("INSERT INTO workspace_settings (workspace_id) VALUES ('wm-fork-test-workspace')")
+        .execute(&db)
+        .await?;
+    sqlx::query!(
+        "INSERT INTO workspace_key(workspace_id, kind, key)
+         VALUES ('wm-fork-test-workspace', 'cloud', 'test-key')"
+    )
+    .execute(&db)
+    .await?;
+
+    // Source-only row with no `behind`: the trigger has no backing row, so the
+    // visibility filter drops it exactly as it would an ACL-hidden one.
+    sqlx::query!(
+        "INSERT INTO workspace_diff
+         (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes, exists_in_source, exists_in_fork)
+         VALUES ('test-workspace', 'wm-fork-test-workspace', 'f/rt/parent_only', 'http_trigger', 1, 0, true, true, false)"
+    )
+    .execute(&db)
+    .await?;
+
+    let comparison: serde_json::Value = non_admin
+        .client()
+        .get(&format!(
+            "{base_url}/w/test-workspace/workspaces/compare/wm-fork-test-workspace"
+        ))
+        .send()
+        .await?
+        .json()
+        .await?;
+    assert_eq!(
+        comparison["all_behind_items_visible"].as_bool(),
+        Some(false),
+        "a hidden source-only row must trip the warning even at behind = 0: {comparison}"
+    );
+    assert_eq!(
+        comparison["hidden_behind"]["total"].as_i64(),
+        Some(1),
+        "a hidden source-only row must be counted as withheld from the update direction: {comparison}"
+    );
+    assert_eq!(
+        comparison["all_ahead_items_visible"].as_bool(),
+        Some(true),
+        "the merge direction does not carry a source-only row, so hiding one withholds nothing from it: {comparison}"
+    );
+    assert_eq!(
+        comparison["hidden_ahead"]["total"].as_i64(),
+        Some(0),
+        "a source-only row must not be reported as withheld from the merge direction: {comparison}"
+    );
+
+    Ok(())
+}
+
 /// Regression: the "sees everything" guard must require admin of BOTH sides, not
 /// just the fork. `filter_visible_diffs` keeps a modified/conflict row (one that
 /// exists in the source AND the fork) only when the caller can see it on both
@@ -2129,3 +2206,357 @@ async fn test_full_diff_scan_against_arbitrary_workspace(db: Pool<Postgres>) ->
 
     Ok(())
 }
+
+/// Regression for WIN-2289. A fork deletion and a git-sync pull reverting an
+/// earlier deploy leave the same `ahead > 0, behind = 0` row with the item gone
+/// from the fork; the comparison must carry the recorded origin that tells them
+/// apart, and a tally that cannot vouch for its event must not overwrite it.
+///
+/// Gated on `private` for the same reason as the tally tests above: the OSS
+/// `handle_deployment_metadata` is a no-op, so no rows would ever be written.
+#[cfg(feature = "private")]
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_compare_records_fork_removal_origin(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base_url = format!("http://localhost:{port}/api");
+    let admin = windmill_api_client::create_client(
+        &format!("http://localhost:{port}"),
+        "SECRET_TOKEN".to_string(),
+    );
+
+    sqlx::query!("DELETE FROM skip_workspace_diff_tally")
+        .execute(&db)
+        .await?;
+
+    // Deployed in the parent before the fork exists, so nothing is tallied yet and
+    // the fork starts with both scripts. bash needs no lock generation, so the
+    // create tallies inline instead of deferring to a dependency job (no worker
+    // runs in this test).
+    for path in ["u/admin/dropped_by_user", "u/admin/dropped_by_sync"] {
+        let resp = admin
+            .client()
+            .post(&format!("{base_url}/w/test-workspace/scripts/create"))
+            .json(&json!({
+                "path": path,
+                "summary": "",
+                "description": "",
+                "content": "echo 1",
+                "language": "bash",
+                "schema": {"type": "object", "properties": {}, "required": []},
+            }))
+            .send()
+            .await?;
+        let status = resp.status();
+        assert!(
+            status.is_success(),
+            "script create failed: {} — {}",
+            status,
+            resp.text().await?
+        );
+    }
+
+    let resp = admin
+        .client()
+        .post(&format!(
+            "{base_url}/w/test-workspace/workspaces/create_fork"
+        ))
+        .json(&json!({"id": "wm-fork-removal", "name": "Removal Fork"}))
+        .send()
+        .await?;
+    assert!(
+        resp.status().is_success(),
+        "fork creation failed: {}",
+        resp.status()
+    );
+
+    // Same act, same resulting row shape; only the header a sync client sets differs.
+    for (path, origin_header) in [
+        ("u/admin/dropped_by_user", None),
+        ("u/admin/dropped_by_sync", Some("sync")),
+    ] {
+        let mut req = admin.client().post(&format!(
+            "{base_url}/w/wm-fork-removal/scripts/archive/p/{path}"
+        ));
+        if let Some(origin) = origin_header {
+            req = req.header("X-Windmill-Deploy-Origin", origin);
+        }
+        let resp = req.send().await?;
+        let status = resp.status();
+        assert!(
+            status.is_success(),
+            "archive of {path} failed: {} — {}",
+            status,
+            resp.text().await?
+        );
+    }
+
+    // The tally runs in a `tokio::spawn` inside `handle_deployment_metadata`.
+    let mut recorded = 0;
+    for _ in 0..40 {
+        recorded = sqlx::query_scalar!(
+            "SELECT COUNT(*) AS \"count!\" FROM workspace_diff
+             WHERE source_workspace_id = 'test-workspace'
+               AND fork_workspace_id = 'wm-fork-removal'
+               AND kind = 'script'
+               AND fork_last_event_origin IS NOT NULL"
+        )
+        .fetch_one(&db)
+        .await?;
+        if recorded >= 2 {
+            break;
+        }
+        tokio::time::sleep(std::time::Duration::from_millis(50)).await;
+    }
+    assert_eq!(recorded, 2, "both archives should have tallied an event");
+
+    let comparison: serde_json::Value = admin
+        .client()
+        .get(&format!(
+            "{base_url}/w/test-workspace/workspaces/compare/wm-fork-removal"
+        ))
+        .send()
+        .await?
+        .json()
+        .await?;
+    let diffs = comparison["diffs"].as_array().unwrap();
+
+    for (path, expected_origin) in [
+        ("u/admin/dropped_by_user", "authored"),
+        ("u/admin/dropped_by_sync", "sync"),
+    ] {
+        let row = diffs
+            .iter()
+            .find(|d| d["path"] == path && d["kind"] == "script")
+            .unwrap_or_else(|| panic!("{path} should be in the diff; got {diffs:?}"));
+        assert_eq!(row["exists_in_source"].as_bool(), Some(true), "{row}");
+        assert_eq!(row["exists_in_fork"].as_bool(), Some(false), "{row}");
+        assert_eq!(row["behind"].as_i64(), Some(0), "{row}");
+        assert_eq!(
+            row["fork_last_event_kind"].as_str(),
+            Some("delete"),
+            "{row}"
+        );
+        assert_eq!(
+            row["fork_last_event_origin"].as_str(),
+            Some(expected_origin),
+            "the two removals must stay distinguishable: {row}"
+        );
+    }
+
+    // The call the worker makes on its success path for a lock-generating deploy:
+    // it reports a deploy that landed before the archive and cannot answer for what
+    // the path holds now. The archive's record has to survive it, and only the
+    // counter moves.
+    windmill_git_sync::handle_deployment_metadata(
+        "admin@windmill.dev",
+        "admin",
+        &db,
+        "wm-fork-removal",
+        windmill_git_sync::DeployedObject::Script {
+            hash: windmill_common::scripts::ScriptHash(0),
+            path: "u/admin/dropped_by_sync".to_string(),
+            parent_path: Some("u/admin/dropped_by_sync".to_string()),
+        },
+        None,
+        true,
+        // A redeploy that did not move the item passes the same path back; it must
+        // not be tallied a second time as the path a rename vacated.
+        Some("u/admin/dropped_by_sync"),
+    )
+    .await?;
+    let mut after = None;
+    for _ in 0..40 {
+        tokio::time::sleep(std::time::Duration::from_millis(50)).await;
+        let row = sqlx::query!(
+            "SELECT ahead, fork_last_event_kind, fork_last_event_origin FROM workspace_diff
+             WHERE source_workspace_id = 'test-workspace' AND fork_workspace_id = 'wm-fork-removal'
+               AND kind = 'script' AND path = 'u/admin/dropped_by_sync'"
+        )
+        .fetch_one(&db)
+        .await?;
+        if row.ahead > 1 {
+            after = Some(row);
+            break;
+        }
+    }
+    let after = after.expect("the detached tally should still bump the counter");
+    assert_eq!(after.fork_last_event_kind.as_deref(), Some("delete"));
+    assert_eq!(
+        after.fork_last_event_origin.as_deref(),
+        Some("sync"),
+        "a tally that cannot vouch for its event must not overwrite one that did"
+    );
+    assert_eq!(after.ahead, 2, "and it counts once, not twice");
+
+    Ok(())
+}
+
+/// `probe_deploy_event_kind` builds its query for these kinds by interpolating the
+/// table name, so a wrong entry compiles fine and only fails once someone deploys
+/// that trigger kind in a fork — where the error aborts the tally and the item
+/// never reaches `workspace_diff` at all. Sweep the allowlist against a live
+/// database instead.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_probe_covers_every_path_keyed_table(db: Pool<Postgres>) -> anyhow::Result<()> {
+    for kind in windmill_git_sync::PATH_KEYED_TABLES {
+        let probed =
+            windmill_git_sync::probe_deploy_event_kind(&db, "test-workspace", kind, "u/a/nothing")
+                .await
+                .unwrap_or_else(|e| panic!("probing `{kind}` failed: {e}"));
+        assert_eq!(
+            probed,
+            Some(windmill_common::deploy_origin::DeployEventKind::Delete),
+            "an absent `{kind}` must probe as a deletion"
+        );
+    }
+    Ok(())
+}
+
+/// Flows always generate a lock, so without the request reporting the path a
+/// rename left behind, a renamed flow leaves its old path in the parent with
+/// nothing to merge.
+#[cfg(feature = "private")]
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_rename_records_the_vacated_path(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base_url = format!("http://localhost:{port}/api");
+    let admin = windmill_api_client::create_client(
+        &format!("http://localhost:{port}"),
+        "SECRET_TOKEN".to_string(),
+    );
+
+    sqlx::query!("DELETE FROM skip_workspace_diff_tally")
+        .execute(&db)
+        .await?;
+    let resp = admin
+        .client()
+        .post(&format!(
+            "{base_url}/w/test-workspace/workspaces/create_fork"
+        ))
+        .json(&json!({"id": "wm-fork-renamed", "name": "Rename Fork"}))
+        .send()
+        .await?;
+    assert!(
+        resp.status().is_success(),
+        "fork creation: {}",
+        resp.status()
+    );
+
+    let flow = |path: &str| {
+        json!({
+            "path": path,
+            "summary": "",
+            "description": "",
+            "value": {"modules": []},
+            "schema": {"type": "object", "properties": {}, "required": []},
+        })
+    };
+    for (path, origin) in [
+        ("u/admin/moved_by_user", None),
+        ("u/admin/moved_by_sync", Some("sync")),
+    ] {
+        let mut req = admin
+            .client()
+            .post(&format!("{base_url}/w/wm-fork-renamed/flows/create"))
+            .json(&flow(path));
+        if let Some(origin) = origin {
+            req = req.header("X-Windmill-Deploy-Origin", origin);
+        }
+        let resp = req.send().await?;
+        assert!(resp.status().is_success(), "flow create: {}", resp.status());
+
+        let mut req = admin
+            .client()
+            .post(&format!("{base_url}/w/wm-fork-renamed/flows/update/{path}"))
+            .json(&flow(&format!("{path}_new")));
+        if let Some(origin) = origin {
+            req = req.header("X-Windmill-Deploy-Origin", origin);
+        }
+        let resp = req.send().await?;
+        assert!(resp.status().is_success(), "flow rename: {}", resp.status());
+    }
+
+    let mut rows = vec![];
+    for _ in 0..40 {
+        tokio::time::sleep(std::time::Duration::from_millis(50)).await;
+        rows = sqlx::query!(
+            "SELECT path, fork_last_event_kind, fork_last_event_origin FROM workspace_diff
+             WHERE fork_workspace_id = 'wm-fork-renamed' AND kind = 'flow'
+               AND fork_last_event_origin IS NOT NULL ORDER BY path"
+        )
+        .fetch_all(&db)
+        .await?;
+        if rows.len() >= 2 {
+            break;
+        }
+    }
+    let claimed: Vec<_> = rows
+        .iter()
+        .map(|r| {
+            (
+                r.path.as_str(),
+                r.fork_last_event_kind.as_deref(),
+                r.fork_last_event_origin.as_deref(),
+            )
+        })
+        .collect();
+    assert_eq!(
+        claimed,
+        vec![
+            ("u/admin/moved_by_sync", Some("delete"), Some("sync")),
+            ("u/admin/moved_by_user", Some("delete"), Some("authored")),
+        ],
+        "each vacated path is recorded with the origin of the rename that left it, \
+         and the deployed paths — which only the dependency job reports — are not"
+    );
+
+    // A script needing no lock deploys inline, so its own request reports both
+    // paths and can say why the old one is empty rather than only that it is.
+    let mut parent_hash: Option<String> = None;
+    for path in ["u/admin/inline", "u/admin/inline_moved"] {
+        let resp = admin
+            .client()
+            .post(&format!("{base_url}/w/wm-fork-renamed/scripts/create"))
+            .json(&json!({
+                "path": path,
+                "summary": "",
+                "description": "",
+                // bash needs no lock, so this deploys inline.
+                "content": "echo 1",
+                "language": "bash",
+                "schema": {"type": "object", "properties": {}, "required": []},
+                "parent_hash": parent_hash,
+            }))
+            .send()
+            .await?;
+        let status = resp.status();
+        let hash = resp.text().await?;
+        assert!(status.is_success(), "script deploy failed: {status} — {hash}");
+        parent_hash = Some(hash.trim().trim_matches('"').to_string());
+    }
+    let mut vacated = None;
+    for _ in 0..40 {
+        tokio::time::sleep(std::time::Duration::from_millis(50)).await;
+        vacated = sqlx::query!(
+            "SELECT fork_last_event_kind, fork_last_event_origin FROM workspace_diff
+             WHERE fork_workspace_id = 'wm-fork-renamed' AND kind = 'script'
+               AND path = 'u/admin/inline' AND fork_last_event_kind IS NOT NULL"
+        )
+        .fetch_optional(&db)
+        .await?;
+        if vacated.is_some() {
+            break;
+        }
+    }
+    let vacated = vacated.expect("the inline rename should report the path it left");
+    assert_eq!(vacated.fork_last_event_kind.as_deref(), Some("rename_from"));
+    assert_eq!(vacated.fork_last_event_origin.as_deref(), Some("authored"));
+
+    Ok(())
+}
diff --git a/backend/windmill-api-integration-tests/tests/workspaces.rs b/backend/windmill-api-integration-tests/tests/workspaces.rs
index 851dcbb4cd..e9eeb88996 100644
--- a/backend/windmill-api-integration-tests/tests/workspaces.rs
+++ b/backend/windmill-api-integration-tests/tests/workspaces.rs
@@ -964,3 +964,46 @@ async fn test_get_imports(db: Pool<Postgres>) -> anyhow::Result<()> {
 
     Ok(())
 }
+
+/// A dbt project names a warehouse and nothing else, so the workspace setting is
+/// the only place the connection is decided. Two things have to hold for that to
+/// work at all: the setting round-trips as the MAP the resolver reads (an
+/// envelope stored verbatim makes every warehouse name unresolvable), and the
+/// route that serves the name to a worker with no database stays job-scoped.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_dbt_warehouses(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base = format!("http://localhost:{port}/api/w/test-workspace");
+
+    let resp = authed(client().post(format!("{base}/workspaces/edit_dbt_warehouses")))
+        .json(&json!({
+            "dbt_warehouses": { "main": { "resource_path": "u/admin/wh", "target": "prod" } }
+        }))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200);
+
+    let resp = authed(client().get(format!("{base}/workspaces/get_settings")))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200);
+    let settings = resp.json::<serde_json::Value>().await?;
+    assert_eq!(
+        settings["dbt_warehouses"],
+        json!({ "main": { "resource_path": "u/admin/wh", "target": "prod" } })
+    );
+
+    // A user token is not a job token: the warehouses a workspace configures are
+    // a running job's business, not a browsable list.
+    let resp = authed(client().get(format!("{base}/dbt/warehouse/main")))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 400);
+
+    Ok(())
+}
diff --git a/backend/windmill-api-jobs/src/execution.rs b/backend/windmill-api-jobs/src/execution.rs
index b4707fca9f..ebee1bcbbf 100644
--- a/backend/windmill-api-jobs/src/execution.rs
+++ b/backend/windmill-api-jobs/src/execution.rs
@@ -691,6 +691,7 @@ pub async fn run_flow<'c>(
     bool,
     Option<sqlx::Transaction<'c, sqlx::Postgres>>,
 )> {
+    let on_behalf_of = flow_version_info.on_behalf_of(w_id, &db).await?;
     let FlowVersionInfo {
         version,
         tag,
@@ -698,8 +699,6 @@ pub async fn run_flow<'c>(
         has_preprocessor,
         has_failure_module,
         chat_input_enabled,
-        on_behalf_of_email,
-        edited_by,
         early_return,
         labels,
         ..
@@ -719,10 +718,10 @@ pub async fn run_flow<'c>(
             Some(authed.clone().into()),
             PushIsolationLevel::Transaction(tx),
         )
-    } else if let Some(on_behalf_of_email) = on_behalf_of_email.as_ref() {
+    } else if let Some(obo) = on_behalf_of.as_ref() {
         (
-            on_behalf_of_email,
-            username_to_permissioned_as(&edited_by),
+            &obo.email,
+            obo.permissioned_as.clone(),
             None,
             PushIsolationLevel::IsolatedRoot(db.clone()),
         )
@@ -752,6 +751,7 @@ pub async fn run_flow<'c>(
         email,
         permissioned_as,
         authed.token_prefix.as_deref(),
+        authed.username_override.as_deref(),
         scheduled_for,
         None,
         run_query.parent_job,
@@ -769,7 +769,7 @@ pub async fn run_flow<'c>(
         push_authed.as_ref(),
         false,
         None,
-        trigger,
+        authed.trigger_or_fallback(trigger),
         run_query.suspended_mode,
     )
     .await?;
@@ -966,6 +966,7 @@ pub async fn push_script_job_by_path_into_queue<'c>(
         email,
         permissioned_as,
         authed.token_prefix.as_deref(),
+        authed.username_override.as_deref(),
         scheduled_for,
         None,
         run_query.parent_job,
@@ -988,7 +989,7 @@ pub async fn push_script_job_by_path_into_queue<'c>(
         push_authed.as_ref(),
         false,
         None,
-        trigger,
+        authed.trigger_or_fallback(trigger),
         run_query.suspended_mode,
     )
     .await?;
diff --git a/backend/windmill-api-jobs/src/types.rs b/backend/windmill-api-jobs/src/types.rs
index 0d96a66750..6c2d776e30 100644
--- a/backend/windmill-api-jobs/src/types.rs
+++ b/backend/windmill-api-jobs/src/types.rs
@@ -455,6 +455,7 @@ impl From<UnifiedJob> for Job {
                     resolved_at: None,
                     resolution_note: None,
                     resolved_automatically: None,
+                    trigger_kind: None,
                 },
             )),
             "QueuedJob" => Job::QueuedJob(JobExtended::new(
@@ -505,6 +506,7 @@ impl From<UnifiedJob> for Job {
                     runnable_settings_handle: uj.runnable_settings_handle,
                     labels: uj.labels,
                     is_retry: uj.is_retry,
+                    trigger_kind: None,
                 },
             )),
             t => panic!("job type {} not valid", t),
diff --git a/backend/windmill-api-scripts/Cargo.toml b/backend/windmill-api-scripts/Cargo.toml
index ecf0ff0b61..8b34512872 100644
--- a/backend/windmill-api-scripts/Cargo.toml
+++ b/backend/windmill-api-scripts/Cargo.toml
@@ -10,12 +10,14 @@ path = "src/lib.rs"
 
 [features]
 default = []
-enterprise = ["windmill-common/enterprise"]
+enterprise = ["windmill-common/enterprise", "windmill-native-triggers?/enterprise"]
 private = ["windmill-common/private", "windmill-dep-map/private"]
 python = ["dep:windmill-parser-py", "dep:windmill-parser-py-asset"]
 prometheus = ["dep:prometheus", "windmill-common/prometheus"]
+native_trigger = ["dep:windmill-native-triggers", "windmill-native-triggers/native_trigger"]
 [dependencies]
 windmill-common = { workspace = true, default-features = false }
+windmill-native-triggers = { workspace = true, optional = true }
 windmill-object-store.workspace = true
 windmill-api-auth.workspace = true
 windmill-queue.workspace = true
diff --git a/backend/windmill-api-scripts/src/asset_inference.rs b/backend/windmill-api-scripts/src/asset_inference.rs
index 5debb0d271..9c503ae1ae 100644
--- a/backend/windmill-api-scripts/src/asset_inference.rs
+++ b/backend/windmill-api-scripts/src/asset_inference.rs
@@ -42,6 +42,13 @@ fn parse_assets_for_lang(
         #[cfg(feature = "python")]
         ScriptLang::Python3 => windmill_parser_py_asset::parse_assets(content),
         ScriptLang::Ansible => windmill_parser_yaml::parse_assets(content),
+        // dbt is the one language whose assets are not a function of the script
+        // content: they come from `manifest.json`, which needs a clone of the
+        // project's repo and a dbt invocation. The deploy-time dependency job
+        // does that parse and writes the `asset` rows itself
+        // (`dbt_executor::dbt_dep`), so returning None here is what keeps this
+        // path from clobbering them with an empty list.
+        ScriptLang::Dbt => return None,
         _ => return None,
     };
     match parsed {
diff --git a/backend/windmill-api-scripts/src/scripts.rs b/backend/windmill-api-scripts/src/scripts.rs
index c2f023ce5a..2433502537 100644
--- a/backend/windmill-api-scripts/src/scripts.rs
+++ b/backend/windmill-api-scripts/src/scripts.rs
@@ -71,6 +71,7 @@ use windmill_common::{
         ScriptHistory, ScriptHistoryUpdate, ScriptKind, ScriptLang, ScriptModule,
         ScriptWithStarred,
     },
+    triggers::MovedNativeTrigger,
     users::username_to_permissioned_as,
     utils::{not_found_if_none, query_elems_from_hub, require_admin, Pagination, StripPath},
     worker::to_raw_value,
@@ -499,6 +500,35 @@ async fn get_top_hub_scripts(
     Ok::<_, Error>((status_code, headers, response))
 }
 
+/// Re-point the webhooks of the native triggers a rename carried onto the new path.
+///
+/// Runs after the deploy transaction commits — repointing a webhook is not undoable — and off the
+/// request, because it waits on a third-party service that may be slow or gone, and a deploy that
+/// already committed must not look like it failed. The rename itself marked these rows
+/// `REREGISTRATION_PENDING`, so nothing is lost silently if this never finishes.
+fn reregister_moved_native_triggers(
+    db: &DB,
+    authed: &ApiAuthed,
+    w_id: &str,
+    moved: Vec<MovedNativeTrigger>,
+) {
+    if moved.is_empty() {
+        return;
+    }
+    #[cfg(feature = "native_trigger")]
+    {
+        let (db, authed, w_id) = (db.clone(), authed.clone(), w_id.to_string());
+        tokio::spawn(async move {
+            windmill_native_triggers::rename::reregister_triggers_after_rename(
+                &db, &authed, &w_id, &moved,
+            )
+            .await;
+        });
+    }
+    #[cfg(not(feature = "native_trigger"))]
+    let _ = (db, authed, w_id, moved);
+}
+
 async fn create_snapshot_script(
     authed: ApiAuthed,
     Extension(user_db): Extension<UserDB>,
@@ -513,6 +543,7 @@ async fn create_snapshot_script(
     let mut tx = None;
     let mut uploaded = false;
     let mut handle_deployment_metadata = None;
+    let mut moved_native_triggers = Vec::new();
     while let Some(field) = multipart.next_field().await.unwrap() {
         let name = field.name().unwrap().to_string();
         let data = field.bytes().await.unwrap();
@@ -520,7 +551,7 @@ async fn create_snapshot_script(
             let ns: NewScript = Some(serde_json::from_slice(&data).map_err(to_anyhow)?).unwrap();
             let is_tar = ns.codebase.as_ref().is_some_and(|x| x.ends_with(".tar"));
             let use_esm = ns.codebase.as_ref().is_some_and(|x| x.contains(".esm"));
-            let (new_hash, ntx, hdm) = create_script_internal(
+            let (new_hash, ntx, hdm, moved) = create_script_internal(
                 ns,
                 w_id.clone(),
                 authed.clone(),
@@ -540,6 +571,7 @@ async fn create_snapshot_script(
             script_hash = Some(nh);
             tx = Some(ntx);
             handle_deployment_metadata = hdm;
+            moved_native_triggers = moved;
         }
         if name == "file" {
             let hash = script_hash.as_ref().ok_or_else(|| {
@@ -570,6 +602,7 @@ async fn create_snapshot_script(
     }
 
     tx.unwrap().commit().await?;
+    reregister_moved_native_triggers(&db, &authed, &w_id, moved_native_triggers);
     if let Some(hdm) = handle_deployment_metadata {
         hdm.handle(&db).await?;
     }
@@ -627,7 +660,8 @@ async fn create_script(
     let script_path = ns.path.clone();
     let email = authed.email.clone();
     let username = authed.username.clone();
-    let (hash, tx, hdm) = create_script_internal(
+    let authed_for_triggers = authed.clone();
+    let (hash, tx, hdm, moved_native_triggers) = create_script_internal(
         ns,
         w_id.clone(),
         authed,
@@ -638,51 +672,78 @@ async fn create_script(
     )
     .await?;
     tx.commit().await?;
+    reregister_moved_native_triggers(&db, &authed_for_triggers, &w_id, moved_native_triggers);
     if let Some(hdm) = hdm {
-        // hdm is Some when no lock generation is needed (script is ready immediately).
-        // Trigger CI tests for any items that reference this script.
+        // Only a script that needed no lock generation is deployed and runnable by
+        // now; one that did gets its CI tests from the dependency job instead, so
+        // they don't run against a version whose lock does not exist yet — and
+        // don't run twice.
+        let ready_to_test = matches!(hdm, PostCommitDeploy::Full { .. });
         hdm.handle(&db).await?;
         let db2 = db.clone();
-        tokio::spawn(async move {
-            if let Err(e) = windmill_dep_map::ci_tests::trigger_ci_tests_for_item(
-                &db2,
-                &w_id,
-                &script_path,
-                "script",
-                &email,
-                &username,
-            )
-            .await
-            {
-                tracing::error!(%e, "error triggering CI tests after script deploy");
-            }
-        });
+        if ready_to_test {
+            tokio::spawn(async move {
+                if let Err(e) = windmill_dep_map::ci_tests::trigger_ci_tests_for_item(
+                    &db2,
+                    &w_id,
+                    &script_path,
+                    "script",
+                    &email,
+                    &username,
+                )
+                .await
+                {
+                    tracing::error!(%e, "error triggering CI tests after script deploy");
+                }
+            });
+        }
     }
     Ok((StatusCode::CREATED, format!("{}", hash)))
 }
 
-struct HandleDeploymentMetadata {
-    email: String,
-    created_by: String,
-    w_id: String,
-    obj: DeployedObject,
-    deployment_message: Option<String>,
-    renamed_from: Option<String>,
+/// What a script deploy still has to do once its transaction has committed.
+enum PostCommitDeploy {
+    /// Everything, for a deploy with no dependency job to hand it to.
+    Full {
+        email: String,
+        created_by: String,
+        w_id: String,
+        obj: DeployedObject,
+        deployment_message: Option<String>,
+        renamed_from: Option<String>,
+    },
+    /// Only the path a rename left behind; the dependency job handles the rest.
+    /// See `tally_rename_vacated_path`.
+    VacatedPath { w_id: String, obj: DeployedObject },
 }
 
-impl HandleDeploymentMetadata {
+impl PostCommitDeploy {
     async fn handle(self, db: &DB) -> Result<()> {
-        handle_deployment_metadata(
-            &self.email,
-            &self.created_by,
-            &db,
-            &self.w_id,
-            self.obj,
-            self.deployment_message,
-            false,
-            self.renamed_from.as_deref(),
-        )
-        .await
+        match self {
+            PostCommitDeploy::Full {
+                email,
+                created_by,
+                w_id,
+                obj,
+                deployment_message,
+                renamed_from,
+            } => {
+                handle_deployment_metadata(
+                    &email,
+                    &created_by,
+                    &db,
+                    &w_id,
+                    obj,
+                    deployment_message,
+                    false,
+                    renamed_from.as_deref(),
+                )
+                .await
+            }
+            PostCommitDeploy::VacatedPath { w_id, obj } => {
+                windmill_git_sync::tally_rename_vacated_path(db, &w_id, obj).await
+            }
+        }
     }
 }
 
@@ -708,6 +769,7 @@ impl HandleDeploymentMetadata {
 async fn is_noop_deploy_against_parent(
     ns: &NewScript,
     parent: &Script<ScriptRunnableSettingsHandle>,
+    resolved_on_behalf_of: Option<&str>,
     db: &DB,
 ) -> Result<bool> {
     if parent.archived || parent.deleted {
@@ -750,7 +812,10 @@ async fn is_noop_deploy_against_parent(
         auto_kind: _,
         codebase,
         has_preprocessor,
-        on_behalf_of_email,
+        // both halves are folded into `resolved_on_behalf_of` before the comparison below,
+        // which is the identity that would actually be stored
+        on_behalf_of_email: _,
+        on_behalf_of: _,
         // caller-intent flag (permission preservation), not script state
         preserve_on_behalf_of: _,
         assets,
@@ -769,7 +834,20 @@ async fn is_noop_deploy_against_parent(
     if content != &parent.content {
         return Ok(false);
     }
-    if normalize_optional_text(lock.as_deref()) != normalize_optional_text(parent.lock.as_deref()) {
+    // A dbt lock is DERIVED, never supplied: the request carries none — the CLI
+    // sends `lock: undefined` and this route discards any anyway — while a
+    // deployed parent carries what its dependency job wrote. Comparing them makes
+    // every unchanged push a new version, a fresh dependency job and the sync
+    // activity `skip_if_noop` exists to prevent. The parent must actually hold
+    // one, or a deploy whose dependency job failed could never be retried by
+    // pushing the same project again.
+    if matches!(language, ScriptLang::Dbt) {
+        if normalize_optional_text(parent.lock.as_deref()).is_empty() {
+            return Ok(false);
+        }
+    } else if normalize_optional_text(lock.as_deref())
+        != normalize_optional_text(parent.lock.as_deref())
+    {
         return Ok(false);
     }
     if summary != &parent.summary {
@@ -815,10 +893,25 @@ async fn is_noop_deploy_against_parent(
     {
         return Ok(false);
     }
-    if on_behalf_of_email != &parent.on_behalf_of_email {
+    if resolved_on_behalf_of != parent.on_behalf_of.as_deref() {
         return Ok(false);
     }
-    if !schema_opt_eq(schema.as_ref(), parent.schema.as_ref()) {
+    // Both of a dbt script's derived fields are compared as they WOULD BE STORED,
+    // not as they arrived: the schema comes from the descriptor and the clients
+    // cannot derive it (`windmill-parser-wasm` has no dbt arm), so they send the
+    // previous version's or none at all. Comparing what they sent makes every
+    // unchanged push differ.
+    let dbt_schema = matches!(language, ScriptLang::Dbt)
+        .then(|| windmill_parser_yaml::dbt_arg_schema(content).ok())
+        .flatten()
+        .and_then(|v| serde_json::value::to_raw_value(&v).ok())
+        .map(|v| Schema(sqlx::types::Json(v)));
+    let effective_schema = if matches!(language, ScriptLang::Dbt) {
+        dbt_schema.as_ref()
+    } else {
+        schema.as_ref()
+    };
+    if !schema_opt_eq(effective_schema, parent.schema.as_ref()) {
         return Ok(false);
     }
     if !json_serialize_eq(assets, &parent.assets) {
@@ -905,7 +998,8 @@ async fn create_script_internal<'c>(
 ) -> Result<(
     ScriptHash,
     Transaction<'c, Postgres>,
-    Option<HandleDeploymentMetadata>,
+    Option<PostCommitDeploy>,
+    Vec<MovedNativeTrigger>,
 )> {
     if authed.is_operator {
         return Err(Error::NotAuthorized(
@@ -965,7 +1059,7 @@ async fn create_script_internal<'c>(
 
     // Apply folder default_permissioned_as the first time a script is deployed
     // at this path. Check inside the transaction to avoid TOCTOU with concurrent deploys.
-    let explicit_preserve = ns.on_behalf_of_email.is_some()
+    let explicit_preserve = (ns.on_behalf_of_email.is_some() || ns.on_behalf_of.is_some())
         && ns.preserve_on_behalf_of.unwrap_or(false)
         && windmill_common::can_preserve_on_behalf_of(&authed);
     if !explicit_preserve && windmill_common::can_preserve_on_behalf_of(&authed) {
@@ -978,17 +1072,33 @@ async fn create_script_internal<'c>(
         .await?
         .unwrap_or(false);
         if !path_already_exists {
-            if let Some(default_email) =
-                windmill_common::folders::resolve_folder_default_on_behalf_of_email(
-                    &db, &w_id, &ns.path,
-                )
-                .await?
+            if let Some((default_email, default_permissioned_as)) =
+                windmill_common::folders::resolve_folder_default_on_behalf_of(&db, &w_id, &ns.path)
+                    .await?
             {
                 ns.on_behalf_of_email = Some(default_email);
+                ns.on_behalf_of = Some(default_permissioned_as);
                 ns.preserve_on_behalf_of = Some(true);
             }
         }
     }
+    let authed_principal = windmill_common::users::username_to_permissioned_as(&authed.username);
+    // Resolved here rather than at the INSERT so the no-op check below compares the identity
+    // that would actually be stored: the parent row holds only the principal, while a
+    // preserving push may name that same principal by address alone.
+    let resolved_on_behalf_of = windmill_common::resolve_on_behalf_of(
+        ns.on_behalf_of_email.as_deref(),
+        ns.on_behalf_of.as_deref(),
+        ns.preserve_on_behalf_of.unwrap_or(false),
+        &authed,
+        &w_id,
+        &db,
+    )
+    .await?;
+    // Written beside the principal only while a worker that still reads it may be live.
+    let legacy_on_behalf_of_email =
+        windmill_common::legacy_on_behalf_of_email(resolved_on_behalf_of.as_deref(), &w_id, &db)
+            .await?;
     if sqlx::query_scalar!(
         "SELECT 1 FROM script WHERE hash = $1 AND workspace_id = $2",
         hash.0,
@@ -1089,17 +1199,26 @@ async fn create_script_internal<'c>(
             // sync / promotion callbacks — the whole point is that idempotent
             // CLI pushes must not produce phantom commits on the downstream
             // git repository.
-            if skip_if_noop && is_noop_deploy_against_parent(&ns, &ps, &db).await? {
+            if skip_if_noop
+                && is_noop_deploy_against_parent(&ns, &ps, resolved_on_behalf_of.as_deref(), &db)
+                    .await?
+            {
                 tracing::info!(
                     workspace_id = %w_id,
                     path = %ns.path,
                     parent_hash = %p_hash.0,
                     "Skipping no-op script deploy (identical to parent)"
                 );
-                return Ok((p_hash.clone(), tx, None));
+                return Ok((p_hash.clone(), tx, None, Vec::new()));
             }
 
             if ps.path != ns.path {
+                // A rename writes the source as much as the destination, and only the destination
+                // is scope-checked above. `require_owner_of_path` answers whether the *user* owns
+                // the source, never what their token is scoped to — so without this a path-scoped
+                // token could move a script it has no say over, taking its native triggers along
+                // and re-registering them under that token's identity.
+                check_scopes(&authed, || format!("scripts:write:{}", ps.path))?;
                 require_owner_of_path(&authed, &ps.path)?;
             }
 
@@ -1143,6 +1262,25 @@ async fn create_script_internal<'c>(
         .as_ref()
         .map(|v| v.perms.clone())
         .unwrap_or(json!({}));
+    // A dbt lock names a manifest digest and engine versions that only a
+    // dependency job can determine, and that job is also what publishes the
+    // script's manifest graph. Honouring a supplied one would skip it, leaving
+    // the script with no graph — including on the UI paths that round-trip an
+    // existing lock, like rename and unarchive.
+    if matches!(ns.language, ScriptLang::Dbt) {
+        ns.lock = None;
+        // A codebase is a bundle of JS/TS sources; a dbt script's project is
+        // its modules. Accepting one takes the branch below that stands in for
+        // lock generation, which would suppress the very job that parses the
+        // project and publishes the graph.
+        if ns.codebase.is_some() {
+            return Err(Error::BadRequest(
+                "a dbt script has no codebase: its project is its modules, the \
+                 `<script>__dbt/` folder the CLI syncs"
+                    .to_string(),
+            ));
+        }
+    }
     let lock = if ns.codebase.is_some() {
         Some(String::new())
     } else if !(
@@ -1160,6 +1298,7 @@ async fn create_script_internal<'c>(
             || ns.language == ScriptLang::Ruby
             || ns.language == ScriptLang::Rlang
             || ns.language == ScriptLang::Powershell
+            || ns.language == ScriptLang::Dbt
         // for related places search: ADD_NEW_LANG
     ) {
         Some(String::new())
@@ -1196,6 +1335,23 @@ async fn create_script_internal<'c>(
         ns.language.clone()
     };
 
+    // The dbt run form's arguments come from the descriptor, and only the
+    // server can read them: both the browser and the CLI infer schemas through
+    // `windmill-parser-wasm`, whose published package has no dbt arm, so they
+    // send whatever the previous version had (nothing, for a new script).
+    if matches!(lang, ScriptLang::Dbt) {
+        match windmill_parser_yaml::dbt_arg_schema(&ns.content) {
+            Ok(schema) => {
+                ns.schema = serde_json::value::to_raw_value(&schema)
+                    .ok()
+                    .map(|v| Schema(sqlx::types::Json(v)));
+            }
+            // A descriptor that does not parse fails later with a better
+            // message than a schema error would give.
+            Err(e) => tracing::warn!("could not derive the dbt schema for {}: {e:#}", ns.path),
+        }
+    }
+
     let validate_schema = should_validate_schema(&ns.content, &ns.language);
 
     let (auto_kind, has_preprocessor) = if matches!(ns.kind, Some(ScriptKind::Preprocessor)) {
@@ -1434,7 +1590,11 @@ async fn create_script_internal<'c>(
         } else {
             None
         };
-    let in_pipeline = pipeline_annotations.in_pipeline;
+    // dbt is deliberately not a pipeline member: that membership carries an
+    // editor whose premise is that the transforms are authored in it, and a dbt
+    // project is authored in a local `dbt run` loop. Its models reach the shared
+    // graph as `dbt://` assets either way (docs/dbt-runtime.md).
+    let in_pipeline = pipeline_annotations.in_pipeline && ns.language != ScriptLang::Dbt;
     // `// trigger all` → AND join barrier (else OR, the default).
     let pipeline_join_all = !pipeline_annotations.join_mode.is_any();
     // Script-level `// debounce <dur>` default; a per-`// on debounce=`
@@ -1547,8 +1707,8 @@ async fn create_script_internal<'c>(
          content, created_by, schema, is_template, extra_perms, lock, language, kind, tag, \
          envs, concurrent_limit, concurrency_time_window_s, cache_ttl, \
          dedicated_worker, ws_error_handler_muted, priority, restart_unless_cancelled, \
-         delete_after_use, delete_after_secs, timeout, concurrency_key, visible_to_runner_only, auto_kind, codebase, has_preprocessor, on_behalf_of_email, schema_validation, assets, debounce_key, debounce_delay_s, cache_ignore_s3_path, runnable_settings_handle, modules, labels) \
-         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9::text::json, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22, $23, $24, $25, $26, $27, $28, $29, $30, $31, $32, $33, $34, $35, $36, $37, $38, $39, $40)",
+         delete_after_use, delete_after_secs, timeout, concurrency_key, visible_to_runner_only, auto_kind, codebase, has_preprocessor, schema_validation, assets, debounce_key, debounce_delay_s, cache_ignore_s3_path, runnable_settings_handle, modules, labels, on_behalf_of, on_behalf_of_email) \
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9::text::json, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22, $23, $24, $25, $26, $27, $28, $29, $30, $31, $32, $33, $34, $35, $36, $37, $38, $39, $40, $41)",
         &w_id,
         &hash.0,
         ns.path,
@@ -1580,11 +1740,6 @@ async fn create_script_internal<'c>(
         auto_kind.as_deref(),
         codebase,
         has_preprocessor.filter(|x: &bool| *x),
-        windmill_common::resolve_on_behalf_of_email(
-            ns.on_behalf_of_email.as_deref(),
-            ns.preserve_on_behalf_of.unwrap_or(false),
-            &authed,
-        ),
         validate_schema,
         effective_assets
             .as_ref()
@@ -1594,7 +1749,9 @@ async fn create_script_internal<'c>(
         ns.cache_ignore_s3_path,
         runnable_settings_handle,
         ns.modules.as_ref().and_then(|m| serde_json::to_value(m).ok()),
-        ns.labels.as_deref() as Option<&[String]>
+        ns.labels.as_deref() as Option<&[String]>,
+        resolved_on_behalf_of,
+        legacy_on_behalf_of_email,
     )
     .execute(&mut *tx)
     .await?;
@@ -1807,6 +1964,7 @@ async fn create_script_internal<'c>(
         }
     }
 
+    let mut moved_native_triggers = Vec::new();
     let p_path_opt = parent_hashes_and_perms.as_ref().map(|x| x.p_path.clone());
     if let Some(ref p_path) = p_path_opt {
         if !skip_draft_deletion {
@@ -1883,7 +2041,7 @@ async fn create_script_internal<'c>(
         .await?;
 
         if p_path != &ns.path {
-            windmill_common::triggers::update_triggers_script_path(
+            moved_native_triggers = windmill_common::triggers::update_triggers_script_path(
                 &mut tx, &ns.path, p_path, &w_id, false,
             )
             .await
@@ -1926,10 +2084,10 @@ async fn create_script_internal<'c>(
         )
         .await?;
         if let Some(on_behalf_of) = windmill_common::check_on_behalf_of_preservation(
-            ns.on_behalf_of_email.as_deref(),
+            resolved_on_behalf_of.as_deref(),
             ns.preserve_on_behalf_of.unwrap_or(false),
             &authed,
-            &authed.email,
+            &authed_principal,
         ) {
             audit_log(
                 &mut *tx,
@@ -1974,10 +2132,10 @@ async fn create_script_internal<'c>(
         )
         .await?;
         if let Some(on_behalf_of) = windmill_common::check_on_behalf_of_preservation(
-            ns.on_behalf_of_email.as_deref(),
+            resolved_on_behalf_of.as_deref(),
             ns.preserve_on_behalf_of.unwrap_or(false),
             &authed,
-            &authed.email,
+            &authed_principal,
         ) {
             audit_log(
                 &mut *tx,
@@ -2030,16 +2188,52 @@ async fn create_script_internal<'c>(
     // stale `// on` edges keep matching producers (and would trigger a script
     // later recreated at that path with no annotation, P1) and its producer
     // rows keep it lingering in the asset graph.
+    // The dbt GRAPH is deliberately not cleared when a path stops being a dbt
+    // script, nor on the rename below. It is keyed by version, and every graph
+    // query joins it on `(path, hash)` through a `language = 'dbt'` CTE — so an
+    // old version's rows can never attach to whatever lives at that path now,
+    // while its own finished runs still render from them. Clearing by path
+    // would empty those run pages for good.
+    if ns.language != ScriptLang::Dbt {
+        // The saved retry state does go: nothing regenerates it, it is keyed by
+        // path alone, and it carries one user's failed invocation and its
+        // arguments. No dbt version is live at this path any more to resume it.
+        windmill_common::dbt_manifest::clear_dbt_run_state(&mut tx, &w_id, &ns.path).await?;
+    }
     if let Some(ref old) = p_path_opt {
         if old != &ns.path {
             clear_script_triggers(&mut *tx, &w_id, old, AssetUsageKind::Script).await?;
             clear_static_asset_usage(&mut *tx, &w_id, old, AssetUsageKind::Script).await?;
+            // The saved retry state travels rather than being cleared: nothing
+            // regenerates it, so dropping it would throw away a resumable
+            // failure for what is only a rename. Only while the destination is
+            // still dbt — a rename that also converts the language would
+            // otherwise reinstate at the new path the state the branch above
+            // just cleared, leaving one user's arguments and results under a
+            // path no dbt script occupies.
+            if ns.language == ScriptLang::Dbt {
+                windmill_common::dbt_manifest::move_dbt_run_state(&mut tx, &w_id, old, &ns.path)
+                    .await?;
+            } else {
+                windmill_common::dbt_manifest::clear_dbt_run_state(&mut tx, &w_id, old).await?;
+            }
         }
     }
     for spec in &pipeline_triggers {
         let Some((trigger_kind, trigger_ref)) = trigger_spec_to_row(spec) else {
             continue;
         };
+        // A `dbt://` subscription can never fire: dbt is the only producer of a
+        // warehouse relation (`// materialize` takes DuckLake targets only) and a
+        // dbt run does not dispatch. Refusing beats persisting a row that draws a
+        // cascade arrow on the canvas and then never wakes anything.
+        if trigger_ref.starts_with("dbt://") {
+            return Err(Error::BadRequest(format!(
+                "`{trigger_ref}` cannot be subscribed to: a dbt run does not trigger downstream \
+                 runs, and nothing else writes a warehouse relation. Declare the read without \
+                 `on` to keep the lineage edge, or schedule this script."
+            )));
+        }
         // Effective debounce for this edge: per-`// on debounce=` wins,
         // else the script-level `// debounce` default. Debounce only
         // applies to asset-cascade edges; other trigger kinds get none.
@@ -2194,6 +2388,7 @@ async fn create_script_internal<'c>(
             &authed.email,
             permissioned_as,
             authed.token_prefix.as_deref(),
+            authed.username_override.as_deref(),
             None,
             None,
             None,
@@ -2230,7 +2425,19 @@ async fn create_script_internal<'c>(
         .execute(&mut *new_tx)
         .await?;
 
-        Ok((hash, new_tx, None))
+        // The dependency job takes it from here, except for the path a rename left.
+        let vacated =
+            p_path_opt
+                .filter(|old| *old != script_path)
+                .map(|old| PostCommitDeploy::VacatedPath {
+                    w_id: w_id.clone(),
+                    obj: DeployedObject::Script {
+                        hash: hash.clone(),
+                        path: old,
+                        parent_path: None,
+                    },
+                });
+        Ok((hash, new_tx, vacated, moved_native_triggers))
     } else {
         if codebase.is_none() {
             let db2 = db.clone();
@@ -2283,7 +2490,7 @@ async fn create_script_internal<'c>(
         Ok((
             hash,
             tx,
-            Some(HandleDeploymentMetadata {
+            Some(PostCommitDeploy::Full {
                 email: authed.email,
                 created_by: authed.username,
                 w_id,
@@ -2295,6 +2502,7 @@ async fn create_script_internal<'c>(
                 deployment_message: ns.deployment_message,
                 renamed_from: p_path_opt,
             }),
+            moved_native_triggers,
         ))
     }
 }
@@ -3138,6 +3346,12 @@ async fn archive_script_by_path(
     .map_err(|e| Error::internal_err(format!("archiving script in {w_id}: {e:#}")))?;
 
     clear_static_asset_usage(&mut *tx, &w_id, path, AssetUsageKind::Script).await?;
+    // The graph stays: the pinned read resolves versions through a CTE that
+    // already skips archived rows, so it stops answering for current relations
+    // either way, while deleting it would empty the Models panel of every
+    // completed run of the project. Retry state does go — nothing may resume a
+    // script that is no longer live.
+    windmill_common::dbt_manifest::clear_dbt_run_state(&mut tx, &w_id, path).await?;
     // Pipeline event hygiene: an archived script must not be triggered by
     // anything. Wipe declared `// on ...` edges (asset-event subscribers
     // look these up).
@@ -3220,6 +3434,14 @@ async fn archive_script_by_hash(
 
     check_scopes(&authed, || format!("scripts:write:{}", &script.path))?;
     clear_static_asset_usage_by_script_hash(&mut *tx, &w_id, hash).await?;
+    // The version's graph stays: its finished runs still render from it, and
+    // the live-version CTE already skips archived rows. Deletion clears it.
+    windmill_common::dbt_manifest::clear_dbt_run_state_if_path_retired(
+        &mut tx,
+        &w_id,
+        &script.path,
+    )
+    .await?;
     // Pipeline event hygiene: archived scripts must not be triggered by
     // anything. Wipe declared `// on ...` edges.
     clear_script_triggers(&mut *tx, &w_id, &script.path, AssetUsageKind::Script).await?;
@@ -3283,7 +3505,19 @@ async fn delete_script_by_hash(
 
     check_scopes(&authed, || format!("scripts:write:{}", &script.path))?;
 
+    // Graph before assets, the order both publishers take them in — the reverse
+    // deadlocks against a job that clears its own graph and then rewrites the
+    // path's `asset` rows. A clear is needed at all because this route only
+    // soft-deletes the `script` row, so nothing cascades.
+    windmill_common::dbt_manifest::clear_dbt_manifest_version(&mut tx, &w_id, &script.path, hash.0)
+        .await?;
     clear_static_asset_usage_by_script_hash(&mut *tx, &w_id, hash).await?;
+    windmill_common::dbt_manifest::clear_dbt_run_state_if_path_retired(
+        &mut tx,
+        &w_id,
+        &script.path,
+    )
+    .await?;
     // Pipeline event hygiene: a deleted script must not be triggered by
     // anything. Wipe declared `// on ...` edges. Idempotent — safe even if
     // the script was never a pipeline member.
@@ -3377,6 +3611,15 @@ async fn delete_script_by_path(
     .await
     .map_err(|e| Error::internal_err(format!("deleting script by path {w_id}: {e:#}")))?;
 
+    // After the DELETE, never before: every dbt writer locks the `script` row
+    // first, so taking a sidecar ahead of it deadlocks one of the pair. The
+    // VERSIONED graph needs no clear at all, cascading off `script`; the retry
+    // state does, being keyed by path alone and so inherited by whatever is
+    // created here next, and so do the editor's own graphs, whose NULL
+    // `script_hash` satisfies that foreign key without riding its cascade.
+    windmill_common::dbt_manifest::clear_dbt_run_state(&mut tx, &w_id, path).await?;
+    windmill_common::dbt_manifest::clear_dbt_editor_graphs(&mut tx, &w_id, path).await?;
+
     if !trash_scripts.is_empty() {
         let mut trash_data = serde_json::json!({"scripts": trash_scripts});
         if !trash_drafts.is_empty() {
@@ -3540,6 +3783,13 @@ async fn delete_scripts_bulk(
     .await
     .map_err(|e| Error::internal_err(format!("deleting scripts in bulk {w_id}: {e:#}")))?;
 
+    // Same reason as the single-path delete, over every requested path rather
+    // than the deleted ones: a path that had no script left can still hold state.
+    for p in &request.paths {
+        windmill_common::dbt_manifest::clear_dbt_run_state(&mut tx, &w_id, p).await?;
+        windmill_common::dbt_manifest::clear_dbt_editor_graphs(&mut tx, &w_id, p).await?;
+    }
+
     // remove duplicates from deleted_paths
     deleted_paths.sort();
     deleted_paths.dedup();
diff --git a/backend/windmill-api-settings/src/lib.rs b/backend/windmill-api-settings/src/lib.rs
index 1bfd7d0d28..7c2453d848 100644
--- a/backend/windmill-api-settings/src/lib.rs
+++ b/backend/windmill-api-settings/src/lib.rs
@@ -52,23 +52,28 @@ use windmill_common::secret_backend::{
 use windmill_common::{
     auth::is_super_admin_email,
     ee_oss::{get_license_plan, LicensePlan},
-    email_oss::send_email_plain_text,
+    email_oss::{send_email_plain_text, SMTP_ENABLED},
     error::{self, pg_error_message, JsonResult, Result},
     get_database_url,
     global_settings::{
         AI_CONFIG_SETTING, APP_WORKSPACED_ROUTE_SETTING, AUTOMATE_USERNAME_CREATION_SETTING,
-        CRITICAL_ALERT_MUTE_UI_SETTING, DEFAULT_TAGS_WORKSPACES_SETTING, DISABLE_HUB_SETTING,
-        EMAIL_DOMAIN_SETTING, ENV_SETTINGS, GITHUB_APP_WEBHOOK_BASE_URL_SETTING,
-        HTTP_ROUTE_WORKSPACED_ROUTE_SETTING, HUB_ACCESSIBLE_URL_SETTING, HUB_BASE_URL_SETTING,
-        MAX_RETENTION_OVERRIDE_WORKSPACES, RETENTION_PERIOD_SECS_OVERRIDES_SETTING,
-        RUFF_CONFIG_SETTING, WORKSPACE_FAIRNESS_DURATION_SECS_SETTING,
-        WORKSPACE_FAIRNESS_ENABLED_SETTING, WORKSPACE_FAIRNESS_MAX_PERCENT_SETTING,
-        WORKSPACE_FAIRNESS_MIN_TOTAL_SETTING, WS_BASE_URL_SETTING,
+        CRITICAL_ALERT_MUTE_UI_SETTING, CUSTOM_TAGS_SETTING, DEFAULT_TAGS_WORKSPACES_SETTING,
+        DISABLE_HUB_SETTING, EMAIL_DOMAIN_SETTING, ENV_SETTINGS,
+        GITHUB_APP_WEBHOOK_BASE_URL_SETTING, HTTP_ROUTE_WORKSPACED_ROUTE_SETTING,
+        HUB_ACCESSIBLE_URL_SETTING, HUB_BASE_URL_SETTING, MAX_RETENTION_OVERRIDE_WORKSPACES,
+        RETENTION_PERIOD_SECS_OVERRIDES_SETTING, RUFF_CONFIG_SETTING,
+        WORKSPACE_FAIRNESS_DURATION_SECS_SETTING, WORKSPACE_FAIRNESS_ENABLED_SETTING,
+        WORKSPACE_FAIRNESS_MAX_PERCENT_SETTING, WORKSPACE_FAIRNESS_MIN_TOTAL_SETTING,
+        WS_BASE_URL_SETTING,
     },
     instance_config::{self, ApplyMode, InstanceConfig},
     server::Smtp,
 };
-use windmill_common::{error::to_anyhow, worker::CLOUD_HOSTED, PgDatabase};
+use windmill_common::{
+    error::to_anyhow,
+    worker::{reload_custom_tags_setting, CLOUD_HOSTED},
+    PgDatabase,
+};
 
 /// Unauthenticated settings routes.
 ///
@@ -115,10 +120,7 @@ pub fn global_service() -> Router {
             post(set_global_setting).get(get_global_setting),
         )
         .route("/list_global", get(list_global_settings))
-        .route(
-            "/github_app_stale_webhooks",
-            get(github_app_stale_webhooks),
-        )
+        .route("/github_app_stale_webhooks", get(github_app_stale_webhooks))
         .route(
             "/instance_config",
             get(get_instance_config).put(set_instance_config),
@@ -235,10 +237,19 @@ pub async fn test_email(
     Json(test_email): Json<TestEmail>,
 ) -> error::Result<String> {
     require_super_admin(&db, &authed.email).await?;
+    if !SMTP_ENABLED {
+        return Err(error::Error::Generic(
+            axum::http::StatusCode::NOT_IMPLEMENTED,
+            "This Windmill build was compiled without SMTP support, so no email can be sent."
+                .to_string(),
+        ));
+    }
     let smtp = test_email.smtp;
     let to = test_email.to;
 
-    let client_timeout = Duration::from_secs(3);
+    // A connection attempt covers TCP, the TLS handshake, EHLO and authentication against a remote
+    // provider; a tighter budget times out before the server ever states why it refused.
+    let client_timeout = Duration::from_secs(20);
     send_email_plain_text(
         "Test email from Windmill",
         "Test email content",
@@ -246,7 +257,15 @@ pub async fn test_email(
         smtp,
         Some(client_timeout),
     )
-    .await?;
+    .await
+    // The SMTP layer already phrases its failures for an instance admin; the anyhow wrapper it
+    // comes back in would bury that behind "Internal: ... @<source location>".
+    .map_err(|e| match e {
+        error::Error::Anyhow { error, .. } => {
+            error::Error::Generic(axum::http::StatusCode::BAD_REQUEST, format!("{error:#}"))
+        }
+        e => e,
+    })?;
 
     Ok("Sent test email".to_string())
 }
@@ -787,7 +806,6 @@ pub async fn set_global_setting_internal(
         value
     };
 
-
     // EE gate for workspace-fairness settings. Workspace fairness only matters
     // on multi-tenant clusters; it is licensed as an Enterprise feature so the
     // setter rejects writes from non-EE builds. Disabling/clearing writes are
@@ -852,6 +870,16 @@ pub async fn set_global_setting_internal(
         bump_instance_ai_config_revision();
     }
 
+    // Tag reads are served from an in-memory cache that this process otherwise only
+    // refreshes on the next global-settings poll, so without this a refetch right after
+    // the write still returns the pre-write list. The setting is already persisted at
+    // this point, so a failed refresh must not be reported as a failed write — the
+    // poller retries it.
+    if key == CUSTOM_TAGS_SETTING {
+        if let Err(e) = reload_custom_tags_setting(db).await {
+            tracing::error!(error = %e, "Could not reload custom tags setting after write");
+        }
+    }
 
     Ok(())
 }
@@ -1198,7 +1226,6 @@ async fn set_instance_config(
         if ai_config_changed {
             bump_instance_ai_config_revision();
         }
-
     }
 
     if !desired.worker_configs.is_empty() {
diff --git a/backend/windmill-api-users/src/users.rs b/backend/windmill-api-users/src/users.rs
index f78a9e85ff..96b89e322c 100644
--- a/backend/windmill-api-users/src/users.rs
+++ b/backend/windmill-api-users/src/users.rs
@@ -49,7 +49,8 @@ use windmill_common::oauth2::InstanceEvent;
 use windmill_common::users::truncate_token;
 use windmill_common::users::COOKIE_NAME;
 use windmill_common::users::{
-    SUPERADMIN_NOTIFICATION_EMAIL, SUPERADMIN_SECRET_EMAIL, SUPERADMIN_SYNC_EMAIL, VALID_EMAIL,
+    username_to_permissioned_as, PERMISSIONED_AS_MAX_LEN, SUPERADMIN_NOTIFICATION_EMAIL,
+    SUPERADMIN_SECRET_EMAIL, SUPERADMIN_SYNC_EMAIL, VALID_EMAIL,
 };
 use windmill_common::utils::paginate;
 use windmill_common::worker::CLOUD_HOSTED;
@@ -57,7 +58,9 @@ use windmill_common::{
     auth::{get_folders_for_user, get_groups_for_user},
     db::UserDB,
     error::{self, Error, JsonResult, Result},
-    utils::{not_found_if_none, rd_string, require_admin, Pagination, StripPath},
+    utils::{
+        escape_ilike_pattern, not_found_if_none, rd_string, require_admin, Pagination, StripPath,
+    },
 };
 use windmill_common::{BASE_URL, HUB_BASE_URL};
 use windmill_git_sync::handle_deployment_metadata;
@@ -104,6 +107,7 @@ fn check_token_create_rate_limit(username: &str) -> Result<()> {
 pub fn workspaced_service() -> Router {
     Router::new()
         .route("/list", get(list_users))
+        .route("/list_addable", get(list_addable_instance_users))
         .route("/list_usage", get(list_user_usage))
         .route("/list_usernames", get(list_usernames))
         .route("/exists", post(exists_username))
@@ -409,6 +413,7 @@ async fn list_users(
         SELECT workspace_id, username, email, is_admin, created_at, operator, disabled, role, added_via, is_service_account
           FROM usr
          WHERE workspace_id = $1
+         ORDER BY email
          ",
         w_id
     )
@@ -418,6 +423,53 @@ async fn list_users(
     Ok(Json(rows))
 }
 
+#[derive(Serialize)]
+struct AddableInstanceUser {
+    email: String,
+    username: Option<String>,
+}
+
+#[derive(Deserialize)]
+struct AddableInstanceUsersQuery {
+    search: Option<String>,
+    per_page: Option<i64>,
+}
+
+/// Instance accounts that can still be added to `w_id`, for the member picker. Service accounts
+/// live in `usr` only, so selecting from `password` leaves them out.
+async fn list_addable_instance_users(
+    authed: ApiAuthed,
+    Extension(db): Extension<DB>,
+    Path(w_id): Path<String>,
+    Query(AddableInstanceUsersQuery { search, per_page }): Query<AddableInstanceUsersQuery>,
+) -> JsonResult<Vec<AddableInstanceUser>> {
+    require_super_admin(&db, &authed.email).await?;
+    let per_page = per_page.unwrap_or(10).clamp(1, 100);
+    // An absent search yields '%%', which matches every row.
+    let search = format!(
+        "%{}%",
+        escape_ilike_pattern(search.as_deref().unwrap_or_default())
+    );
+
+    // Every exclusion is part of the query so that the limit counts addable accounts only.
+    let rows = sqlx::query_as!(
+        AddableInstanceUser,
+        "SELECT email, username FROM password
+         WHERE disabled IS false
+           AND (email ILIKE $2 OR username ILIKE $2)
+           AND NOT EXISTS (SELECT 1 FROM usr WHERE usr.workspace_id = $1 AND usr.email = password.email)
+         ORDER BY email
+         LIMIT $3",
+        w_id,
+        search,
+        per_page
+    )
+    .fetch_all(&db)
+    .await?;
+
+    Ok(Json(rows))
+}
+
 async fn list_user_usage(
     authed: ApiAuthed,
     Extension(user_db): Extension<UserDB>,
@@ -1785,6 +1837,44 @@ async fn change_user_email(
         }
     }
 
+    // An account named by its address carries that address into every principal column, and
+    // `v2_job.permissioned_as` is narrower than all of them: the move would leave runnables that
+    // look configured but cannot enqueue. Same limit the deploy path applies.
+    let old_principal_probe = username_to_permissioned_as(&old_email);
+    if username_to_permissioned_as(&new_email).chars().count() > PERMISSIONED_AS_MAX_LEN {
+        let names_a_runnable = sqlx::query_scalar!(
+            "SELECT EXISTS(
+                SELECT 1 FROM script WHERE on_behalf_of = $1
+                UNION ALL SELECT 1 FROM flow WHERE on_behalf_of = $1
+                UNION ALL SELECT 1 FROM app WHERE policy->>'on_behalf_of' = $1
+                UNION ALL SELECT 1 FROM schedule WHERE permissioned_as = $1
+                UNION ALL SELECT 1 FROM http_trigger WHERE permissioned_as = $1
+                UNION ALL SELECT 1 FROM websocket_trigger WHERE permissioned_as = $1
+                UNION ALL SELECT 1 FROM postgres_trigger WHERE permissioned_as = $1
+                UNION ALL SELECT 1 FROM mqtt_trigger WHERE permissioned_as = $1
+                UNION ALL SELECT 1 FROM kafka_trigger WHERE permissioned_as = $1
+                UNION ALL SELECT 1 FROM nats_trigger WHERE permissioned_as = $1
+                UNION ALL SELECT 1 FROM sqs_trigger WHERE permissioned_as = $1
+                UNION ALL SELECT 1 FROM gcp_trigger WHERE permissioned_as = $1
+                UNION ALL SELECT 1 FROM email_trigger WHERE permissioned_as = $1
+                UNION ALL SELECT 1 FROM amqp_trigger WHERE permissioned_as = $1
+                UNION ALL SELECT 1 FROM azure_trigger WHERE permissioned_as = $1
+                UNION ALL SELECT 1 FROM folder
+                    WHERE default_permissioned_as @> jsonb_build_array(
+                        jsonb_build_object('permissioned_as', $1::text)))",
+            &old_principal_probe
+        )
+        .fetch_one(&mut *tx)
+        .await?
+        .unwrap_or(false);
+        if names_a_runnable {
+            return Err(Error::BadRequest(format!(
+                "{new_email} is longer than the {PERMISSIONED_AS_MAX_LEN} characters a job can \
+                 carry, and runnables or triggers run on behalf of this account by its address"
+            )));
+        }
+    }
+
     // A pending_user row only reserves a username for an address that has no account yet, which
     // stops being true here. The moved account keeps its own username.
     sqlx::query!("DELETE FROM pending_user WHERE email = $1", &new_email)
@@ -1956,54 +2046,93 @@ async fn change_user_email(
     .execute(&mut *tx)
     .await?;
 
+    // Apps store an address next to their principal, and the synthetic
+    // `group-{name}@windmill.dev` may be a real user's, so a group-owned app has to keep its
+    // address when a colliding user moves: an app running in Anonymous or Publisher mode takes
+    // its permissions from that pair rather than from the caller, and a half-rewritten pair
+    // names two accounts. Drafts below carry the same pair and need the same guard.
     sqlx::query!(
-        "UPDATE azure_trigger SET email = $1 WHERE email = $2",
+        "UPDATE app SET policy = jsonb_set(policy, ARRAY['on_behalf_of_email'], to_jsonb($1::text)) WHERE policy->>'on_behalf_of_email' = $2 AND (policy->>'on_behalf_of' IS NULL OR policy->>'on_behalf_of' NOT LIKE 'g/%')",
         &new_email,
         &old_email
     )
     .execute(&mut *tx)
     .await?;
 
-    sqlx::query!(
-        "UPDATE script SET on_behalf_of_email = $1 WHERE on_behalf_of_email = $2",
-        &new_email,
-        &old_email
-    )
-    .execute(&mut *tx)
-    .await?;
+    // ---- permissioned_as naming the account by its address ----
+    // `usr.username` is constrained to `[\w-]+`, so a workspace member is always named
+    // `u/{username}` and their principals survive an address change untouched. The address form
+    // belongs to an account acting without a `usr` row — a superadmin outside their workspaces,
+    // named by `password.username` or, failing that, by the address itself. Those are the rows
+    // that go stale here, and `username_to_permissioned_as` is what encodes both ends of the
+    // move (an address containing a `/` is prefixed, since readers split on the first one).
+    let old_principal = username_to_permissioned_as(&old_email);
+    let new_principal = username_to_permissioned_as(&new_email);
 
-    sqlx::query!(
-        "UPDATE flow SET on_behalf_of_email = $1 WHERE on_behalf_of_email = $2",
-        &new_email,
-        &old_email
-    )
-    .execute(&mut *tx)
-    .await?;
-
-    // Apps carry the same identity inside their policy JSONB. An app running in Anonymous or
-    // Publisher mode takes its permissions from there rather than from the caller, so a stale
-    // address silently costs it its superadmin flag and its instance groups.
-    sqlx::query!(
-        "UPDATE app SET policy = jsonb_set(policy, ARRAY['on_behalf_of_email'], to_jsonb($1::text)) WHERE policy->>'on_behalf_of_email' = $2",
-        &new_email,
-        &old_email
-    )
-    .execute(&mut *tx)
-    .await?;
-
-    // ---- permissioned_as holding a raw email ----
-    // `username_to_permissioned_as` returns its input verbatim when it contains '@', and the
-    // migration that introduced these columns back-filled them the same way, so a user whose
-    // username is their email is stored as the bare address instead of `u/{username}`. Those rows
-    // are the ones that go stale here; `u/{username}` rows are safe because the username is kept.
     sqlx::query!(
         "UPDATE app SET policy = jsonb_set(policy, ARRAY['on_behalf_of'], to_jsonb($1::text)) WHERE policy->>'on_behalf_of' = $2",
+        &new_principal,
+        &old_principal
+    )
+    .execute(&mut *tx)
+    .await?;
+
+    sqlx::query!(
+        "UPDATE script SET on_behalf_of = $1 WHERE on_behalf_of = $2",
+        &new_principal,
+        &old_principal
+    )
+    .execute(&mut *tx)
+    .await?;
+
+    // The address these two keep beside the principal is what a worker predating
+    // MIN_VERSION_SUPPORTS_ON_BEHALF_OF_PRINCIPAL reads, so it follows the account for as long
+    // as one may be live. Group-owned rows are held back for the reason given above the app
+    // sweep: their address is the group's, which a colliding user does not take with them.
+    sqlx::query!(
+        "UPDATE script SET on_behalf_of_email = $1 WHERE on_behalf_of_email = $2 AND (on_behalf_of IS NULL OR on_behalf_of NOT LIKE 'g/%')",
         &new_email,
         &old_email
     )
     .execute(&mut *tx)
     .await?;
 
+    sqlx::query!(
+        "UPDATE flow SET on_behalf_of = $1 WHERE on_behalf_of = $2",
+        &new_principal,
+        &old_principal
+    )
+    .execute(&mut *tx)
+    .await?;
+
+    sqlx::query!(
+        "UPDATE flow SET on_behalf_of_email = $1 WHERE on_behalf_of_email = $2 AND (on_behalf_of IS NULL OR on_behalf_of NOT LIKE 'g/%')",
+        &new_email,
+        &old_email
+    )
+    .execute(&mut *tx)
+    .await?;
+
+    // Script/flow rows store only the principal, but drafts carry an address beside it and
+    // `deployDraft` sends both — left stale it contradicts the principal, which resolves to the
+    // new address, and the deploy is rejected. Group-owned drafts are held back for the reason
+    // given above the app sweep.
+    sqlx::query!(
+        r#"UPDATE draft SET value = to_json(jsonb_set(to_jsonb(value), ARRAY['on_behalf_of_email'], to_jsonb($1::text))) WHERE typ IN ('script', 'flow') AND value->>'on_behalf_of_email' = $2 AND (value->>'on_behalf_of' IS NULL OR value->>'on_behalf_of' NOT LIKE 'g/%')"#,
+        &new_email,
+        &old_email
+    )
+    .execute(&mut *tx)
+    .await?;
+
+    sqlx::query!(
+        r#"UPDATE draft SET value = to_json(jsonb_set(to_jsonb(value), ARRAY['on_behalf_of'], to_jsonb($1::text))) WHERE typ IN ('script', 'flow') AND value->>'on_behalf_of' = $2"#,
+        &new_principal,
+        &old_principal
+    )
+    .execute(&mut *tx)
+    .await?;
+
     // A folder's default rules are an ordered array, first match wins, so the rewrite has to
     // preserve their order. A rule left on the old address makes `ensure_permissioned_as_exists`
     // reject the creation of every runnable the rule matches.
@@ -2016,104 +2145,104 @@ async fn change_user_email(
                 ORDER BY ord)
             FROM jsonb_array_elements(default_permissioned_as) WITH ORDINALITY AS t(rule, ord))
         WHERE default_permissioned_as @> jsonb_build_array(jsonb_build_object('permissioned_as', $2::text))"#,
-        &new_email,
-        &old_email
+        &new_principal,
+        &old_principal
     )
     .execute(&mut *tx)
     .await?;
 
     sqlx::query!(
         "UPDATE schedule SET permissioned_as = $1 WHERE permissioned_as = $2",
-        &new_email,
-        &old_email
+        &new_principal,
+        &old_principal
     )
     .execute(&mut *tx)
     .await?;
 
     sqlx::query!(
         "UPDATE http_trigger SET permissioned_as = $1 WHERE permissioned_as = $2",
-        &new_email,
-        &old_email
+        &new_principal,
+        &old_principal
     )
     .execute(&mut *tx)
     .await?;
 
     sqlx::query!(
         "UPDATE websocket_trigger SET permissioned_as = $1 WHERE permissioned_as = $2",
-        &new_email,
-        &old_email
+        &new_principal,
+        &old_principal
     )
     .execute(&mut *tx)
     .await?;
 
     sqlx::query!(
         "UPDATE postgres_trigger SET permissioned_as = $1 WHERE permissioned_as = $2",
-        &new_email,
-        &old_email
+        &new_principal,
+        &old_principal
     )
     .execute(&mut *tx)
     .await?;
 
     sqlx::query!(
         "UPDATE mqtt_trigger SET permissioned_as = $1 WHERE permissioned_as = $2",
-        &new_email,
-        &old_email
+        &new_principal,
+        &old_principal
     )
     .execute(&mut *tx)
     .await?;
 
     sqlx::query!(
         "UPDATE kafka_trigger SET permissioned_as = $1 WHERE permissioned_as = $2",
-        &new_email,
-        &old_email
+        &new_principal,
+        &old_principal
     )
     .execute(&mut *tx)
     .await?;
 
     sqlx::query!(
         "UPDATE nats_trigger SET permissioned_as = $1 WHERE permissioned_as = $2",
-        &new_email,
-        &old_email
+        &new_principal,
+        &old_principal
     )
     .execute(&mut *tx)
     .await?;
 
     sqlx::query!(
         "UPDATE sqs_trigger SET permissioned_as = $1 WHERE permissioned_as = $2",
-        &new_email,
-        &old_email
+        &new_principal,
+        &old_principal
     )
     .execute(&mut *tx)
     .await?;
 
     sqlx::query!(
         "UPDATE gcp_trigger SET permissioned_as = $1 WHERE permissioned_as = $2",
-        &new_email,
-        &old_email
+        &new_principal,
+        &old_principal
     )
     .execute(&mut *tx)
     .await?;
 
     sqlx::query!(
         "UPDATE email_trigger SET permissioned_as = $1 WHERE permissioned_as = $2",
-        &new_email,
-        &old_email
+        &new_principal,
+        &old_principal
     )
     .execute(&mut *tx)
     .await?;
 
     sqlx::query!(
         "UPDATE amqp_trigger SET permissioned_as = $1 WHERE permissioned_as = $2",
-        &new_email,
-        &old_email
+        &new_principal,
+        &old_principal
     )
     .execute(&mut *tx)
     .await?;
 
     sqlx::query!(
         "UPDATE azure_trigger SET permissioned_as = $1 WHERE permissioned_as = $2",
-        &new_email,
-        &old_email
+        &new_principal,
+        &old_principal
     )
     .execute(&mut *tx)
     .await?;
@@ -2131,8 +2260,8 @@ async fn change_user_email(
 
     sqlx::query!(
         "UPDATE v2_job SET permissioned_as = $1 WHERE permissioned_as = $2 AND id IN (SELECT id FROM v2_job_queue)",
-        &new_email,
-        &old_email
+        &new_principal,
+        &old_principal
     )
     .execute(&mut *tx)
     .await?;
@@ -2181,8 +2310,24 @@ async fn change_user_email(
     )
     .await?;
 
+    // Read back inside the transaction: the address is derived at dispatch through a cache
+    // that nothing else evicts, so without this a job pushed in the next 60s would resolve
+    // the old address and with it the wrong superadmin flag and instance groups.
+    let memberships = sqlx::query_scalar!(
+        "SELECT workspace_id FROM usr WHERE email = $1",
+        &new_email
+    )
+    .fetch_all(&mut *tx)
+    .await?;
+
     tx.commit().await?;
 
+    if let Some(username) = username.as_deref() {
+        for w_id in &memberships {
+            windmill_common::users::invalidate_email_cache(w_id, username);
+        }
+    }
+
     Ok(format!(
         "changed email of user {old_email} to {new_email}{}",
         username
@@ -2764,6 +2909,21 @@ async fn create_token(
     forbid_superadmin_job_token(&db, &authed.email, job_id).await?;
     check_token_create_rate_limit(&authed.username)?;
 
+    // `username_override_from_label` trusts a server-minted label to name the entity acting,
+    // so a forged one would put an arbitrary name in `created_by` and the audit trail.
+    // Deliberately narrower than the `is_user_token` guard on relabelling: the editor and the
+    // debugger mint their own tokens through this handler. Server-side mints bypass it by
+    // calling `create_token_internal` / `create_token_for_owner` directly.
+    if token_config
+        .label
+        .as_deref()
+        .is_some_and(windmill_common::auth::is_server_minted_label)
+    {
+        return Err(Error::BadRequest(
+            "label collides with a reserved system-token namespace".to_string(),
+        ));
+    }
+
     windmill_api_auth::ensure_scopes_within_caller(&authed, token_config.scopes.as_deref())?;
 
     let mut tx = db.begin().await?;
@@ -2798,6 +2958,20 @@ async fn impersonate(
             "impersonate_username is required".to_string(),
         ));
     }
+    // This route writes its own row rather than going through the `create_token`
+    // handler, so it repeats that handler's guard: impersonation names its
+    // subject in `impersonate_email`, and a server-minted label — which
+    // `username_override_from_label` trusts to name the entity acting — would
+    // attribute this token's jobs to a third identity.
+    if new_token
+        .label
+        .as_deref()
+        .is_some_and(windmill_common::auth::is_server_minted_label)
+    {
+        return Err(Error::BadRequest(
+            "label collides with a reserved system-token namespace".to_string(),
+        ));
+    }
 
     let impersonated = new_token.impersonate_email.unwrap();
 
diff --git a/backend/windmill-api-workspaces/src/datatable_migrations.rs b/backend/windmill-api-workspaces/src/datatable_migrations.rs
index b4c0611b03..5b1dde395a 100644
--- a/backend/windmill-api-workspaces/src/datatable_migrations.rs
+++ b/backend/windmill-api-workspaces/src/datatable_migrations.rs
@@ -37,7 +37,9 @@ use windmill_common::users::username_to_permissioned_as;
 use windmill_common::worker::to_raw_value;
 use windmill_common::workspaces::get_datatable_resource_from_db_unchecked;
 use windmill_common::{PgDatabase, DB};
-use windmill_git_sync::{handle_deployment_metadata, DeployedObject};
+use windmill_git_sync::{
+    handle_deployment_metadata, handle_deployment_metadata_batch, DeployedObject,
+};
 use windmill_queue::{push, PushArgs, PushIsolationLevel};
 
 pub(crate) fn routes() -> Router {
@@ -164,6 +166,7 @@ async fn run_datatable_migration_job(
         &authed.email,
         username_to_permissioned_as(&authed.username),
         authed.token_prefix.as_deref(),
+        authed.username_override.as_deref(),
         None,
         None,
         None,
@@ -929,6 +932,37 @@ pub(crate) fn validate_datatable_path_segment(datatable: &str) -> Result<()> {
     Ok(())
 }
 
+/// A data table's name is a path segment of every migration it owns, and git sync
+/// carries that path through three matchers that all speak the same restricted
+/// charset: `transform_regexp` expands a repo's `**` filter to `[a-zA-Z0-9_\-./]*`,
+/// the CLI reuses the path as a minimatch pattern (where a leading `.` also needs
+/// `dot: true`, which the CLI does not set), and the deploy stages it as a
+/// `git add` pathspec. A name outside the charset matches nothing in all three, so
+/// its migrations would silently never reach the repo.
+///
+/// Only names being introduced are held to this — an existing data table keeps
+/// saving (and can be renamed to a syncable name) instead of locking its workspace
+/// out of the settings form.
+pub(crate) fn validate_new_datatable_name(datatable: &str) -> Result<()> {
+    validate_datatable_path_segment(datatable)?;
+    let starts_alphanumeric = datatable
+        .chars()
+        .next()
+        .is_some_and(|c| c.is_ascii_alphanumeric());
+    if !starts_alphanumeric
+        || !datatable
+            .chars()
+            .all(|c| c.is_ascii_alphanumeric() || matches!(c, '_' | '-' | '.'))
+    {
+        return Err(Error::BadRequest(format!(
+            "Invalid data table name '{datatable}': start with a letter or digit and use only \
+             letters, digits, '_', '-' and '.' so its SQL migrations can be synced to a git \
+             repository"
+        )));
+    }
+    Ok(())
+}
+
 /// Record a data table migration change as a deployed object so it is tallied
 /// into `workspace_diff` and shows up as a `datatable_migration` item in the
 /// workspace-merge diff. The diff path is `<datatable>/<timestamp>_<name>`,
@@ -941,6 +975,15 @@ async fn record_datatable_migration_deployment(
     timestamp: i64,
     name: &str,
 ) -> Result<()> {
+    // A data table predating `validate_new_datatable_name` can carry a name no
+    // repo filter can match; say so once per change instead of letting the deploy
+    // vanish inside the path filter.
+    if validate_new_datatable_name(datatable).is_err() {
+        tracing::warn!(
+            "Data table '{datatable}' has a name git sync cannot match, so its SQL migrations \
+             will not reach a linked repository. Rename it to letters, digits, '_', '-' and '.'."
+        );
+    }
     handle_deployment_metadata(
         &authed.email,
         &authed.username,
@@ -1536,21 +1579,33 @@ async fn remote_rename_datatable_migrations(
 /// temporarily unreachable data-table database is logged rather than failing the
 /// whole config edit. If one is missed, the next run re-applies its migrations
 /// against the existing schema.
+///
+/// Returns every migration path the cascade moved or removed, so the caller can
+/// deploy them once `tx` commits — otherwise a linked git repo keeps the files of
+/// a deleted or pre-rename data table forever.
 pub(crate) async fn cascade_datatable_migration_renames_and_deletes(
     db: &DB,
     tx: &mut Transaction<'_, Postgres>,
     w_id: &str,
     renames: &[DatatableRename],
     deleted_datatables: &[String],
-) -> Result<()> {
+) -> Result<Vec<String>> {
+    let mut changed_paths: Vec<String> = vec![];
+
     if !deleted_datatables.is_empty() {
-        sqlx::query!(
-            "DELETE FROM datatable_migrations WHERE workspace_id = $1 AND datatable = ANY($2::text[])",
+        let deleted = sqlx::query!(
+            "DELETE FROM datatable_migrations WHERE workspace_id = $1 AND datatable = ANY($2::text[]) \
+             RETURNING datatable, timestamp, name",
             w_id,
             deleted_datatables
         )
-        .execute(&mut **tx)
+        .fetch_all(&mut **tx)
         .await?;
+        changed_paths.extend(
+            deleted
+                .into_iter()
+                .map(|m| format!("{}/{}_{}", m.datatable, m.timestamp, m.name)),
+        );
     }
 
     for (i, r) in renames.iter().enumerate() {
@@ -1566,14 +1621,21 @@ pub(crate) async fn cascade_datatable_migration_renames_and_deletes(
     }
     for (i, r) in renames.iter().enumerate() {
         let tmp = format!("__wm_rename_tmp/{i}");
-        sqlx::query!(
-            "UPDATE datatable_migrations SET datatable = $3 WHERE workspace_id = $1 AND datatable = $2",
+        let moved = sqlx::query!(
+            "UPDATE datatable_migrations SET datatable = $3 WHERE workspace_id = $1 AND datatable = $2 \
+             RETURNING timestamp, name",
             w_id,
             &tmp,
             &r.to
         )
-        .execute(&mut **tx)
+        .fetch_all(&mut **tx)
         .await?;
+        for m in moved {
+            // Both ends: the old path so its files are dropped from the repo, the
+            // new one so they reappear under the renamed data table.
+            changed_paths.push(format!("{}/{}_{}", r.from, m.timestamp, m.name));
+            changed_paths.push(format!("{}/{}_{}", r.to, m.timestamp, m.name));
+        }
     }
 
     for name in deleted_datatables {
@@ -1602,7 +1664,34 @@ pub(crate) async fn cascade_datatable_migration_renames_and_deletes(
         }
     }
 
-    Ok(())
+    Ok(changed_paths)
+}
+
+/// Deploy the migration paths a data table rename/delete moved or removed, so a
+/// linked git repo drops the stale files and picks up the renamed ones. Call
+/// after the config transaction commits — the deploy reads the workspace export.
+pub(crate) async fn record_datatable_cascade_deployments(
+    authed: &ApiAuthed,
+    db: &DB,
+    w_id: &str,
+    changed_paths: Vec<String>,
+) -> Result<()> {
+    if changed_paths.is_empty() {
+        return Ok(());
+    }
+    let objs = changed_paths
+        .into_iter()
+        .map(|path| DeployedObject::DatatableMigration { path })
+        .collect();
+    handle_deployment_metadata_batch(
+        &authed.email,
+        &authed.username,
+        db,
+        w_id,
+        objs,
+        Some("Data table migrations updated by a data table rename or deletion".to_string()),
+    )
+    .await
 }
 
 /// Copy a workspace's migration definitions to another workspace, so a fork
@@ -1673,6 +1762,30 @@ mod tests {
         }
     }
 
+    // A new name must survive the git-sync path matchers; an existing one is only
+    // held to the escape rule, so a workspace carrying a legacy name can still save
+    // its settings and rename its way out.
+    #[test]
+    fn validate_new_datatable_name_requires_a_sync_safe_charset() {
+        for ok in ["mydt", "my-dt", "my_dt.v2", "main"] {
+            assert!(validate_new_datatable_name(ok).is_ok(), "{ok} should be ok");
+        }
+        for bad in [
+            "a b", "a*b", "a[b]", "a{b}", "a?b", "café", ".staging", "-dt", "a/b", "",
+        ] {
+            assert!(
+                validate_new_datatable_name(bad).is_err(),
+                "{bad} should be rejected"
+            );
+            if bad != "a/b" && !bad.is_empty() {
+                assert!(
+                    validate_datatable_path_segment(bad).is_ok(),
+                    "{bad} should still be storable once persisted"
+                );
+            }
+        }
+    }
+
     #[test]
     fn parse_datatable_migration_diff_path_roundtrips() {
         assert_eq!(
@@ -1730,8 +1843,9 @@ mod tests {
     }
 
     // The cascade keeps each data table's migrations attached to its name when a
-    // data table is renamed, drops them when it is deleted, and survives a swap
-    // (A->B, B->A) at a shared timestamp without a primary-key collision.
+    // data table is renamed, drops them when it is deleted, survives a swap
+    // (A->B, B->A) at a shared timestamp without a primary-key collision, and
+    // reports both ends of every move so git sync drops the stale files.
     #[sqlx::test(migrations = "../migrations")]
     async fn cascade_renames_and_deletes_datatable_migrations(pool: DB) {
         let w_id = format!("dtmig{}", uuid::Uuid::new_v4().simple());
@@ -1748,7 +1862,7 @@ mod tests {
         seed_migration(&pool, &w_id, "sb", 5000, "sb_mig").await;
 
         let mut tx = pool.begin().await.unwrap();
-        cascade_datatable_migration_renames_and_deletes(
+        let mut changed = cascade_datatable_migration_renames_and_deletes(
             &pool,
             &mut tx,
             &w_id,
@@ -1771,6 +1885,20 @@ mod tests {
                 ("sb".to_string(), "sa_mig".to_string()),
             ]
         );
+
+        changed.sort();
+        assert_eq!(
+            changed,
+            vec![
+                "a/1_a_mig".to_string(),
+                "a2/1_a_mig".to_string(),
+                "d/1_d_mig".to_string(),
+                "sa/5000_sa_mig".to_string(),
+                "sa/5000_sb_mig".to_string(),
+                "sb/5000_sa_mig".to_string(),
+                "sb/5000_sb_mig".to_string(),
+            ]
+        );
     }
 
     // A fork inherits its parent's migration definitions unchanged.
diff --git a/backend/windmill-api-workspaces/src/workspaces.rs b/backend/windmill-api-workspaces/src/workspaces.rs
index 6e5e9cecc0..f69c9dbd9a 100644
--- a/backend/windmill-api-workspaces/src/workspaces.rs
+++ b/backend/windmill-api-workspaces/src/workspaces.rs
@@ -123,6 +123,7 @@ pub fn workspaced_service() -> Router {
             "/edit_large_file_storage_config",
             post(edit_large_file_storage_config),
         )
+        .route("/edit_dbt_warehouses", post(edit_dbt_warehouses))
         .route("/edit_ducklake_config", post(edit_ducklake_config))
         .route("/list_ducklakes", get(list_ducklakes))
         .route("/list_datatables", get(list_datatables))
@@ -246,6 +247,8 @@ struct Workspace {
     premium: bool,
     color: Option<String>,
     parent_workspace_id: Option<String>,
+    is_dev_workspace: bool,
+    dev_workspace_label: Option<String>,
 }
 
 #[derive(FromRow, Serialize, Debug)]
@@ -277,6 +280,9 @@ pub struct WorkspaceSettings {
     pub webhook: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub ai_config: Option<serde_json::Value>,
+    /// Pointers to the resources dbt scripts run against by default.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub dbt_warehouses: Option<serde_json::Value>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub large_file_storage: Option<serde_json::Value>,
     #[serde(skip_serializing_if = "Option::is_none")]
@@ -484,8 +490,8 @@ struct CreateWorkspaceFork {
     /// the team can work in it. Defaults off; the dev-workspace UI defaults it on.
     #[serde(default)]
     copy_members: bool,
-    /// Cosmetic display label for the dev workspace: 'dev' | 'staging'. Purely visual (badge text +
-    /// wording); ignored for non-dev forks. None defaults to 'dev'.
+    /// Environment label for the dev workspace, e.g. 'dev' or 'staging': its badge text and the
+    /// branch it deploys to. Ignored for non-dev forks. None defaults to 'dev'.
     #[serde(default)]
     dev_workspace_label: Option<String>,
 }
@@ -653,7 +659,8 @@ async fn list_pending_invites(
             workspace_invite.operator,
             workspace.parent_workspace_id
         FROM workspace_invite JOIN workspace ON workspace_invite.workspace_id = workspace.id
-        WHERE workspace_id = $1",
+        WHERE workspace_id = $1
+        ORDER BY workspace_invite.email",
         w_id
     )
     .fetch_all(&mut *tx)
@@ -706,16 +713,84 @@ struct DevWorkspaceInfo {
     dev_workspace_label: Option<String>,
 }
 
-/// Normalize/validate the cosmetic dev-workspace display label. None or 'dev' both render as "dev";
-/// 'staging' renders as "stg". Anything else is rejected. Stored explicitly ('dev'/'staging') so it
-/// round-trips, but a NULL column is treated as 'dev' on the read side too.
+/// The environment labels a dev workspace may carry, ordered dev -> prod. Each names the git branch
+/// that workspace deploys to (`dev_workspace_branch`), and every dev workspace in a chain must
+/// carry a distinct one (`reject_dev_label_taken_in_chain`) — so the length of this list is also
+/// the deepest promotion chain. A fixed list rather than free text: the label has to be a usable
+/// single-segment branch name, must not collide with the `wm-fork/**` and `wm_deploy/**` namespaces
+/// git-sync already writes, and must not be a repository's default branch (`main`, `master`).
+pub const DEV_WORKSPACE_LABELS: [&str; 8] = [
+    "dev", "qa", "test", "uat", "staging", "demo", "sandbox", "preprod",
+];
+
+/// Normalize/validate the dev-workspace environment label. Unset defaults to 'dev', which is also
+/// what a NULL column reads as; any supplied value must be one of `DEV_WORKSPACE_LABELS` exactly,
+/// so the accepted set is what the OpenAPI enum advertises — no trimming, no empty-string alias.
 fn normalize_dev_workspace_label(label: Option<String>) -> Result<Option<String>> {
-    match label.as_deref() {
-        None | Some("dev") => Ok(Some("dev".to_string())),
-        Some("staging") => Ok(Some("staging".to_string())),
-        Some(other) => Err(Error::BadRequest(format!(
-            "invalid dev workspace label '{other}' (expected 'dev' or 'staging')"
-        ))),
+    let Some(label) = label else {
+        return Ok(Some("dev".to_string()));
+    };
+    if !DEV_WORKSPACE_LABELS.contains(&label.as_str()) {
+        return Err(Error::BadRequest(format!(
+            "invalid dev workspace label '{label}' (expected one of: {})",
+            DEV_WORKSPACE_LABELS.join(", ")
+        )));
+    }
+    Ok(Some(label))
+}
+
+#[cfg(test)]
+mod dev_workspace_label_tests {
+    use super::{normalize_dev_workspace_label, tracked_branch_blocks_dev_label};
+
+    #[test]
+    fn tracked_branch_blocks_its_own_name_and_its_namespace() {
+        assert!(tracked_branch_blocks_dev_label("uat", "uat"));
+        // The label would have to be a ref and a ref directory at once.
+        assert!(tracked_branch_blocks_dev_label("release", "release/main"));
+        assert!(!tracked_branch_blocks_dev_label("release", "release-main"));
+        assert!(!tracked_branch_blocks_dev_label("release", "main"));
+        assert!(!tracked_branch_blocks_dev_label("uat", "pre/uat"));
+    }
+
+    fn norm(label: &str) -> Option<String> {
+        normalize_dev_workspace_label(Some(label.to_string()))
+            .ok()
+            .flatten()
+    }
+
+    #[test]
+    fn unset_defaults_to_dev() {
+        assert_eq!(
+            normalize_dev_workspace_label(None).unwrap().as_deref(),
+            Some("dev")
+        );
+    }
+
+    #[test]
+    fn accepts_every_offered_label_and_nothing_else() {
+        for label in super::DEV_WORKSPACE_LABELS {
+            assert_eq!(norm(label).as_deref(), Some(label), "rejected '{label}'");
+        }
+        // Off-list names are refused whether or not they would make a usable branch: the list is
+        // what keeps a label off `main`/`master` and out of the `wm-fork/**` and `wm_deploy/**`
+        // namespaces git-sync writes. Padded and empty values are refused too, so the accepted set
+        // is exactly the OpenAPI enum rather than a superset a validating client would reject.
+        for label in [
+            " uat ",
+            "",
+            "main",
+            "master",
+            "wm-fork",
+            "wm_deploy",
+            "UAT",
+            "feature/uat",
+        ] {
+            assert!(
+                normalize_dev_workspace_label(Some(label.to_string())).is_err(),
+                "accepted '{label}'"
+            );
+        }
     }
 }
 
@@ -745,7 +820,7 @@ async fn list_workspaces(
     let mut tx = user_db.begin(&authed).await?;
     let workspaces = sqlx::query_as!(
         Workspace,
-        "SELECT workspace.id, workspace.name, workspace.owner, workspace.deleted, workspace.premium, workspace_settings.color, workspace.parent_workspace_id
+        "SELECT workspace.id, workspace.name, workspace.owner, workspace.deleted, workspace.premium, workspace_settings.color, workspace.parent_workspace_id, workspace.is_dev_workspace, workspace.dev_workspace_label
          FROM workspace
          LEFT JOIN workspace_settings ON workspace.id = workspace_settings.workspace_id
          JOIN usr ON usr.workspace_id = workspace.id
@@ -789,11 +864,23 @@ fn clear_client_supplied_auto_pull_state(
     auto_pull.last_pull_status = None;
 }
 
-/// A dev workspace deploys to a branch named after its environment label. If a
-/// git-sync repository's tracked branch carries that same name, dev deploys
-/// would write straight into the branch the workspace (or its prod) syncs
-/// from — the CLI refuses that push, so every deploy job would fail. Reject
-/// the label up front instead.
+/// Whether a git-sync repository tracking `tracked` rules out `label_branch` as a dev workspace's
+/// deploy branch. Two ways it can:
+///
+/// - the same name: dev deploys would write straight into the branch the workspace (or its prod)
+///   syncs from, and the CLI refuses that push;
+/// - `label_branch` is the namespace `tracked` sits under (label `release`, tracked
+///   `release/main`): git stores refs hierarchically, so `refs/heads/release` cannot exist
+///   alongside `refs/heads/release/main`.
+///
+/// Either way every deploy job from that workspace would fail.
+fn tracked_branch_blocks_dev_label(label_branch: &str, tracked: &str) -> bool {
+    tracked == label_branch || tracked.starts_with(&format!("{label_branch}/"))
+}
+
+/// Reject a label whose branch clashes with a tracked branch of any git-sync repository on
+/// `workspace_ids`, before the pairing is created. (`wm-fork` and `wm_deploy`, whose namespaces
+/// exist whatever a repo tracks, are reserved unconditionally in `normalize_dev_workspace_label`.)
 async fn reject_dev_label_matching_tracked_branch(
     db: &DB,
     label: Option<&str>,
@@ -821,14 +908,31 @@ async fn reject_dev_label_matching_tracked_branch(
             .fetch_optional(db)
             .await?
             .flatten();
-            if branch.as_deref() == Some(label_branch.as_str()) {
-                return Err(Error::BadRequest(format!(
+            // A repository that pins no branch tracks the remote's default, which cannot be
+            // resolved here without a network call — but no offered label is a plausible default
+            // (`main`/`master` are off the list), so there is nothing to compare against.
+            let Some(tracked) = branch.as_deref().filter(|b| !b.is_empty()) else {
+                continue;
+            };
+            if !tracked_branch_blocks_dev_label(&label_branch, tracked) {
+                continue;
+            }
+            return Err(Error::BadRequest(if tracked == label_branch {
+                format!(
                     "The environment label '{label_branch}' matches the tracked branch of git-sync \
                      repository '{path}' in workspace '{w_id}': deploys from the dev workspace go \
                      to the '{label_branch}' branch and would overwrite the branch that repository \
-                     syncs from. Use the other label or change the repository's tracked branch."
-                )));
-            }
+                     syncs from. Use a different label or change the repository's branch."
+                )
+            } else {
+                format!(
+                    "The environment label '{label_branch}' is the namespace of the tracked branch \
+                     '{tracked}' of git-sync repository '{path}' in workspace '{w_id}': git cannot \
+                     hold a branch named '{label_branch}' alongside '{tracked}', so every deploy \
+                     from the dev workspace would fail. Use a different label or change the \
+                     repository's branch."
+                )
+            }));
         }
     }
     Ok(())
@@ -909,6 +1013,7 @@ async fn get_settings(
             plan,
             webhook,
             ai_config,
+            dbt_warehouses,
             large_file_storage,
             datatable,
             ducklake,
@@ -1738,6 +1843,95 @@ async fn edit_webhook(
     Ok(format!("Edit webhook for workspace {}", &w_id))
 }
 
+/// A warehouse's resource, checked at the one place a warehouse is written.
+///
+/// Same grammar as any Windmill resource path, with the `$res:` prefix optional
+/// because the storage configs are inconsistent about it. Traversal and control
+/// characters are refused here rather than at the far end: an unusable path
+/// stored now surfaces as every dbt run in the workspace failing later, with
+/// nothing pointing back at the settings page that accepted it.
+fn validate_dbt_resource_path(name: &str, path: &str) -> Result<()> {
+    let bare = path.strip_prefix("$res:").unwrap_or(path);
+    let parts: Vec<&str> = bare.split('/').collect();
+    let ok = (bare.starts_with("f/") || bare.starts_with("u/"))
+        && parts.len() >= 3
+        && parts
+            .iter()
+            .all(|p| !p.is_empty() && *p != "." && *p != "..")
+        // `resource.path` is VARCHAR(255), so a longer path names a resource that
+        // cannot exist.
+        && bare.chars().count() <= 255
+        && !bare.chars().any(|c| c.is_control() || "?#%\\ ".contains(c));
+    if !ok {
+        return Err(Error::BadRequest(format!(
+            "the dbt warehouse `{name}` names `{path}`, which is not a resource path \
+             (`f/<folder>/<name>` or `u/<user>/<name>`, optionally prefixed with `$res:`)"
+        )));
+    }
+    Ok(())
+}
+
+#[derive(serde::Deserialize, serde::Serialize)]
+struct DbtWarehouseConfig {
+    resource_path: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    target: Option<String>,
+}
+
+#[derive(serde::Deserialize)]
+struct EditDbtWarehouses {
+    /// Typed rather than free JSON: a shape the resolver cannot read (a list, a
+    /// number where a config belongs) would be accepted here and then fail every
+    /// dbt run in the workspace, far from the request that caused it.
+    dbt_warehouses: Option<std::collections::HashMap<String, DbtWarehouseConfig>>,
+}
+
+/// The workspace's dbt warehouses, by name, each a POINTER to a resource rather
+/// than credentials — like `large_file_storage`. A dbt project can then carry no
+/// connection at all, and the resource keeps its own ACL. Admin-only, because it
+/// decides what every dbt script in the workspace reaches.
+async fn edit_dbt_warehouses(
+    authed: ApiAuthed,
+    Extension(db): Extension<DB>,
+    Path(w_id): Path<String>,
+    ApiAuthed { is_admin, username, .. }: ApiAuthed,
+    Json(new_config): Json<EditDbtWarehouses>,
+) -> Result<String> {
+    require_admin(is_admin, &username)?;
+    let new_config = new_config.dbt_warehouses;
+    if let Some(map) = new_config.as_ref() {
+        for (name, cfg) in map.iter() {
+            windmill_common::workspaces::validate_dbt_warehouse_name(name)?;
+            validate_dbt_resource_path(name, &cfg.resource_path)?;
+        }
+    }
+    let new_config = new_config
+        .map(|m| serde_json::to_value(m))
+        .transpose()
+        .map_err(|e| Error::internal_err(format!("serializing the dbt warehouses: {e}")))?;
+    let mut tx = db.begin().await?;
+    audit_log(
+        &mut *tx,
+        &authed,
+        "workspaces.edit_dbt_warehouses",
+        ActionKind::Update,
+        &w_id,
+        Some(&authed.email),
+        Some([("dbt_warehouses", format!("{new_config:?}").as_str())].into()),
+    )
+    .await?;
+    let value = new_config.filter(|v| !v.is_null());
+    sqlx::query!(
+        "UPDATE workspace_settings SET dbt_warehouses = $1 WHERE workspace_id = $2",
+        value,
+        &w_id
+    )
+    .execute(&mut *tx)
+    .await?;
+    tx.commit().await?;
+    Ok("Updated the workspace's dbt warehouses".to_string())
+}
+
 async fn edit_large_file_storage_config(
     authed: ApiAuthed,
     Extension(db): Extension<DB>,
@@ -2415,6 +2609,16 @@ mod tests {
         assert!(!json_text_has_nul_escape(&nul_json(0)));
     }
 
+    #[test]
+    fn dbt_resource_path_length_bound() {
+        let at_limit = format!("f/dbt/{}", "a".repeat(255 - "f/dbt/".len()));
+        assert_eq!(at_limit.chars().count(), 255);
+        assert!(validate_dbt_resource_path("main", &at_limit).is_ok());
+        // The `$res:` prefix is not stored, so it does not count against the column.
+        assert!(validate_dbt_resource_path("main", &format!("$res:{at_limit}")).is_ok());
+        assert!(validate_dbt_resource_path("main", &format!("{at_limit}a")).is_err());
+    }
+
     #[test]
     fn nul_escape_ignores_clean_values() {
         assert!(!json_text_has_nul_escape(
@@ -2536,7 +2740,7 @@ pub(crate) async fn pg_dump_database(
 
     let host = &pg_db.host;
     let port = pg_db.port.unwrap_or(5432).to_string();
-    let user = pg_db.user.as_deref().unwrap_or("postgres");
+    let user = pg_db.login_name();
     let dbname = &pg_db.dbname;
 
     let mut cmd = tokio::process::Command::new("pg_dump");
@@ -2580,7 +2784,7 @@ pub(crate) async fn pg_dump_database(
 async fn pg_import_dump(target_db: &PgDatabase, dump_file: &DumpFile) -> Result<()> {
     let host = &target_db.host;
     let port = target_db.port.unwrap_or(5432).to_string();
-    let user = target_db.user.as_deref().unwrap_or("postgres");
+    let user = target_db.login_name();
     let dbname = &target_db.dbname;
 
     let mut cmd = tokio::process::Command::new("psql");
@@ -2947,13 +3151,19 @@ async fn edit_datatable_config(
 
     // Validate every persisted data table name and rename segment before
     // touching anything, since they become directory segments in migration
-    // storage/export keys (`migrations/datatable/<name>/...`).
+    // storage/export keys (`migrations/datatable/<name>/...`). Names being
+    // introduced take the stricter git-sync-safe charset; already-persisted ones
+    // keep the historical rule so an old name can still be saved and renamed.
     for name in new_config.settings.datatables.keys() {
-        crate::datatable_migrations::validate_datatable_path_segment(name)?;
+        if old_datatables.contains_key(name) {
+            crate::datatable_migrations::validate_datatable_path_segment(name)?;
+        } else {
+            crate::datatable_migrations::validate_new_datatable_name(name)?;
+        }
     }
     for r in &new_config.renames {
         crate::datatable_migrations::validate_datatable_path_segment(&r.from)?;
-        crate::datatable_migrations::validate_datatable_path_segment(&r.to)?;
+        crate::datatable_migrations::validate_new_datatable_name(&r.to)?;
     }
 
     // Map new name -> old name so a renamed data table inherits the previous
@@ -3020,17 +3230,26 @@ async fn edit_datatable_config(
     .execute(&mut *tx)
     .await?;
 
-    crate::datatable_migrations::cascade_datatable_migration_renames_and_deletes(
-        &db,
-        &mut tx,
-        &w_id,
-        &new_config.renames,
-        &new_config.deleted_datatables,
-    )
-    .await?;
+    let cascaded_migration_paths =
+        crate::datatable_migrations::cascade_datatable_migration_renames_and_deletes(
+            &db,
+            &mut tx,
+            &w_id,
+            &new_config.renames,
+            &new_config.deleted_datatables,
+        )
+        .await?;
 
     tx.commit().await?;
 
+    crate::datatable_migrations::record_datatable_cascade_deployments(
+        &authed,
+        &db,
+        &w_id,
+        cascaded_migration_paths,
+    )
+    .await?;
+
     Ok(format!("Edit datatable config for workspace {}", &w_id))
 }
 
@@ -4708,7 +4927,9 @@ async fn get_workspace_as_superadmin(
             workspace.deleted AS \"deleted!\",
             workspace.premium AS \"premium!\",
             workspace_settings.color AS \"color\",
-            workspace.parent_workspace_id AS \"parent_workspace_id\"
+            workspace.parent_workspace_id AS \"parent_workspace_id\",
+            workspace.is_dev_workspace AS \"is_dev_workspace!\",
+            workspace.dev_workspace_label AS \"dev_workspace_label\"
         FROM workspace
         LEFT JOIN workspace_settings ON workspace.id = workspace_settings.workspace_id
         WHERE workspace.id = $1",
@@ -4742,7 +4963,9 @@ async fn list_workspaces_as_super_admin(
             workspace.deleted AS \"deleted!\",
             workspace.premium AS \"premium!\",
             workspace_settings.color AS \"color\",
-            workspace.parent_workspace_id AS \"parent_workspace_id\"
+            workspace.parent_workspace_id AS \"parent_workspace_id\",
+            workspace.is_dev_workspace AS \"is_dev_workspace!\",
+            workspace.dev_workspace_label AS \"dev_workspace_label\"
         FROM workspace
         LEFT JOIN workspace_settings ON workspace.id = workspace_settings.workspace_id
          LIMIT $1 OFFSET $2",
@@ -4786,11 +5009,17 @@ struct SessionWorkspaceStatusRequest {
 
 /// Reconciliation support for client-side AI sessions, which the backend cannot touch
 /// directly. The client posts the workspace ids its sessions reference and uses the
-/// per-id status to keep sessions in sync with workspace lifecycle: `deleted` (no row /
-/// no access → unresolvable) drops the sessions, `archived` (soft-deleted, still a
-/// member) archives them, `active` restores ones previously archived-by-workspace.
+/// per-id status to keep sessions in sync with workspace lifecycle: `deleted` (no row, or
+/// no way for this caller to reach it) drops the sessions, `archived` (soft-deleted, still
+/// reachable) archives them, `active` restores ones previously archived-by-workspace.
 /// Archived and hard-deleted workspaces are absent from `user_workspaces`, so this is the
 /// only way the client learns about a change made while it was away or on another device.
+///
+/// Membership alone under-reports reachability: a superadmin is authed into any existing
+/// workspace without a `usr` row, and `admins` has no `usr` rows at all, so answering from
+/// `usr` destroys sessions that still work. It over-reports in one direction — a `usr` row
+/// with `disabled` counts here but not in the extractor — which only leaves a session
+/// lingering, so it is deliberately not treated as unreachable.
 async fn session_workspace_status(
     Extension(db): Extension<DB>,
     ApiAuthed { email, .. }: ApiAuthed,
@@ -4801,10 +5030,15 @@ async fn session_workspace_status(
             "Too many workspace ids (max 1000)".to_string(),
         ));
     }
+    let is_superadmin = windmill_common::auth::is_super_admin_email(&db, &email).await?;
     let rows = sqlx::query!(
+        // A missing workspace row must be caught before the membership arm: for a
+        // superadmin the two arms below both fall through, and a hard-deleted workspace
+        // would report `active` forever.
         "SELECT req.id AS \"id!\",
                 (CASE
-                    WHEN usr.email IS NULL THEN 'deleted'
+                    WHEN workspace.id IS NULL THEN 'deleted'
+                    WHEN usr.email IS NULL AND NOT $3 THEN 'deleted'
                     WHEN workspace.deleted THEN 'archived'
                     ELSE 'active'
                 END) AS \"status!\"
@@ -4813,6 +5047,7 @@ async fn session_workspace_status(
          LEFT JOIN usr ON usr.workspace_id = workspace.id AND usr.email = $2",
         &req.workspace_ids[..],
         email,
+        is_superadmin,
     )
     .fetch_all(&db)
     .await?;
@@ -5187,6 +5422,12 @@ async fn clone_workspace_data(
     // Clone scripts with new hashes
     clone_scripts(tx, source_workspace_id, target_workspace_id).await?;
 
+    // Clone the dbt graph sidecars. After `clone_scripts`, which keeps each
+    // script's hash: these key on it, and a static descriptor never re-ingests,
+    // so a fork without them shows dbt scripts with no models until someone
+    // redeploys.
+    clone_dbt_graph(tx, source_workspace_id, target_workspace_id).await?;
+
     // Clone CI test references
     clone_ci_test_references(tx, source_workspace_id, target_workspace_id).await?;
     clone_macro_registry(tx, source_workspace_id, target_workspace_id).await?;
@@ -5455,14 +5696,14 @@ async fn clone_triggers_and_schedules(
         r#"INSERT INTO azure_trigger (
             azure_resource_path, azure_mode, scope_resource_id, topic_name,
             subscription_name, event_type_filters, push_auth_config, path, script_path,
-            is_flow, workspace_id, edited_by, email, edited_at, extra_perms, server_id,
+            is_flow, workspace_id, edited_by, edited_at, extra_perms, server_id,
             last_server_ping, error, mode, permissioned_as, error_handler_path,
             error_handler_args, retry, labels
         )
         SELECT
             azure_resource_path, azure_mode, scope_resource_id, topic_name,
             subscription_name, event_type_filters, push_auth_config, path, script_path,
-            is_flow, $1, edited_by, email, edited_at, extra_perms, NULL,
+            is_flow, $1, edited_by, edited_at, extra_perms, NULL,
             NULL, NULL, 'disabled'::TRIGGER_MODE, permissioned_as, error_handler_path,
             error_handler_args, retry, labels
         FROM azure_trigger WHERE workspace_id = $2"#,
@@ -5521,6 +5762,7 @@ async fn update_workspace_settings(
             ai_config = source_ws.ai_config,
             large_file_storage = source_ws.large_file_storage,
             ducklake = source_ws.ducklake,
+            dbt_warehouses = source_ws.dbt_warehouses,
             datatable = source_ws.datatable,
             git_app_installations = source_ws.git_app_installations
         FROM workspace_settings source_ws
@@ -5779,6 +6021,11 @@ async fn clone_variables(
     Ok(())
 }
 
+/// A principal is workspace-scoped — `usr` is keyed by `(workspace_id, username)` — and a
+/// clone lands in a workspace with its own membership, so it is kept only when it still
+/// resolves there (the fork copies usernames and groups verbatim, and an instance superadmin
+/// resolves anywhere). Dropping one that names nobody is the only safe alternative: it could
+/// not authenticate, and the runnable falls back to running as its caller.
 async fn clone_scripts(
     tx: &mut Transaction<'_, Postgres>,
     source_workspace_id: &str,
@@ -5794,7 +6041,7 @@ async fn clone_scripts(
             dedicated_worker, ws_error_handler_muted, priority, timeout,
             delete_after_use, delete_after_secs, restart_unless_cancelled, concurrency_key,
             visible_to_runner_only, auto_kind, codebase, has_preprocessor,
-            on_behalf_of_email, assets, modules
+            on_behalf_of, on_behalf_of_email, assets, modules
         )
         SELECT
             $1, hash, path, parent_hashes, summary, description, content,
@@ -5804,7 +6051,29 @@ async fn clone_scripts(
             dedicated_worker, ws_error_handler_muted, priority, timeout,
             delete_after_use, delete_after_secs, restart_unless_cancelled, concurrency_key,
             visible_to_runner_only, auto_kind, codebase, has_preprocessor,
-            on_behalf_of_email, assets, modules
+            -- Same three forms and the same prefix-first rule as permissioned_as_exists,
+            -- superadmin fallback included: one acting outside their workspaces has no usr
+            -- row but still authenticates.
+            CASE WHEN on_behalf_of LIKE 'u/%' THEN
+                    (SELECT on_behalf_of WHERE EXISTS (
+                        SELECT 1 FROM usr u WHERE u.workspace_id = $1::varchar
+                          AND u.username = substring(on_behalf_of from 3)
+                        UNION ALL
+                        SELECT 1 FROM password p WHERE p.super_admin
+                          AND (p.username = substring(on_behalf_of from 3)
+                               OR p.email = substring(on_behalf_of from 3))))
+                 WHEN on_behalf_of LIKE 'g/%' THEN
+                    (SELECT on_behalf_of WHERE EXISTS (
+                        SELECT 1 FROM group_ g WHERE g.workspace_id = $1::varchar
+                          AND g.name = substring(on_behalf_of from 3)))
+                 ELSE
+                    (SELECT on_behalf_of WHERE EXISTS (
+                        SELECT 1 FROM usr u WHERE u.workspace_id = $1::varchar
+                          AND u.username = on_behalf_of
+                        UNION ALL
+                        SELECT 1 FROM password p WHERE p.email = on_behalf_of
+                          AND p.super_admin))
+            END, on_behalf_of_email, assets, modules
         FROM script
         WHERE workspace_id = $2"#,
         target_workspace_id,
@@ -5813,6 +6082,73 @@ async fn clone_scripts(
     .execute(&mut **tx)
     .await?;
 
+    clear_orphaned_compat_address(
+        tx,
+        "script",
+        "hash",
+        source_workspace_id,
+        target_workspace_id,
+    )
+    .await?;
+
+    Ok(())
+}
+
+/// The parsed dbt graph a deployed script carries: its models, their SQL and
+/// tests, and the `ref()` lineage between them.
+///
+/// Keyed on (workspace_id, script_path, script_hash), and the fork keeps every
+/// script's hash, so each row moves across as itself.
+///
+/// The DEPLOYED graph only (`job_id` all-zero). A per-run snapshot is keyed to a
+/// job in the source workspace, which nothing in the fork can ask for, so
+/// copying them adds another workspace's run history — `raw_code` and all — to
+/// every fork transaction to be reclaimed later by the age sweep.
+async fn clone_dbt_graph(
+    tx: &mut Transaction<'_, Postgres>,
+    source_workspace_id: &str,
+    target_workspace_id: &str,
+) -> Result<()> {
+    sqlx::query!(
+        "INSERT INTO dbt_node (workspace_id, script_path, script_hash, job_id, unique_id,
+            resource_type, name, asset_path, materialized, materialize_strategy, unique_key,
+            tags, description, test_kind, test_column, test_args, severity, attached_node,
+            columns, freshness, raw_code, original_file_path, ingested_at)
+         SELECT $2, script_path, script_hash, job_id, unique_id,
+            resource_type, name, asset_path, materialized, materialize_strategy, unique_key,
+            tags, description, test_kind, test_column, test_args, severity, attached_node,
+            columns, freshness, raw_code, original_file_path, ingested_at
+         FROM dbt_node
+         WHERE workspace_id = $1 AND job_id = '00000000-0000-0000-0000-000000000000'",
+        source_workspace_id,
+        target_workspace_id
+    )
+    .execute(&mut **tx)
+    .await?;
+    sqlx::query!(
+        "INSERT INTO dbt_edge (workspace_id, script_path, script_hash, job_id,
+            parent_unique_id, child_unique_id, ingested_at)
+         SELECT $2, script_path, script_hash, job_id, parent_unique_id, child_unique_id,
+            ingested_at
+         FROM dbt_edge
+         WHERE workspace_id = $1 AND job_id = '00000000-0000-0000-0000-000000000000'",
+        source_workspace_id,
+        target_workspace_id
+    )
+    .execute(&mut **tx)
+    .await?;
+    sqlx::query!(
+        "INSERT INTO dbt_graph_snapshot (workspace_id, script_path, script_hash, job_id,
+            digest, relation_root_at_last_ingest, ingested_at)
+         SELECT $2, script_path, script_hash, job_id, digest, relation_root_at_last_ingest,
+            ingested_at
+         FROM dbt_graph_snapshot
+         WHERE workspace_id = $1 AND job_id = '00000000-0000-0000-0000-000000000000'",
+        source_workspace_id,
+        target_workspace_id
+    )
+    .execute(&mut **tx)
+    .await?;
     Ok(())
 }
 
@@ -5915,6 +6251,36 @@ async fn clone_asset_usages_and_triggers(
     Ok(())
 }
 
+/// The address is only meaningful next to the principal it was derived from: where the clone
+/// dropped one that names nobody in the target, an old worker reading the address alone would
+/// still run the row as the account left behind.
+///
+/// Only where *the clone* dropped it. A source row that already had no principal is one a server
+/// predating this release wrote, address alone; that address is all there is to recover it from,
+/// and the migration that drops the column re-derives from it.
+async fn clear_orphaned_compat_address(
+    tx: &mut Transaction<'_, Postgres>,
+    table: &str,
+    key: &str,
+    source_workspace_id: &str,
+    target_workspace_id: &str,
+) -> Result<()> {
+    // SAFETY: `table` and `key` are literals from the two call sites, never user input.
+    sqlx::query(&format!(
+        "UPDATE {table} t SET on_behalf_of_email = NULL
+         WHERE t.workspace_id = $1 AND t.on_behalf_of IS NULL AND t.on_behalf_of_email IS NOT NULL
+           AND EXISTS (SELECT 1 FROM {table} s
+                        WHERE s.workspace_id = $2 AND s.{key} = t.{key}
+                          AND s.on_behalf_of IS NOT NULL)"
+    ))
+    .bind(target_workspace_id)
+    .bind(source_workspace_id)
+    .execute(&mut **tx)
+    .await?;
+    Ok(())
+}
+
+/// Carries over the recorded principal under the rule spelled out on [`clone_scripts`].
 async fn clone_flows(
     tx: &mut Transaction<'_, Postgres>,
     source_workspace_id: &str,
@@ -5926,12 +6292,33 @@ async fn clone_flows(
             workspace_id, path, summary, description, value, edited_by, edited_at,
             archived, schema, extra_perms, dependency_job, tag,
             ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only,
-            concurrency_key, versions, on_behalf_of_email, lock_error_logs
+            concurrency_key, versions, on_behalf_of, on_behalf_of_email, lock_error_logs
         )
         SELECT $2, path, summary, description, value, edited_by, edited_at,
                archived, schema, extra_perms, NULL, tag,
                ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only,
-               concurrency_key, ARRAY[]::bigint[], on_behalf_of_email, lock_error_logs
+               concurrency_key, ARRAY[]::bigint[],
+               -- Same predicate as clone_scripts.
+               CASE WHEN on_behalf_of LIKE 'u/%' THEN
+                       (SELECT on_behalf_of WHERE EXISTS (
+                           SELECT 1 FROM usr u WHERE u.workspace_id = $2::varchar
+                             AND u.username = substring(on_behalf_of from 3)
+                           UNION ALL
+                           SELECT 1 FROM password p WHERE p.super_admin
+                             AND (p.username = substring(on_behalf_of from 3)
+                                  OR p.email = substring(on_behalf_of from 3))))
+                    WHEN on_behalf_of LIKE 'g/%' THEN
+                       (SELECT on_behalf_of WHERE EXISTS (
+                           SELECT 1 FROM group_ g WHERE g.workspace_id = $2::varchar
+                             AND g.name = substring(on_behalf_of from 3)))
+                    ELSE
+                       (SELECT on_behalf_of WHERE EXISTS (
+                           SELECT 1 FROM usr u WHERE u.workspace_id = $2::varchar
+                             AND u.username = on_behalf_of
+                           UNION ALL
+                           SELECT 1 FROM password p WHERE p.email = on_behalf_of
+                             AND p.super_admin))
+               END, on_behalf_of_email, lock_error_logs
         FROM flow
         WHERE workspace_id = $1",
         source_workspace_id,
@@ -5940,6 +6327,9 @@ async fn clone_flows(
     .execute(&mut **tx)
     .await?;
 
+    clear_orphaned_compat_address(tx, "flow", "path", source_workspace_id, target_workspace_id)
+        .await?;
+
     // Then clone flow versions
     let flow_versions = sqlx::query!(
         "SELECT id, workspace_id, path, value, schema, created_by, created_at
@@ -6291,9 +6681,17 @@ async fn clone_drafts(
     target_workspace_id: &str,
     authed_email: &str,
 ) -> Result<()> {
+    // A script/flow draft carries the principal in its value, and deploying it in the clone
+    // would send a pair naming somebody who is not a member there. Stripped rather than
+    // filtered like `clone_scripts`: the address the draft still carries re-derives the
+    // clone's own principal at deploy time, which is the more accurate answer of the two.
     sqlx::query!(
         "INSERT INTO draft (workspace_id, path, typ, value, created_at, email)
-         SELECT $2, path, typ, value, created_at, email
+         SELECT $2, path, typ,
+                CASE WHEN typ IN ('script', 'flow')
+                     THEN to_json(to_jsonb(value) - 'on_behalf_of')
+                     ELSE value END,
+                created_at, email
          FROM draft
          WHERE workspace_id = $1 AND (email = $3 OR email IS NULL)",
         source_workspace_id,
@@ -6400,10 +6798,18 @@ async fn create_workspace_fork_branch(
     // that second call. Validating early lets a bad request fail before any branch is created.
     if nw.is_dev_workspace {
         validate_dev_workspace_id(&nw.id)?;
-        // Reject a bad cosmetic label before any git branch is created (acted on in create_workspace_fork).
+        // Reject a bad label before any git branch is created (acted on in create_workspace_fork).
         let label = normalize_dev_workspace_label(nw.dev_workspace_label.clone())?;
         reject_dev_label_matching_tracked_branch(&db, label.as_deref(), &[&w_id]).await?;
-        ensure_dev_parent_is_root(&db, &w_id).await?;
+        ensure_dev_parent_can_host_dev(&db, &w_id).await?;
+        reject_dev_label_taken_in_chain(
+            &mut *db.acquire().await?,
+            &w_id,
+            &nw.id,
+            false,
+            label.as_deref(),
+        )
+        .await?;
         // Reject before creating any git branch if the parent already has a dev workspace,
         // otherwise the deferred branch-creation job leaves a dangling branch on the synced repos.
         ensure_no_existing_dev_workspace(&db, &w_id).await?;
@@ -6719,11 +7125,19 @@ async fn create_workspace_fork(
         validate_fork_workspace_id(&nw.id)?;
     }
     validate_workspace_name(&nw.name)?;
-    // Cosmetic label only applies to dev workspaces; a non-dev fork stores NULL.
+    // The environment label only applies to dev workspaces; a non-dev fork stores NULL.
     let dev_workspace_label = if nw.is_dev_workspace {
         let label = normalize_dev_workspace_label(nw.dev_workspace_label.clone())?;
         reject_dev_label_matching_tracked_branch(&db, label.as_deref(), &[&parent_workspace_id])
             .await?;
+        reject_dev_label_taken_in_chain(
+            &mut *db.acquire().await?,
+            &parent_workspace_id,
+            &nw.id,
+            false,
+            label.as_deref(),
+        )
+        .await?;
         label
     } else {
         None
@@ -6790,7 +7204,7 @@ async fn create_workspace_fork(
     }
 
     if nw.is_dev_workspace {
-        ensure_dev_parent_is_root(&db, &parent_workspace_id).await?;
+        ensure_dev_parent_can_host_dev(&db, &parent_workspace_id).await?;
         // Creating the canonical dev consumes the parent's one-dev-per-prod slot (and locking prod
         // mutates its protection rules), so require admin of the parent regardless of the lock flags —
         // mirrors attach/detach, which are prod-admin gated. Without this a non-admin forker could
@@ -6801,6 +7215,22 @@ async fn create_workspace_fork(
 
     let mut tx: Transaction<'_, Postgres> = db.begin().await?;
 
+    if nw.is_dev_workspace {
+        // The checks above ran outside a transaction, so the parent's eligibility and the chain's
+        // labels could have changed under us: re-decide both here, under the pairing lock.
+        lock_dev_pairing(&mut tx, &[&parent_workspace_id]).await?;
+        ensure_dev_parent_can_host_dev(&mut *tx, &parent_workspace_id).await?;
+        ensure_no_existing_dev_workspace(&mut *tx, &parent_workspace_id).await?;
+        reject_dev_label_taken_in_chain(
+            &mut *tx,
+            &parent_workspace_id,
+            &nw.id,
+            false,
+            dev_workspace_label.as_deref(),
+        )
+        .await?;
+    }
+
     let forked_id = nw.id;
 
     sqlx::query!(
@@ -6977,7 +7407,7 @@ struct AttachDevWorkspace {
     lock_prod_deploy: bool,
     #[serde(default)]
     lock_prod_forking: bool,
-    /// Cosmetic display label for the attached dev workspace: 'dev' | 'staging'. None defaults to 'dev'.
+    /// Environment label for the attached dev workspace, e.g. 'dev' or 'staging'. None defaults to 'dev'.
     #[serde(default)]
     dev_workspace_label: Option<String>,
 }
@@ -7034,15 +7464,6 @@ async fn attach_dev_workspace(
     // The id is interpolated into a `wm-fork/<branch>/<id>` branch name like any fork.
     validate_dev_workspace_id(&dev_w_id)?;
     let dev_workspace_label = normalize_dev_workspace_label(req.dev_workspace_label.clone())?;
-    // The attached workspace keeps its own sync repos and prod keeps its config;
-    // the label branch must not collide with either side's tracked branch.
-    reject_dev_label_matching_tracked_branch(
-        &db,
-        dev_workspace_label.as_deref(),
-        &[&prod_w_id, &dev_w_id],
-    )
-    .await?;
-
     let dev = sqlx::query!(
         r#"SELECT parent_workspace_id, deleted FROM workspace WHERE id = $1"#,
         &dev_w_id
@@ -7071,24 +7492,41 @@ async fn attach_dev_workspace(
             dev_w_id
         )));
     }
-    // The candidate can't itself be a prod with its own dev workspace (no nested dev chains).
-    ensure_no_existing_dev_workspace(&db, &dev_w_id).await?;
-
-    // Prod must be a root workspace, otherwise attaching could form a parent<->child cycle (e.g.
-    // attaching A as the dev of B when B is already the dev of A), which breaks hierarchy traversal.
-    let prod_has_parent = sqlx::query_scalar!(
-        r#"SELECT (parent_workspace_id IS NOT NULL) AS "has_parent!" FROM workspace WHERE id = $1"#,
+    let prod_exists = sqlx::query_scalar!(
+        r#"SELECT EXISTS(SELECT 1 FROM workspace WHERE id = $1) AS "exists!""#,
         &prod_w_id
     )
-    .fetch_optional(&db)
-    .await?
-    .ok_or_else(|| Error::NotFound(format!("Workspace {} not found", prod_w_id)))?;
-    if prod_has_parent {
-        return Err(Error::BadRequest(format!(
-            "Workspace {} is itself a fork or dev workspace and cannot be a prod workspace",
+    .fetch_one(&db)
+    .await?;
+    if !prod_exists {
+        return Err(Error::NotFound(format!(
+            "Workspace {} not found",
             prod_w_id
         )));
     }
+    // Prod may be a root workspace or another dev workspace (a dev of a dev); a throwaway fork
+    // can't host one.
+    ensure_dev_parent_can_host_dev(&db, &prod_w_id).await?;
+    reject_attach_cycle(&db, &prod_w_id, &dev_w_id).await?;
+
+    // The attached workspace keeps its own sync repos and prod keeps its config; the label branch
+    // must not collide with either side's tracked branch.
+    reject_dev_label_matching_tracked_branch(
+        &db,
+        dev_workspace_label.as_deref(),
+        &[&prod_w_id, &dev_w_id],
+    )
+    .await?;
+    // The candidate keeps its own subtree, so its dev descendants keep their labels and join the
+    // chain alongside it.
+    reject_dev_label_taken_in_chain(
+        &mut *db.acquire().await?,
+        &prod_w_id,
+        &dev_w_id,
+        true,
+        dev_workspace_label.as_deref(),
+    )
+    .await?;
 
     // The caller must be admin of the dev workspace too (or a superadmin).
     let is_admin_of_dev = sqlx::query_scalar!(
@@ -7105,9 +7543,47 @@ async fn attach_dev_workspace(
         )));
     }
 
-    ensure_no_existing_dev_workspace(&db, &prod_w_id).await?;
-
     let mut tx = db.begin().await?;
+    // Everything above ran outside a transaction, so prod's eligibility and the chain's labels could
+    // have changed under us: re-decide both here, under the pairing lock.
+    lock_dev_pairing(&mut tx, &[&prod_w_id, &dev_w_id]).await?;
+    // The candidate was read before the lock, and archiving it is one of the operations the lock
+    // serializes: re-read it, or the pairing lands on a workspace that is gone or has since been
+    // taken by another prod.
+    let dev = sqlx::query!(
+        r#"SELECT parent_workspace_id, deleted FROM workspace WHERE id = $1"#,
+        &dev_w_id
+    )
+    .fetch_optional(&mut *tx)
+    .await?
+    .ok_or_else(|| Error::NotFound(format!("Workspace {} not found", dev_w_id)))?;
+    if dev.deleted {
+        return Err(Error::BadRequest(format!(
+            "Workspace {} is archived",
+            dev_w_id
+        )));
+    }
+    if dev
+        .parent_workspace_id
+        .as_deref()
+        .is_some_and(|p| p != prod_w_id)
+    {
+        return Err(Error::BadRequest(format!(
+            "Workspace {} is already a fork or dev workspace of another workspace",
+            dev_w_id
+        )));
+    }
+    ensure_dev_parent_can_host_dev(&mut *tx, &prod_w_id).await?;
+    reject_attach_cycle(&mut *tx, &prod_w_id, &dev_w_id).await?;
+    ensure_no_existing_dev_workspace(&mut *tx, &prod_w_id).await?;
+    reject_dev_label_taken_in_chain(
+        &mut *tx,
+        &prod_w_id,
+        &dev_w_id,
+        true,
+        dev_workspace_label.as_deref(),
+    )
+    .await?;
     sqlx::query!(
         "UPDATE workspace SET parent_workspace_id = $1, is_dev_workspace = true, dev_workspace_label = $3 WHERE id = $2",
         &prod_w_id,
@@ -7279,6 +7755,11 @@ async fn detach_dev_workspace(
     require_admin(authed.is_admin, &authed.username)?;
 
     let dev_w_id = req.dev_workspace_id;
+
+    let mut tx = db.begin().await?;
+    // Under the pairing lock, so a dev workspace cannot appear beneath this one between the check
+    // below and the update.
+    lock_dev_pairing(&mut tx, &[&prod_w_id, &dev_w_id]).await?;
     let is_dev_of_prod = sqlx::query_scalar!(
         r#"SELECT EXISTS(
             SELECT 1 FROM workspace
@@ -7287,7 +7768,7 @@ async fn detach_dev_workspace(
         &dev_w_id,
         &prod_w_id
     )
-    .fetch_one(&db)
+    .fetch_one(&mut *tx)
     .await?
     .unwrap_or(false);
     if !is_dev_of_prod {
@@ -7296,8 +7777,8 @@ async fn detach_dev_workspace(
             dev_w_id, prod_w_id
         )));
     }
+    reject_stranding_nested_dev(&mut *tx, &dev_w_id, DevTeardown::Detach).await?;
 
-    let mut tx = db.begin().await?;
     // A wm-fork- workspace re-designated as dev returns to being a plain fork
     // (keeps its parent); a standalone workspace that was attached returns to
     // being standalone — with the parent kept it would still classify as a
@@ -7405,6 +7886,30 @@ pub(crate) async fn archive_workspace_impl(
 ) -> Result<(usize, usize, usize)> {
     // Step 1: Disable all schedules and clear their queued jobs
     let mut tx = db.begin().await?;
+    // Unconditionally, before reading any pairing state: whether this workspace is a dev, and whether
+    // it has one, is exactly what a concurrent attach changes, so gating the lock on the caller's
+    // `dev_lock_parent` would skip it on the strength of the value the race invalidates.
+    lock_dev_pairing(&mut tx, &[w_id]).await?;
+    let dev_parent = sqlx::query_scalar!(
+        "SELECT parent_workspace_id FROM workspace WHERE id = $1 AND is_dev_workspace",
+        w_id
+    )
+    .fetch_optional(&mut *tx)
+    .await?
+    .flatten();
+    // The caller resolved this before the lock and authorized against it — its prod admin check, and
+    // the pairing teardown below, are both answers to that value. Refuse rather than act on a pairing
+    // nobody checked.
+    if dev_parent.as_deref() != dev_lock_parent {
+        return Err(Error::BadRequest(format!(
+            "The dev pairing of {w_id} changed while it was being archived. Retry."
+        )));
+    }
+    if dev_parent.is_some() {
+        // Archiving a dev workspace clears its dev flag, so it must not strand a dev workspace of
+        // its own.
+        reject_stranding_nested_dev(&mut *tx, w_id, DevTeardown::Archive).await?;
+    }
     let disabled_schedules = sqlx::query_scalar!(
         "UPDATE schedule SET enabled = false WHERE workspace_id = $1 AND enabled = true RETURNING path",
         w_id
@@ -7545,7 +8050,9 @@ async fn archive_workspace(
     }
 
     // The dev pairing teardown (clear is_dev + drop the prod lock) runs inside archive_workspace_impl's
-    // transaction, atomically with `deleted = true`.
+    // transaction, atomically with `deleted = true` — including the guard that it strands no nested
+    // dev workspace, which only applies to a workspace that is itself a dev (`dev_lock_parent`): a
+    // root archived out from under its dev is the pre-existing shape and not this pairing's to police.
     let (schedules_count, canceled_count, deleted_tokens_count) =
         archive_workspace_impl(&db, &w_id, &authed.username, dev_lock_parent.as_deref()).await?;
 
@@ -8482,6 +8989,9 @@ struct CreateProtectionRuleRequest {
 
 #[derive(Deserialize)]
 struct UpdateProtectionRuleRequest {
+    /// Renames the rule when it differs from the path name. Absent means "leave the name alone",
+    /// which is what a client that never sends the field gets.
+    name: Option<String>,
     rules: Vec<ProtectionRuleKind>,
     bypass_groups: Vec<String>,
     bypass_users: Vec<String>,
@@ -8594,7 +9104,10 @@ async fn lock_prod_workspace(
 
 /// Error out if `parent_w_id` already has an active (non-archived) dev workspace. Mirrors the
 /// partial unique index `workspace_canonical_dev_idx` with a friendly message.
-async fn ensure_no_existing_dev_workspace(db: &DB, parent_w_id: &str) -> Result<()> {
+async fn ensure_no_existing_dev_workspace<'e, E: sqlx::Executor<'e, Database = Postgres>>(
+    db: E,
+    parent_w_id: &str,
+) -> Result<()> {
     let existing = sqlx::query_scalar!(
         "SELECT id FROM workspace WHERE parent_workspace_id = $1 AND is_dev_workspace AND deleted = false",
         parent_w_id
@@ -8610,29 +9123,271 @@ async fn ensure_no_existing_dev_workspace(db: &DB, parent_w_id: &str) -> Result<
     Ok(())
 }
 
-/// A dev workspace pairs with a root prod workspace; nesting dev workspaces (a dev of a dev) isn't
-/// supported and would muddle the prod<->dev relationship.
-async fn ensure_dev_parent_is_root(db: &DB, parent_w_id: &str) -> Result<()> {
-    let parent_is_fork = sqlx::query_scalar!(
-        r#"SELECT (parent_workspace_id IS NOT NULL) AS "is_fork!" FROM workspace WHERE id = $1"#,
+/// A dev workspace pairs with a root workspace or — supported, though not the recommended shape —
+/// with another dev workspace, giving a promotion chain (dev of dev -> dev -> prod). A throwaway
+/// fork is never a valid prod: its deploys go to its own `wm-fork/**` branch and it is discarded
+/// with its subtree, so a dev pinned under it has nowhere to promote to. Nor is an archived one,
+/// which hosts nothing at all.
+async fn ensure_dev_parent_can_host_dev<'e, E: sqlx::Executor<'e, Database = Postgres>>(
+    db: E,
+    parent_w_id: &str,
+) -> Result<()> {
+    let parent = sqlx::query!(
+        r#"SELECT (parent_workspace_id IS NOT NULL) AS "is_fork!", is_dev_workspace, deleted
+           FROM workspace WHERE id = $1"#,
         parent_w_id
     )
     .fetch_optional(db)
-    .await?
-    .unwrap_or(false);
-    if parent_is_fork {
+    .await?;
+    let Some(parent) = parent else {
+        return Ok(());
+    };
+    if parent.deleted {
         return Err(Error::BadRequest(format!(
-            "Cannot create a dev workspace of '{}' because it is itself a fork or dev workspace.",
+            "Cannot create a dev workspace of '{}' because it is archived.",
+            parent_w_id
+        )));
+    }
+    if parent.is_fork && !parent.is_dev_workspace {
+        return Err(Error::BadRequest(format!(
+            "Cannot create a dev workspace of '{}' because it is a throwaway fork.",
             parent_w_id
         )));
     }
     Ok(())
 }
 
-/// `dev_workspace_lock` is owned by the dev-workspace feature (attach/detach/archive/delete create and
-/// remove it by name). Reserve it from the public protection-rule API so a user-managed rule can't
-/// collide: otherwise the feature's name-based cleanup would clobber the user's rule, or a manual edit
-/// could weaken the feature's lock.
+/// Prod may be a dev workspace, so the candidate can sit ABOVE it in the tree — reparenting it below
+/// prod would close a parent<->child cycle and hang every hierarchy walk. Prod itself is at depth 0
+/// of the chain, so callers must have rejected `dev_w_id == prod_w_id` first.
+///
+/// `reject_dev_label_taken_in_chain` would also reject a cyclic pairing, since a cycle puts one
+/// workspace in the chain twice and so always repeats a label. It reports it as a workspace clashing
+/// with itself, which describes nothing the caller can act on — hence this, first.
+async fn reject_attach_cycle<'e, E: sqlx::Executor<'e, Database = Postgres>>(
+    db: E,
+    prod_w_id: &str,
+    dev_w_id: &str,
+) -> Result<()> {
+    let would_cycle = sqlx::query_scalar!(
+        r#"WITH RECURSIVE chain AS (
+               SELECT id, parent_workspace_id, 0 AS depth FROM workspace WHERE id = $1
+               UNION ALL
+               SELECT w.id, w.parent_workspace_id, chain.depth + 1 FROM workspace w
+               JOIN chain ON w.id = chain.parent_workspace_id
+               WHERE chain.depth < 20
+           )
+           SELECT EXISTS(SELECT 1 FROM chain WHERE id = $2) AS "cycle!""#,
+        prod_w_id,
+        dev_w_id,
+    )
+    .fetch_one(db)
+    .await?;
+    if would_cycle {
+        return Err(Error::BadRequest(format!(
+            "Workspace {} is an ancestor of {} and cannot become its dev workspace",
+            dev_w_id, prod_w_id
+        )));
+    }
+    Ok(())
+}
+
+/// Serialize everything that makes or breaks a dev pairing: giving a workspace a dev workspace
+/// (create, attach) and clearing one's dev flag (detach, archive). Each decides on state the others
+/// mutate — whether a workspace already has a dev, still has one, or leaves a label free — so
+/// unserialized they all pass their checks and commit a shape those checks exist to reject. Take it
+/// before re-running them inside the mutating transaction; it releases on commit or rollback.
+///
+/// Locks every workspace the operation's own checks read: each seed, its ancestors, and the dev
+/// workspaces beneath it. Locking just the endpoints is not enough — the label rule spans a whole
+/// chain, so two operations a couple of hops apart would hold disjoint keys and both commit. Reading
+/// the same set that is checked is what closes that: an attach splices two chains together and so
+/// holds nodes from both, and any operation that could collide with it necessarily touches the
+/// joined chain, hence shares a node. Acquired in id order, the only ordering rule that keeps two
+/// overlapping sets from deadlocking.
+///
+/// Recomputed inside the transaction, but from a set that may already be stale — harmless, because
+/// whoever made it stale is the operation holding the node this one is missing.
+pub(crate) async fn lock_dev_pairing(
+    tx: &mut Transaction<'_, Postgres>,
+    seeds: &[&str],
+) -> Result<()> {
+    let seeds: Vec<String> = seeds.iter().map(|s| s.to_string()).collect();
+    // Depth bounds are the cycle-safety backstop used by every other hierarchy walk.
+    let nodes = sqlx::query_scalar!(
+        r#"WITH RECURSIVE seeded AS (SELECT unnest($1::text[]) AS id),
+           up AS (
+               SELECT w.id, w.parent_workspace_id, 0 AS depth
+               FROM workspace w JOIN seeded s ON w.id = s.id
+               UNION ALL
+               SELECT w.id, w.parent_workspace_id, up.depth + 1
+               FROM workspace w JOIN up ON w.id = up.parent_workspace_id
+               WHERE up.depth < 20
+           ),
+           down AS (
+               SELECT w.id, 0 AS depth FROM workspace w JOIN seeded s ON w.id = s.id
+               UNION ALL
+               SELECT w.id, down.depth + 1
+               FROM workspace w JOIN down ON w.parent_workspace_id = down.id
+               WHERE down.depth < 20 AND w.is_dev_workspace
+           )
+           SELECT id AS "id!" FROM (
+               SELECT id FROM seeded UNION SELECT id FROM up UNION SELECT id FROM down
+           ) n ORDER BY id"#,
+        &seeds[..]
+    )
+    .fetch_all(&mut **tx)
+    .await?;
+    // One statement per node rather than a set-returning call: only a client-side loop actually
+    // guarantees the acquisition order the deadlock argument above rests on.
+    for node in nodes {
+        sqlx::query!(
+            "SELECT pg_advisory_xact_lock(hashtext('dev_workspace_pairing:' || $1))",
+            node
+        )
+        .execute(&mut **tx)
+        .await?;
+    }
+    Ok(())
+}
+
+/// What is about to clear `is_dev_workspace` on a workspace, which decides whether the workspace can
+/// go on hosting a dev workspace of its own afterwards.
+enum DevTeardown {
+    /// Keeps `parent_workspace_id` only for a `wm-fork-` workspace, which then reads as a throwaway
+    /// fork. A prefix-less workspace returns to standalone and hosts its dev exactly as before.
+    Detach,
+    /// Soft-deletes the workspace whatever its id looks like, so it hosts nothing afterwards.
+    Archive,
+}
+
+/// A nested dev workspace outlives whatever clears its parent's dev flag, and the parent is then a
+/// shape that hosts no pairing: its settings tab offers no detach control, and `delete_workspace`
+/// refuses a workspace that still has a dev child, so the pairing could never be undone. Reject the
+/// teardown so it is done bottom-up instead.
+async fn reject_stranding_nested_dev<'e, E: sqlx::Executor<'e, Database = Postgres>>(
+    db: E,
+    w_id: &str,
+    teardown: DevTeardown,
+) -> Result<()> {
+    let action = match teardown {
+        DevTeardown::Detach => {
+            if !w_id.starts_with(windmill_common::workspaces::WM_FORK_PREFIX) {
+                return Ok(());
+            }
+            "Detaching"
+        }
+        DevTeardown::Archive => "Archiving",
+    };
+    let nested = sqlx::query_scalar!(
+        "SELECT id FROM workspace
+         WHERE parent_workspace_id = $1 AND is_dev_workspace AND NOT deleted",
+        w_id
+    )
+    .fetch_optional(db)
+    .await?;
+    if let Some(nested) = nested {
+        return Err(Error::BadRequest(format!(
+            "{action} {w_id} would leave it unable to host a pairing, but it is the prod workspace \
+             of '{nested}'. Detach '{nested}' first."
+        )));
+    }
+    Ok(())
+}
+
+/// A dev workspace deploys to the branch named by its environment label, and every dev workspace in
+/// a chain inherits the same git-sync repositories, so two of them sharing a label push to one
+/// branch: each deploy clobbers the other environment, and the root's auto-pull routes that branch
+/// to whichever dev it matches first. Require every dev workspace in the resulting chain to carry a
+/// distinct label — the dev ancestors `new_dev_id` lands under, `new_dev_id` with `label`, and (when
+/// it already exists and so keeps its own subtree) the dev workspaces it brings with it. Dev
+/// workspaces only ever hang off a root or another dev (`ensure_dev_parent_can_host_dev`), so that
+/// chain is linear and this is the whole of it.
+async fn reject_dev_label_taken_in_chain(
+    db: &mut sqlx::PgConnection,
+    parent_w_id: &str,
+    new_dev_id: &str,
+    keeps_own_subtree: bool,
+    label: Option<&str>,
+) -> Result<()> {
+    // Depth bounds are the cycle-safety backstop used by every other hierarchy walk.
+    let mut chain = sqlx::query!(
+        r#"WITH RECURSIVE ancestors AS (
+               SELECT id, parent_workspace_id, is_dev_workspace, dev_workspace_label, deleted,
+                      0 AS depth
+               FROM workspace WHERE id = $1
+               UNION ALL
+               SELECT w.id, w.parent_workspace_id, w.is_dev_workspace, w.dev_workspace_label,
+                      w.deleted, ancestors.depth + 1
+               FROM workspace w JOIN ancestors ON w.id = ancestors.parent_workspace_id
+               WHERE ancestors.depth < 20
+           )
+           SELECT id AS "id!", dev_workspace_label FROM ancestors
+           WHERE is_dev_workspace AND NOT deleted"#,
+        parent_w_id
+    )
+    .fetch_all(&mut *db)
+    .await?
+    .into_iter()
+    .map(|r| {
+        (
+            r.id,
+            windmill_common::workspaces::dev_workspace_branch(r.dev_workspace_label.as_deref()),
+        )
+    })
+    .collect::<Vec<_>>();
+    chain.push((
+        new_dev_id.to_string(),
+        windmill_common::workspaces::dev_workspace_branch(label),
+    ));
+    if keeps_own_subtree {
+        // `depth > 0`: the candidate itself is already in the list above, carrying its new label.
+        chain.extend(
+            sqlx::query!(
+                r#"WITH RECURSIVE tree AS (
+                       SELECT id, is_dev_workspace, dev_workspace_label, deleted, 0 AS depth
+                       FROM workspace WHERE id = $1
+                       UNION ALL
+                       SELECT w.id, w.is_dev_workspace, w.dev_workspace_label, w.deleted,
+                              tree.depth + 1
+                       FROM workspace w JOIN tree ON w.parent_workspace_id = tree.id
+                       WHERE tree.depth < 20
+                   )
+                   SELECT id AS "id!", dev_workspace_label FROM tree
+                   WHERE depth > 0 AND is_dev_workspace AND NOT deleted"#,
+                new_dev_id
+            )
+            .fetch_all(&mut *db)
+            .await?
+            .into_iter()
+            .map(|r| {
+                (
+                    r.id,
+                    windmill_common::workspaces::dev_workspace_branch(
+                        r.dev_workspace_label.as_deref(),
+                    ),
+                )
+            }),
+        );
+    }
+    let mut by_branch: HashMap<String, String> = HashMap::new();
+    for (id, branch) in chain {
+        if let Some(other) = by_branch.insert(branch.clone(), id.clone()) {
+            return Err(Error::BadRequest(format!(
+                "'{other}' and '{id}' would both be '{branch}' workspaces in the same chain: dev \
+                 workspaces in a chain share their git-sync repositories, so both would deploy to \
+                 the '{branch}' branch. Use a different environment label."
+            )));
+        }
+    }
+    Ok(())
+}
+
+/// `dev_workspace_lock` is owned by the dev-workspace feature, which creates and removes it by name
+/// (attach/detach/archive/delete). Reserve the name against creation and deletion so a user-managed
+/// rule can't collide with the feature's name-based cleanup, and so detach stays the way a pairing's
+/// lock is lifted. Updating it is deliberately allowed: relaxing the lock is an admin's call, and the
+/// name is immutable on update so no collision can arise.
 fn reject_reserved_rule_name(name: &str) -> Result<()> {
     if name == DEV_WORKSPACE_LOCK_RULE_NAME {
         return Err(Error::BadRequest(format!(
@@ -8726,7 +9481,28 @@ async fn update_protection_rule(
     Json(req): Json<UpdateProtectionRuleRequest>,
 ) -> Result<String> {
     require_admin(authed.is_admin, &authed.username)?;
-    reject_reserved_rule_name(&rule_name)?;
+
+    // A rename moves the row's primary key, so it needs the same name checks a create does. The
+    // reserved rule can be neither end of one: the dev-workspace feature finds it by name, so
+    // renaming it away would strand the lock and renaming onto it would collide with the feature.
+    // Names are stored verbatim, as creation stores them, so this comparison is raw: a rule called
+    // " prod-lock " survives an edit that submits its current name back untouched, and a name that
+    // differs only in surrounding whitespace is a real rename rather than a silent no-op.
+    let new_name = req.name.as_deref().filter(|n| *n != rule_name);
+    if let Some(new_name) = new_name {
+        if new_name.trim().is_empty() {
+            return Err(Error::BadRequest(
+                "Protection rule name cannot be empty".to_string(),
+            ));
+        }
+        if rule_name == DEV_WORKSPACE_LOCK_RULE_NAME {
+            return Err(Error::BadRequest(format!(
+                "'{}' cannot be renamed: the dev workspace feature locates it by name",
+                DEV_WORKSPACE_LOCK_RULE_NAME
+            )));
+        }
+        reject_reserved_rule_name(new_name)?;
+    }
 
     let mut tx = db.begin().await?;
 
@@ -8747,13 +9523,33 @@ async fn update_protection_rule(
         )));
     }
 
+    if let Some(new_name) = new_name {
+        let taken = sqlx::query_scalar!(
+            "SELECT EXISTS(SELECT 1 FROM workspace_protection_rule WHERE workspace_id = $1 AND name = $2)",
+            &w_id,
+            new_name
+        )
+        .fetch_one(&mut *tx)
+        .await?
+        .unwrap_or(false);
+        if taken {
+            return Err(Error::BadRequest(format!(
+                "Protection rule with name '{}' already exists",
+                new_name
+            )));
+        }
+    }
+
+    let final_name = new_name.unwrap_or(&rule_name);
+
     // Update the rule
     sqlx::query!(
         r#"
             UPDATE workspace_protection_rule
-            SET rules = $1, bypass_groups = $2, bypass_users = $3
-            WHERE workspace_id = $4 AND name = $5
+            SET name = $1, rules = $2, bypass_groups = $3, bypass_users = $4
+            WHERE workspace_id = $5 AND name = $6
         "#,
+        final_name,
         ProtectionRules::from(&req.rules).bits(),
         &req.bypass_groups,
         &req.bypass_users,
@@ -8763,14 +9559,18 @@ async fn update_protection_rule(
     .execute(&mut *tx)
     .await?;
 
+    let mut audit_args = std::collections::HashMap::from([("name", final_name)]);
+    if new_name.is_some() {
+        audit_args.insert("previous_name", &rule_name[..]);
+    }
     audit_log(
         &mut *tx,
         &authed,
         "workspaces.update_protection_rule",
         ActionKind::Update,
         &w_id,
-        Some(&rule_name),
-        Some([("name", &rule_name[..])].into()),
+        Some(final_name),
+        Some(audit_args),
     )
     .await?;
 
@@ -8784,14 +9584,14 @@ async fn update_protection_rule(
         &authed.username,
         &db,
         &w_id,
-        DeployedObject::Settings { setting_type: format!("protection_rule_{}", rule_name) },
+        DeployedObject::Settings { setting_type: format!("protection_rule_{}", final_name) },
         None,
         false,
         None,
     )
     .await?;
 
-    Ok(format!("Updated protection rule '{}'", rule_name))
+    Ok(format!("Updated protection rule '{}'", final_name))
 }
 
 /// Delete a protection rule
@@ -8945,6 +9745,24 @@ pub struct WorkspaceDiffRow {
     has_changes: Option<bool>,
     exists_in_source: Option<bool>,
     exists_in_fork: Option<bool>,
+    /// The last deploy event claimed on each side, per
+    /// `windmill_common::deploy_origin`. Omitted rather than null, as the schema
+    /// declares; absent means no evidence, which never justifies propagating a
+    /// removal.
+    ///
+    /// Only the fork half is consumed today, by the merge direction. The update
+    /// direction has the mirror shape (a parent-side removal it cannot attribute)
+    /// but writes to the fork rather than to prod, and gating it on evidence would
+    /// strand a row a legacy tally left without any — so the source half is
+    /// recorded and surfaced, unread, rather than left as a gap to backfill.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    fork_last_event_kind: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    fork_last_event_origin: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    source_last_event_kind: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    source_last_event_origin: Option<String>,
 }
 
 async fn compare_workspaces(
@@ -9036,7 +9854,9 @@ async fn compare_workspaces(
     // is left intact, so unpinning resurfaces it without a re-tally.
     let diff_items = sqlx::query_as!(
         WorkspaceDiffRow,
-        "SELECT path, kind, ahead, behind, has_changes, exists_in_source, exists_in_fork FROM workspace_diff
+        "SELECT path, kind, ahead, behind, has_changes, exists_in_source, exists_in_fork,
+            fork_last_event_kind, fork_last_event_origin, source_last_event_kind, source_last_event_origin
+        FROM workspace_diff
         WHERE source_workspace_id = $1 AND fork_workspace_id = $2
         AND NOT EXISTS (
             SELECT 1 FROM ws_specific ws
@@ -9297,16 +10117,39 @@ async fn compare_workspaces(
             .count(),
     };
 
-    let all_ahead_items_visible = summary.total_ahead
-        == confirmed_diffs
-            .iter()
+    // Each direction accounts for what it carries (see the frontend's
+    // `diffActionableInDirection`): a lineage merge leaves out a row the fork lacks
+    // unless the fork's own last event says it deleted or renamed it away, while the
+    // update takes it whatever the counters say — and since it can carry
+    // `behind = 0`, that side counts rows rather than sums.
+    let source_only = |d: &WorkspaceDiffRow| {
+        d.exists_in_source.unwrap_or(false) && !d.exists_in_fork.unwrap_or(false)
+    };
+    // Through the enums rather than their wire values: renaming one otherwise
+    // compiles clean on both sides and silently makes this always false.
+    let fork_removed_it = |d: &WorkspaceDiffRow| {
+        use windmill_common::deploy_origin::{DeployEventKind, DeployOrigin};
+        d.fork_last_event_origin.as_deref() == Some(DeployOrigin::Authored.as_str())
+            && d.fork_last_event_kind.as_deref().is_some_and(|k| {
+                k == DeployEventKind::Delete.as_str() || k == DeployEventKind::RenameFrom.as_str()
+            })
+    };
+    let merge_carries =
+        |d: &WorkspaceDiffRow| !is_lineage_pair || !source_only(d) || fork_removed_it(d);
+    let ahead_sum = |rows: &[WorkspaceDiffRow]| {
+        rows.iter()
+            .filter(|d| merge_carries(d))
             .map(|s| s.ahead)
-            .fold(0, |acc, s| acc + s.try_into().unwrap_or(0));
+            .fold(0i64, |acc, s| acc + i64::from(s))
+    };
+    let all_ahead_items_visible = ahead_sum(&visible_diffs) == ahead_sum(&confirmed_diffs);
     let all_behind_items_visible = summary.total_behind
         == confirmed_diffs
             .iter()
             .map(|s| s.behind)
-            .fold(0, |acc, s| acc + s.try_into().unwrap_or(0));
+            .fold(0, |acc, s| acc + s.try_into().unwrap_or(0))
+        && visible_diffs.iter().filter(|d| source_only(d)).count()
+            == confirmed_diffs.iter().filter(|d| source_only(d)).count();
 
     // Blast-radius guard for the "changes not visible to your user" warning
     // (which hides the deploy button). The flag is a pure visibility guarantee —
@@ -9346,7 +10189,9 @@ async fn compare_workspaces(
         if visible_keys.contains(&(d.kind.as_str(), d.path.as_str())) {
             continue;
         }
-        if d.ahead > 0 {
+        // Both sides mirror the flags above: a row is only withheld from a direction
+        // that would have carried it.
+        if d.ahead > 0 && merge_carries(d) {
             hidden_ahead.total += 1;
             *hidden_ahead.by_kind.entry(d.kind.clone()).or_default() += 1;
             if sees_all_items {
@@ -9355,7 +10200,7 @@ async fn compare_workspaces(
                     .push(HiddenItem { kind: d.kind.clone(), path: d.path.clone() });
             }
         }
-        if d.behind > 0 {
+        if d.behind > 0 || source_only(d) {
             hidden_behind.total += 1;
             *hidden_behind.by_kind.entry(d.kind.clone()).or_default() += 1;
             if sees_all_items {
@@ -9746,6 +10591,8 @@ async fn load_workspace_authed(
             folders: vec![],
             scopes: base_authed.scopes.clone(),
             username_override: base_authed.username_override.clone(),
+            username_override_is_token_label: base_authed.username_override_is_token_label,
+            is_session_token: base_authed.is_session_token,
             token_prefix: base_authed.token_prefix.clone(),
             read_only: base_authed.read_only,
         });
@@ -9775,6 +10622,8 @@ async fn load_workspace_authed(
         folders,
         scopes: base_authed.scopes.clone(),
         username_override: base_authed.username_override.clone(),
+        username_override_is_token_label: base_authed.username_override_is_token_label,
+        is_session_token: base_authed.is_session_token,
         token_prefix: base_authed.token_prefix.clone(),
         read_only: base_authed.read_only,
     })
@@ -10591,6 +11440,7 @@ const FEATURE_USAGE_KINDS: &[(&str, &str)] = &[
     ("ai_chat", "message"),
     ("ai_chat", "model"),
     ("ai_chat", "tool"),
+    ("flow_editor", "panel_placement"),
 ];
 
 fn is_identifier_shaped(s: &str, max_len: usize) -> bool {
@@ -10734,6 +11584,16 @@ async fn get_cloud_quotas(
     .await?
     .unwrap_or(0);
 
+    // Every path keeps exactly one current version, so the prunable count is the total minus
+    // the number of distinct paths — one scan rather than a probe per row.
+    let resources_prunable = sqlx::query_scalar!(
+        "SELECT COUNT(*) - COUNT(DISTINCT path) FROM resource_version WHERE workspace_id = $1",
+        &w_id
+    )
+    .fetch_one(&db)
+    .await?
+    .unwrap_or(0);
+
     let variables_used = sqlx::query_scalar!(
         "SELECT COUNT(*) FROM variable WHERE workspace_id = $1",
         &w_id
@@ -10774,7 +11634,7 @@ async fn get_cloud_quotas(
         flows: QuotaInfo { used: flows_used, limit: 1000, prunable: flows_prunable },
         apps: QuotaInfo { used: apps_used, limit: 1000, prunable: apps_prunable },
         variables: QuotaInfo { used: variables_used, limit: 10000, prunable: 0 },
-        resources: QuotaInfo { used: resources_used, limit: 10000, prunable: 0 },
+        resources: QuotaInfo { used: resources_used, limit: 10000, prunable: resources_prunable },
         forks,
     }))
 }
@@ -10861,9 +11721,25 @@ async fn prune_versions(
 
             deleted.rows_affected()
         }
+        "resources" => {
+            // No `versions` array to rewrite afterwards, unlike flows and apps: the latest
+            // version is whichever row has the highest id for the path.
+            let deleted = sqlx::query(
+                "DELETE FROM resource_version
+                WHERE workspace_id = $1
+                AND id NOT IN (
+                    SELECT max(id) FROM resource_version
+                    WHERE workspace_id = $1 GROUP BY path
+                )",
+            )
+            .bind(&w_id)
+            .execute(&db)
+            .await?;
+            deleted.rows_affected()
+        }
         _ => {
             return Err(Error::BadRequest(format!(
-                "Invalid resource type '{}'. Must be 'scripts', 'flows', or 'apps'",
+                "Invalid resource type '{}'. Must be 'scripts', 'flows', 'apps', or 'resources'",
                 req.resource_type
             )));
         }
diff --git a/backend/windmill-api-workspaces/src/workspaces_extra.rs b/backend/windmill-api-workspaces/src/workspaces_extra.rs
index 663626d5ed..55f7c4f15d 100644
--- a/backend/windmill-api-workspaces/src/workspaces_extra.rs
+++ b/backend/windmill-api-workspaces/src/workspaces_extra.rs
@@ -57,6 +57,12 @@ pub(crate) async fn change_workspace_id(
 
     let mut tx = db.begin().await?;
 
+    // A rename rewrites the workspace's dev flag and reparents its children, so it decides on the
+    // same state the pairing handlers do: without this lock a concurrent create/attach could commit
+    // an active dev workspace under the shell this rename is about to archive. Both ids, since the
+    // rename moves the chain from one to the other.
+    crate::workspaces::lock_dev_pairing(&mut tx, &[&old_id, &rw.new_id]).await?;
+
     check_w_id_conflict(&mut tx, &rw.new_id).await?;
 
     info!(
@@ -108,7 +114,7 @@ pub(crate) async fn change_workspace_id(
     // Duplicate workspace settings (keep copy in old workspace for reference)
     info!("Duplicating workspace_settings table");
     sqlx::query!(
-        "INSERT INTO workspace_settings (workspace_id, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, ducklake, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts) SELECT $1, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, ducklake, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts FROM workspace_settings WHERE workspace_id = $2",
+        "INSERT INTO workspace_settings (workspace_id, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts) SELECT $1, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts FROM workspace_settings WHERE workspace_id = $2",
         &rw.new_id,
         &old_id
     )
@@ -384,8 +390,8 @@ pub(crate) async fn change_workspace_id(
     info!("Duplicating flow table rows");
     sqlx::query!(
         "INSERT INTO flow
-            (workspace_id, path, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, lock_error_logs)
-        SELECT $1, path, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, lock_error_logs
+            (workspace_id, path, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, lock_error_logs)
+        SELECT $1, path, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, lock_error_logs
             FROM flow WHERE workspace_id = $2",
         &rw.new_id,
         &old_id
@@ -743,6 +749,30 @@ pub(crate) async fn change_workspace_id(
     .execute(&mut *tx)
     .await?;
 
+    // The dbt graph tables key on (workspace_id, script_hash) and follow the
+    // script update by cascade. These two key on the JOB, so they follow the
+    // jobs that moved — only queued ones do — the way `job_perms` just did.
+    // Moving them wholesale would strand a completed run's retry state in a
+    // workspace its job is not in, which reads as "no resumable run".
+    info!("Updating dbt run state tables for migrated jobs");
+    sqlx::query!(
+        "UPDATE dbt_run_state SET workspace_id = $1
+         WHERE workspace_id = $2 AND job_id IN (SELECT id FROM v2_job WHERE workspace_id = $1)",
+        &rw.new_id,
+        &old_id
+    )
+    .execute(&mut *tx)
+    .await?;
+
+    sqlx::query!(
+        "UPDATE dbt_run_progress SET workspace_id = $1
+         WHERE workspace_id = $2 AND job_id IN (SELECT id FROM v2_job WHERE workspace_id = $1)",
+        &rw.new_id,
+        &old_id
+    )
+    .execute(&mut *tx)
+    .await?;
+
     info!("Updating token table");
     sqlx::query!(
         "UPDATE token SET workspace_id = $1 WHERE workspace_id = $2",
diff --git a/backend/windmill-api/Cargo.toml b/backend/windmill-api/Cargo.toml
index ee789945f5..e39c2a35c4 100644
--- a/backend/windmill-api/Cargo.toml
+++ b/backend/windmill-api/Cargo.toml
@@ -11,14 +11,14 @@ path = "src/lib.rs"
 [features]
 default = []
 private = ["windmill-audit/private", "windmill-common/private", "windmill-api-auth/private", "windmill-store/private", "windmill-api-users/private", "windmill-api-workspaces/private", "windmill-api-groups/private", "windmill-api-configs/private", "windmill-api-settings/private", "windmill-api-assets/private", "windmill-api-agent-workers?/private", "windmill-trigger-kafka?/private", "windmill-trigger-postgres?/private", "windmill-trigger-mqtt?/private", "windmill-trigger-amqp?/private", "windmill-trigger-websocket?/private", "windmill-trigger-nats?/private", "windmill-trigger-sqs?/private", "windmill-trigger-gcp?/private", "windmill-trigger-azure?/private", "windmill-trigger-email?/private", "windmill-git-sync/private", "windmill-autoscaling?/private", "windmill-object-store/private"]
-enterprise = ["windmill-queue/enterprise", "windmill-audit/enterprise", "windmill-git-sync/enterprise", "windmill-common/enterprise", "windmill-worker?/enterprise", "windmill-api-auth/enterprise", "windmill-store/enterprise", "windmill-api-jobs/enterprise", "windmill-api-scripts/enterprise", "windmill-api-flows/enterprise", "windmill-api-users/enterprise", "windmill-api-workspaces/enterprise", "windmill-api-groups/enterprise", "windmill-api-configs/enterprise", "windmill-api-settings/enterprise", "windmill-api-schedule/enterprise", "windmill-api-agent-workers?/enterprise", "windmill-trigger/enterprise", "windmill-trigger-kafka?/enterprise", "windmill-trigger-postgres?/enterprise", "windmill-trigger-mqtt?/enterprise", "windmill-trigger-amqp?/enterprise", "windmill-trigger-websocket?/enterprise", "windmill-trigger-email?/enterprise", "windmill-trigger-nats?/enterprise", "windmill-trigger-sqs?/enterprise", "windmill-trigger-gcp?/enterprise", "windmill-trigger-azure?/enterprise", "windmill-trigger-http?/enterprise", "windmill-native-triggers?/enterprise", "dep:windmill-autoscaling", "windmill-autoscaling/enterprise", "license"]
+enterprise = ["windmill-queue/enterprise", "windmill-audit/enterprise", "windmill-git-sync/enterprise", "windmill-common/enterprise", "windmill-worker?/enterprise", "windmill-api-auth/enterprise", "windmill-store/enterprise", "windmill-api-jobs/enterprise", "windmill-api-scripts/enterprise", "windmill-api-flows/enterprise", "windmill-api-users/enterprise", "windmill-api-workspaces/enterprise", "windmill-api-groups/enterprise", "windmill-api-configs/enterprise", "windmill-api-settings/enterprise", "windmill-api-schedule/enterprise", "windmill-api-debug/enterprise", "windmill-api-agent-workers?/enterprise", "windmill-trigger/enterprise", "windmill-trigger-kafka?/enterprise", "windmill-trigger-postgres?/enterprise", "windmill-trigger-mqtt?/enterprise", "windmill-trigger-amqp?/enterprise", "windmill-trigger-websocket?/enterprise", "windmill-trigger-email?/enterprise", "windmill-trigger-nats?/enterprise", "windmill-trigger-sqs?/enterprise", "windmill-trigger-gcp?/enterprise", "windmill-trigger-azure?/enterprise", "windmill-trigger-http?/enterprise", "windmill-native-triggers?/enterprise", "dep:windmill-autoscaling", "windmill-autoscaling/enterprise", "license"]
 stripe = []
 run_inline = ["dep:windmill-worker", "windmill-api-configs/run_inline"]
 agent_worker_server = ["dep:windmill-worker", "dep:windmill-api-agent-workers"]
 enterprise_saml = ["dep:samael", "dep:libxml"]
 benchmark = []
 embedding = ["windmill-api-embeddings/embedding"]
-parquet = ["dep:datafusion", "windmill-common/parquet", "windmill-object-store/parquet", "windmill-worker?/parquet", "windmill-api-users/parquet", "windmill-api-settings/parquet", "windmill-api-workspaces/parquet", "dep:aws-sigv4", "dep:aws-sdk-config"]
+parquet = ["dep:datafusion", "windmill-common/parquet", "windmill-object-store/parquet", "windmill-worker?/parquet", "windmill-api-users/parquet", "windmill-api-settings/parquet", "windmill-api-workspaces/parquet", "dep:aws-sigv4", "dep:aws-sdk-config", "dep:quick-xml"]
 prometheus = ["windmill-common/prometheus", "windmill-queue/prometheus", "dep:prometheus", "windmill-worker?/prometheus", "windmill-api-scripts/prometheus"]
 openidconnect = ["dep:openidconnect", "windmill-common/openidconnect", "windmill-store/openidconnect"]
 tantivy = ["dep:windmill-indexer"]
@@ -39,7 +39,7 @@ static_frontend = ["dep:rust-embed"]
 postgres_trigger = ["dep:windmill-trigger-postgres", "windmill-store/postgres_trigger"]
 mqtt_trigger = ["dep:windmill-trigger-mqtt", "windmill-store/mqtt_trigger"]
 amqp_trigger = ["dep:windmill-trigger-amqp", "windmill-store/amqp_trigger"]
-native_trigger = ["dep:windmill-native-triggers", "windmill-native-triggers/native_trigger", "dep:strum", "oauth2"]
+native_trigger = ["dep:windmill-native-triggers", "windmill-native-triggers/native_trigger", "windmill-api-flows/native_trigger", "windmill-api-scripts/native_trigger", "dep:strum", "oauth2"]
 sqs_trigger = ["dep:windmill-trigger-sqs", "windmill-store/sqs_trigger"]
 gcp_trigger = ["dep:windmill-trigger-gcp", "windmill-store/gcp_trigger"]
 azure_trigger = ["dep:windmill-trigger-azure", "windmill-store/azure_trigger"]
@@ -128,6 +128,7 @@ hmac.workspace = true
 cookie.workspace = true
 sha2.workspace = true
 urlencoding.workspace = true
+quick-xml = { workspace = true, optional = true }
 lazy_static.workspace = true
 prometheus = { workspace = true, optional = true }
 async_zip = { workspace = true, optional = true }
diff --git a/backend/windmill-api/build.rs b/backend/windmill-api/build.rs
index 768df207fb..59ac12bc2b 100644
--- a/backend/windmill-api/build.rs
+++ b/backend/windmill-api/build.rs
@@ -2,8 +2,8 @@ fn main() {
     // rust-embed requires the embedded folder to exist at compile time.
     // When building without a prior frontend build, create the directory
     // so the derive macro doesn't panic.
-    let dir = std::env::var("FRONTEND_BUILD_DIR")
-        .unwrap_or_else(|_| "../../frontend/build/".to_string());
+    let dir =
+        std::env::var("FRONTEND_BUILD_DIR").unwrap_or_else(|_| "../../frontend/build/".to_string());
     let path = std::path::Path::new(&dir);
     if !path.exists() {
         std::fs::create_dir_all(path).ok();
diff --git a/backend/windmill-api/openapi-deref.json b/backend/windmill-api/openapi-deref.json
index fb23829156..fd40b6fa5e 100644
--- a/backend/windmill-api/openapi-deref.json
+++ b/backend/windmill-api/openapi-deref.json
@@ -31385,12 +31385,28 @@
               "type": "string"
             }
           },
+          {
+            "name": "search",
+            "in": "query",
+            "description": "Match keys by path prefix, case-sensitively, on the raw key rather than per path segment (so \"a/file1\" matches \"a/file1000\"). Pushed down to the storage provider as a seek; resume with the returned next_marker.",
+            "schema": {
+              "type": "string"
+            }
+          },
           {
             "name": "storage",
             "in": "query",
             "schema": {
               "type": "string"
             }
+          },
+          {
+            "name": "s3_resource_path",
+            "in": "query",
+            "description": "When set, list the files of this object storage resource instead of the workspace storage",
+            "schema": {
+              "type": "string"
+            }
           }
         ],
         "responses": {
@@ -31424,6 +31440,100 @@
         }
       }
     },
+    "/w/{workspace}/job_helpers/list_stored_files_paged": {
+      "get": {
+        "summary": "List one page of a single folder level in a workspace object storage",
+        "operationId": "listStoredFilesPaged",
+        "tags": [
+          "helpers"
+        ],
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/WorkspaceId"
+          },
+          {
+            "name": "prefix",
+            "in": "query",
+            "description": "Folder to list; empty for the bucket root, otherwise must end with '/'",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "max_keys",
+            "in": "query",
+            "description": "Maximum number of folders and files combined",
+            "schema": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 1000,
+              "default": 100
+            }
+          },
+          {
+            "name": "page_token",
+            "in": "query",
+            "description": "Opaque token from a previous response, to continue listing the same folder",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "storage",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "s3_resource_path",
+            "in": "query",
+            "description": "When set, list the files of this object storage resource instead of the workspace storage",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "One page of folders and files at this level",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "folders": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/StorageFolder"
+                      }
+                    },
+                    "files": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/StorageFile"
+                      }
+                    },
+                    "next_page_token": {
+                      "type": "string",
+                      "description": "When set, more entries remain at this level"
+                    },
+                    "restricted_access": {
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "folders",
+                    "files",
+                    "restricted_access"
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/w/{workspace}/job_helpers/load_file_metadata": {
       "get": {
         "summary": "Load metadata of the file",
@@ -37058,7 +37168,8 @@
           "trigger",
           "settings",
           "key",
-          "workspacedependencies"
+          "workspacedependencies",
+          "datatablemigration"
         ]
       },
       "AIProviderModel": {
@@ -48449,6 +48560,44 @@
         "required": [
           "type"
         ]
+      },
+      "StorageFolder": {
+        "type": "object",
+        "properties": {
+          "prefix": {
+            "type": "string",
+            "description": "Full key prefix of the folder, ending with '/'"
+          },
+          "name": {
+            "type": "string",
+            "description": "Last path segment, without the trailing '/'"
+          }
+        },
+        "required": [
+          "prefix",
+          "name"
+        ]
+      },
+      "StorageFile": {
+        "type": "object",
+        "properties": {
+          "key": {
+            "type": "string"
+          },
+          "name": {
+            "type": "string"
+          },
+          "size": {
+            "type": "integer"
+          },
+          "last_modified": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "key",
+          "name"
+        ]
       }
     }
   }
diff --git a/backend/windmill-api/openapi-deref.yaml b/backend/windmill-api/openapi-deref.yaml
index afbc03a6c0..7efc30a509 100644
--- a/backend/windmill-api/openapi-deref.yaml
+++ b/backend/windmill-api/openapi-deref.yaml
@@ -4920,6 +4920,7 @@ paths:
                             - settings
                             - key
                             - workspacedependencies
+                            - datatablemigration
                   mute_critical_alerts:
                     type: boolean
                 required:
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index bf70b380a7..d89ac01582 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.775.2
+  version: 1.783.0
   title: Windmill API
 
   contact:
@@ -1239,7 +1239,8 @@ paths:
                   type: boolean
                 dev_workspace_label:
                   type: string
-                  enum: [dev, staging]
+                  enum: [dev, qa, test, uat, staging, demo, sandbox, preprod]
+                  description: "Environment label; also names the branch the dev workspace deploys to. Omitted defaults to 'dev'"
               required:
                 - dev_workspace_id
       responses:
@@ -1301,7 +1302,7 @@ paths:
                   dev_workspace_label:
                     type: string
                     nullable: true
-                    description: "Cosmetic display label ('dev' | 'staging'); null defaults to 'dev'"
+                    description: "Environment label, e.g. 'dev' or 'staging'; null defaults to 'dev'"
                 required:
                   - id
                   - name
@@ -3688,6 +3689,8 @@ paths:
                     $ref: "#/components/schemas/LargeFileStorage"
                   ducklake:
                     $ref: "#/components/schemas/DucklakeSettings"
+                  dbt_warehouses:
+                    $ref: "#/components/schemas/DbtWarehouses"
                   datatable:
                     $ref: "#/components/schemas/DataTableSettings"
                   git_sync:
@@ -4514,6 +4517,112 @@ paths:
             application/json:
               schema: {}
 
+  /w/{workspace}/workspaces/edit_dbt_warehouses:
+    post:
+      summary: edit the workspace's dbt warehouses
+      operationId: editDbtWarehouses
+      tags:
+        - workspace
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+      requestBody:
+        description: dbt warehouses, by name
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                dbt_warehouses:
+                  $ref: "#/components/schemas/DbtWarehouses"
+      responses:
+        "200":
+          description: status
+          content:
+            application/json:
+              schema: {}
+
+  /w/{workspace}/dbt/run_progress:
+    post:
+      summary: record the running job's settled dbt nodes
+      description: >-
+        Job-scoped: needs a job token, and the job is taken from the token rather
+        than the body. For workers with no database access.
+      operationId: recordDbtRunProgress
+      tags:
+        - dbt
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: array
+              items:
+                type: object
+                properties:
+                  asset_path:
+                    type: string
+                  status:
+                    type: string
+                  row_count:
+                    type: integer
+                  error:
+                    type: string
+                required:
+                  - asset_path
+                  - status
+      responses:
+        "200":
+          description: recorded
+
+  /w/{workspace}/dbt/warehouse/{name}:
+    get:
+      summary: resolve a dbt warehouse to the connection it names
+      description: >-
+        Job-scoped: needs a job token, because the response carries the
+        warehouse's credentials. dbt is unpermissioned by design, so a running
+        job reaches any warehouse the workspace configures.
+      operationId: getDbtWarehouse
+      tags:
+        - dbt
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - name: name
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: the connection the warehouse names
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/DbtWarehouseConnection"
+
+  /w/{workspace}/dbt/warehouse_exists/{name}:
+    get:
+      summary: check that a dbt warehouse is configured, without resolving it
+      description: >-
+        Job-scoped: needs a job token. For a project bringing its own
+        `profiles.yml`, which names a warehouse only to say where its assets
+        belong and never opens the connection.
+      operationId: dbtWarehouseExists
+      tags:
+        - dbt
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - name: name
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: the warehouse is configured
+
   /w/{workspace}/workspaces/list_ducklakes:
     get:
       summary: list ducklakes
@@ -5791,6 +5900,41 @@ paths:
                 items:
                   $ref: "#/components/schemas/User"
 
+  /w/{workspace}/users/list_addable:
+    get:
+      summary: list instance users that can still be added to this workspace (require to be super admin)
+      operationId: listAddableInstanceUsers
+      tags:
+        - user
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - name: search
+          in: query
+          description: filter users whose email or username contains this string
+          schema:
+            type: string
+        - name: per_page
+          in: query
+          description: number of users to return (default 10, max 100)
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: addable instance users
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  type: object
+                  properties:
+                    email:
+                      type: string
+                    username:
+                      type: string
+                  required:
+                    - email
+
   /w/{workspace}/users/list_usage:
     get:
       summary: list users usage
@@ -6549,6 +6693,12 @@ paths:
                 - bypass_groups
                 - bypass_users
               properties:
+                name:
+                  type: string
+                  description: >-
+                    New name for the rule. Omit, or pass the current name, to leave it unchanged.
+                    The reserved `dev_workspace_lock` rule cannot be renamed, nor can another rule
+                    be renamed onto it.
                 rules:
                   $ref: "#/components/schemas/ProtectionRules"
                 bypass_groups:
@@ -6825,7 +6975,7 @@ paths:
 
   /w/{workspace}/workspaces/prune_versions:
     post:
-      summary: prune old versions of scripts, flows, or apps
+      summary: prune old versions of scripts, flows, apps, or resources
       operationId: pruneVersions
       tags:
         - workspace
@@ -6844,6 +6994,7 @@ paths:
                     - scripts
                     - flows
                     - apps
+                    - resources
               required:
                 - resource_type
       responses:
@@ -7583,6 +7734,102 @@ paths:
               schema:
                 type: string
 
+  /w/{workspace}/resources/history/p/{path}:
+    get:
+      summary: get resource version history
+      operationId: getResourceHistory
+      tags:
+        - resource
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/Path"
+      responses:
+        "200":
+          description: resource version history
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  versions:
+                    type: array
+                    items:
+                      $ref: "#/components/schemas/ResourceVersion"
+                  versioned:
+                    type: boolean
+                required:
+                  - versions
+                  - versioned
+    delete:
+      summary: clear a resource's past versions, keeping only the current value
+      operationId: clearResourceHistory
+      tags:
+        - resource
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/Path"
+      responses:
+        "200":
+          description: history cleared
+          content:
+            text/plain:
+              schema:
+                type: string
+
+  /w/{workspace}/resources/history/v/{version}:
+    get:
+      summary: get a single resource version, with its value
+      operationId: getResourceVersion
+      tags:
+        - resource
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - name: version
+          in: path
+          required: true
+          schema:
+            type: integer
+            format: int64
+      responses:
+        "200":
+          description: resource version
+          content:
+            application/json:
+              schema:
+                allOf:
+                  - $ref: "#/components/schemas/ResourceVersion"
+                  - type: object
+                    properties:
+                      value: {}
+                      missing_references:
+                        type: array
+                        items:
+                          type: string
+                    required:
+                      - missing_references
+
+  /w/{workspace}/resources/history/restore/v/{version}:
+    post:
+      summary: restore a resource to a previous version
+      operationId: restoreResourceVersion
+      tags:
+        - resource
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - name: version
+          in: path
+          required: true
+          schema:
+            type: integer
+            format: int64
+      responses:
+        "200":
+          description: resource restored
+          content:
+            text/plain:
+              schema:
+                type: string
+
   /w/{workspace}/resources/get/{path}:
     get:
       summary: get resource
@@ -8391,6 +8638,7 @@ paths:
         - app
       parameters:
         - $ref: "#/components/parameters/CustomPath"
+        - $ref: "#/components/parameters/SdkConsent"
       responses:
         "200":
           description: embed token
@@ -10548,6 +10796,33 @@ paths:
               schema:
                 type: string
 
+  /w/{workspace}/jobs/job_public_view_token/{id}:
+    get:
+      summary: mint a public read-only share token for a job
+      description: >
+        Returns a stateless `{job_id}.{hmac}` token that grants anyone holding it —
+        including logged-out visitors, who land on the minimal public run page — read
+        access to this job (and its flow subtree) via a `view_token` query param or
+        `X-View-Token` header. Only callable by a user who can already read the job.
+      operationId: getJobPublicViewToken
+      tags:
+        - job
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - name: id
+          in: path
+          required: true
+          schema:
+            type: string
+            format: uuid
+      responses:
+        "200":
+          description: the public share read token
+          content:
+            text/plain:
+              schema:
+                type: string
+
   /w/{workspace}/flows/list_paths:
     get:
       summary: list all flow paths
@@ -11686,6 +11961,9 @@ paths:
     get:
       summary: list all apps
       operationId: listApps
+      x-mcp-tool: true
+      x-mcp-instructions: "Lists every app, low-code and full-code alike. `raw_app` tells them apart: true is a full-code app, which getAppByPath then reads and updateApp deploys. An app with no `raw_app` field is low-code — the field is omitted rather than sent as false. A low-code app can only be read here — editing one is a job for its editor in the UI."
+      x-mcp-tool-include-query-params: [path_start, page, per_page]
       tags:
         - app
       parameters:
@@ -11745,16 +12023,6 @@ paths:
     post:
       summary: create app
       operationId: createApp
-      x-mcp-tool: true
-      x-mcp-tool-include-fields:
-        - path
-        - value
-        - summary
-        - policy
-        - deployment_message
-      x-mcp-tool-opaque-fields:
-        - value
-        - policy
       tags:
         - app
       parameters:
@@ -11879,6 +12147,9 @@ paths:
     get:
       summary: get app by path
       operationId: getAppByPath
+      x-mcp-tool: true
+      x-mcp-instructions: "Returns the app's whole `value`, which is what updateApp needs: it takes the whole thing, not a patch. A big enough app is truncated by the tool-result limit; sending that back fails the build rather than deploying something partial, so edit those in the app editor or with the CLI. `raw_app` says whether this is a full-code app (its value holds `files`/`runnables`) or a low-code one (a `grid`), and only a full-code app can be deployed through MCP."
+      x-mcp-tool-include-query-params: []
       tags:
         - app
       parameters:
@@ -11907,6 +12178,43 @@ paths:
                   - $ref: "#/components/schemas/AppWithLastVersion"
                   - $ref: "#/components/schemas/UserDraftOverlay"
 
+  /w/{workspace}/apps/preview_sdk_token:
+    post:
+      summary: mint a frontend SDK token for the raw app editor's preview
+      operationId: mintPreviewSdkToken
+      tags:
+        - app
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                path:
+                  type: string
+                  description: App being edited; may not be deployed yet.
+                scopes:
+                  type: array
+                  items:
+                    type: string
+                  description: >
+                    Scopes from the policy being edited. Capped by the curated
+                    allowlist and by the caller's own scopes, and minted as the
+                    caller, so it grants nothing they could not mint themselves.
+              required:
+                - path
+                - scopes
+      responses:
+        "200":
+          description: the token
+          content:
+            text/plain:
+              schema:
+                type: string
+
   /w/{workspace}/apps/embed_token/p/{path}:
     get:
       summary: get app embed token by path
@@ -11916,6 +12224,7 @@ paths:
       parameters:
         - $ref: "#/components/parameters/WorkspaceId"
         - $ref: "#/components/parameters/ScriptPath"
+        - $ref: "#/components/parameters/SdkConsent"
       responses:
         "200":
           description: embed token
@@ -12054,6 +12363,7 @@ paths:
           required: true
           schema:
             type: string
+        - $ref: "#/components/parameters/SdkConsent"
       responses:
         "200":
           description: embed token
@@ -12150,16 +12460,6 @@ paths:
     post:
       summary: update app
       operationId: updateApp
-      x-mcp-tool: true
-      x-mcp-tool-include-fields:
-        - path
-        - value
-        - summary
-        - policy
-        - deployment_message
-      x-mcp-tool-opaque-fields:
-        - value
-        - policy
       tags:
         - app
       parameters:
@@ -12194,6 +12494,151 @@ paths:
                 skip_draft_deletion:
                   type: boolean
                   description: "When true (set by the CLI / git sync), deploying this app does not delete an existing user draft at the same path."
+                allow_kind_change:
+                  type: boolean
+                  description: "When true, this deploy may switch the app between low-code and raw. Without it, deploying a value to an app of the other kind is refused so an app is never converted by accident."
+      responses:
+        "200":
+          description: app updated
+          content:
+            text/plain:
+              schema:
+                type: string
+
+  /w/{workspace}/apps/create_raw_source:
+    post:
+      # The summary is what the MCP token picker shows next to the tool, so it has
+      # to carry the consequence of granting it, not just what it does.
+      summary: create a raw app from its sources, compiling them on a worker (which runs the app's own dependencies to do so)
+      operationId: createAppRawSource
+      x-mcp-tool: true
+      # Creating an app through MCP means creating a full-code one; low-code apps
+      # are legacy and aren't exposed there at all.
+      x-mcp-tool-name: createApp
+      x-mcp-instructions: "Creates a raw (full-code) app: `value.files` holds its sources, keyed by path (`/index.tsx`, `/App.tsx`, `/package.json`), and needs an entry point (`/index.tsx`, `/index.ts` or `/index.js`). The sources are compiled on a worker by the same build the editor and the CLI run, so a compile error comes back as the error of this call. Compiling runs the app's own dependencies on a worker, so this tool can execute code there. Low-code apps are legacy and have no MCP tool at all — they are built in their editor."
+      x-mcp-tool-include-fields:
+        - path
+        - value
+        - summary
+        - policy
+      tags:
+        - app
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+      requestBody:
+        description: raw app sources to bundle and deploy
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                path:
+                  type: string
+                summary:
+                  type: string
+                value:
+                  type: object
+                  description: "The raw app's value. `files` maps each source path to its content and must contain an entry point; `runnables` and `data` are carried through unchanged."
+                  properties:
+                    files:
+                      type: object
+                      additionalProperties:
+                        type: string
+                    runnables:
+                      type: object
+                    data:
+                      type: object
+                  required: [files]
+                policy:
+                  $ref: "#/components/schemas/Policy"
+                deployment_message:
+                  type: string
+                custom_path:
+                  type: string
+                preserve_on_behalf_of:
+                  type: boolean
+                  description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original on_behalf_of value in the policy instead of overwriting it."
+                labels:
+                  type: array
+                  items:
+                    type: string
+                skip_draft_deletion:
+                  type: boolean
+                  description: "When true (set by the CLI / git sync), deploying this app does not delete an existing user draft at the same path."
+              required: [path, value, summary, policy]
+      responses:
+        "201":
+          description: app created
+          content:
+            text/plain:
+              schema:
+                type: string
+
+  /w/{workspace}/apps/update_raw_source/{path}:
+    post:
+      # The summary is what the MCP token picker shows next to the tool, so it has
+      # to carry the consequence of granting it, not just what it does.
+      summary: update a raw app from its sources, compiling them on a worker (which runs the app's own dependencies to do so)
+      operationId: updateAppRawSource
+      x-mcp-tool: true
+      x-mcp-tool-name: updateApp
+      x-mcp-instructions: "Use this to change a raw (full-code) app — an app whose `raw_app` field is true. Send the whole `value` (`files`, `runnables`, `data`), not a patch: read the current one with getAppByPath first and edit it. The sources are compiled on a worker by the same build the editor and the CLI run, so a compile error comes back as the error of this call. Compiling runs the app's own dependencies on a worker, so this tool can execute code there. Low-code apps are legacy and have no MCP tool at all — they are edited in their editor."
+      x-mcp-tool-include-fields:
+        - path
+        - value
+        - summary
+        - policy
+      tags:
+        - app
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/ScriptPath"
+      requestBody:
+        description: raw app sources to bundle and deploy
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                path:
+                  type: string
+                summary:
+                  type: string
+                value:
+                  type: object
+                  description: "The raw app's value. `files` maps each source path (e.g. `/index.tsx`, `/App.tsx`, `/package.json`) to its content and must contain an entry point (`/index.tsx`, `/index.ts` or `/index.js`); `runnables` and `data` are carried through unchanged."
+                  properties:
+                    files:
+                      type: object
+                      additionalProperties:
+                        type: string
+                    runnables:
+                      type: object
+                    data:
+                      type: object
+                  required: [files]
+                policy:
+                  $ref: "#/components/schemas/Policy"
+                deployment_message:
+                  type: string
+                custom_path:
+                  type: string
+                preserve_on_behalf_of:
+                  type: boolean
+                  description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original on_behalf_of value in the policy instead of overwriting it."
+                labels:
+                  type: array
+                  items:
+                    type: string
+                skip_draft_deletion:
+                  type: boolean
+                  description: "When true (set by the CLI / git sync), deploying this app does not delete an existing user draft at the same path."
+                allow_kind_change:
+                  type: boolean
+                  description: "When true, this deploy may switch the app between low-code and raw. Without it, deploying a value to an app of the other kind is refused so an app is never converted by accident."
+              required: [value]
       responses:
         "200":
           description: app updated
@@ -12243,6 +12688,9 @@ paths:
                     skip_draft_deletion:
                       type: boolean
                       description: "When true (set by the CLI / git sync), deploying this app does not delete an existing user draft at the same path."
+                    allow_kind_change:
+                      type: boolean
+                      description: "When true, this deploy may switch the app between low-code and raw. Without it, deploying a value to an app of the other kind is refused so an app is never converted by accident."
                 js:
                   type: string
                 css:
@@ -14748,6 +15196,7 @@ paths:
                         - ducklake
                         - datatable
                         - volume
+                        - dbt
                     asset_path:
                       type: string
                     outcome:
@@ -14838,6 +15287,7 @@ paths:
                         - ducklake
                         - datatable
                         - volume
+                        - dbt
                     asset_path:
                       type: string
                     created_at:
@@ -21456,6 +21906,11 @@ paths:
           in: query
           schema:
             type: string
+        - name: search
+          in: query
+          description: Match keys by path prefix, case-sensitively, on the raw key rather than per path segment (so "a/file1" matches "a/file1000"). Pushed down to the storage provider as a seek; resume with the returned next_marker.
+          schema:
+            type: string
         - name: storage
           in: query
           schema:
@@ -21484,6 +21939,67 @@ paths:
                 required:
                   - windmill_large_files
 
+  /w/{workspace}/job_helpers/list_stored_files_paged:
+    get:
+      summary: List one page of a single folder level in a workspace object storage
+      operationId: listStoredFilesPaged
+      tags:
+        - helpers
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - name: prefix
+          in: query
+          description: Folder to list; empty for the bucket root, otherwise must end with '/'
+          schema:
+            type: string
+        - name: max_keys
+          in: query
+          description: Maximum number of folders and files combined
+          schema:
+            type: integer
+            minimum: 1
+            maximum: 1000
+            default: 100
+        - name: page_token
+          in: query
+          description: Opaque token from a previous response, to continue listing the same folder
+          schema:
+            type: string
+        - name: storage
+          in: query
+          schema:
+            type: string
+        - name: s3_resource_path
+          in: query
+          description: When set, list the files of this object storage resource instead of the workspace storage
+          schema:
+            type: string
+      responses:
+        "200":
+          description: One page of folders and files at this level
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  folders:
+                    type: array
+                    items:
+                      $ref: "#/components/schemas/StorageFolder"
+                  files:
+                    type: array
+                    items:
+                      $ref: "#/components/schemas/StorageFile"
+                  next_page_token:
+                    type: string
+                    description: When set, more entries remain at this level
+                  restricted_access:
+                    type: boolean
+                required:
+                  - folders
+                  - files
+                  - restricted_access
+
   /w/{workspace}/job_helpers/load_file_metadata:
     get:
       summary: Load metadata of the file
@@ -22918,170 +23434,22 @@ paths:
           description: Scope the graph to runnables in a single folder
           schema:
             type: string
+        - name: dbt_script_hash
+          in: query
+          description: >
+            Render the dbt half of the graph as one version of a dbt script had
+            it, rather than as the currently deployed one. Given this, `folder`
+            no longer scopes the dbt nodes: the pinned version's own models and
+            lineage are the answer, including models a later deploy removed.
+          schema:
+            type: string
       responses:
         "200":
           description: asset graph nodes, lineage edges and trigger edges
           content:
             application/json:
               schema:
-                type: object
-                required: [assets, runnables, edges, triggers]
-                properties:
-                  assets:
-                    type: array
-                    items:
-                      type: object
-                      required: [kind, path]
-                      properties:
-                        kind:
-                          $ref: "#/components/schemas/AssetKind"
-                        path:
-                          type: string
-                        fork_materialization:
-                          type: string
-                          enum: [fork, deferred]
-                          description: Fork workspaces only — 'fork' when this ducklake asset was materialized in the fork itself, 'deferred' when reads fall back to the parent workspace's current table via a defer view. Omitted otherwise.
-                  runnables:
-                    type: array
-                    items:
-                      type: object
-                      required: [path, usage_kind]
-                      properties:
-                        path:
-                          type: string
-                        usage_kind:
-                          $ref: "#/components/schemas/AssetUsageKind"
-                        in_pipeline:
-                          type: boolean
-                          description: True iff the script is a pipeline member (deployed with `// pipeline`). Omitted when false.
-                        macros:
-                          type: array
-                          description: Macros this script provides to the workspace registry (deployed `// macros` library). Omitted when empty.
-                          items:
-                            type: object
-                            required: [name, params, is_table]
-                            properties:
-                              name:
-                                type: string
-                              params:
-                                type: string
-                                description: verbatim parameter list
-                              is_table:
-                                type: boolean
-                  edges:
-                    type: array
-                    items:
-                      type: object
-                      required:
-                        [runnable_path, runnable_kind, asset_kind, asset_path]
-                      properties:
-                        runnable_path:
-                          type: string
-                        runnable_kind:
-                          $ref: "#/components/schemas/AssetUsageKind"
-                        asset_kind:
-                          $ref: "#/components/schemas/AssetKind"
-                        asset_path:
-                          type: string
-                        access_type:
-                          $ref: "#/components/schemas/AssetUsageAccessType"
-                  triggers:
-                    type: array
-                    items:
-                      oneOf:
-                        - type: object
-                          description: Asset trigger edge (`// on <asset>`)
-                          required:
-                            [
-                              trigger_kind,
-                              asset_kind,
-                              asset_path,
-                              runnable_kind,
-                              runnable_path,
-                            ]
-                          properties:
-                            trigger_kind:
-                              type: string
-                              enum: [asset]
-                            asset_kind:
-                              $ref: "#/components/schemas/AssetKind"
-                            asset_path:
-                              type: string
-                            runnable_kind:
-                              $ref: "#/components/schemas/AssetUsageKind"
-                            runnable_path:
-                              type: string
-                        - type: object
-                          description: Native trigger edge (schedule, email, kafka, ...). `path` is the trigger row's path.
-                          required:
-                            [trigger_kind, path, runnable_kind, runnable_path]
-                          properties:
-                            trigger_kind:
-                              type: string
-                              enum:
-                                - schedule
-                                - email
-                                - kafka
-                                - mqtt
-                                - nats
-                                - postgres
-                                - sqs
-                                - gcp
-                            path:
-                              type: string
-                            runnable_kind:
-                              $ref: "#/components/schemas/AssetUsageKind"
-                            runnable_path:
-                              type: string
-                  macro_edges:
-                    type: array
-                    description: Macro-library → consumer edges (deploy-recorded call detection plus `// use`). Omitted when empty.
-                    items:
-                      type: object
-                      required: [lib_path, consumer_path, macro_names, via_use]
-                      properties:
-                        lib_path:
-                          type: string
-                        consumer_path:
-                          type: string
-                        macro_names:
-                          type: array
-                          items:
-                            type: string
-                        via_use:
-                          type: boolean
-                  test_edges:
-                    type: array
-                    description: >-
-                      Ordering-only "must-run-after" edges — a `// data_test relationships`
-                      (or custom test reading a pipeline asset) requires the referenced
-                      asset's producer to run before the tested script. Not a data-consumption
-                      edge; fed into the cascade topo-sort so cold runs order correctly.
-                      Omitted when empty.
-                    items:
-                      type: object
-                      required:
-                        [
-                          producer_kind,
-                          producer_path,
-                          runnable_kind,
-                          runnable_path,
-                          asset_kind,
-                          asset_path,
-                        ]
-                      properties:
-                        producer_kind:
-                          $ref: "#/components/schemas/AssetUsageKind"
-                        producer_path:
-                          type: string
-                        runnable_kind:
-                          $ref: "#/components/schemas/AssetUsageKind"
-                        runnable_path:
-                          type: string
-                        asset_kind:
-                          $ref: "#/components/schemas/AssetKind"
-                        asset_path:
-                          type: string
+                $ref: "#/components/schemas/AssetGraph"
 
   /w/{workspace}/assets/macros:
     get:
@@ -23167,6 +23535,144 @@ paths:
                 items:
                   $ref: "#/components/schemas/MaterializedPartition"
 
+  /w/{workspace}/jobs/dbt_resumable/{id}:
+    get:
+      summary: Whether a dbt retry by this caller would resume this run
+      description: >
+        One failed run is saved per script per execution principal, so a `retry`
+        resumes that one — not necessarily the run being looked at. Answers about
+        THIS run alone: its own id when a retry submitted by this caller would
+        resume it, null otherwise (a later run holds the state, the run left
+        nothing to rebuild, or the caller's runs execute as another principal).
+        Authorized through the job, like `run_progress`.
+      operationId: getDbtResumable
+      tags:
+        - job
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - name: id
+          in: path
+          required: true
+          description: The job whose script and principal decide the saved failure
+          schema:
+            type: string
+            format: uuid
+      responses:
+        "200":
+          description: this job's id when a retry would resume it, or null
+          content:
+            application/json:
+              schema:
+                type: string
+                format: uuid
+                nullable: true
+
+  /w/{workspace}/jobs/dbt_resumable_script/p/{path}:
+    get:
+      summary: Which run a dbt retry of this script would resume for the caller
+      description: >
+        A `retry` requires `dbt_retry_job`, and the run form has no job id to
+        hand. Returns the one the caller's own retry would land on — the saved
+        failure for the principal the run would execute as, which is the script's
+        author for an `on_behalf_of` script and the caller otherwise — and only
+        when that run is one the caller may read. Null when there is nothing to
+        resume, or nothing this caller may be told about.
+      operationId: getDbtResumableForScript
+      tags:
+        - job
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/Path"
+      responses:
+        "200":
+          description: the job id a retry would resume, or null
+          content:
+            application/json:
+              schema:
+                type: string
+                format: uuid
+                nullable: true
+
+  /w/{workspace}/jobs/dbt_graph/{id}:
+    get:
+      summary: Get the asset graph as one run saw it
+      description: >
+        The workspace asset graph with its dbt half pinned to what a single run
+        built. Only a dynamic descriptor (a `{{ }}` placeholder in `vars`) leaves a
+        per-run snapshot; without one for this job the pinned version's own graph
+        answers, so a run page may use this route unconditionally. Authorized
+        through the job, the same gate as `run_progress` — pinning to a run is
+        job-scoped, which is why `assets/graph` cannot do it.
+      operationId: getDbtRunGraph
+      tags:
+        - job
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - name: id
+          in: path
+          required: true
+          description: The job whose graph to render
+          schema:
+            type: string
+            format: uuid
+        - name: asset_kinds
+          in: query
+          description: Filter by asset kinds (comma-separated list)
+          schema:
+            type: string
+        - name: folder
+          in: query
+          description: Scope the graph to runnables in a single folder
+          schema:
+            type: string
+        - name: dbt_script_hash
+          in: query
+          description: >
+            Fallback only, for a job that names no deployed script — a preview or
+            a flow. For a script job the version comes from the job row itself,
+            so this is ignored: which deploy's models, SQL and `ref()` lineage
+            are shown is not the caller's to choose.
+          schema:
+            type: string
+      responses:
+        "200":
+          description: asset graph nodes, lineage edges and trigger edges
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AssetGraph"
+
+  /w/{workspace}/jobs/run_progress/{id}:
+    get:
+      summary: List the per-relation progress one job has recorded so far
+      description: >
+        Live materialization state for the relations a single job writes, keyed by
+        relation. Polled while a run is in flight so a graph can move a node as its
+        model completes. Authorized through the job, so a caller who may not read it
+        is refused rather than told the run has no progress. An empty list means the
+        job exists and has recorded nothing yet, or is unknown to this workspace.
+      operationId: getRunProgress
+      tags:
+        - job
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - name: id
+          in: path
+          required: true
+          description: The job whose per-relation progress to read
+          schema:
+            type: string
+            format: uuid
+      responses:
+        "200":
+          description: per-relation status for this run
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/AssetProgress"
+
   /w/{workspace}/assets/partitions_in_range:
     get:
       summary: List expected partitions of a ducklake asset in a date range with their materialization status (enterprise)
@@ -24054,6 +24560,16 @@ components:
       required: true
       schema:
         type: string
+    SdkConsent:
+      name: sdk_consent
+      in: query
+      required: false
+      description: >
+        Raw apps: the viewer confirmed the frontend-SDK permissions consent
+        banner, so the viewer-scoped SDK token may actually be minted. Without
+        it the response only advertises the declared sdk_scopes.
+      schema:
+        type: boolean
     PathId:
       name: id
       in: path
@@ -24400,6 +24916,266 @@ components:
         enum: [script, flow]
 
   schemas:
+    AssetGraph:
+      type: object
+      required: [assets, runnables, edges, triggers]
+      properties:
+        assets:
+          type: array
+          items:
+            type: object
+            required: [kind, path]
+            properties:
+              kind:
+                $ref: "#/components/schemas/AssetKind"
+              path:
+                type: string
+              fork_materialization:
+                type: string
+                enum: [fork, deferred]
+                description: Fork workspaces only — 'fork' when this ducklake asset was materialized in the fork itself, 'deferred' when reads fall back to the parent workspace's current table via a defer view. Omitted otherwise.
+              dbt:
+                $ref: "#/components/schemas/DbtAssetProvenance"
+        runnables:
+          type: array
+          items:
+            type: object
+            required: [path, usage_kind]
+            properties:
+              path:
+                type: string
+              usage_kind:
+                $ref: "#/components/schemas/AssetUsageKind"
+              in_pipeline:
+                type: boolean
+                description: True iff the script is a pipeline member (deployed with `// pipeline`). Omitted when false.
+              macros:
+                type: array
+                description: Macros this script provides to the workspace registry (deployed `// macros` library). Omitted when empty.
+                items:
+                  type: object
+                  required: [name, params, is_table]
+                  properties:
+                    name:
+                      type: string
+                    params:
+                      type: string
+                      description: verbatim parameter list
+                    is_table:
+                      type: boolean
+              dbt:
+                type: object
+                description: Set on a `dbt` script, which owns a whole project rather than a single output. Omitted otherwise.
+                required: [model_count]
+                properties:
+                  model_count:
+                    type: integer
+        edges:
+          type: array
+          items:
+            type: object
+            required:
+              [runnable_path, runnable_kind, asset_kind, asset_path]
+            properties:
+              runnable_path:
+                type: string
+              runnable_kind:
+                $ref: "#/components/schemas/AssetUsageKind"
+              asset_kind:
+                $ref: "#/components/schemas/AssetKind"
+              asset_path:
+                type: string
+              access_type:
+                $ref: "#/components/schemas/AssetUsageAccessType"
+        triggers:
+          type: array
+          items:
+            oneOf:
+              - type: object
+                description: Asset trigger edge (`// on <asset>`)
+                required:
+                  [
+                    trigger_kind,
+                    asset_kind,
+                    asset_path,
+                    runnable_kind,
+                    runnable_path,
+                  ]
+                properties:
+                  trigger_kind:
+                    type: string
+                    enum: [asset]
+                  asset_kind:
+                    $ref: "#/components/schemas/AssetKind"
+                  asset_path:
+                    type: string
+                  runnable_kind:
+                    $ref: "#/components/schemas/AssetUsageKind"
+                  runnable_path:
+                    type: string
+              - type: object
+                description: Native trigger edge (schedule, email, kafka, ...). `path` is the trigger row's path.
+                required:
+                  [trigger_kind, path, runnable_kind, runnable_path]
+                properties:
+                  trigger_kind:
+                    type: string
+                    enum:
+                      - schedule
+                      - email
+                      - kafka
+                      - mqtt
+                      - nats
+                      - postgres
+                      - sqs
+                      - gcp
+                  path:
+                    type: string
+                  runnable_kind:
+                    $ref: "#/components/schemas/AssetUsageKind"
+                  runnable_path:
+                    type: string
+        macro_edges:
+          type: array
+          description: Macro-library → consumer edges (deploy-recorded call detection plus `// use`). Omitted when empty.
+          items:
+            type: object
+            required: [lib_path, consumer_path, macro_names, via_use]
+            properties:
+              lib_path:
+                type: string
+              consumer_path:
+                type: string
+              macro_names:
+                type: array
+                items:
+                  type: string
+              via_use:
+                type: boolean
+        test_edges:
+          type: array
+          description: >-
+            Ordering-only "must-run-after" edges — a `// data_test relationships`
+            (or custom test reading a pipeline asset) requires the referenced
+            asset's producer to run before the tested script. Not a data-consumption
+            edge; fed into the cascade topo-sort so cold runs order correctly.
+            Omitted when empty.
+          items:
+            type: object
+            required:
+              [
+                producer_kind,
+                producer_path,
+                runnable_kind,
+                runnable_path,
+                asset_kind,
+                asset_path,
+              ]
+            properties:
+              producer_kind:
+                $ref: "#/components/schemas/AssetUsageKind"
+              producer_path:
+                type: string
+              runnable_kind:
+                $ref: "#/components/schemas/AssetUsageKind"
+              runnable_path:
+                type: string
+              asset_kind:
+                $ref: "#/components/schemas/AssetKind"
+              asset_path:
+                type: string
+        dbt_edges:
+          type: array
+          description: >-
+            `ref()` lineage BETWEEN two dbt models, in the terms the canvas draws
+            — the relations, not dbt's node ids. Without it every model hangs off
+            the one dbt runnable and the project reads as a flat fan-out.
+            Omitted when empty.
+          items:
+            type: object
+            required: [from_asset_path, to_asset_path]
+            properties:
+              from_asset_path:
+                type: string
+              to_asset_path:
+                type: string
+        dbt_snapshot_job:
+          type: string
+          format: uuid
+          description: >-
+            The job whose own snapshot the dbt half was resolved from, when one
+            was asked for and found. A run page polls the graph while its job
+            runs, because a dynamic descriptor's snapshot is written mid-run, and
+            this is what tells it to stop. Omitted when the answer came from the
+            version's deployed graph.
+        dbt_graph_ingested_at:
+          type: string
+          format: date-time
+          description: >-
+            When the dbt half on screen was parsed, for a graph pinned to a job.
+            What the dbt editor labels its provenance with — "parsed from the
+            editor at 14:32" against "as of last deploy" — since the two are
+            drawn identically and the ambiguity would otherwise just move into
+            the editor. Omitted for the unpinned workspace graph, which spans
+            every project and so has no one time.
+    DbtAssetProvenance:
+      type: object
+      description: >-
+        What dbt says about the model, snapshot, seed or source that produces (or,
+        for a source, is read at) this relation. A dbt project is one runnable
+        node with many model assets, so per-model metadata belongs here rather
+        than on the script.
+      required: [unique_id, resource_type]
+      properties:
+        unique_id:
+          type: string
+          description: dbt's own node id, e.g. `model.jaffle_shop.customers`.
+        resource_type:
+          type: string
+          enum: [model, snapshot, seed, source]
+        materialized:
+          type: string
+          description: dbt's own word (`table`, `view`, `incremental`, `snapshot`).
+        materialize_strategy:
+          type: string
+          description: The Windmill write strategy it maps to, absent for `view` and `ephemeral`, which have none.
+        tags:
+          type: array
+          items:
+            type: string
+        description:
+          type: string
+        data_tests:
+          type: array
+          items:
+            type: object
+            required: [kind]
+            properties:
+              kind:
+                type: string
+                description: One of the four generic tests, or a package test's namespaced name (`dbt_utils.accepted_range`).
+              column:
+                type: string
+              args:
+                type: object
+                additionalProperties: true
+              severity:
+                type: string
+                description: Lowercased. dbt's severity decides whether a failure fails the run.
+        columns:
+          type: object
+          additionalProperties: true
+          description: Declared column metadata (name -> description). NOT column lineage — `manifest.json` carries none.
+        freshness:
+          type: object
+          additionalProperties: true
+          description: A source's declared freshness policy, for the staleness chip.
+        raw_code:
+          type: string
+          description: The model's SQL as written, at the deploy this graph belongs to. Omitted when the caller cannot read the script.
+        original_file_path:
+          type: string
+          description: Its path inside the dbt project, e.g. `models/staging/stg_orders.sql`.
     # NOTE: Not so many generators and validators support this format:
     # $ref: "../../openflow.openapi.yaml#/components/schemas"
     # This is why it is better to inline each of schemas for better compat
@@ -25107,6 +25883,7 @@ components:
         - settings
         - key
         - workspacedependencies
+        - datatablemigration
 
     AIProviderModel:
       type: object
@@ -25444,6 +26221,9 @@ components:
           type: boolean
         on_behalf_of_email:
           type: string
+        on_behalf_of:
+          type: string
+          description: "Authorization identity the runnable runs as: u/{username}, g/{group}, or a bare email when the username is itself email-shaped. The only stored half of the identity; on_behalf_of_email is derived from it."
         modules:
           type: object
           nullable: true
@@ -25565,9 +26345,12 @@ components:
           type: boolean
         on_behalf_of_email:
           type: string
+        on_behalf_of:
+          type: string
+          description: "Authorization identity to run as: u/{username}, g/{group}, or a bare email when the username is itself email-shaped. Supply this or on_behalf_of_email; when only the address is given it is resolved to the account it names, and an address naming nobody is rejected. A pair that disagrees is rejected."
         preserve_on_behalf_of:
           type: boolean
-          description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original on_behalf_of_email value instead of overwriting it."
+          description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original on_behalf_of_email / on_behalf_of pair instead of overwriting it with the caller's own identity."
         assets:
           type: array
           items:
@@ -25778,6 +26561,8 @@ components:
           type: boolean
         is_retry:
           type: boolean
+        trigger_kind:
+          $ref: "#/components/schemas/JobTriggerKind"
         worker:
           type: string
       required:
@@ -25919,6 +26704,8 @@ components:
             true when a succeeding retry resolved this rather than a person. Explicit rather
             than inferred from an absent resolved_by, which is also absent for a manual
             resolution outside enterprise
+        trigger_kind:
+          $ref: "#/components/schemas/JobTriggerKind"
         worker:
           type: string
       required:
@@ -27081,6 +27868,7 @@ components:
           rlang,
           duckdb,
           bunnative,
+          dbt,
           # for related places search: ADD_NEW_LANG
         ]
 
@@ -27273,6 +28061,21 @@ components:
         - resource_type
         - is_oauth
 
+    ResourceVersion:
+      type: object
+      properties:
+        id:
+          type: integer
+          format: int64
+        created_at:
+          type: string
+          format: date-time
+        created_by:
+          type: string
+      required:
+        - id
+        - created_at
+
     ListableResource:
       type: object
       properties:
@@ -27776,6 +28579,7 @@ components:
         - asset
         - freshness
         - app
+        - ui
 
     TriggerMode:
       description: job trigger mode
@@ -30451,7 +31255,7 @@ components:
               dev_workspace_label:
                 type: string
                 nullable: true
-                description: "Cosmetic display label of the dev workspace ('dev' | 'staging'); null defaults to 'dev'"
+                description: "Environment label of the dev workspace, e.g. 'dev' or 'staging'; null defaults to 'dev'"
               created_by:
                 type: string
                 nullable: true
@@ -30527,8 +31331,8 @@ components:
           description: "Copy the parent's members (users + group memberships) into the fork so the team can work in it"
         dev_workspace_label:
           type: string
-          enum: [dev, staging]
-          description: "Cosmetic display label for the dev workspace (badge text + wording only); ignored for non-dev forks"
+          enum: [dev, qa, test, uat, staging, demo, sandbox, preprod]
+          description: "Environment label for the dev workspace: its badge text and the branch it deploys to. Ignored for non-dev forks. Omitted defaults to 'dev'"
       required:
         - id
         - name
@@ -30550,6 +31354,15 @@ components:
         parent_workspace_id:
           type: string
           nullable: true
+        deleted:
+          type: boolean
+          description: "Archived (soft-deleted) workspace"
+        is_dev_workspace:
+          type: boolean
+        dev_workspace_label:
+          type: string
+          nullable: true
+          description: "Environment label of the dev workspace, e.g. 'dev' or 'staging'; null defaults to 'dev'"
       required:
         - id
         - name
@@ -30721,6 +31534,9 @@ components:
           type: boolean
         on_behalf_of_email:
           type: string
+        on_behalf_of:
+          type: string
+          description: "Authorization identity the runnable runs as: u/{username}, g/{group}, or a bare email when the username is itself email-shaped. The only stored half of the identity; on_behalf_of_email is derived from it."
         labels:
           type: array
           items:
@@ -30762,9 +31578,12 @@ components:
               type: boolean
             on_behalf_of_email:
               type: string
+            on_behalf_of:
+              type: string
+              description: "Authorization identity to run as: u/{username}, g/{group}, or a bare email when the username is itself email-shaped. Supply this or on_behalf_of_email; when only the address is given it is resolved to the account it names, and an address naming nobody is rejected. A pair that disagrees is rejected."
             preserve_on_behalf_of:
               type: boolean
-              description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original on_behalf_of_email value instead of overwriting it."
+              description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original on_behalf_of_email / on_behalf_of pair instead of overwriting it with the caller's own identity."
             labels:
               type: array
               items:
@@ -30795,9 +31614,12 @@ components:
               type: boolean
             on_behalf_of_email:
               type: string
+            on_behalf_of:
+              type: string
+              description: "Authorization identity to run as: u/{username}, g/{group}, or a bare email when the username is itself email-shaped. Supply this or on_behalf_of_email; when only the address is given it is resolved to the account it names, and an address naming nobody is rejected. A pair that disagrees is rejected."
             preserve_on_behalf_of:
               type: boolean
-              description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original on_behalf_of_email value instead of overwriting it."
+              description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original on_behalf_of_email / on_behalf_of pair instead of overwriting it with the caller's own identity."
             labels:
               type: array
               items:
@@ -30892,6 +31714,20 @@ components:
             is isolated from each viewer's Windmill session. When false/absent
             the app runs same-origin with the viewer's full session (the
             default, pre-isolation behavior).
+        frontend_sdk_scopes:
+          type: array
+          items:
+            type: string
+          description: >
+            Raw apps: author-declared scopes for the frontend SDK token. Takes
+            effect only when `sandbox` is also true — an unsandboxed bundle runs
+            with the viewer's own session, so no token is advertised or minted
+            for it and this list stays inert. On a sandboxed app a non-empty
+            list lets viewers mint (after consenting) a short-lived token
+            carrying their own identity restricted to these scopes, handed to
+            the app bundle so `windmill-client` calls run as the viewer. Must
+            be a subset of the server's curated allowlist (jobs:run, jobs:read,
+            users:read, resources:read, variables:read).
 
     ListableApp:
       type: object
@@ -31117,7 +31953,13 @@ components:
         token:
           type: string
           nullable: true
-          description: Narrowly-scoped embed token for the iframe. Absent for fully anonymous or raw apps, which load without a scoped token.
+          description: >
+            Scoped token for the app. For sandboxed low-code apps this is the
+            embed token handed to the opaque iframe. For a raw app it is the
+            viewer-scoped frontend SDK token, returned only when the app is
+            sandboxed, its policy declares frontend_sdk_scopes, and the request
+            carries sdk_consent=true. Absent for anonymous viewers and whenever
+            no token is needed.
         expiration:
           type: string
           format: date-time
@@ -31125,7 +31967,11 @@ components:
           description: Expiration of the embed token.
         raw_app:
           type: boolean
-          description: Raw apps render single-iframe and skip the opaque-viewer indirection and the embed token entirely.
+          description: >
+            Raw apps render single-iframe and skip the opaque-viewer
+            indirection and the embed token entirely. A sandboxed one may still
+            carry a token here: the viewer-scoped frontend SDK token, which is
+            a different credential from the low-code embed token.
         sandbox:
           type: boolean
           description: Publisher opted this app into sandbox isolation. When false the viewer runs the app same-origin with its full session.
@@ -31137,6 +31983,22 @@ components:
           type: string
           nullable: true
           description: The resolved workspace; pairs with app_path so apps at the same path in different workspaces don't share a localStorage store.
+        sdk_scopes:
+          type: array
+          nullable: true
+          items:
+            type: string
+          description: >
+            Sandboxed raw apps: scopes the app policy declares for the frontend
+            SDK token. Null when the app is unsandboxed, however the policy
+            reads. The viewer renders these in the permission prompt; token
+            stays absent until the endpoint is re-called with sdk_consent=true.
+        viewer_email:
+          type: string
+          nullable: true
+          description: >
+            The caller's own email, returned alongside sdk_scopes so the viewer
+            can key its stored "do not ask again" per person.
       required:
         - raw_app
         - sandbox
@@ -31204,6 +32066,35 @@ components:
       required:
         - region_name
 
+    DbtWarehouses:
+      type: object
+      description: >-
+        Warehouses a dbt project may run against, by name. `main` is the one a
+        project gets when its descriptor names none. Each entry points at a
+        resource; it never holds credentials.
+      additionalProperties:
+        type: object
+        properties:
+          resource_path:
+            type: string
+          target:
+            type: string
+        required:
+          - resource_path
+
+    DbtWarehouseConnection:
+      type: object
+      properties:
+        value:
+          description: the resolved resource, rendered into profiles.yml
+        target:
+          type: string
+        resource_type:
+          type: string
+          description: decides whether the value is translated into a profiles.yml target or already is one
+      required:
+        - value
+
     LargeFileStorage:
       type: object
       properties:
@@ -31487,6 +32378,34 @@ components:
       required:
         - s3
 
+    StorageFolder:
+      type: object
+      properties:
+        prefix:
+          type: string
+          description: Full key prefix of the folder, ending with '/'
+        name:
+          type: string
+          description: Last path segment, without the trailing '/'
+      required:
+        - prefix
+        - name
+
+    StorageFile:
+      type: object
+      properties:
+        key:
+          type: string
+        name:
+          type: string
+        size:
+          type: integer
+        last_modified:
+          type: string
+      required:
+        - key
+        - name
+
     WindmillFileMetadata:
       type: object
       properties:
@@ -32147,6 +33066,32 @@ components:
         exists_in_fork:
           type: boolean
           description: If the item exists in the fork workspace
+        fork_last_event_kind:
+          $ref: "#/components/schemas/DeployEventKind"
+        fork_last_event_origin:
+          $ref: "#/components/schemas/DeployEventOrigin"
+        source_last_event_kind:
+          $ref: "#/components/schemas/DeployEventKind"
+        source_last_event_origin:
+          $ref: "#/components/schemas/DeployEventOrigin"
+
+    DeployEventKind:
+      type: string
+      enum: ["write", "delete", "rename_from"]
+      description: |
+        What a deploy event did to the path it is recorded against: `write` (the path holds an item
+        after the event), `delete` (it does not), or `rename_from` (the path was vacated by a rename
+        to another path). Create and update are not distinguished. Omitted when no such event has
+        been recorded for that side, which counts as no evidence.
+
+    DeployEventOrigin:
+      type: string
+      enum: ["authored", "sync"]
+      description: |
+        Who caused a deploy event: `authored` (written in that workspace by the requester) or `sync`
+        (applied there by a git-sync pull or a workspace-to-workspace deploy). Only an authored
+        removal is evidence that the workspace dropped the item on purpose. Omitted when no such
+        event has been recorded for that side.
 
     CompareSummary:
       type: object
@@ -32367,6 +33312,26 @@ components:
         - ducklake
         - datatable
         - volume
+        - dbt
+    AssetProgress:
+      type: object
+      required: [asset_kind, asset_path, status]
+      properties:
+        asset_kind:
+          $ref: "#/components/schemas/AssetKind"
+        asset_path:
+          type: string
+        status:
+          type: string
+          enum: [running, materialized, failed]
+        row_count:
+          type: integer
+          format: int64
+          nullable: true
+        error:
+          type: string
+          nullable: true
+
     MaterializedPartition:
       type: object
       required: [asset_kind, asset_path, partition, status, materialized_at]
@@ -32583,6 +33548,7 @@ components:
         - DisableWorkspaceForking
         - RestrictDeployToDeployers
         - RestrictAnonymousAppDeployment
+        - RestrictPublicRunSharing
     RuleBypasserGroups:
       type: array
       description: Groups that can bypass this ruleset
@@ -32774,8 +33740,17 @@ components:
           description: Short summary to be displayed when listed
         external_data:
           type: object
-          description: Configuration data from the external service
+          nullable: true
+          description: >-
+            Configuration data from the external service. Null when the service has no
+            such API, or when it could not be read — see external_error.
           additionalProperties: true
+        external_error:
+          type: string
+          nullable: true
+          description: >-
+            Why the external service configuration could not be read. When set,
+            external_data is null and the configuration Windmill stored is returned instead.
       required:
         - external_id
         - workspace_id
diff --git a/backend/windmill-api/src/ai_skills.rs b/backend/windmill-api/src/ai_skills.rs
index 6deb8dc58f..11d99d55da 100644
--- a/backend/windmill-api/src/ai_skills.rs
+++ b/backend/windmill-api/src/ai_skills.rs
@@ -7,13 +7,13 @@
  */
 
 use crate::db::{ApiAuthed, DB};
-use std::collections::HashSet;
 use axum::{
     extract::{Extension, Json, Path},
     routing::{delete, get, post},
     Router,
 };
 use serde::{Deserialize, Serialize};
+use std::collections::HashSet;
 use windmill_audit::audit_oss::audit_log;
 use windmill_audit::ActionKind;
 use windmill_common::{
diff --git a/backend/windmill-api/src/apps.rs b/backend/windmill-api/src/apps.rs
index aa320c4167..037f701346 100644
--- a/backend/windmill-api/src/apps.rs
+++ b/backend/windmill-api/src/apps.rs
@@ -13,7 +13,8 @@ use crate::job_helpers_oss::{
     spawn_storage_usage_recount_floored,
 };
 use crate::{
-    auth::{get_end_user_email, OptTokened},
+    apps_raw_bundle,
+    auth::{get_end_user_email, AuthCache, OptTokened},
     db::{ApiAuthed, DB},
     jobs::RunJobQuery,
     users::{require_owner_of_path, require_path_read_access_for_preview, OptAuthed},
@@ -82,7 +83,10 @@ use windmill_common::{
 use windmill_object_store::object_store_reexports::{Attribute, Attributes};
 use windmill_store::resources::get_resource_value_interpolated_internal;
 
-use windmill_api_auth::{create_token_internal, ensure_scopes_within_caller, NewToken};
+use windmill_api_auth::{
+    create_token_internal, ensure_scopes_within_caller, forbid_superadmin_job_token, NewToken,
+    OptJobAuthed,
+};
 use windmill_git_sync::{handle_deployment_metadata, DeployedObject};
 use windmill_queue::{push, PushArgs, PushArgsOwned, PushIsolationLevel};
 
@@ -99,6 +103,7 @@ pub fn workspaced_service(raw_app_body_limit: usize) -> Router {
         .route("/list_search", get(list_search_apps))
         .route("/get/p/{*path}", get(get_app))
         .route("/embed_token/p/{*path}", get(get_app_embed_token_for_path))
+        .route("/preview_sdk_token", post(mint_preview_sdk_token))
         .route("/get/lite/{*path}", get(get_app_lite))
         .route("/secret_of/{*path}", get(get_secret_id))
         .route(
@@ -113,6 +118,16 @@ pub fn workspaced_service(raw_app_body_limit: usize) -> Router {
             "/update_raw/{*path}",
             post(update_app_raw).layer(axum::extract::DefaultBodyLimit::max(raw_app_body_limit)),
         )
+        .route(
+            "/create_raw_source",
+            post(create_app_raw_source)
+                .layer(axum::extract::DefaultBodyLimit::max(raw_app_body_limit)),
+        )
+        .route(
+            "/update_raw_source/{*path}",
+            post(update_app_raw_source)
+                .layer(axum::extract::DefaultBodyLimit::max(raw_app_body_limit)),
+        )
         .route("/delete/{*path}", delete(delete_app))
         .route("/create", post(create_app))
         .route(
@@ -329,6 +344,11 @@ pub struct Policy {
     // with the viewer's full session, the pre-isolation behavior.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub sandbox: Option<bool>,
+    /// Raw apps: scopes a viewer may mint a token for, so the bundle's
+    /// `windmill-client` calls run as them. Subset of
+    /// `FRONTEND_SDK_ALLOWED_SCOPES`; absent means no credential (the default).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub frontend_sdk_scopes: Option<Vec<String>>,
 }
 
 #[derive(Deserialize)]
@@ -365,6 +385,11 @@ pub struct EditApp {
     /// Transient — never persisted.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub skip_draft_deletion: Option<bool>,
+    /// Caller-intent flag: when true this deploy may switch the app between
+    /// low-code and raw (see `update_app_internal`). Transient — never
+    /// persisted.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub allow_kind_change: Option<bool>,
 }
 
 #[derive(Serialize, FromRow)]
@@ -632,6 +657,9 @@ async fn get_raw_app_data(
             .header(http::header::CONTENT_TYPE, "text/html; charset=utf-8")
             .header("X-Content-Type-Options", "nosniff")
             .header("Cross-Origin-Resource-Policy", "cross-origin")
+            // This URL carries the frontend-SDK handshake nonce, so it must not
+            // travel to whatever the bundle navigates to or links out to.
+            .header("Referrer-Policy", "no-referrer")
             .header(
                 http::header::CONTENT_SECURITY_POLICY,
                 "sandbox allow-scripts allow-forms allow-popups \
@@ -744,9 +772,10 @@ async fn get_raw_app_data(
 /// HTML wrapper that hosts a raw-app bundle inside a sandboxed, opaque-origin
 /// iframe. Served by [`get_raw_app_data`] for the `.html` "file type". It loads
 /// the bundle `.js`/`.css` as same-path subresources, shims web storage (which
-/// an opaque origin disallows), and waits for the embedder to hand it the user
-/// context via `postMessage` before evaluating the bundle — so the bundle never
-/// receives a credential and `window.ctx` is set synchronously when it runs.
+/// an opaque origin disallows), and waits for the embedder's handshake before
+/// evaluating the bundle, so `window.ctx` — and `window.process.env` when the
+/// viewer approved SDK scopes — is set synchronously when it runs. That token is
+/// the bundle's only credential, gated on both handshake proofs below.
 fn raw_app_wrapper_html(secret: &str) -> String {
     const TEMPLATE: &str = r##"<!DOCTYPE html>
 <html>
@@ -815,21 +844,34 @@ fn raw_app_wrapper_html(secret: &str) -> String {
     s.src = './__SECRET__.js';
     document.body.appendChild(s);
   }
-  window.addEventListener('message', function (e) {
-    var d = e.data || {};
-    if (d.type === 'windmill:ctx') {
-      window.ctx = d.ctx;
-      if (window.__wmStorageShim && d.storage) {
-        window.__wmStorageShim.local.__hydrate(d.storage.local);
-        window.__wmStorageShim.session.__hydrate(d.storage.session);
-      }
-      if (d.initialHash && d.initialHash !== '#' && !window.location.hash) {
-        try { history.replaceState(null, '', d.initialHash); } catch (_) {}
-      }
-      loadBundle();
+  function applyCtx(d) {
+    if (!d || d.type !== 'windmill:ctx') return;
+    window.ctx = d.ctx;
+    if (window.__wmStorageShim && d.storage) {
+      window.__wmStorageShim.local.__hydrate(d.storage.local);
+      window.__wmStorageShim.session.__hydrate(d.storage.session);
     }
-  });
-  try { window.parent.postMessage({ type: 'windmill:ready' }, '*'); } catch (_) {}
+    // A bundled `windmill-client` reads window.process.env at module load, so the
+    // env must exist before the bundle script is injected below. BASE_URL comes
+    // from the embedder — location.origin is "null" on this opaque origin.
+    if (d.sdk && d.sdk.token) {
+      window.process = { env: { WM_RAW_APP: 'true', WM_TOKEN: d.sdk.token, BASE_URL: d.sdk.baseUrl, WM_WORKSPACE: d.sdk.workspace } };
+    }
+    if (d.initialHash && d.initialHash !== '#' && !window.location.hash) {
+      try { history.replaceState(null, '', d.initialHash); } catch (_) {}
+    }
+    loadBundle();
+  }
+  // The embedder parts with the viewer's SDK token only if both hold: the nonce
+  // from our URL says which document is asking (one navigated in later cannot
+  // read it), and our own port says the answer reaches only this document
+  // (replacing the document discards the port).
+  try {
+    var hs = new URLSearchParams(window.location.search).get('wm_hs') || undefined;
+    var ch = new MessageChannel();
+    ch.port1.onmessage = function (e) { applyCtx(e.data); };
+    window.parent.postMessage({ type: 'windmill:ready', nonce: hs }, '*', [ch.port2]);
+  } catch (_) {}
   // Fallback for contexts that never send ctx (e.g. ctx-less rendering).
   setTimeout(loadBundle, 1500);
 })();
@@ -1210,6 +1252,201 @@ pub const APP_EMBED_SCOPES: [&str; 5] = [
 /// (e.g. after a `401` from the iframe) so this can stay short.
 const APP_EMBED_TOKEN_VALIDITY_HOURS: i64 = 12;
 
+/// Scopes an app author may declare in `Policy::frontend_sdk_scopes`. No `apps:*`
+/// scope, so the token cannot reach the mint endpoints and renew itself; the
+/// `raw_app_sdk` sentinel narrows the rest (see `scopes.rs`).
+pub const FRONTEND_SDK_ALLOWED_SCOPES: [&str; 5] = [
+    "jobs:run",
+    "jobs:read",
+    "users:read",
+    "resources:read",
+    "variables:read",
+];
+
+/// Reject a policy declaring frontend SDK scopes outside the curated list.
+/// Enforced on every policy write AND re-checked at mint time, so a policy
+/// written by an older/foreign client can't broaden what gets minted.
+fn validate_frontend_sdk_scopes_list(scopes: &[String]) -> Result<()> {
+    let mut seen = std::collections::HashSet::new();
+    for s in scopes {
+        if !FRONTEND_SDK_ALLOWED_SCOPES.contains(&s.as_str()) {
+            return Err(Error::BadRequest(format!(
+                "Invalid frontend SDK scope '{}'. Allowed scopes: {}",
+                s,
+                FRONTEND_SDK_ALLOWED_SCOPES.join(", ")
+            )));
+        }
+        // The viewer's permission prompt renders these as a keyed list, which a
+        // repeat would break. The editor can't produce one; the API/CLI can.
+        if !seen.insert(s.as_str()) {
+            return Err(Error::BadRequest(format!(
+                "Duplicate frontend SDK scope '{}'",
+                s
+            )));
+        }
+    }
+    Ok(())
+}
+
+fn validate_frontend_sdk_scopes(policy: &Policy) -> Result<()> {
+    if let Some(scopes) = &policy.frontend_sdk_scopes {
+        validate_frontend_sdk_scopes_list(scopes)?;
+    }
+    Ok(())
+}
+
+/// Mint the viewer-identity token a raw app's bundle uses for `windmill-client`.
+///
+/// The CALLER MUST establish that `authed` may hold this app's credential: the
+/// viewer endpoints verify read access, `mint_preview_sdk_token` requires
+/// `apps:write:<path>`.
+async fn mint_raw_app_sdk_token(
+    db: &DB,
+    w_id: &str,
+    app_path: &str,
+    authed: &ApiAuthed,
+    scopes: &[String],
+    job_id: Option<uuid::Uuid>,
+) -> Result<(String, chrono::DateTime<chrono::Utc>)> {
+    // This credential outlives the request, so an ephemeral job token must not be
+    // able to launder itself into one — the reason `users/tokens/create` refuses.
+    forbid_superadmin_job_token(db, &authed.email, job_id).await?;
+    // An embed token represents untrusted app JS; it must not bootstrap a
+    // broader SDK credential (same guard as `mint_app_embed_token`).
+    if windmill_api_auth::scopes::has_app_embed_sentinel(authed.scopes.as_deref()) {
+        return Err(Error::NotAuthorized(
+            "App embed tokens cannot mint SDK tokens".to_string(),
+        ));
+    }
+    validate_frontend_sdk_scopes_list(scopes)?;
+    // A scope-restricted caller token must not bootstrap a broader-scoped SDK
+    // token. No-op for unscoped browser sessions. Checked on the declared scopes
+    // only — the sentinel grants nothing and exists to *narrow* the token.
+    ensure_scopes_within_caller(authed, Some(scopes))?;
+    let mut scopes = scopes.to_vec();
+    scopes.push(windmill_api_auth::scopes::RAW_APP_SDK_SENTINEL.to_string());
+    let expiration = chrono::Utc::now() + chrono::Duration::hours(APP_EMBED_TOKEN_VALIDITY_HOURS);
+    let token_config = NewToken::new(
+        Some(format!("sdk_app:{app_path}")),
+        Some(expiration),
+        None,
+        Some(scopes),
+        Some(w_id.to_string()),
+        // Never let an SDK token gain write capability the caller's own
+        // session lacks.
+        Some(authed.read_only),
+    );
+    let mut tx = db.begin().await?;
+    let token = create_token_internal(&mut *tx, db, authed, token_config).await?;
+    tx.commit().await?;
+    Ok((token, expiration))
+}
+
+/// Shared tail of the three embed-token endpoints: which credential the viewer
+/// gets. Sandboxed low-code gets the embed token; a sandboxed raw app declaring
+/// `frontend_sdk_scopes` gets the SDK token once `sdk_consent` is set — the
+/// viewer's answer, not a boundary; the boundary is the scope set.
+///
+/// The CALLER MUST verify that `opt_authed` may view `app_path`.
+pub async fn build_embed_token_response(
+    db: &DB,
+    w_id: &str,
+    app_path: &str,
+    raw_app: bool,
+    policy: &EmbedPolicyView,
+    opt_authed: Option<&ApiAuthed>,
+    sdk_consent: bool,
+    job_id: Option<uuid::Uuid>,
+) -> Result<EmbedTokenResponse> {
+    // Only advertise scopes where a token could actually be minted, so the viewer
+    // is never shown a permission prompt that can grant nothing: an anonymous
+    // visitor has no identity to mint against.
+    // Frontend SDK access is sandbox-only: an unsandboxed bundle already runs with
+    // the viewer's session, so a prompt there would suggest a boundary that isn't
+    // one. A policy still carrying scopes with isolation off is simply inert.
+    let sdk_scopes = if raw_app
+        && policy.sandbox
+        && opt_authed.is_some()
+        && !policy.frontend_sdk_scopes.is_empty()
+    {
+        Some(policy.frontend_sdk_scopes.clone())
+    } else {
+        None
+    };
+    let (token, expiration) = if raw_app {
+        match (&sdk_scopes, opt_authed) {
+            (Some(scopes), Some(authed)) if sdk_consent => {
+                let (t, e) =
+                    mint_raw_app_sdk_token(db, w_id, app_path, authed, scopes, job_id).await?;
+                (Some(t), Some(e))
+            }
+            _ => (None, None),
+        }
+    } else if policy.sandbox {
+        let resp = mint_app_embed_token(db, w_id, app_path, opt_authed).await?;
+        (resp.token, resp.expiration)
+    } else {
+        (None, None)
+    };
+    let viewer_email = sdk_scopes
+        .is_some()
+        .then(|| opt_authed.map(|a| a.email.clone()))
+        .flatten();
+    Ok(EmbedTokenResponse {
+        token,
+        expiration,
+        raw_app,
+        sandbox: policy.sandbox,
+        app_path: Some(app_path.to_string()),
+        workspace_id: Some(w_id.to_string()),
+        sdk_scopes,
+        viewer_email,
+    })
+}
+
+#[derive(Deserialize)]
+pub struct PreviewSdkTokenRequest {
+    /// The app being edited. May not exist yet (a draft), so this is only used for
+    /// the write-scope check and the token label.
+    pub path: String,
+    /// Scopes from the policy currently being edited, so the preview behaves like
+    /// the deployed app instead of the last-deployed policy.
+    pub scopes: Vec<String>,
+}
+
+/// Mint an SDK token for the raw-app editor's own preview. The author grants it
+/// to themselves — minted from their session and capped the same way, so it
+/// conveys nothing `users/tokens/create` wouldn't. Scopes come from the request
+/// so the preview matches an app whose scopes aren't deployed yet, as
+/// `execute_component` already does for editor previews.
+async fn mint_preview_sdk_token(
+    authed: ApiAuthed,
+    OptJobAuthed { job_id, .. }: OptJobAuthed,
+    Extension(db): Extension<DB>,
+    Path(w_id): Path<String>,
+    Json(req): Json<PreviewSdkTokenRequest>,
+) -> Result<String> {
+    if authed.is_operator {
+        return Err(Error::NotAuthorized(
+            "Operators cannot preview raw apps".to_string(),
+        ));
+    }
+    check_scopes(&authed, || format!("apps:write:{}", req.path))?;
+    let (token, _expiration) =
+        mint_raw_app_sdk_token(&db, &w_id, &req.path, &authed, &req.scopes, job_id).await?;
+    Ok(token)
+}
+
+/// Query for the embed-token endpoints.
+#[derive(Deserialize)]
+pub struct EmbedTokenQuery {
+    /// Raw apps: the viewer confirmed the SDK-permissions consent banner, so the
+    /// viewer-scoped SDK token may actually be minted. Defaults to false — the
+    /// first fetch only advertises the declared scopes.
+    #[serde(default)]
+    pub sdk_consent: bool,
+}
+
 #[derive(Serialize)]
 pub struct EmbedTokenResponse {
     /// Narrowly-scoped token for the iframe. `None` for fully anonymous access
@@ -1237,6 +1474,16 @@ pub struct EmbedTokenResponse {
     /// share a store. For custom-path apps the viewer can't derive this itself.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub workspace_id: Option<String>,
+    /// Raw apps: scopes the app policy declares for the frontend SDK token. The
+    /// viewer renders these in the permission prompt; `token` stays `None` until
+    /// the endpoint is re-called with `sdk_consent=true`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub sdk_scopes: Option<Vec<String>>,
+    /// The caller's own email, so the viewer can key its stored "do not ask
+    /// again" per person — that localStorage is shared across everyone using the
+    /// browser. Set alongside `sdk_scopes`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub viewer_email: Option<String>,
 }
 
 /// Mint a short-lived, narrowly-scoped embed token for `app_path` when a caller
@@ -1313,6 +1560,8 @@ pub async fn mint_app_embed_token(
         sandbox: false,
         app_path: Some(app_path.to_string()),
         workspace_id: Some(w_id.to_string()),
+        sdk_scopes: None,
+        viewer_email: None,
     })
 }
 
@@ -1322,10 +1571,22 @@ pub async fn mint_app_embed_token(
 /// access to the app.
 async fn get_app_embed_token(
     OptAuthed(opt_authed): OptAuthed,
+    // Resolved from the token when there is one: this endpoint serves anonymous
+    // viewers too, so it cannot take an extractor that requires auth.
+    OptTokened { token }: OptTokened,
+    Extension(cache): Extension<Arc<AuthCache>>,
     Extension(user_db): Extension<UserDB>,
     Extension(db): Extension<DB>,
     Path((w_id, secret)): Path<(String, String)>,
+    Query(sdk_query): Query<EmbedTokenQuery>,
 ) -> JsonResult<EmbedTokenResponse> {
+    let job_id = match token.as_deref() {
+        Some(t) => cache
+            .get_opt_job_authed(Some(w_id.clone()), t)
+            .await
+            .and_then(|x| x.job_id),
+        None => None,
+    };
     let id = get_id_from_secret(&db, &w_id, secret, None).await?;
 
     let app = sqlx::query!(
@@ -1374,29 +1635,17 @@ async fn get_app_embed_token(
         Some(authed)
     };
 
-    // The token is only consumed by the sandboxed low-code render. Raw apps
-    // render single-iframe with the page credential (WIN-2006 Variant A), and
-    // unsandboxed apps render same-origin with the viewer's own session — minting
-    // for those would write a useless token row per view and, worse, could fail
-    // the whole render for a scope-restricted caller (`ensure_scopes_within_caller`)
-    // even though no token is needed. The access check above still gates
-    // visibility in every case.
-    let mut resp = if raw_app || !policy.sandbox {
-        EmbedTokenResponse {
-            token: None,
-            expiration: None,
-            raw_app,
-            sandbox: policy.sandbox,
-            app_path: None,
-            workspace_id: None,
-        }
-    } else {
-        mint_app_embed_token(&db, &w_id, &app.path, authed_for_token.as_ref()).await?
-    };
-    resp.raw_app = raw_app;
-    resp.sandbox = policy.sandbox;
-    resp.app_path = Some(app.path);
-    resp.workspace_id = Some(w_id.to_string());
+    let resp = build_embed_token_response(
+        &db,
+        &w_id,
+        &app.path,
+        raw_app,
+        &policy,
+        authed_for_token.as_ref(),
+        sdk_query.sdk_consent,
+        job_id,
+    )
+    .await?;
     Ok(Json(resp))
 }
 
@@ -1410,6 +1659,9 @@ async fn get_app_embed_token(
 pub struct EmbedPolicyView {
     pub anonymous_execution: bool,
     pub sandbox: bool,
+    /// Raw apps: author-declared scopes for the frontend SDK token; empty when
+    /// the app doesn't use the frontend SDK (non-string entries are ignored).
+    pub frontend_sdk_scopes: Vec<String>,
 }
 
 pub fn parse_embed_policy(policy_str: &str) -> Result<EmbedPolicyView> {
@@ -1417,6 +1669,15 @@ pub fn parse_embed_policy(policy_str: &str) -> Result<EmbedPolicyView> {
     Ok(EmbedPolicyView {
         anonymous_execution: v.get("execution_mode").and_then(|m| m.as_str()) == Some("anonymous"),
         sandbox: v.get("sandbox").and_then(|b| b.as_bool()).unwrap_or(false),
+        frontend_sdk_scopes: v
+            .get("frontend_sdk_scopes")
+            .and_then(|s| s.as_array())
+            .map(|a| {
+                a.iter()
+                    .filter_map(|x| x.as_str().map(|s| s.to_string()))
+                    .collect()
+            })
+            .unwrap_or_default(),
     })
 }
 
@@ -1427,9 +1688,11 @@ pub fn parse_embed_policy(policy_str: &str) -> Result<EmbedPolicyView> {
 /// scoped token. Raw apps get no token (single-iframe with the page credential).
 async fn get_app_embed_token_for_path(
     authed: ApiAuthed,
+    OptJobAuthed { job_id, .. }: OptJobAuthed,
     Extension(user_db): Extension<UserDB>,
     Extension(db): Extension<DB>,
     Path((w_id, path)): Path<(String, StripPath)>,
+    Query(sdk_query): Query<EmbedTokenQuery>,
 ) -> JsonResult<EmbedTokenResponse> {
     let path = path.to_path();
     check_scopes(&authed, || format!("apps:read:{}", path))?;
@@ -1450,26 +1713,20 @@ async fn get_app_embed_token_for_path(
     let policy_str = app
         .policy
         .ok_or_else(|| Error::internal_err("App policy missing".to_string()))?;
-    // Lenient parse + mint only for the sandboxed low-code render — see
-    // [`get_app_embed_token`] for the rationale (identical here).
+    // Lenient parse — see [`get_app_embed_token`] for the rationale (identical here).
     let policy = parse_embed_policy(&policy_str)?;
 
-    let mut resp = if raw_app || !policy.sandbox {
-        EmbedTokenResponse {
-            token: None,
-            expiration: None,
-            raw_app,
-            sandbox: policy.sandbox,
-            app_path: None,
-            workspace_id: None,
-        }
-    } else {
-        mint_app_embed_token(&db, &w_id, path, Some(&authed)).await?
-    };
-    resp.raw_app = raw_app;
-    resp.sandbox = policy.sandbox;
-    resp.app_path = Some(path.to_string());
-    resp.workspace_id = Some(w_id.to_string());
+    let resp = build_embed_token_response(
+        &db,
+        &w_id,
+        path,
+        raw_app,
+        &policy,
+        Some(&authed),
+        sdk_query.sdk_consent,
+        job_id,
+    )
+    .await?;
     Ok(Json(resp))
 }
 
@@ -1854,6 +2111,7 @@ async fn create_app_internal<'a>(
     // inside process_app_multipart!, so checking after this call would leave a
     // denied app committed in the DB.
     check_scopes(&authed, || format!("apps:write:{}", &app.path))?;
+    validate_frontend_sdk_scopes(&app.policy)?;
     if *CLOUD_HOSTED {
         let nb_apps =
             sqlx::query_scalar!("SELECT COUNT(*) FROM app WHERE workspace_id = $1", &w_id)
@@ -2055,6 +2313,7 @@ async fn create_app_internal<'a>(
         &authed.email,
         windmill_common::users::username_to_permissioned_as(&authed.username),
         authed.token_prefix.as_deref(),
+        authed.username_override.as_deref(),
         None,
         None,
         None,
@@ -2294,6 +2553,33 @@ async fn delete_app(
     Ok(format!("app {} deleted", path))
 }
 
+/// Report the path an app rename left behind (see `tally_rename_vacated_path`).
+/// `raw_app` decides the diff row's kind, so read it back rather than guess — a
+/// wrong kind writes a row nothing reads.
+async fn tally_app_rename(db: &DB, w_id: &str, opath: &str, npath: &str, v_id: i64) {
+    if opath == npath {
+        return;
+    }
+    let raw_app = match sqlx::query_scalar!("SELECT raw_app FROM app_version WHERE id = $1", v_id)
+        .fetch_optional(db)
+        .await
+    {
+        Ok(raw_app) => raw_app.unwrap_or(false),
+        Err(e) => {
+            tracing::error!(%e, "could not read app_version {v_id} to tally the rename");
+            return;
+        }
+    };
+    let vacated = if raw_app {
+        DeployedObject::RawApp { path: opath.to_string(), version: v_id, parent_path: None }
+    } else {
+        DeployedObject::App { path: opath.to_string(), version: v_id, parent_path: None }
+    };
+    if let Err(e) = windmill_git_sync::tally_rename_vacated_path(db, w_id, vacated).await {
+        tracing::error!(%e, "error tallying the path renamed away from");
+    }
+}
+
 async fn update_app(
     authed: ApiAuthed,
     Extension(db): Extension<DB>,
@@ -2324,10 +2610,13 @@ async fn update_app(
     }
 
     let opath = path.to_string();
-    let (new_tx, npath, _v_id) =
+    let db2 = db.clone();
+    let (new_tx, npath, v_id) =
         update_app_internal(authed, db, user_db, &w_id, path, false, ns).await?;
     new_tx.commit().await?;
 
+    tally_app_rename(&db2, &w_id, &opath, &npath, v_id).await;
+
     webhook.send_message(
         w_id.clone(),
         WebhookMessage::UpdateApp {
@@ -2340,6 +2629,285 @@ async fn update_app(
     Ok(format!("app {} updated (npath: {:?})", opath, npath))
 }
 
+/// Deploy a raw app from its sources, compiling them on a worker. `update_raw`
+/// takes the bundle the caller already built (the editor and the CLI both
+/// bundle before calling it); an API client has nothing to build with, so this
+/// is the raw-app deploy an MCP agent or a script can actually reach.
+async fn update_app_raw_source(
+    authed: ApiAuthed,
+    Extension(user_db): Extension<UserDB>,
+    Extension(db): Extension<DB>,
+    Extension(webhook): Extension<WebhookShared>,
+    Path((w_id, path)): Path<(String, StripPath)>,
+    Json(ns): Json<EditApp>,
+) -> Result<String> {
+    if authed.is_operator {
+        return Err(Error::NotAuthorized(
+            "Operators cannot update apps for security reasons".to_string(),
+        ));
+    }
+
+    let path = path.to_path();
+    check_scopes(&authed, || format!("apps:write:{}", path))?;
+    // The sources are compiled by a job on a worker: dependency resolution and
+    // the build run there, on caller-supplied input. A token that can't run jobs
+    // must not gain that through an app write, so require both scopes.
+    check_scopes(&authed, || "jobs:run".to_string())?;
+
+    if let RuleCheckResult::Blocked(msg) = check_deploy_rules(
+        &w_id,
+        AuditAuthorable::username(&authed),
+        &authed.groups,
+        authed.is_admin,
+        &db,
+    )
+    .await?
+    {
+        return Err(Error::PermissionDenied(msg));
+    }
+
+    let Some(value) = ns.value.as_ref() else {
+        return Err(Error::BadRequest(
+            "value with the app's `files` is required to deploy a raw app".to_string(),
+        ));
+    };
+    let files: RawAppSourceFiles = serde_json::from_str(value.0.get())
+        .map_err(|e| Error::BadRequest(format!("app value is not a raw app source: {e}")))?;
+
+    // All before the compile, which costs a job on a worker: it must not run for
+    // a path with no app, for a caller who can only read one (RLS refuses the
+    // write, but not until their sources have been built), or for an app of the
+    // other kind, which update_app_internal refuses anyway.
+    let deployed_raw_app = deployed_app_kind(&user_db, &authed, &w_id, path)
+        .await?
+        .ok_or_else(|| Error::NotFound(format!("App {path} not found")))?;
+    if !can_write_app(&user_db, &authed, &w_id, path).await? {
+        return Err(Error::PermissionDenied(format!(
+            "You do not have permission to update app {path}"
+        )));
+    }
+    if !ns.allow_kind_change.unwrap_or(false) {
+        reject_kind_change(path, true, Some(deployed_raw_app))?;
+    }
+
+    let (js, css) =
+        apps_raw_bundle::bundle_raw_app_sources(&db, &user_db, &authed, &w_id, &files.files)
+            .await?;
+
+    let opath = path.to_string();
+    let db2 = db.clone();
+    let (mut tx, npath, v_id) =
+        update_app_internal(authed, db, user_db, &w_id, path, true, ns).await?;
+    store_raw_app_file(&w_id, &v_id, "js", bytes::Bytes::from(js), &mut tx).await?;
+    if !css.is_empty() {
+        store_raw_app_file(&w_id, &v_id, "css", bytes::Bytes::from(css), &mut tx).await?;
+    }
+    tx.commit().await?;
+    tally_app_rename(&db2, &w_id, &opath, &npath, v_id).await;
+
+    webhook.send_message(
+        w_id.clone(),
+        WebhookMessage::UpdateApp {
+            workspace: w_id.clone(),
+            old_path: opath.clone(),
+            new_path: npath.clone(),
+        },
+    );
+
+    Ok(format!("app {} updated (npath: {:?})", opath, npath))
+}
+
+/// Whether the caller may create an app at `path` — asked of the database rather
+/// than restated here, like `can_write_app`: the app's RLS grants group members
+/// write on a `g/<group>/…` path, which a hand-written check misses. The probe is
+/// the insert itself, rolled back; `app` has no insert trigger, so the only trace
+/// is a consumed sequence value.
+async fn can_create_app(
+    user_db: &UserDB,
+    authed: &ApiAuthed,
+    w_id: &str,
+    path: &str,
+) -> Result<bool> {
+    let mut tx = user_db.clone().begin(authed).await?;
+    let allowed = sqlx::query_scalar!(
+        "INSERT INTO app (workspace_id, path, summary, policy, versions)
+         VALUES ($1, $2, '', '{}'::jsonb, '{}') RETURNING 1",
+        w_id,
+        path
+    )
+    .fetch_optional(&mut *tx)
+    .await;
+    tx.rollback().await?;
+    match allowed {
+        Ok(row) => Ok(row.is_some()),
+        Err(sqlx::Error::Database(e)) => match e.code().as_deref() {
+            // RLS refuses an insert outright rather than filtering it out.
+            Some("42501") => Ok(false),
+            // The path was taken between the existence check and this probe.
+            // Permission is not what is wrong, so let the real insert say so.
+            Some("23505") => Ok(true),
+            _ => Err(sqlx::Error::Database(e).into()),
+        },
+        Err(e) => Err(e.into()),
+    }
+}
+
+/// Whether a deployed app already occupies `path`. Through the privileged pool
+/// on purpose: a path taken by an app the caller can't see is still taken, and
+/// `create_app_internal` would fail on the unique index either way.
+async fn app_exists(db: &DB, w_id: &str, path: &str) -> Result<bool> {
+    Ok(sqlx::query_scalar!(
+        "SELECT EXISTS(SELECT 1 FROM app WHERE path = $1 AND workspace_id = $2)",
+        path,
+        w_id
+    )
+    .fetch_one(db)
+    .await?
+    .unwrap_or(false))
+}
+
+/// Create a raw app from its sources, compiling them on a worker. The counterpart
+/// of `update_app_raw_source`: `create_raw` takes a bundle the caller already
+/// built, which an API client has no way to produce.
+async fn create_app_raw_source(
+    authed: ApiAuthed,
+    Extension(user_db): Extension<UserDB>,
+    Extension(db): Extension<DB>,
+    Extension(webhook): Extension<WebhookShared>,
+    Path(w_id): Path<String>,
+    Json(app): Json<CreateApp>,
+) -> Result<(StatusCode, String)> {
+    if authed.is_operator {
+        return Err(Error::NotAuthorized(
+            "Operators cannot create apps for security reasons".to_string(),
+        ));
+    }
+
+    let path = app.path.clone();
+    check_scopes(&authed, || format!("apps:write:{}", path))?;
+    // See update_app_raw_source: the compile runs caller-supplied sources on a
+    // worker, so writing an app must not be a way to gain that.
+    check_scopes(&authed, || "jobs:run".to_string())?;
+
+    if let RuleCheckResult::Blocked(msg) = check_deploy_rules(
+        &w_id,
+        AuditAuthorable::username(&authed),
+        &authed.groups,
+        authed.is_admin,
+        &db,
+    )
+    .await?
+    {
+        return Err(Error::PermissionDenied(msg));
+    }
+
+    let files: RawAppSourceFiles = serde_json::from_str(app.value.0.get())
+        .map_err(|e| Error::BadRequest(format!("app value is not a raw app source: {e}")))?;
+
+    // Before the compile, which costs a job on a worker: it must not run for a
+    // path already taken, nor for one the caller can't write. `create_app_internal`
+    // rejects both, but only after the sources have been built.
+    if app_exists(&db, &w_id, &path).await? {
+        return Err(Error::BadRequest(format!("App {path} already exists")));
+    }
+    if !can_create_app(&user_db, &authed, &w_id, &path).await? {
+        return Err(Error::PermissionDenied(format!(
+            "You do not have permission to create app {path}"
+        )));
+    }
+
+    let (js, css) =
+        apps_raw_bundle::bundle_raw_app_sources(&db, &user_db, &authed, &w_id, &files.files)
+            .await?;
+
+    let (mut tx, npath, v_id) = create_app_internal(authed, db, user_db, &w_id, true, app).await?;
+    store_raw_app_file(&w_id, &v_id, "js", bytes::Bytes::from(js), &mut tx).await?;
+    if !css.is_empty() {
+        store_raw_app_file(&w_id, &v_id, "css", bytes::Bytes::from(css), &mut tx).await?;
+    }
+    tx.commit().await?;
+
+    webhook.send_message(
+        w_id.clone(),
+        WebhookMessage::CreateApp { workspace: w_id, path: npath.clone() },
+    );
+
+    Ok((StatusCode::CREATED, npath))
+}
+
+/// The part of a raw app's value the bundler needs.
+#[derive(Deserialize)]
+struct RawAppSourceFiles {
+    #[serde(default)]
+    files: HashMap<String, String>,
+}
+
+fn reject_kind_change(path: &str, raw_app: bool, deployed_raw_app: Option<bool>) -> Result<()> {
+    if !deployed_raw_app.is_some_and(|deployed| deployed != raw_app) {
+        return Ok(());
+    }
+    // Name the folder suffix too: a sync push picks the endpoint from the repo
+    // layout, so its operator has no endpoint to swap, only a folder.
+    let (kind, endpoint, folder) = if raw_app {
+        ("a low-code app", "/apps/update", ".app")
+    } else {
+        ("a raw app", "/apps/update_raw", ".raw_app")
+    };
+    Err(Error::BadRequest(format!(
+        "App {path} is {kind}: deploying a value to it through the other kind's endpoint \
+         would convert it and strand its bundle. Deploy it through {endpoint} instead \
+         (from a synced repo, from a `{folder}` folder), or set allow_kind_change to \
+         convert it on purpose."
+    )))
+}
+
+/// Whether the caller may write the app — decided by the database rather than by
+/// restating its policies here, which is how a hand-written check came to miss
+/// that the app's RLS grants group members write on a `g/<group>/…` path. The
+/// probe is the write itself, rolled back; `path = path` touches no column any
+/// trigger watches.
+async fn can_write_app(
+    user_db: &UserDB,
+    authed: &ApiAuthed,
+    w_id: &str,
+    path: &str,
+) -> Result<bool> {
+    let mut tx = user_db.clone().begin(authed).await?;
+    let allowed = sqlx::query_scalar!(
+        "UPDATE app SET path = path WHERE path = $1 AND workspace_id = $2 RETURNING 1",
+        path,
+        w_id
+    )
+    .fetch_optional(&mut *tx)
+    .await?
+    .is_some();
+    tx.rollback().await?;
+    Ok(allowed)
+}
+
+/// Whether the app deployed at `path` is raw, or None when there is none the
+/// caller can see. Through `user_db`, so it can't tell a caller anything about
+/// an app they aren't allowed to read.
+async fn deployed_app_kind(
+    user_db: &UserDB,
+    authed: &ApiAuthed,
+    w_id: &str,
+    path: &str,
+) -> Result<Option<bool>> {
+    let mut tx = user_db.clone().begin(authed).await?;
+    let deployed_raw_app = sqlx::query_scalar!(
+        "SELECT app_version.raw_app FROM app
+         JOIN app_version ON app_version.id = app.versions[array_upper(app.versions, 1)]
+         WHERE app.path = $1 AND app.workspace_id = $2",
+        path,
+        w_id
+    )
+    .fetch_optional(&mut *tx)
+    .await?;
+    tx.commit().await?;
+    Ok(deployed_raw_app)
+}
+
 async fn update_app_raw<'a>(
     authed: ApiAuthed,
     Extension(user_db): Extension<UserDB>,
@@ -2369,7 +2937,8 @@ async fn update_app_raw<'a>(
     let path = path.to_path();
     check_scopes(&authed, || format!("apps:write:{}", path))?;
     let opath = path.to_string();
-    let (npath, _id) = process_app_multipart!(
+    let db2 = db.clone();
+    let (npath, v_id) = process_app_multipart!(
         authed,
         user_db,
         db,
@@ -2379,6 +2948,7 @@ async fn update_app_raw<'a>(
         update_app_internal
     )
     .await?;
+    tally_app_rename(&db2, &w_id, &opath, &npath, v_id).await;
 
     webhook.send_message(
         w_id.clone(),
@@ -2418,6 +2988,33 @@ async fn update_app_internal<'a>(
 
     let mut tx = user_db.clone().begin(&authed).await?;
 
+    // `app_version.raw_app` is set by whichever endpoint writes the version, so a
+    // value deployed through the wrong one converts the app and strands its bundle.
+    // `FOR UPDATE` holds the app row until this transaction appends its own version,
+    // so a concurrent deploy of the other kind can't land between check and append.
+    if ns.value.is_some() && !ns.allow_kind_change.unwrap_or(false) {
+        let deployed_version = sqlx::query_scalar!(
+            "SELECT versions[array_upper(versions, 1)] FROM app
+             WHERE path = $1 AND workspace_id = $2 FOR UPDATE",
+            path,
+            w_id
+        )
+        .fetch_optional(&mut *tx)
+        .await?
+        .flatten();
+        let deployed_raw_app = match deployed_version {
+            // A separate statement: it needs the head the lock above pinned, not
+            // the snapshot the locking statement started from.
+            Some(version) => {
+                sqlx::query_scalar!("SELECT raw_app FROM app_version WHERE id = $1", version)
+                    .fetch_optional(&mut *tx)
+                    .await?
+            }
+            None => None,
+        };
+        reject_kind_change(path, raw_app, deployed_raw_app)?;
+    }
+
     let mut preserved_on_behalf_of: Option<String> = None;
     let npath = if ns.policy.is_some()
         || ns.path.is_some()
@@ -2492,6 +3089,7 @@ async fn update_app_internal<'a>(
         }
 
         if let Some(mut npolicy) = ns.policy {
+            validate_frontend_sdk_scopes(&npolicy)?;
             if matches!(npolicy.execution_mode, ExecutionMode::Anonymous) && !authed.is_admin {
                 // Restricted users may keep deploying an app that is already
                 // public, but flipping an app to anonymous (public) access is
@@ -2681,6 +3279,7 @@ async fn update_app_internal<'a>(
         &authed.email,
         windmill_common::users::username_to_permissioned_as(&authed.username),
         authed.token_prefix.as_deref(),
+        authed.username_override.as_deref(),
         None,
         None,
         None,
@@ -2837,15 +3436,12 @@ async fn execute_component(
     Json(mut payload): Json<ExecuteApp>,
 ) -> Result<String> {
     let path = path.to_path();
-    // Authorize FIRST, before touching the payload: confine the app embed token (the
-    // only credential handed to untrusted app JS, carrying `apps:run:<own path>`) to
-    // the app it was minted for. The route layer can't path-check the apps domain, so
-    // enforce it here. Scoped to embed tokens only — other callers (anonymous, cookie,
-    // plain external JWT) keep their existing access; the run is still policy-gated.
+    // Authorize before touching the payload: the route layer is resource-blind, so a
+    // path-scoped caller (app embed token, or a picker-minted `apps:run|write:<path>`)
+    // is confined to its own app only here. No-op for unscoped callers; anonymous ones
+    // are policy-gated below.
     if let Some(authed) = opt_authed.as_ref() {
-        if windmill_api_auth::scopes::has_app_embed_sentinel(authed.scopes.as_deref()) {
-            check_scopes(authed, || format!("apps:run:{}", path))?;
-        }
+        check_scopes(authed, || format!("apps:run:{}", path))?;
     }
     // Only honor temp_script_refs for the inline-script preview path:
     // preview/editor mode (force_viewer_static_fields set, == `is_preview`),
@@ -3217,6 +3813,9 @@ async fn execute_component(
             .and_then(|a| a.token_prefix)
             .or_else(|| tokened.token.map(|t| t[0..TOKEN_PREFIX_LEN].to_string()))
             .as_deref(),
+        // The caller of an app run is whoever used the app, which `push` already derives from
+        // `username` here — the app identity took `permissioned_as`.
+        None,
         None,
         None,
         None,
@@ -3372,14 +3971,10 @@ async fn upload_s3_file_from_app(
     Query(query): Query<UploadFileToS3Query>,
     request: axum::extract::Request,
 ) -> JsonResult<AppUploadFileResponse> {
-    // Confine an app embed token (untrusted app JS) to uploading for its OWN app.
-    // The route is reachable with `apps:run` (RUN_PATH_ACTIONS), so without this a
-    // token minted for app A could drive app B's upload policy. Mirrors
-    // execute_component / download_s3_file; other callers are unaffected.
+    // Same path confinement as `execute_component`: without it a token scoped to app A
+    // could drive app B's upload policy.
     if let Some(authed) = opt_authed.as_ref() {
-        if windmill_api_auth::scopes::has_app_embed_sentinel(authed.scopes.as_deref()) {
-            check_scopes(authed, || format!("apps:run:{}", path.to_path()))?;
-        }
+        check_scopes(authed, || format!("apps:run:{}", path.to_path()))?;
     }
     let policy = if let Some(file_key_regex) = query.force_viewer_file_key_regex {
         // `force_viewer_*` lets the caller supply a synthetic upload policy that
@@ -3416,6 +4011,7 @@ async fn upload_s3_file_from_app(
             }]),
             allowed_s3_keys: None,
             sandbox: None,
+            frontend_sdk_scopes: None,
         })
     } else {
         let policy_o = sqlx::query_scalar!(
@@ -3818,6 +4414,7 @@ async fn get_on_behalf_authed_from_app(
             s3_inputs: None,
             allowed_s3_keys: Some(force_allowed_s3_keys),
             sandbox: None,
+            frontend_sdk_scopes: None,
         }
     } else {
         // TODO: improve db query to not return uneeded fields
@@ -3841,6 +4438,7 @@ async fn get_on_behalf_authed_from_app(
                 s3_inputs: None,
                 allowed_s3_keys: None,
                 sandbox: None,
+                frontend_sdk_scopes: None,
             })
     };
 
@@ -3991,6 +4589,19 @@ struct AppS3FileQueryWithForceViewerAllowedS3Keys {
     pub force_viewer_allowed_s3_keys: Option<String>,
 }
 
+/// Confine a scoped caller to THIS app's S3 files, or it could read another app's
+/// through that app's on-behalf policy. Either grant reads them: `apps:read:<path>`
+/// (app embed tokens) or `apps:run:<path>` (a run-scoped token fetching back what its
+/// own runs produced). Unscoped/anonymous callers fall through to the provenance gate.
+#[cfg(feature = "parquet")]
+fn check_app_s3_read_scope(opt_authed: &Option<ApiAuthed>, path: &str) -> Result<()> {
+    let Some(authed) = opt_authed.as_ref() else {
+        return Ok(());
+    };
+    check_scopes(authed, || format!("apps:run:{}", path))
+        .or_else(|_| check_scopes(authed, || format!("apps:read:{}", path)))
+}
+
 #[cfg(feature = "parquet")]
 async fn download_s3_file_from_app(
     OptAuthed(opt_authed): OptAuthed,
@@ -4002,14 +4613,7 @@ async fn download_s3_file_from_app(
 
     let path = path.to_path();
 
-    // Authorize the app path first: a scoped caller (notably an app embed token,
-    // which carries `apps:read:<own path>`) may only download files for the app it
-    // was minted for — otherwise it could read another app's S3 files via that app's
-    // on-behalf policy. Unscoped sessions / anonymous callers pass through (the
-    // latter still gated by the policy allowlist in `check_if_allowed_...`).
-    if let Some(authed) = opt_authed.as_ref() {
-        check_scopes(authed, || format!("apps:read:{}", path))?;
-    }
+    check_app_s3_read_scope(&opt_authed, path)?;
 
     let force_viewer_allowed_s3_keys = if let Some(force_viewer_allowed_s3_keys) =
         query.force_viewer_allowed_s3_keys.clone()
@@ -4087,8 +4691,8 @@ fn app_s3_file_query(s3: String, storage: Option<String>, sig: AppS3Sig) -> AppS
     }
 }
 
-/// Shared entry for every app-scoped (`apps_u/*`) S3 display op: scope-confine an
-/// app embed token, resolve the on-behalf identity per `execution_mode`, then run
+/// Shared entry for every app-scoped (`apps_u/*`) S3 display op: confine a scoped
+/// caller to this app, resolve the on-behalf identity per `execution_mode`, then run
 /// the provenance gate (`check_if_allowed_to_access_s3_file_from_app`) once before
 /// dispatching to the S3 helpers.
 #[cfg(feature = "parquet")]
@@ -4099,9 +4703,7 @@ async fn app_s3_on_behalf_and_provenance(
     opt_authed: &Option<ApiAuthed>,
     file_query: &AppS3FileQuery,
 ) -> Result<crate::db::OptJobAuthed> {
-    if let Some(authed) = opt_authed.as_ref() {
-        check_scopes(authed, || format!("apps:read:{}", path))?;
-    }
+    check_app_s3_read_scope(opt_authed, path)?;
     let (on_behalf_authed, policy) =
         get_on_behalf_authed_from_app(db, path, w_id, opt_authed, None).await?;
     let read_authed = match check_if_allowed_to_access_s3_file_from_app(
@@ -4497,9 +5099,9 @@ async fn build_args(
         if arg_str.starts_with("\"$ctx:") {
             let prop = arg_str.trim_start_matches("\"$ctx:").trim_end_matches("\"");
             let value = match prop {
-                "username" => authed.as_ref().map(|a| {
-                    serde_json::to_value(a.username_override.as_ref().unwrap_or(&a.username))
-                }),
+                "username" => authed
+                    .as_ref()
+                    .map(|a| serde_json::to_value(a.display_username())),
                 "email" => authed.as_ref().map(|a| serde_json::to_value(&a.email)),
                 "workspace" => Some(serde_json::to_value(&w_id)),
                 "groups" => authed.as_ref().map(|a| serde_json::to_value(&a.groups)),
@@ -4724,6 +5326,87 @@ mod embed_token_tests {
             .includes(&required));
     }
 
+    /// Locks what the SDK token can reach: no `apps:*` (so it can't renew itself),
+    /// and the `raw_app_sdk` sentinel keeping `jobs:run` off the code-running
+    /// endpoints and `users:read` off the member directory.
+    #[test]
+    fn frontend_sdk_scopes_reach_declared_domains_but_never_mint_routes() {
+        // Mirror mint_raw_app_sdk_token: declared scopes + the narrowing sentinel.
+        let mut scopes: Vec<String> = super::FRONTEND_SDK_ALLOWED_SCOPES
+            .iter()
+            .map(|s| s.to_string())
+            .collect();
+        scopes.push(windmill_api_auth::scopes::RAW_APP_SDK_SENTINEL.to_string());
+        let scopes = Some(scopes.as_slice());
+
+        let allowed = [
+            // Deployed runnables by path/hash — what the SDK's run helpers call.
+            ("/api/w/test/jobs/run/p/u/admin/script", "POST"),
+            ("/api/w/test/jobs/run_wait_result/p/u/admin/script", "POST"),
+            // A deployed runnable whose own path contains "preview" must not be
+            // caught by the request-supplied-code deny.
+            ("/api/w/test/jobs/run/p/f/team/preview_report", "POST"),
+            ("/api/w/test/jobs_u/completed/get_result/some-uuid", "GET"),
+            ("/api/w/test/users/whoami", "GET"),
+            // Unlike the embed token, resource VALUE reads are intended here —
+            // the author declared it and the viewer consented.
+            ("/api/w/test/resources/get_value/u/admin/r", "GET"),
+            ("/api/w/test/variables/get_value/u/admin/v", "GET"),
+        ];
+        for (path, method) in allowed {
+            assert!(
+                check_scopes_for_route(scopes, path, method).is_ok(),
+                "SDK token should allow {method} {path}"
+            );
+        }
+
+        let denied = [
+            // No apps scope → every mint endpoint (and the Apps domain at large)
+            // is unreachable: no self-renewal, no embed-token bootstrap.
+            ("/api/w/test/apps_u/embed_token/secret", "GET"),
+            ("/api/w/test/apps/embed_token/p/u/admin/app", "GET"),
+            ("/api/w/test/apps_u/embed_token_by_custom_path/foo", "GET"),
+            ("/api/w/test/apps/get/p/u/admin/app", "GET"),
+            // Read-level scopes must not grant writes.
+            ("/api/w/test/resources/update/u/admin/r", "POST"),
+            ("/api/w/test/variables/create", "POST"),
+            // `jobs:run` must not reach the request-supplied-code endpoints: a
+            // preview job runs attacker-chosen code and its own credential is
+            // unscoped and permissioned as the viewer, so reaching these would
+            // make a captured SDK token equivalent to the viewer's whole account.
+            ("/api/w/test/jobs/run/preview", "POST"),
+            ("/api/w/test/jobs/run_inline/preview", "POST"),
+            ("/api/w/test/jobs/run_wait_result/preview", "POST"),
+            ("/api/w/test/jobs/run/preview_bundle", "POST"),
+            ("/api/w/test/jobs/run/preview_flow", "POST"),
+            ("/api/w/test/jobs/run_wait_result/preview_flow", "POST"),
+            // Dependency jobs are the same class: they resolve and install
+            // request-supplied imports on a worker.
+            ("/api/w/test/jobs/run/dependencies", "POST"),
+            ("/api/w/test/jobs/run/dependencies_async", "POST"),
+            ("/api/w/test/jobs/run/flow_dependencies", "POST"),
+            ("/api/w/test/jobs/run/flow_dependencies_async", "POST"),
+            // Replay a named job's already-stored code as the caller: the queued
+            // preview's raw_code, or a completed preview flow's raw_flow.
+            (
+                "/api/w/test/jobs/run/workflow_as_code/some-uuid/main",
+                "POST",
+            ),
+            ("/api/w/test/jobs/restart/f/some-uuid", "POST"),
+            // `users:read` is presented to the viewer as "read your identity", so
+            // the workspace member directory must stay out of reach.
+            ("/api/w/test/users/list", "GET"),
+            ("/api/w/test/users/list_usage", "GET"),
+            ("/api/w/test/users/username_to_email/admin", "GET"),
+        ];
+        for (path, method) in denied {
+            assert!(
+                check_scopes_for_route(scopes, path, method).is_err(),
+                "SDK token should deny {method} {path}"
+            );
+        }
+    }
+
     /// The token carries path-scoped `apps:run:<own path>` and `apps:read:<own path>`
     /// (NOT unqualified `apps:run`). Every handler that resolves an app and acts on
     /// its behalf re-checks the requested path via `ScopeDefinition::includes`, so the
diff --git a/backend/windmill-api/src/apps_raw_bundle.rs b/backend/windmill-api/src/apps_raw_bundle.rs
new file mode 100644
index 0000000000..833e7c6b58
--- /dev/null
+++ b/backend/windmill-api/src/apps_raw_bundle.rs
@@ -0,0 +1,256 @@
+//! Server-side bundling of a raw app's sources.
+//!
+//! A raw app is served as a compiled js/css bundle, so every deploy path has to
+//! compile first: the editor bundles in a browser iframe, the CLI bundles on the
+//! developer's machine. Neither is reachable from a plain API call, which is why
+//! `/apps/update_raw` takes the bundle as multipart and why there was no way to
+//! deploy a raw app from an API client (an MCP agent, most of all — its only
+//! app-write tool was the low-code one, which converted the app instead).
+//!
+//! The compile runs as a normal bun job on a worker: no new job kind, no new
+//! executor, and the build's logs, timeout, cancellation and attribution are the
+//! ones every other job gets. The build itself is `wmill app bundle`, so this
+//! adds no bundler of its own to keep in step with the CLI's and the editor's.
+
+use std::collections::HashMap;
+use std::io::Read;
+
+use base64::Engine;
+use serde::Deserialize;
+use uuid::Uuid;
+use windmill_common::{
+    db::UserDB,
+    error::{Error, Result},
+    jobs::{JobPayload, RawCode},
+    scripts::ScriptLang,
+    worker::to_raw_value,
+    DB,
+};
+use windmill_queue::{push, PushArgs, PushIsolationLevel};
+
+use crate::db::ApiAuthed;
+
+/// The bundle job's script, as its own file so it stays readable TypeScript.
+const BUNDLER_TS: &str = include_str!("apps_raw_bundler.ts");
+
+/// Cap the job so a pathological `package.json` can't sit on a worker forever.
+/// This bounds the *run*, not the wait: see `wait_for_bundle`.
+const BUNDLE_TIMEOUT_SECS: i32 = 300;
+
+#[derive(Deserialize)]
+struct BundleResult {
+    js_gz: String,
+    css_gz: String,
+}
+
+/// This server's release, without the git describe suffix an off-tag build
+/// carries — the CLI is published per release, so that is the version to ask npm
+/// for, and the one an installed CLI must report to be used instead.
+fn release_version() -> String {
+    let v = &*windmill_common::utils::GIT_SEM_VERSION;
+    format!("{}.{}.{}", v.major, v.minor, v.patch)
+}
+
+/// The build command the job falls back to when the worker has no usable `wmill`
+/// installed: the CLI for this server's release, fetched on the spot. A dev
+/// server is off-tag and so asks for the last release; to build with an
+/// unreleased CLI set `WM_RAW_APP_BUNDLER_CLI` to the whole command, e.g.
+/// `bun run /path/to/cli/src/main.ts app bundle` — which also stops the job from
+/// preferring an installed `wmill`.
+fn bundler_cli_command() -> Vec<String> {
+    match std::env::var("WM_RAW_APP_BUNDLER_CLI") {
+        Ok(cmd) if !cmd.trim().is_empty() => {
+            cmd.split_whitespace().map(|s| s.to_string()).collect()
+        }
+        // `bun x`, not `bunx`: the images copy the `bun` binary alone, so the
+        // `bunx` entry point isn't on a worker's PATH.
+        _ => vec![
+            "bun".to_string(),
+            "x".to_string(),
+            "--bun".to_string(),
+            format!("windmill-cli@{}", release_version()),
+            "app".to_string(),
+            "bundle".to_string(),
+        ],
+    }
+}
+
+/// Compile `files` into the js/css a deployed raw app serves. Returns the
+/// build's own error when it fails, so the caller sees the compile error rather
+/// than a generic failure.
+///
+/// This makes a worker run a build on caller-supplied sources, so it requires
+/// `jobs:run` here rather than trusting each caller to have checked: a token
+/// that can't run jobs must not gain that by writing an app.
+pub(crate) async fn bundle_raw_app_sources(
+    db: &DB,
+    user_db: &UserDB,
+    authed: &ApiAuthed,
+    w_id: &str,
+    files: &HashMap<String, String>,
+) -> Result<(String, String)> {
+    crate::utils::check_scopes(authed, || "jobs:run".to_string())?;
+
+    if files.is_empty() {
+        return Err(Error::BadRequest(
+            "app value has no `files` to bundle".to_string(),
+        ));
+    }
+
+    // A queued bundle holds this request open until it runs, so refuse early
+    // rather than pile up connections waiting behind a backlog.
+    windmill_api_jobs::execution::check_queue_too_long(
+        db,
+        *windmill_api_jobs::execution::QUEUE_LIMIT_WAIT_RESULT,
+    )
+    .await?;
+
+    let shared_ui = shared_ui_files(user_db, authed, w_id).await?;
+
+    let mut args: HashMap<String, Box<serde_json::value::RawValue>> = HashMap::new();
+    args.insert("files".to_string(), to_raw_value(files));
+    args.insert("shared_ui".to_string(), to_raw_value(&shared_ui));
+    let overridden = std::env::var("WM_RAW_APP_BUNDLER_CLI").is_ok_and(|c| !c.trim().is_empty());
+    args.insert(
+        "cli_command".to_string(),
+        to_raw_value(&bundler_cli_command()),
+    );
+    args.insert(
+        "prefer_installed_cli".to_string(),
+        to_raw_value(&!overridden),
+    );
+
+    let tx = PushIsolationLevel::Isolated(user_db.clone(), authed.clone().into());
+    let (uuid, tx) = push(
+        db,
+        tx,
+        w_id,
+        JobPayload::Code(RawCode {
+            hash: None,
+            content: BUNDLER_TS.to_string(),
+            path: Some("bundle raw app".to_string()),
+            language: ScriptLang::Bun,
+            lock: None,
+            concurrency_settings: Default::default(),
+            debouncing_settings: Default::default(),
+            cache_ttl: None,
+            cache_ignore_s3_path: None,
+            dedicated_worker: None,
+            modules: None,
+            tag: None,
+        }),
+        PushArgs { args: &args, extra: None },
+        authed.display_username(),
+        &authed.email,
+        windmill_common::users::username_to_permissioned_as(&authed.username),
+        authed.token_prefix.as_deref(),
+        authed.username_override.as_deref(),
+        None,
+        None,
+        None,
+        None,
+        None,
+        None,
+        false,
+        false,
+        None,
+        true,
+        None,
+        Some(BUNDLE_TIMEOUT_SECS),
+        None,
+        None,
+        Some(&authed.clone().into()),
+        false,
+        None,
+        authed.trigger_or_fallback(None),
+        None,
+    )
+    .await?;
+    tx.commit().await?;
+
+    wait_for_bundle(db, w_id, uuid, authed).await
+}
+
+/// Waits for the bundle job. The wait itself is bounded by
+/// `TIMEOUT_WAIT_RESULT`, not by `BUNDLE_TIMEOUT_SECS` — the job's timeout only
+/// starts once a worker picks it up.
+async fn wait_for_bundle(
+    db: &DB,
+    w_id: &str,
+    uuid: Uuid,
+    authed: &ApiAuthed,
+) -> Result<(String, String)> {
+    let (result, success) = windmill_api_jobs::execution::run_wait_result_internal(
+        db,
+        uuid,
+        w_id,
+        None,
+        false,
+        &authed.username,
+    )
+    .await?;
+
+    if !success {
+        // The job's error is the compile error the caller needs to act on.
+        return Err(Error::BadRequest(format!(
+            "raw app bundling failed (job {uuid}): {}",
+            result.get()
+        )));
+    }
+
+    let bundle: BundleResult = serde_json::from_str(result.get()).map_err(|e| {
+        Error::internal_err(format!(
+            "unexpected raw app bundler result (job {uuid}): {e}"
+        ))
+    })?;
+    // One budget across both, so the pair can't hold twice the limit in memory.
+    let limit = *crate::REQUEST_SIZE_LIMIT.read().await * 5;
+    let js = gunzip_b64(&bundle.js_gz, limit)?;
+    let css = gunzip_b64(&bundle.css_gz, limit - js.len())?;
+    Ok((js, css))
+}
+
+/// Bounded: what the job returns is compressed, so the result-size cap says
+/// nothing about what it expands to, and the sources that produced it came from
+/// the caller. The budget is shared by the js and css of one bundle, and matches
+/// what `/apps/update_raw` accepts as a whole body.
+fn gunzip_b64(b64: &str, limit: usize) -> Result<String> {
+    let compressed = base64::engine::general_purpose::STANDARD
+        .decode(b64)
+        .map_err(|e| Error::internal_err(format!("raw app bundle is not valid base64: {e}")))?;
+    // Bytes, not a String: over the limit the read stops mid-stream, and
+    // read_to_string would report that as invalid utf-8 rather than as the size
+    // it is. One byte past, so a bundle that just fits is told from one cut short.
+    let mut out = Vec::new();
+    flate2::read::GzDecoder::new(&compressed[..])
+        .take(limit as u64 + 1)
+        .read_to_end(&mut out)
+        .map_err(|e| Error::internal_err(format!("raw app bundle is not valid gzip: {e}")))?;
+    if out.len() > limit {
+        // `limit` is what is left of the budget, not the whole of it, so say so
+        // rather than report a nearly-exhausted budget as the limit itself.
+        return Err(Error::BadRequest(format!(
+            "raw app bundle is too large: {limit} bytes left of the budget the js and css share"
+        )));
+    }
+    String::from_utf8(out)
+        .map_err(|e| Error::internal_err(format!("raw app bundle is not valid utf-8: {e}")))
+}
+
+async fn shared_ui_files(
+    user_db: &UserDB,
+    authed: &ApiAuthed,
+    w_id: &str,
+) -> Result<HashMap<String, String>> {
+    let mut tx = user_db.clone().begin(authed).await?;
+    let files = sqlx::query_scalar!(
+        "SELECT files FROM workspace_shared_ui WHERE workspace_id = $1",
+        w_id
+    )
+    .fetch_optional(&mut *tx)
+    .await?;
+    tx.commit().await?;
+    Ok(files
+        .and_then(|f| serde_json::from_value::<HashMap<String, String>>(f).ok())
+        .unwrap_or_default())
+}
diff --git a/backend/windmill-api/src/apps_raw_bundler.ts b/backend/windmill-api/src/apps_raw_bundler.ts
new file mode 100644
index 0000000000..ceefc93207
--- /dev/null
+++ b/backend/windmill-api/src/apps_raw_bundler.ts
@@ -0,0 +1,121 @@
+/**
+ * Bundles a raw app's sources into the js/css a deployed raw app serves. Runs as
+ * a bun job so the compile happens on a worker, not in the API process — see
+ * `apps_raw_bundle.rs`, which is the only thing that runs it.
+ *
+ * The build itself is `wmill app bundle`, the same one `wmill app push` runs, so
+ * an app deployed through the API is compiled exactly as the CLI and the editor
+ * compile it — entry point, virtual `wmill` module, `/ui/` shared-UI resolution
+ * and the Svelte/Vue plugins included. Reimplementing any of that here would be
+ * a third bundler to keep in step with the other two.
+ */
+export async function main(
+	files: Record<string, string>,
+	shared_ui: Record<string, string> | undefined,
+	cli_command: string[],
+	// Set unless the server was told to build with a specific command.
+	prefer_installed_cli: boolean | undefined
+): Promise<{ js_gz: string; css_gz: string }> {
+	const fs = await import('node:fs/promises')
+	const path = await import('node:path')
+
+	const dir = path.join(process.cwd(), 'wm_raw_app')
+	await fs.rm(dir, { recursive: true, force: true })
+
+	// Where a key lands, `path.join` normalising `./` and `..` away. Everything
+	// that reasons about a file goes through this, so nothing disagrees with what
+	// was actually written.
+	const target = (rel: string) => {
+		const abs = path.join(dir, rel.replace(/^\/+/, ''))
+		if (!abs.startsWith(dir + path.sep)) {
+			throw new Error(`file path escapes the build directory: ${rel}`)
+		}
+		return abs
+	}
+	const write = async (rel: string, content: string) => {
+		const abs = target(rel)
+		await fs.mkdir(path.dirname(abs), { recursive: true })
+		await fs.writeFile(abs, content)
+	}
+	for (const [p, content] of Object.entries(files ?? {})) {
+		await write(p, content)
+	}
+	// `ui/` next to the app is where `wmill app bundle` looks for the shared UI.
+	for (const [p, content] of Object.entries(shared_ui ?? {})) {
+		await write('ui/' + p.replace(/^\/+/, ''), content)
+	}
+
+	const manifest = path.join(dir, 'package.json')
+	const hasPackageJson = Object.keys(files ?? {}).some((p) => target(p) === manifest)
+	// Piped rather than inherited so the output can go in the error too, then
+	// echoed either way — the job's log is where someone looks to see what the
+	// build did.
+	const spawn = (argv: string[]) => {
+		const proc = Bun.spawnSync(argv, { cwd: dir, stdout: 'pipe', stderr: 'pipe' })
+		const output = proc.stdout.toString() + proc.stderr.toString()
+		console.log(output)
+		return { ok: proc.exitCode === 0, output }
+	}
+	const run = (argv: string[], what: string) => {
+		const { ok, output } = spawn(argv)
+		if (!ok) {
+			throw new Error(`${what} failed:\n${output}`)
+		}
+		return output
+	}
+
+	if (hasPackageJson) {
+		// Installed here rather than left to the CLI so it can be --ignore-scripts:
+		// the app's dependencies are compiled, never run, so a package's lifecycle
+		// script has no business executing on the worker. The CLI skips its own
+		// install once node_modules exists.
+		run(['bun', 'install', '--ignore-scripts'], 'bun install')
+	} else {
+		// The CLI installs when node_modules is missing, and it shells out to npm,
+		// which the slim images don't ship. An app with no manifest has nothing to
+		// install, so hand it the empty directory it would have produced.
+		await fs.mkdir(path.join(dir, 'node_modules'), { recursive: true })
+	}
+
+	const outDir = path.join(dir, 'dist')
+	// Prefer the CLI the image installed: no npm reachability needed at deploy
+	// time. It can predate `app bundle` (the images install it unpinned), and a
+	// CLI without the command exits with cliffy's usage text before building
+	// anything — so that specific failure, and only it, falls back to fetching
+	// the one for this server's release. `wmill --version` isn't used to decide:
+	// it reports npm's latest release as well as its own, and it reaches out to
+	// npm to do so, which is the cost this branch exists to avoid.
+	const installed = prefer_installed_cli ? Bun.which('wmill') : null
+	let buildOutput: string | undefined
+	if (installed) {
+		const attempt = spawn([installed, 'app', 'bundle', dir, '--out', outDir])
+		// Colours sit between the words cliffy prints, so match on the stripped text.
+		const plain = attempt.output.replace(/\x1b\[[0-9;]*m/g, '')
+		if (attempt.ok) {
+			buildOutput = attempt.output
+		} else if (!/Unknown command|Usage:\s+wmill app\b/.test(plain)) {
+			throw new Error(`bundle failed:\n${attempt.output}`)
+		}
+	}
+	if (buildOutput === undefined) {
+		buildOutput = run([...cli_command, dir, '--out', outDir], 'bundle')
+	}
+
+	const read = async (name: string) => {
+		try {
+			return await fs.readFile(path.join(outDir, name), 'utf8')
+		} catch {
+			return ''
+		}
+	}
+	const js = await read('bundle.js')
+	const css = await read('bundle.css')
+	if (js === '') {
+		throw new Error('bundle produced no javascript:\n' + buildOutput)
+	}
+
+	// Gzipped so a large app's bundle stays well inside MAX_RESULT_SIZE_MB, which
+	// a deployment can set far below the 500MB default.
+	const gz = (s: string) => Buffer.from(Bun.gzipSync(Buffer.from(s, 'utf8'))).toString('base64')
+	return { js_gz: gz(js), css_gz: gz(css) }
+}
diff --git a/backend/windmill-api/src/dbt.rs b/backend/windmill-api/src/dbt.rs
new file mode 100644
index 0000000000..ccdd189f66
--- /dev/null
+++ b/backend/windmill-api/src/dbt.rs
@@ -0,0 +1,227 @@
+use axum::{
+    extract::Path,
+    routing::{get, post},
+    Extension, Json, Router,
+};
+use windmill_common::{
+    db::UserDB,
+    error::{Error, Result},
+    workspaces::{dbt_warehouse_resource, DbtWarehouseConnection},
+    DB,
+};
+
+use crate::db::{ApiAuthed, OptJobAuthed};
+use windmill_api_auth::{is_no_auth, Tokened};
+
+pub fn workspaced_service() -> Router {
+    Router::new()
+        .route("/warehouse/{name}", get(get_warehouse))
+        .route("/warehouse_exists/{name}", get(warehouse_exists))
+        .route("/run_progress", post(record_run_progress))
+}
+
+async fn get_warehouse(
+    OptJobAuthed { job_id, authed }: OptJobAuthed,
+    Tokened { token }: Tokened,
+    Extension(db): Extension<DB>,
+    Extension(_user_db): Extension<UserDB>,
+    Path((w_id, name)): Path<(String, String)>,
+) -> Result<Json<DbtWarehouseConnection>> {
+    // Scoped to a running DBT job, and the reason it must stay that way: the
+    // response carries the warehouse's credentials. A dbt job already holds them
+    // in its rendered `profiles.yml`, so serving them changes nothing for it —
+    // but every script job's token carries a job id too, and any other language
+    // asking for them would be reading a credential it was never given.
+    // In no-auth mode every request is the synthetic superadmin and carries no
+    // job, so the scoping below has nothing to check. Refusing there would make
+    // dbt unusable on an instance that has deliberately turned auth off, and
+    // there is no credential boundary left to protect.
+    let Some(job_id) = job_id else {
+        if is_no_auth() {
+            // Validated here too, so all three paths agree on what a name may be
+            // rather than one of them accepting whatever the URL carried.
+            windmill_common::workspaces::validate_dbt_warehouse_name(&name)?;
+            let (resource_path, target) = dbt_warehouse_resource(&db, &w_id, &name).await?;
+            let value = windmill_store::resources::get_resource_value_interpolated_internal(
+                &windmill_common::db::DbWithOptAuthed::<ApiAuthed>::from_authed(
+                    &authed,
+                    db.clone(),
+                    None,
+                ),
+                &w_id,
+                &resource_path,
+                None,
+                Some(&token),
+                false,
+            )
+            .await?
+            .ok_or_else(|| {
+                Error::NotFound(format!(
+                    "the dbt warehouse `{name}` points at `{resource_path}`, which does not exist"
+                ))
+            })?;
+            let resource_type = warehouse_resource_type(&db, &w_id, &resource_path).await?;
+            return Ok(Json(DbtWarehouseConnection { value, target, resource_type }));
+        }
+        return Err(Error::BadRequest(
+            "this route resolves a dbt warehouse for a running job and needs a job token"
+                .to_string(),
+        ));
+    };
+    let is_dbt = sqlx::query_scalar!(
+        "SELECT script_lang = 'dbt' FROM v2_job WHERE id = $1 AND workspace_id = $2",
+        job_id,
+        &w_id
+    )
+    .fetch_optional(&db)
+    .await?
+    .flatten()
+    .unwrap_or(false);
+    if !is_dbt {
+        return Err(Error::NotAuthorized(
+            "only a dbt job may resolve a dbt warehouse".to_string(),
+        ));
+    }
+    windmill_common::workspaces::validate_dbt_warehouse_name(&name)?;
+    let (resource_path, target) = dbt_warehouse_resource(&db, &w_id, &name).await?;
+    // Interpolated AGAINST THE JOB, so a warehouse whose resource carries
+    // `$WM_TOKEN` or another `$WM_*` renders what the job would see rather than
+    // the literal placeholder. Unchecked (no `user_db`) because dbt warehouses
+    // are unpermissioned by design; uncached because a job-context value must
+    // not be served to the next job.
+    let value = windmill_store::resources::get_resource_value_interpolated_internal(
+        &windmill_common::db::DbWithOptAuthed::<ApiAuthed>::from_authed(&authed, db.clone(), None),
+        &w_id,
+        &resource_path,
+        Some(job_id),
+        Some(&token),
+        false,
+    )
+    .await?
+    .ok_or_else(|| {
+        Error::NotFound(format!(
+            "the dbt warehouse `{name}` points at `{resource_path}`, which does not exist"
+        ))
+    })?;
+    let resource_type = warehouse_resource_type(&db, &w_id, &resource_path).await?;
+    Ok(Json(DbtWarehouseConnection { value, target, resource_type }))
+}
+
+/// A warehouse resource's type, which decides whether its value is translated
+/// into a `profiles.yml` target or taken as one. Read separately from the value
+/// because the interpolating loader returns the value alone.
+async fn warehouse_resource_type(db: &DB, w_id: &str, path: &str) -> Result<String> {
+    sqlx::query_scalar!(
+        "SELECT resource_type FROM resource WHERE workspace_id = $1 AND path = $2",
+        w_id,
+        path
+    )
+    .fetch_optional(db)
+    .await?
+    .ok_or_else(|| Error::NotFound(format!("the dbt warehouse points at `{path}`, which does not exist")))
+}
+
+/// A settled node's state, for a worker that cannot write the database.
+///
+/// The job is taken from the TOKEN, never the body: a job may report its own
+/// progress and no one else's.
+///
+/// NO no-auth branch, unlike its two siblings: they need only the warehouse
+/// NAME, which the URL carries, while this needs the job — and the job lives in
+/// the token's JWT claims, which the no-auth path never decodes. So on a
+/// no-auth instance an agent worker's per-model rows do not appear. The run is
+/// unaffected: the worker treats a failed post as a display problem and builds
+/// the models regardless. Taking the job from the body instead would hand any
+/// caller another job's run page.
+async fn record_run_progress(
+    OptJobAuthed { job_id, .. }: OptJobAuthed,
+    Extension(db): Extension<DB>,
+    Path(w_id): Path<String>,
+    Json(rows): Json<Vec<windmill_common::dbt_manifest::DbtRunProgressRequest>>,
+) -> Result<()> {
+    let Some(job_id) = job_id else {
+        return Err(Error::BadRequest(
+            "this route records a running job's dbt progress and needs a job token".to_string(),
+        ));
+    };
+    // A DBT job's, like its sibling above. Writing nothing secret, but a row
+    // keyed to another language's job is a run-page entry for a run that has no
+    // models, and the two routes disagreeing on who may call them is how one of
+    // them ends up wrong later.
+    let is_dbt = sqlx::query_scalar!(
+        "SELECT script_lang = 'dbt' FROM v2_job WHERE id = $1 AND workspace_id = $2",
+        job_id,
+        &w_id
+    )
+    .fetch_optional(&db)
+    .await?
+    .flatten()
+    .unwrap_or(false);
+    if !is_dbt {
+        return Err(Error::NotAuthorized(
+            "only a dbt job may record dbt run progress".to_string(),
+        ));
+    }
+    // The agent's own sweep: these rows have no job foreign key, and the
+    // worker-side prune runs only where the pool is reachable, so an
+    // agent-only workspace would accumulate one row per model forever.
+    windmill_common::dbt_manifest::prune_run_progress(&db, &w_id).await;
+    // A run's nodes arrive together; the writes are local to this server, so the
+    // loop that would have been a round trip each is a statement each.
+    for req in &rows {
+        windmill_common::dbt_manifest::record_run_progress(
+            &db,
+            &w_id,
+            &job_id,
+            &req.asset_path,
+            req.status,
+            req.row_count,
+            req.error.as_deref(),
+        )
+        .await;
+    }
+    Ok(())
+}
+
+/// Whether the workspace configures this warehouse. NOTHING is resolved.
+///
+/// A project that brings its own `profiles.yml` names a warehouse to say where
+/// its assets belong and never opens it, so the answer it needs is a yes/no —
+/// decrypting a connection for that would hand out a credential the run has no
+/// use for.
+async fn warehouse_exists(
+    OptJobAuthed { job_id, .. }: OptJobAuthed,
+    Extension(db): Extension<DB>,
+    Path((w_id, name)): Path<(String, String)>,
+) -> Result<()> {
+    // A DBT job's token, like both siblings. No-auth mode carries no job at all,
+    // and there the whole instance is unauthenticated.
+    if !is_no_auth() {
+        let Some(job_id) = job_id else {
+            return Err(Error::BadRequest(
+                "this route answers for a running job and needs a job token".to_string(),
+            ));
+        };
+        let is_dbt = sqlx::query_scalar!(
+            "SELECT script_lang = 'dbt' FROM v2_job WHERE id = $1 AND workspace_id = $2",
+            job_id,
+            &w_id
+        )
+        .fetch_optional(&db)
+        .await?
+        .flatten()
+        .unwrap_or(false);
+        if !is_dbt {
+            return Err(Error::NotAuthorized(
+                "only a dbt job may ask about a dbt warehouse".to_string(),
+            ));
+        }
+    }
+    windmill_common::workspaces::validate_dbt_warehouse_name(&name)?;
+    // Mapped to a bare yes/no: the resolver's miss lists every warehouse the
+    // workspace configures, which is a useful hint to an admin editing settings
+    // and a needless disclosure to a job that only asked about one name.
+    windmill_common::workspaces::dbt_warehouse_exists(&db, &w_id, &name)
+        .await
+        .map_err(|_| Error::NotFound(format!("no dbt warehouse named `{name}` in this workspace")))
+}
diff --git a/backend/windmill-api/src/jobs.rs b/backend/windmill-api/src/jobs.rs
index 1bd8ec536f..7de6c46cdf 100644
--- a/backend/windmill-api/src/jobs.rs
+++ b/backend/windmill-api/src/jobs.rs
@@ -53,6 +53,7 @@ use windmill_common::worker::{Connection, CLOUD_HOSTED, WINDMILL_DIR};
 use windmill_common::workspace_dependencies::{
     RawWorkspaceDependencies, MIN_VERSION_WORKSPACE_DEPENDENCIES,
 };
+use windmill_common::workspaces::{check_user_against_rule, ProtectionRuleKind, RuleCheckResult};
 use windmill_common::DYNAMIC_INPUT_CACHE;
 #[cfg(all(feature = "enterprise", feature = "instance_smtp"))]
 use windmill_common::{email_oss::send_email_html, server::load_smtp_config};
@@ -134,6 +135,13 @@ pub fn workspaced_service() -> Router {
         ServiceBuilder::new().layer(axum::middleware::from_fn(add_webhook_allowed_origin));
 
     Router::new()
+        .route("/run_progress/{id}", get(get_run_progress))
+        .route("/dbt_graph/{id}", get(get_dbt_run_graph))
+        .route("/dbt_resumable/{id}", get(get_dbt_resumable))
+        .route(
+            "/dbt_resumable_script/p/{*script_path}",
+            get(get_dbt_resumable_for_script),
+        )
         .route(
             "/run/f/{*script_path}",
             post(run_flow_by_path)
@@ -362,6 +370,10 @@ pub fn workspaced_service() -> Router {
             "/job_view_token/{id}",
             get(get_job_view_token).layer(cors.clone()),
         )
+        .route(
+            "/job_public_view_token/{id}",
+            get(get_job_public_view_token).layer(cors.clone()),
+        )
         .route("/run/dependencies", post(run_dependencies_job))
         .route("/run/dependencies_async", post(run_dependencies_job_async))
         .route("/run/flow_dependencies", post(run_flow_dependencies_job))
@@ -495,7 +507,63 @@ async fn get_job_view_token(
     // enforces the caller's `if_jobs:filter_tags` scope, so a tag-scoped token can't
     // mint a transferable link for a job outside its allowed tags.
     require_job_update_read_access(&db, &user_db, &authed, &w_id, &id, None).await?;
-    let hmac = generate_view_token(&w_id, id, &db).await?;
+    let hmac = generate_view_token(&w_id, id, VIEW_TOKEN_DOMAIN, &db).await?;
+    Ok(format!("{id}.{hmac}"))
+}
+
+/// Public flavor of [`get_job_view_token`]: the resulting link additionally grants read of
+/// the job (and its flow subtree) to logged-out visitors, who land on the minimal public
+/// run page. Read access is necessary but not sufficient — exposing workspace data to the
+/// anonymous internet is a privileged action, gated like an app's anonymous execution mode.
+async fn get_job_public_view_token(
+    authed: ApiAuthed,
+    Extension(db): Extension<DB>,
+    Extension(user_db): Extension<UserDB>,
+    Path((w_id, id)): Path<(String, Uuid)>,
+) -> error::Result<String> {
+    require_job_update_read_access(&db, &user_db, &authed, &w_id, &id, None).await?;
+
+    // Anonymous readers of a public link carry no scope to confine, so the link would
+    // reach out-of-scope descendants of an in-scope job (mixed-tag flow trees). A tag
+    // scope is a hard restriction: refuse rather than silently narrow the link.
+    if get_scope_tags(&authed).is_some() {
+        return Err(Error::PermissionDenied(
+            "A tag-scoped token cannot share a run publicly: the resulting link is read \
+             anonymously and could not carry the tag restriction to the run's steps."
+                .to_string(),
+        ));
+    }
+
+    if let RuleCheckResult::Blocked(msg) = check_user_against_rule(
+        &w_id,
+        &ProtectionRuleKind::RestrictPublicRunSharing,
+        &authed.username,
+        &authed.groups,
+        authed.is_admin,
+        &db,
+    )
+    .await?
+    {
+        return Err(Error::PermissionDenied(msg));
+    }
+
+    let hmac = generate_view_token(&w_id, id, PUBLIC_VIEW_TOKEN_DOMAIN, &db).await?;
+
+    // The link is stateless and permanent, so the mint is the only moment this is
+    // observable: audit it unconditionally rather than through the opt-in job-view log.
+    let mut tx = db.begin().await?;
+    audit_log(
+        &mut *tx,
+        &AuditAuthor::from(&authed),
+        "jobs.share_publicly",
+        ActionKind::Create,
+        &w_id,
+        Some(&id.to_string()),
+        None,
+    )
+    .await?;
+    tx.commit().await?;
+
     Ok(format!("{id}.{hmac}"))
 }
 
@@ -805,6 +873,321 @@ async fn get_scheduled_for(
     Ok(Json(scheduled_for.timestamp_millis()))
 }
 
+/// Per-relation progress of one job, for a graph that moves while it runs.
+///
+/// The worker records these as it goes -- `running` when a model starts,
+/// `materialized` or `failed` when it ends -- but nothing rendered them: the
+/// asset graph carries a relation's identity, not what a particular run is doing
+/// to it. A retry rewrites the same rows, so a node moves back to `running` and
+/// on to its new outcome without anything extra here.
+#[derive(Serialize, Debug)]
+struct AssetProgress {
+    asset_kind: windmill_common::assets::AssetKind,
+    asset_path: String,
+    status: String,
+    row_count: Option<i64>,
+    error: Option<String>,
+}
+
+/// The asset graph as one run saw it. Pinning to a job needs the full job-read
+/// contract, so it lives on `require_job_read_access` here rather than as a
+/// parameter on `/assets/graph`. See docs/dbt-runtime.md.
+async fn get_dbt_run_graph(
+    authed: ApiAuthed,
+    OptViewToken(view_token): OptViewToken,
+    Extension(db): Extension<DB>,
+    Extension(user_db): Extension<UserDB>,
+    Path((w_id, job_id)): Path<(String, Uuid)>,
+    Query(q): Query<windmill_api_assets::GraphQuery>,
+) -> error::JsonResult<windmill_api_assets::AssetGraphResponse> {
+    // The scope domain comes from the URL segment, so `/jobs` asks a scoped token
+    // for `jobs:read` alone while the body returned is asset data. Both are
+    // required: the job gate below reaches this run, this reaches assets at all.
+    check_scopes(&authed, || "assets:read".to_string())?;
+    let job = sqlx::query!(
+        r#"SELECT created_by, runnable_path,
+                CASE WHEN kind = 'script' THEN runnable_id END AS script_hash,
+                -- Whether this job PARSED a graph of its own with no version
+                -- behind it: the dbt editor refreshing its buffer. That graph is
+                -- reachable no other way, so the job pins to it; every other
+                -- versionless job keeps answering with the workspace graph.
+                EXISTS (SELECT 1 FROM dbt_graph_snapshot g
+                         WHERE g.workspace_id = $2 AND g.job_id = $1
+                           AND g.script_hash IS NULL) AS "editor_graph!"
+           FROM v2_job WHERE id = $1 AND workspace_id = $2"#,
+        job_id,
+        &w_id
+    )
+    .fetch_optional(&db)
+    .await?;
+    // No such job: answer the unpinned graph rather than 404, so a run page whose
+    // job has aged out of retention still draws the deployed version instead of
+    // an error. Reachable only with `assets:read`, which is exactly what
+    // `/assets/graph` would have cost for the same answer.
+    let Some(job) = job else {
+        return windmill_api_assets::asset_graph_for(&authed, &w_id, user_db, db, q, None).await;
+    };
+    require_job_read_access(
+        &db,
+        &user_db,
+        &authed,
+        &w_id,
+        &job_id,
+        &job.created_by,
+        view_token.as_deref(),
+    )
+    .await?;
+    // A preview or flow job names no deployed version, so there is usually no
+    // graph to pin to and the workspace one answers. The exception is a job that
+    // parsed one itself, which is what the dbt editor's refresh is: its graph
+    // belongs to that job alone and nothing else can reach it.
+    let pinned = job
+        .runnable_path
+        .filter(|_| job.script_hash.is_some() || job.editor_graph)
+        .map(|path| windmill_api_assets::PinnedRun {
+            job_id,
+            script_path: path,
+            script_hash: job.script_hash,
+        });
+    windmill_api_assets::asset_graph_for(&authed, &w_id, user_db, db, q, pinned).await
+}
+
+/// Whether a `dbt retry` submitted by this caller would resume THIS run.
+///
+/// One failure is saved per script per execution principal, so a page showing an
+/// older failed run cannot tell whether resuming would reach it or a later one —
+/// and offering it there would submit a retry the worker refuses. Answers about
+/// this run alone: the id when it is the one, `null` otherwise, so no other run's
+/// id leaves through a page that only needs a yes or no.
+async fn get_dbt_resumable(
+    authed: ApiAuthed,
+    OptViewToken(view_token): OptViewToken,
+    Extension(db): Extension<DB>,
+    Extension(user_db): Extension<UserDB>,
+    Path((w_id, job_id)): Path<(String, Uuid)>,
+) -> error::JsonResult<Option<Uuid>> {
+    let Some(job) = sqlx::query!(
+        "SELECT created_by, runnable_path FROM v2_job
+          WHERE id = $1 AND workspace_id = $2",
+        job_id,
+        &w_id
+    )
+    .fetch_optional(&db)
+    .await?
+    else {
+        return Ok(Json(None));
+    };
+    require_job_read_access(
+        &db,
+        &user_db,
+        &authed,
+        &w_id,
+        &job_id,
+        &job.created_by,
+        view_token.as_deref(),
+    )
+    .await?;
+    let Some(script_path) = job.runnable_path else {
+        return Ok(Json(None));
+    };
+    // The CALLER's principal, not the one this run executed as: a retry is a new
+    // job submitted by whoever is reading, so a run of Alice's that Bob may read
+    // is not one Bob's retry could resume.
+    let Some(permissioned_as) = dbt_retry_principal(&user_db, &authed, &w_id, &script_path).await?
+    else {
+        return Ok(Json(None));
+    };
+    let resumable = resumable_run(&db, &w_id, &script_path, &permissioned_as).await?;
+    Ok(Json(resumable.filter(|id| *id == job_id)))
+}
+
+/// Which run a `dbt retry` of this SCRIPT would resume for this caller, if any.
+///
+/// The run form asks: `dbt_retry_job` is required for a retry and a job id is not
+/// something to type from memory.
+async fn get_dbt_resumable_for_script(
+    authed: ApiAuthed,
+    Extension(db): Extension<DB>,
+    Extension(user_db): Extension<UserDB>,
+    Path((w_id, script_path)): Path<(String, StripPath)>,
+) -> error::JsonResult<Option<Uuid>> {
+    // The cutoff `require_job_read_access` applies for the sibling routes, which
+    // this one cannot reach through: user-authored app JS holds an app-embed
+    // token, confined to the jobs it launched, and this answers with a job id.
+    if windmill_api_auth::scopes::has_app_embed_sentinel(authed.scopes.as_deref()) {
+        return Ok(Json(None));
+    }
+    let path = script_path.to_path();
+    let Some(permissioned_as) = dbt_retry_principal(&user_db, &authed, &w_id, path).await? else {
+        return Ok(Json(None));
+    };
+    let Some(job_id) = resumable_run(&db, &w_id, path, &permissioned_as).await? else {
+        return Ok(Json(None));
+    };
+    // Only a run this caller may READ. Everyone running an `on_behalf_of` script
+    // shares one principal, so the saved failure can be a run of the owner's that
+    // this caller cannot open — and answering with its id would be this endpoint
+    // handing over what to resume, when resuming republishes that run's
+    // arguments. Whoever can read the run keeps the prefill, which is the case
+    // the form exists for.
+    let Some(created_by) = sqlx::query_scalar!(
+        "SELECT created_by FROM v2_job WHERE id = $1 AND workspace_id = $2",
+        job_id,
+        &w_id
+    )
+    .fetch_optional(&db)
+    .await?
+    else {
+        return Ok(Json(None));
+    };
+    if require_job_read_access(&db, &user_db, &authed, &w_id, &job_id, &created_by, None)
+        .await
+        .is_err()
+    {
+        return Ok(Json(None));
+    }
+    Ok(Json(Some(job_id)))
+}
+
+/// The identity a run of this script submitted by this caller would execute as, which is the key
+/// `dbt_run_state` is saved under — the recorded `on_behalf_of` when the script has one and the
+/// caller otherwise, the same choice `run_script_by_path` makes. `None` when the caller cannot
+/// see the script.
+async fn dbt_retry_principal(
+    user_db: &UserDB,
+    authed: &ApiAuthed,
+    w_id: &str,
+    path: &str,
+) -> error::Result<Option<String>> {
+    // Through the user db: which of a script's runs you could resume is for
+    // whoever can see the script.
+    let mut tx = user_db.clone().begin(authed).await?;
+    let script = sqlx::query!(
+        "SELECT on_behalf_of FROM script
+          WHERE path = $1 AND workspace_id = $2 AND archived = false AND deleted = false
+          ORDER BY created_at DESC LIMIT 1",
+        path,
+        w_id
+    )
+    .fetch_optional(&mut *tx)
+    .await?;
+    tx.commit().await?;
+    Ok(script.map(|s| {
+        s.on_behalf_of
+            .unwrap_or_else(|| username_to_permissioned_as(&authed.username))
+    }))
+}
+
+/// The saved failure for this script and principal, when there is one to resume.
+/// A run that left nothing retryable is saved too — so a retry can say the run
+/// succeeded rather than that nothing is saved — but it is not resumable.
+async fn resumable_run(
+    db: &DB,
+    w_id: &str,
+    path: &str,
+    permissioned_as: &str,
+) -> error::Result<Option<Uuid>> {
+    Ok(sqlx::query_scalar!(
+        "SELECT job_id FROM dbt_run_state
+          WHERE workspace_id = $1 AND script_path = $2 AND permissioned_as = $3 AND retryable",
+        w_id,
+        path,
+        permissioned_as
+    )
+    .fetch_optional(db)
+    .await?
+    .flatten())
+}
+
+/// Lives with the job routes, not the asset ones, because it is job-scoped and
+/// `require_job_read_access` is what gates it: `materialized_partition` has no
+/// RLS, and RLS alone would not enforce a scoped token's tag filter or the
+/// app-embed cutoff, which that helper adds on top.
+async fn get_run_progress(
+    authed: ApiAuthed,
+    // A shared run page carries its access in this token, not in the caller's
+    // own grants: without it a share-link viewer gets the graph and is refused
+    // the progress that colours it.
+    OptViewToken(view_token): OptViewToken,
+    Extension(db): Extension<DB>,
+    Extension(user_db): Extension<UserDB>,
+    Path((w_id, job_id)): Path<(String, Uuid)>,
+) -> error::JsonResult<Vec<AssetProgress>> {
+    let created_by = sqlx::query_scalar!(
+        "SELECT created_by FROM v2_job WHERE id = $1 AND workspace_id = $2",
+        job_id,
+        &w_id
+    )
+    .fetch_optional(&db)
+    .await?;
+    let Some(created_by) = created_by else {
+        return Ok(Json(vec![]));
+    };
+    require_job_read_access(
+        &db,
+        &user_db,
+        &authed,
+        &w_id,
+        &job_id,
+        &created_by,
+        view_token.as_deref(),
+    )
+    .await?;
+    let mut tx = user_db.begin(&authed).await?;
+    // `dbt_run_progress`, not `materialized_partition`: the latter is keyed by
+    // relation and its `job_id` names only the last writer, so two runs of one
+    // project building the same models would take rows from each other and this
+    // response would lose nodes.
+    let rows = sqlx::query!(
+        "SELECT asset_kind AS \"asset_kind: windmill_common::assets::AssetKind\", asset_path,
+                status::text AS \"status!\", row_count, error
+           FROM dbt_run_progress
+          WHERE workspace_id = $1 AND job_id = $2",
+        w_id,
+        job_id
+    )
+    .fetch_all(&mut *tx)
+    .await?;
+    // An agent worker reaches the database only through the API, and records its
+    // outcomes with the shared `record_materialization`, which writes the
+    // relation-keyed table alone. Falling back to it there keeps those runs
+    // showing progress; it is the racy source, but an agent run that has no rows
+    // of its own is strictly better served by it than by nothing.
+    let rows = if rows.is_empty() {
+        sqlx::query!(
+            "SELECT asset_kind AS \"asset_kind: windmill_common::assets::AssetKind\", asset_path,
+                    status::text AS \"status!\", row_count, error
+               FROM materialized_partition
+              WHERE workspace_id = $1 AND job_id = $2",
+            w_id,
+            job_id
+        )
+        .fetch_all(&mut *tx)
+        .await?
+        .into_iter()
+        .map(|r| AssetProgress {
+            asset_kind: r.asset_kind,
+            asset_path: r.asset_path,
+            status: r.status,
+            row_count: r.row_count,
+            error: r.error,
+        })
+        .collect::<Vec<_>>()
+    } else {
+        rows.into_iter()
+            .map(|r| AssetProgress {
+                asset_kind: r.asset_kind,
+                asset_path: r.asset_path,
+                status: r.status,
+                row_count: r.row_count,
+                error: r.error,
+            })
+            .collect::<Vec<_>>()
+    };
+    tx.commit().await?;
+    Ok(Json(rows))
+}
+
 async fn get_flow_job_debug_info(
     OptViewToken(view_token): OptViewToken,
     OptAuthed(opt_authed): OptAuthed,
@@ -998,7 +1381,7 @@ struct GetJobQuery {
 /// job UUID, even though the same job is hidden from them in `jobs/list`
 /// (RLS-filtered) and the underlying script returns 404. (WIN-2026-jobs-read)
 ///
-/// Unauthenticated callers are still handled by each handler's anonymous-job check;
+/// Unauthenticated callers go through [`require_unauthed_job_read_access`] instead;
 /// this gate applies only when a user is authenticated. Access is granted when:
 /// - the caller created the job (`created_by`) — covers app components, webhooks and
 ///   the caller's own runs, whose `permissioned_as` is the policy identity rather
@@ -1103,9 +1486,10 @@ async fn require_job_read_access(
     // identity, i.e. its `permissioned_as_email` (the token owner's email, never set from
     // the label) equals `authed.email`. This still admits every legitimate same-owner
     // re-read (trigger tokens reading their own webhook/http/email jobs, the
-    // ephemeral-script-end-user worker token, generic labeled tokens) while denying
-    // cross-principal collisions. The DB hit only happens when an override is present and
-    // matches, so the common session/token path stays query-free.
+    // ephemeral-script-end-user worker token, and jobs whose stored `created_by` is a
+    // `label-*` override) while denying cross-principal collisions. The DB hit only happens
+    // when an override is present and matches, so the common session/token path stays
+    // query-free.
     if authed
         .username_override
         .as_deref()
@@ -1124,9 +1508,13 @@ async fn require_job_read_access(
     }
 
     // Share read link: a valid view token minted by someone with read access grants
-    // this authenticated member read of the shared job and its flow subtree.
+    // this authenticated member read of the shared job and its flow subtree. Either
+    // audience does — the public one is a superset of the member one.
     if let Some(token) = view_token {
-        if validate_view_token(db, w_id, job_id, token).await? {
+        if validate_view_token(db, w_id, job_id, token)
+            .await?
+            .is_some()
+        {
             return Ok(());
         }
     }
@@ -1219,43 +1607,109 @@ async fn job_ancestor_chain_ids(db: &DB, w_id: &str, job_id: &Uuid) -> error::Re
     })
 }
 
+/// Who a share read link was minted for.
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+enum ViewTokenAudience {
+    /// Read of the job subtree for an authenticated workspace member.
+    Member,
+    /// The same read, additionally granted to logged-out visitors.
+    Public,
+}
+
 /// A share read link token has the form `{shared_job_id}.{hmac}` where `hmac` is
 /// [`windmill_common::variables::generate_view_token`] for `shared_job_id`. It grants
 /// read of that job and its whole flow subtree, so the run page can present a single
-/// link that also renders the flow's steps. Returns true iff the signature is valid
-/// AND `accessed_job_id` is the shared job or one of its descendants.
+/// link that also renders the flow's steps. Returns the token's audience iff the
+/// signature is valid AND `accessed_job_id` is the shared job or one of its descendants.
 async fn validate_view_token(
     db: &DB,
     w_id: &str,
     accessed_job_id: &Uuid,
     token: &str,
-) -> error::Result<bool> {
+) -> error::Result<Option<ViewTokenAudience>> {
     let Some((shared_id_str, provided_hmac)) = token.split_once('.') else {
-        return Ok(false);
+        return Ok(None);
     };
     let Ok(shared_id) = Uuid::parse_str(shared_id_str) else {
-        return Ok(false);
+        return Ok(None);
     };
     let Ok(provided_bytes) = hex::decode(provided_hmac) else {
-        return Ok(false);
+        return Ok(None);
     };
-    // Constant-time verification (same domain as `generate_view_token`, mirroring
+    // Constant-time verification (same domains as `generate_view_token`, mirroring
     // `verify_suspended_secret`); avoids the timing side-channel of comparing the
     // hex strings with `!=`.
     let key = get_workspace_key(w_id, db).await?;
-    let mut mac = HmacSha256::new_from_slice(key.as_bytes()).map_err(to_anyhow)?;
-    mac.update(shared_id.as_bytes());
-    mac.update(b"view_token");
-    if mac.verify_slice(&provided_bytes).is_err() {
-        return Ok(false);
-    }
+    let verify = |domain: &[u8]| -> error::Result<bool> {
+        let mut mac = HmacSha256::new_from_slice(key.as_bytes()).map_err(to_anyhow)?;
+        mac.update(shared_id.as_bytes());
+        mac.update(domain);
+        Ok(mac.verify_slice(&provided_bytes).is_ok())
+    };
+    let audience = if verify(VIEW_TOKEN_DOMAIN)? {
+        ViewTokenAudience::Member
+    } else if verify(PUBLIC_VIEW_TOKEN_DOMAIN)? {
+        ViewTokenAudience::Public
+    } else {
+        return Ok(None);
+    };
     if accessed_job_id == &shared_id {
-        return Ok(true);
+        return Ok(Some(audience));
     }
     // The token authorizes the shared job's subtree: accessed must descend from it,
     // i.e. the shared job is among accessed's ancestors.
     let chain = job_ancestor_chain_ids(db, w_id, accessed_job_id).await?;
-    Ok(chain.contains(&shared_id))
+    Ok(chain.contains(&shared_id).then_some(audience))
+}
+
+/// Whether `token` is a *public* share link covering `job_id`. This is the only thing
+/// that lets a logged-out caller read a job that was not itself run anonymously.
+async fn public_view_token_grants(
+    db: &DB,
+    w_id: &str,
+    job_id: &Uuid,
+    token: Option<&str>,
+) -> error::Result<bool> {
+    let Some(token) = token else {
+        return Ok(false);
+    };
+    Ok(validate_view_token(db, w_id, job_id, token).await? == Some(ViewTokenAudience::Public))
+}
+
+/// Read gate for logged-out callers, the counterpart of [`require_job_read_access`]: a job
+/// run anonymously is public by construction, and a public share link publishes any other.
+async fn require_unauthed_job_read_access(
+    db: &DB,
+    w_id: &str,
+    job_id: &Uuid,
+    created_by: &str,
+    view_token: Option<&str>,
+) -> error::Result<()> {
+    if created_by == "anonymous" || public_view_token_grants(db, w_id, job_id, view_token).await? {
+        return Ok(());
+    }
+    Err(Error::BadRequest(
+        "As a non logged in user, you can only see jobs ran by anonymous users".to_string(),
+    ))
+}
+
+/// The read gate of every handler that serves both audiences (the `jobs_u` router):
+/// [`require_job_read_access`] when logged in, [`require_unauthed_job_read_access`] when not.
+async fn require_opt_authed_job_read_access(
+    db: &DB,
+    user_db: &UserDB,
+    opt_authed: &Option<ApiAuthed>,
+    w_id: &str,
+    job_id: &Uuid,
+    created_by: &str,
+    view_token: Option<&str>,
+) -> error::Result<()> {
+    match opt_authed {
+        Some(authed) => {
+            require_job_read_access(db, user_db, authed, w_id, job_id, created_by, view_token).await
+        }
+        None => require_unauthed_job_read_access(db, w_id, job_id, created_by, view_token).await,
+    }
 }
 
 lazy_static::lazy_static! {
@@ -1424,7 +1878,12 @@ async fn get_job(
         false
     };
 
-    let mut get = GetQuery::new().with_in_tags(tags.as_ref());
+    let public_view_grant = opt_authed.is_none()
+        && public_view_token_grants(&db, &w_id, &id, view_token.as_deref()).await?;
+
+    let mut get = GetQuery::new()
+        .with_in_tags(tags.as_ref())
+        .with_public_view_grant(public_view_grant);
     if !has_valid_approval_token {
         get = get.with_auth(&opt_authed);
     }
@@ -1439,21 +1898,21 @@ async fn get_job(
     let mut job = get.fetch(&db, &id, &w_id).await?;
     job.fetch_outstanding_wait_time(&db).await?;
 
-    // A valid approval token is itself the capability; otherwise an authenticated
-    // caller must pass the same visibility as `jobs/list` (see `require_job_read_access`).
-    if !has_valid_approval_token {
-        if let Some(authed) = opt_authed.as_ref() {
-            require_job_read_access(
-                &db,
-                &user_db,
-                authed,
-                &w_id,
-                &id,
-                job.created_by(),
-                view_token.as_deref(),
-            )
-            .await?;
-        }
+    // A valid approval token is itself the capability; otherwise the caller must pass the
+    // same visibility as `jobs/list` (see `require_job_read_access`), or hold a public
+    // share link when logged out — which `public_view_grant` already established above,
+    // so skip re-deriving it here: this handler is what the public run page polls.
+    if !has_valid_approval_token && !public_view_grant {
+        require_opt_authed_job_read_access(
+            &db,
+            &user_db,
+            &opt_authed,
+            &w_id,
+            &id,
+            job.created_by(),
+            view_token.as_deref(),
+        )
+        .await?;
     }
 
     log_job_view(
@@ -1526,7 +1985,7 @@ macro_rules! get_job_query {
                 END
             ELSE '{{\"reason\": \"WINDMILL_TOO_BIG\"}}'::jsonb END as args, flow_status, workflow_as_code_status, \
             {logs} as logs, {code} as raw_code, canceled_by is not null as canceled, canceled_by, canceled_reason, kind as job_kind, \
-            CASE WHEN trigger_kind = 'schedule'::job_trigger_kind THEN trigger END AS schedule_path, permissioned_as, \
+            CASE WHEN trigger_kind = 'schedule'::job_trigger_kind THEN trigger END AS schedule_path, v2_job.trigger_kind, permissioned_as, \
             {flow} as raw_flow, flow_step_id IS NOT NULL AS is_flow_step, script_lang as language, \
             {lock} as raw_lock, permissioned_as_email as email, visible_to_owner, memory_peak as mem_peak, v2_job.tag, v2_job.priority, preprocessed, worker,\
             {additional_fields} \
@@ -1550,6 +2009,10 @@ struct GetQuery<'a> {
     with_flow: bool,
     with_auth: Option<&'a Option<ApiAuthed>>,
     with_in_tags: Option<&'a Vec<&'a str>>,
+    /// A public share link covering this job was presented: lifts the logged-out
+    /// restriction in [`Self::check_auth`], the way a view token lifts the ACL check
+    /// in `require_job_read_access` for a member.
+    with_public_view_grant: bool,
 }
 
 impl<'a> GetQuery<'a> {
@@ -1560,6 +2023,7 @@ impl<'a> GetQuery<'a> {
             with_flow: true,
             with_auth: None,
             with_in_tags: None,
+            with_public_view_grant: false,
         }
     }
 
@@ -1584,9 +2048,16 @@ impl<'a> GetQuery<'a> {
         Self { with_in_tags: in_tags, ..self }
     }
 
+    fn with_public_view_grant(self, granted: bool) -> Self {
+        Self { with_public_view_grant: granted, ..self }
+    }
+
     fn check_auth(&self, email: Option<&str>) -> error::Result<()> {
         if let Some(email) = email {
-            if self.with_auth.is_some_and(|x| x.is_none()) && email != "anonymous" {
+            if self.with_auth.is_some_and(|x| x.is_none())
+                && email != "anonymous"
+                && !self.with_public_view_grant
+            {
                 return Err(Error::BadRequest(
                     "As a non logged in user, you can only see jobs ran by anonymous users"
                         .to_string(),
@@ -2068,22 +2539,16 @@ async fn get_completed_job_logs_tail(
         .await?;
 
     if let Some(record) = record {
-        if let Some(authed) = opt_authed.as_ref() {
-            require_job_read_access(
-                &db,
-                &user_db,
-                authed,
-                &w_id,
-                &id,
-                &record.created_by,
-                view_token.as_deref(),
-            )
-            .await?;
-        } else if record.created_by != "anonymous" {
-            return Err(Error::BadRequest(
-                "As a non logged in user, you can only see jobs ran by anonymous users".to_string(),
-            ));
-        }
+        require_opt_authed_job_read_access(
+            &db,
+            &user_db,
+            &opt_authed,
+            &w_id,
+            &id,
+            &record.created_by,
+            view_token.as_deref(),
+        )
+        .await?;
 
         let logs = record.logs.unwrap_or_default();
         Ok(Json(logs))
@@ -2132,22 +2597,16 @@ async fn get_job_logs(
         .await?;
 
     if let Some(record) = record {
-        if let Some(authed) = opt_authed.as_ref() {
-            require_job_read_access(
-                &db,
-                &user_db,
-                authed,
-                &w_id,
-                &id,
-                &record.created_by,
-                view_token.as_deref(),
-            )
-            .await?;
-        } else if record.created_by != "anonymous" {
-            return Err(Error::BadRequest(
-                "As a non logged in user, you can only see jobs ran by anonymous users".to_string(),
-            ));
-        }
+        require_opt_authed_job_read_access(
+            &db,
+            &user_db,
+            &opt_authed,
+            &w_id,
+            &id,
+            &record.created_by,
+            view_token.as_deref(),
+        )
+        .await?;
         let logs = record.logs.unwrap_or_default();
 
         log_job_view(
@@ -2201,10 +2660,15 @@ async fn get_job_logs(
             .await?;
         let text = not_found_if_none(text, "Job Logs", id.to_string())?;
 
-        if opt_authed.is_none() && text.created_by != "anonymous" {
-            return Err(Error::BadRequest(
-                "As a non logged in user, you can only see jobs ran by anonymous users".to_string(),
-            ));
+        if opt_authed.is_none() {
+            require_unauthed_job_read_access(
+                &db,
+                &w_id,
+                &id,
+                &text.created_by,
+                view_token.as_deref(),
+            )
+            .await?;
         }
         let logs = text.logs.unwrap_or_default();
 
@@ -2308,22 +2772,16 @@ async fn authorize_flow_tree_read(
 
     let root_job = not_found_if_none(root_job, "Job", id.to_string())?;
 
-    if let Some(authed) = opt_authed.as_ref() {
-        require_job_read_access(
-            db,
-            user_db,
-            authed,
-            w_id,
-            &id,
-            &root_job.created_by,
-            view_token.as_deref(),
-        )
-        .await?;
-    } else if root_job.created_by != "anonymous" {
-        return Err(Error::BadRequest(
-            "As a non logged in user, you can only see jobs ran by anonymous users".to_string(),
-        ));
-    }
+    require_opt_authed_job_read_access(
+        db,
+        user_db,
+        &opt_authed,
+        w_id,
+        &id,
+        &root_job.created_by,
+        view_token.as_deref(),
+    )
+    .await?;
 
     log_job_view(
         db,
@@ -3304,22 +3762,16 @@ async fn get_args(
         .await?;
 
     if let Some(record) = record {
-        if let Some(authed) = opt_authed.as_ref() {
-            require_job_read_access(
-                &db,
-                &user_db,
-                authed,
-                &w_id,
-                &id,
-                &record.created_by,
-                view_token.as_deref(),
-            )
-            .await?;
-        } else if record.created_by != "anonymous" {
-            return Err(Error::BadRequest(
-                "As a non logged in user, you can only see jobs ran by anonymous users".to_string(),
-            ));
-        }
+        require_opt_authed_job_read_access(
+            &db,
+            &user_db,
+            &opt_authed,
+            &w_id,
+            &id,
+            &record.created_by,
+            view_token.as_deref(),
+        )
+        .await?;
 
         log_job_view(
             &db,
@@ -3343,22 +3795,16 @@ async fn get_args(
             .fetch_optional(&db)
             .await?;
         let record = not_found_if_none(record, "Job Args", id.to_string())?;
-        if let Some(authed) = opt_authed.as_ref() {
-            require_job_read_access(
-                &db,
-                &user_db,
-                authed,
-                &w_id,
-                &id,
-                &record.created_by,
-                view_token.as_deref(),
-            )
-            .await?;
-        } else if record.created_by != "anonymous" {
-            return Err(Error::BadRequest(
-                "As a non logged in user, you can only see jobs ran by anonymous users".to_string(),
-            ));
-        }
+        require_opt_authed_job_read_access(
+            &db,
+            &user_db,
+            &opt_authed,
+            &w_id,
+            &id,
+            &record.created_by,
+            view_token.as_deref(),
+        )
+        .await?;
 
         log_job_view(
             &db,
@@ -3912,7 +4358,9 @@ pub async fn resume_suspended_flow_as_owner(
 
 // --- New approval system endpoints ---
 
-use windmill_common::variables::{generate_approval_token, generate_view_token};
+use windmill_common::variables::{
+    generate_approval_token, generate_view_token, PUBLIC_VIEW_TOKEN_DOMAIN, VIEW_TOKEN_DOMAIN,
+};
 
 /// Verify an approval token against the workspace key + job_id.
 async fn validate_approval_token(
@@ -4377,7 +4825,7 @@ async fn get_approval_info(
     // Possession of view rights over this approval is sufficient to mint a
     // share-read-link token for the flow: it only grants read (no resume), and only to
     // an authenticated workspace member, so it never widens what the approver can do.
-    let hmac = generate_view_token(&w_id, row.id, &db).await?;
+    let hmac = generate_view_token(&w_id, row.id, VIEW_TOKEN_DOMAIN, &db).await?;
     let view_token = Some(format!("{}.{hmac}", row.id));
 
     Ok(Json(ApprovalInfo {
@@ -4890,7 +5338,7 @@ pub async fn get_suspended_job_flow(
     // Possession of a valid approval secret is sufficient to mint a share-read-link
     // token for the parent flow: it only grants read (no resume), and only to an
     // authenticated workspace member, so it never widens what the approver can do.
-    let hmac = generate_view_token(&w_id, flow_id, &db).await?;
+    let hmac = generate_view_token(&w_id, flow_id, VIEW_TOKEN_DOMAIN, &db).await?;
     let view_token = Some(format!("{flow_id}.{hmac}"));
 
     Ok(Json(SuspendedJobFlow { job: flow, approvers, view_token }).into_response())
@@ -6189,6 +6637,7 @@ pub async fn restart_flow(
         &authed.email,
         username_to_permissioned_as(&authed.username),
         authed.token_prefix.as_deref(),
+        authed.username_override.as_deref(),
         scheduled_for,
         None,
         run_query.parent_job,
@@ -6206,7 +6655,7 @@ pub async fn restart_flow(
         Some(&authed.clone().into()),
         false,
         None,
-        None,
+        authed.trigger_or_fallback(None),
         run_query.suspended_mode,
     )
     .await?;
@@ -6457,6 +6906,7 @@ pub async fn run_workflow_as_code(
         email,
         permissioned_as,
         authed.token_prefix.as_deref(),
+        authed.username_override.as_deref(),
         scheduled_for,
         None,
         Some(job_id),
@@ -6769,6 +7219,7 @@ pub async fn run_wait_result_job_by_path_get(
         email,
         permissioned_as,
         authed.token_prefix.as_deref(),
+        authed.username_override.as_deref(),
         None,
         None,
         run_query.parent_job,
@@ -6786,7 +7237,7 @@ pub async fn run_wait_result_job_by_path_get(
         push_authed.as_ref(),
         false,
         None,
-        None,
+        authed.trigger_or_fallback(None),
         run_query.suspended_mode,
     )
     .await?;
@@ -6913,6 +7364,7 @@ pub async fn run_wait_result_script_by_path_internal(
         email,
         permissioned_as,
         authed.token_prefix.as_deref(),
+        authed.username_override.as_deref(),
         None,
         None,
         run_query.parent_job,
@@ -6930,7 +7382,7 @@ pub async fn run_wait_result_script_by_path_internal(
         push_authed.as_ref(),
         false,
         None,
-        None,
+        authed.trigger_or_fallback(None),
         run_query.suspended_mode,
     )
     .await?;
@@ -6966,6 +7418,11 @@ pub async fn run_wait_result_script_by_hash(
 
     let hash = script_hash.0;
     let userdb_authed = UserDbWithAuthed { db: user_db.clone(), authed: &authed.to_authed_ref() };
+    let script_info = get_script_info_for_hash(Some(userdb_authed), &db, &w_id, hash)
+        .await?
+        .prefetch_cached(&db)
+        .await?;
+    let on_behalf_of = script_info.on_behalf_of(&w_id, &db).await?;
     let ScriptHashInfo {
         path,
         tag,
@@ -6978,16 +7435,11 @@ pub async fn run_wait_result_script_by_hash(
         delete_after_secs,
         timeout,
         has_preprocessor,
-        on_behalf_of_email,
-        created_by,
         labels,
         runnable_settings:
             ScriptRunnableSettingsInline { concurrency_settings, debouncing_settings },
         ..
-    } = get_script_info_for_hash(Some(userdb_authed), &db, &w_id, hash)
-        .await?
-        .prefetch_cached(&db)
-        .await?;
+    } = script_info;
 
     if let Some(run_query_cache_ttl) = run_query.cache_ttl {
         cache_ttl = Some(run_query_cache_ttl);
@@ -6998,11 +7450,10 @@ pub async fn run_wait_result_script_by_hash(
     let tag = run_query.tag.clone().or(tag);
     check_tag_available_for_workspace(&db, &w_id, &tag, &authed).await?;
 
-    let (email, permissioned_as, push_authed, tx) = if let Some(email) = on_behalf_of_email.as_ref()
-    {
+    let (email, permissioned_as, push_authed, tx) = if let Some(obo) = on_behalf_of.as_ref() {
         (
-            email,
-            username_to_permissioned_as(created_by.as_str()),
+            &obo.email,
+            obo.permissioned_as.clone(),
             None,
             PushIsolationLevel::IsolatedRoot(db.clone()),
         )
@@ -7038,6 +7489,7 @@ pub async fn run_wait_result_script_by_hash(
         email,
         permissioned_as,
         authed.token_prefix.as_deref(),
+        authed.username_override.as_deref(),
         None,
         None,
         run_query.parent_job,
@@ -7055,7 +7507,7 @@ pub async fn run_wait_result_script_by_hash(
         push_authed.as_ref(),
         false,
         None,
-        None,
+        authed.trigger_or_fallback(None),
         run_query.suspended_mode,
     )
     .await?;
@@ -7305,6 +7757,7 @@ pub async fn stream_job(
         poll_delay_ms,
         early_return,
         has_failure_module,
+        false,
     );
 
     let body = axum::body::Body::from_stream(stream.map(Result::<_, std::convert::Infallible>::Ok));
@@ -7519,6 +7972,7 @@ async fn run_preview_script(
         &authed.email,
         username_to_permissioned_as(&authed.username),
         authed.token_prefix.as_deref(),
+        authed.username_override.as_deref(),
         scheduled_for,
         None,
         None,
@@ -7536,7 +7990,7 @@ async fn run_preview_script(
         Some(&authed.clone().into()),
         false,
         None,
-        None,
+        authed.trigger_or_fallback(None),
         None,
     )
     .await?;
@@ -7884,6 +8338,7 @@ async fn run_bundle_preview_script(
                 &authed.email,
                 username_to_permissioned_as(&authed.username),
                 authed.token_prefix.as_deref(),
+                authed.username_override.as_deref(),
                 scheduled_for,
                 None,
                 None,
@@ -7901,7 +8356,7 @@ async fn run_bundle_preview_script(
                 Some(&authed.clone().into()),
                 false,
                 None,
-                None,
+                authed.trigger_or_fallback(None),
                 None,
             )
             .await?;
@@ -8036,6 +8491,7 @@ async fn push_dependencies_job(
         &authed.email,
         username_to_permissioned_as(&authed.username),
         authed.token_prefix.as_deref(),
+        authed.username_override.as_deref(),
         None,
         None,
         None,
@@ -8145,6 +8601,7 @@ async fn push_flow_dependencies_job(
         &authed.email,
         username_to_permissioned_as(&authed.username),
         authed.token_prefix.as_deref(),
+        authed.username_override.as_deref(),
         None,
         None,
         None,
@@ -8531,6 +8988,7 @@ async fn run_preview_flow_job(
         &authed.email,
         username_to_permissioned_as(&authed.username),
         authed.token_prefix.as_deref(),
+        authed.username_override.as_deref(),
         scheduled_for,
         None,
         None,
@@ -8548,7 +9006,7 @@ async fn run_preview_flow_job(
         Some(&authed.clone().into()),
         false,
         None,
-        None,
+        authed.trigger_or_fallback(None),
         None,
     )
     .await?;
@@ -8796,6 +9254,7 @@ async fn run_dynamic_select(
         &authed.email,
         username_to_permissioned_as(&authed.username),
         authed.token_prefix.as_deref(),
+        authed.username_override.as_deref(),
         scheduled_for,
         None,
         None,
@@ -8814,7 +9273,7 @@ async fn run_dynamic_select(
         Some(&authed.clone().into()),
         false,
         None,
-        None,
+        authed.trigger_or_fallback(None),
         None,
     )
     .await?;
@@ -8871,6 +9330,11 @@ pub async fn run_job_by_hash_inner(
 
     let hash = script_hash.0;
     let userdb_authed = UserDbWithAuthed { db: user_db.clone(), authed: &authed.to_authed_ref() };
+    let script_info = get_script_info_for_hash(Some(userdb_authed), &db, &w_id, hash)
+        .await?
+        .prefetch_cached(&db)
+        .await?;
+    let on_behalf_of = script_info.on_behalf_of(&w_id, &db).await?;
     let ScriptHashInfo {
         path,
         tag,
@@ -8883,16 +9347,11 @@ pub async fn run_job_by_hash_inner(
         priority,
         timeout,
         has_preprocessor,
-        on_behalf_of_email,
-        created_by,
         delete_after_use,
         delete_after_secs,
         labels,
         ..
-    } = get_script_info_for_hash(Some(userdb_authed), &db, &w_id, hash)
-        .await?
-        .prefetch_cached(&db)
-        .await?;
+    } = script_info;
 
     check_scopes(&authed, || format!("jobs:run:scripts:{path}"))?;
     if let Some(run_query_cache_ttl) = run_query.cache_ttl {
@@ -8904,11 +9363,10 @@ pub async fn run_job_by_hash_inner(
 
     check_tag_available_for_workspace(&db, &w_id, &tag, &authed).await?;
 
-    let (email, permissioned_as, push_authed, tx) = if let Some(email) = on_behalf_of_email.as_ref()
-    {
+    let (email, permissioned_as, push_authed, tx) = if let Some(obo) = on_behalf_of.as_ref() {
         (
-            email,
-            username_to_permissioned_as(created_by.as_str()),
+            &obo.email,
+            obo.permissioned_as.clone(),
             None,
             PushIsolationLevel::IsolatedRoot(db.clone()),
         )
@@ -8944,6 +9402,7 @@ pub async fn run_job_by_hash_inner(
         email,
         permissioned_as,
         authed.token_prefix.as_deref(),
+        authed.username_override.as_deref(),
         scheduled_for,
         None,
         run_query.parent_job,
@@ -8961,7 +9420,7 @@ pub async fn run_job_by_hash_inner(
         push_authed.as_ref(),
         false,
         None,
-        trigger,
+        authed.trigger_or_fallback(trigger),
         run_query.suspended_mode,
     )
     .await?;
@@ -8998,8 +9457,7 @@ async fn get_log_file(
     }
 
     // Authorization: the log file directory is the job id, so gate access the same
-    // way as get_job_logs — the caller must be able to read the job. Non-logged-in
-    // callers may only read logs of jobs created by the anonymous user.
+    // way as get_job_logs — the caller must be able to read the job.
     let tags = opt_authed
         .as_ref()
         .map(|authed| get_scope_tags(authed).map(|v| v.iter().map(|s| s.to_string()).collect_vec()))
@@ -9013,22 +9471,16 @@ async fn get_log_file(
     .fetch_optional(&db)
     .await?
     .ok_or_else(|| error::Error::NotFound(format!("Job {job_id} not found")))?;
-    if let Some(authed) = opt_authed.as_ref() {
-        require_job_read_access(
-            &db,
-            &user_db,
-            authed,
-            &w_id,
-            &job_id,
-            &created_by,
-            view_token.as_deref(),
-        )
-        .await?;
-    } else if created_by != "anonymous" {
-        return Err(error::Error::BadRequest(
-            "As a non logged in user, you can only see jobs ran by anonymous users".to_string(),
-        ));
-    }
+    require_opt_authed_job_read_access(
+        &db,
+        &user_db,
+        &opt_authed,
+        &w_id,
+        &job_id,
+        &created_by,
+        view_token.as_deref(),
+    )
+    .await?;
 
     let local_file = format!("{}/logs/{file_p}", *WINDMILL_DIR);
     // SECURITY (defense in depth): refuse to read through a symlink so a planted
@@ -9122,6 +9574,10 @@ async fn get_job_update(
         )
         .await?;
     }
+    // A public share link authorizes a logged-out read of this job, seeding the latch
+    // that would otherwise confine it to anonymously-run jobs.
+    let mut unauthed_read_authorized = opt_authed.is_none()
+        && public_view_token_grants(&db, &w_id, &job_id, view_token.as_deref()).await?;
     Ok(Json(
         get_job_update_data(
             &opt_authed,
@@ -9142,7 +9598,7 @@ async fn get_job_update(
             None,
             false,
             &mut false,
-            &mut false,
+            &mut unauthed_read_authorized,
         )
         .await?,
     ))
@@ -9168,7 +9624,7 @@ async fn get_job_update_sse(
     }): Query<JobUpdateQuery>,
 ) -> error::Result<Response> {
     // Authorize once at connection time; `created_by` cannot change for a given job,
-    // mirroring the per-stream `anonymous_verified` latch in the streaming loop.
+    // mirroring the per-stream `unauthed_read_authorized` latch in the streaming loop.
     if let Some(authed) = opt_authed.as_ref() {
         require_job_update_read_access(
             &db,
@@ -9180,6 +9636,8 @@ async fn get_job_update_sse(
         )
         .await?;
     }
+    let unauthed_read_authorized = opt_authed.is_none()
+        && public_view_token_grants(&db, &w_id, &job_id, view_token.as_deref()).await?;
 
     let (tx, rx) = tokio::sync::mpsc::channel(32);
 
@@ -9201,6 +9659,7 @@ async fn get_job_update_sse(
         poll_delay_ms,
         None,
         false,
+        unauthed_read_authorized,
     );
 
     let stream = tokio_stream::wrappers::ReceiverStream::new(rx).map(|x| {
@@ -9240,6 +9699,9 @@ pub fn start_job_update_sse_stream(
     poll_delay_ms: Option<u64>,
     early_return: Option<String>,
     has_failure_module: bool,
+    // Seeds the per-stream latch below: set when the caller is logged out but presented
+    // a public share link for this job, which authorizes the whole stream up front.
+    unauthed_read_authorized: bool,
 ) -> () {
     tokio::spawn(async move {
         let mut log_offset = initial_log_offset;
@@ -9249,10 +9711,10 @@ pub fn start_job_update_sse_stream(
         // Latched once the early_return node's failure is observed alongside a
         // failure_module — subsequent polls then skip the redundant per-node lookup.
         let mut early_return_suppressed = false;
-        // Latched once we've verified the job was created by "anonymous" — for
+        // Latched once a logged-out caller's read of this job has been authorized — for
         // unauthenticated SSE streams, this gates access and is checked once per
         // stream rather than once per poll (created_by cannot change).
-        let mut anonymous_verified = false;
+        let mut unauthed_read_authorized = unauthed_read_authorized;
 
         // Send initial update immediately
         let mut running = running;
@@ -9278,7 +9740,7 @@ pub fn start_job_update_sse_stream(
             early_return.as_deref(),
             has_failure_module,
             &mut early_return_suppressed,
-            &mut anonymous_verified,
+            &mut unauthed_read_authorized,
         )
         .await
         {
@@ -9401,7 +9863,7 @@ pub fn start_job_update_sse_stream(
                 early_return.as_deref(),
                 has_failure_module,
                 &mut early_return_suppressed,
-                &mut anonymous_verified,
+                &mut unauthed_read_authorized,
             )
             .await
             {
@@ -9555,7 +10017,9 @@ async fn get_job_update_data(
     early_return: Option<&str>,
     has_failure_module: bool,
     early_return_suppressed: &mut bool,
-    anonymous_verified: &mut bool,
+    // Latched gate for logged-out callers: once true, this job's updates are readable
+    // without a session (job run anonymously, or a public share link presented).
+    unauthed_read_authorized: &mut bool,
 ) -> error::Result<JobUpdate> {
     let tags = if log_view {
         log_job_view(
@@ -9577,14 +10041,13 @@ async fn get_job_update_data(
     let ignore_flow_stream_job_id = is_flow.is_some_and(|x| !x) || flow_stream_job_id.is_some();
 
     if only_result.unwrap_or(false) {
-        // Unauthenticated callers may only read jobs whose creator is "anonymous".
+        // Unauthenticated callers are confined to jobs they may read logged out.
         // The non-only_result branch enforces this via `record.created_by` from its
         // main query, but the only_result branch below fetches solely the result by
-        // (workspace_id, job_id), so we guard here to close the gap. The
-        // `anonymous_verified` flag is preserved across SSE poll iterations so the
-        // lookup only happens once per stream — `created_by` cannot change for a
-        // given job once it has been created.
-        if opt_authed.is_none() && !*anonymous_verified {
+        // (workspace_id, job_id), so we guard here to close the gap. The latch is
+        // preserved across SSE poll iterations so the lookup only happens once per
+        // stream — `created_by` cannot change for a given job once it has been created.
+        if opt_authed.is_none() && !*unauthed_read_authorized {
             let created_by = sqlx::query_scalar!(
                 "SELECT created_by FROM v2_job WHERE id = $1 AND workspace_id = $2",
                 job_id,
@@ -9600,7 +10063,7 @@ async fn get_job_update_data(
                         .to_string(),
                 ));
             }
-            *anonymous_verified = true;
+            *unauthed_read_authorized = true;
         }
 
         let (result, running, mut result_stream, mut new_stream_offset, new_flow_stream_job_id) =
@@ -9841,15 +10304,22 @@ async fn get_job_update_data(
             .await?
             .ok_or_else(|| Error::NotFound(format!("Job not found: {}", job_id)))?;
 
-        if opt_authed.is_none() && record.created_by != "anonymous" {
-            return Err(Error::BadRequest(
-                "As a non logged in user, you can only see jobs ran by anonymous users".to_string(),
-            ));
+        if opt_authed.is_none() && !*unauthed_read_authorized {
+            if record.created_by != "anonymous" {
+                return Err(Error::BadRequest(
+                    "As a non logged in user, you can only see jobs ran by anonymous users"
+                        .to_string(),
+                ));
+            }
+            *unauthed_read_authorized = true;
         }
 
         let job = if record.completed.unwrap_or(false) && get_full_job_on_completion {
             let get = GetQuery::new()
                 .with_auth(&opt_authed)
+                // Already authorized above, latch included — don't re-derive it from
+                // `created_by` here or a public share link would lose the full job.
+                .with_public_view_grant(*unauthed_read_authorized)
                 .without_logs()
                 .without_code();
             Some(get.fetch(&db, job_id, &w_id).await?)
@@ -9975,19 +10445,24 @@ async fn get_completed_job<'a>(
         .map(|authed| get_scope_tags(authed))
         .flatten();
 
+    let public_view_grant = opt_authed.is_none()
+        && public_view_token_grants(&db, &w_id, &id, view_token.as_deref()).await?;
+
     let job_o = GetQuery::new()
         .with_auth(&opt_authed)
         .with_in_tags(tags.as_ref())
+        .with_public_view_grant(public_view_grant)
         .fetch_completed(&db, &id, &w_id)
         .await?;
 
     let cj = not_found_if_none(job_o, "Completed Job", id.to_string())?;
 
-    if let Some(authed) = opt_authed.as_ref() {
-        require_job_read_access(
+    // `public_view_grant` already settled the logged-out case above — don't re-derive it.
+    if !public_view_grant {
+        require_opt_authed_job_read_access(
             &db,
             &user_db,
-            authed,
+            &opt_authed,
             &w_id,
             &id,
             &cj.created_by,
@@ -10123,22 +10598,16 @@ async fn get_completed_job_result(
     };
 
     if !approval_secret_ok {
-        if let Some(authed) = opt_authed.as_ref() {
-            require_job_read_access(
-                &db,
-                &user_db,
-                authed,
-                &w_id,
-                &id,
-                &created_by,
-                view_token.as_deref(),
-            )
-            .await?;
-        } else if created_by != "anonymous" {
-            return Err(Error::BadRequest(
-                "As a non logged in user, you can only see jobs ran by anonymous users".to_string(),
-            ));
-        }
+        require_opt_authed_job_read_access(
+            &db,
+            &user_db,
+            &opt_authed,
+            &w_id,
+            &id,
+            &created_by,
+            view_token.as_deref(),
+        )
+        .await?;
     }
 
     format_result(
@@ -10240,22 +10709,16 @@ async fn get_completed_job_result_maybe(
 
     if let Some(mut res) = result_o {
         format_result(res.result_columns.as_ref(), res.result.as_mut());
-        if let Some(authed) = opt_authed.as_ref() {
-            require_job_read_access(
-                &db,
-                &user_db,
-                authed,
-                &w_id,
-                &id,
-                &res.created_by,
-                view_token.as_deref(),
-            )
-            .await?;
-        } else if res.created_by != "anonymous" {
-            return Err(Error::BadRequest(
-                "As a non logged in user, you can only see jobs ran by anonymous users".to_string(),
-            ));
-        }
+        require_opt_authed_job_read_access(
+            &db,
+            &user_db,
+            &opt_authed,
+            &w_id,
+            &id,
+            &res.created_by,
+            view_token.as_deref(),
+        )
+        .await?;
 
         log_job_view(
             &db,
@@ -10286,23 +10749,16 @@ async fn get_completed_job_result_maybe(
         .fetch_optional(&db)
         .await?;
         if let Some(created_by) = created_by {
-            if let Some(authed) = opt_authed.as_ref() {
-                require_job_read_access(
-                    &db,
-                    &user_db,
-                    authed,
-                    &w_id,
-                    &id,
-                    &created_by,
-                    view_token.as_deref(),
-                )
-                .await?;
-            } else if created_by != "anonymous" {
-                return Err(Error::BadRequest(
-                    "As a non logged in user, you can only see jobs ran by anonymous users"
-                        .to_string(),
-                ));
-            }
+            require_opt_authed_job_read_access(
+                &db,
+                &user_db,
+                &opt_authed,
+                &w_id,
+                &id,
+                &created_by,
+                view_token.as_deref(),
+            )
+            .await?;
         }
         let started = sqlx::query_scalar!(
             "SELECT running AS \"running!\" FROM v2_job_queue WHERE id = $1 AND workspace_id = $2",
@@ -10376,9 +10832,8 @@ async fn get_dispatch_events(
 
     // Gate on the producer job's visibility, exactly like
     // get_completed_job_timing on the same unauthed router: scope tags
-    // first, then per-job read access for authed users, anonymous-only
-    // jobs otherwise. The dispatch_event FK to v2_job(id) guarantees the
-    // producer row exists for any extant event.
+    // first, then the shared per-audience read gate. The dispatch_event FK
+    // to v2_job(id) guarantees the producer row exists for any extant event.
     let producer = sqlx::query!(
         r#"SELECT created_by AS "created_by!"
            FROM v2_job
@@ -10391,22 +10846,16 @@ async fn get_dispatch_events(
     .await?;
     let producer = not_found_if_none(producer, "Job", id.to_string())?;
 
-    if let Some(authed) = opt_authed.as_ref() {
-        require_job_read_access(
-            &db,
-            &user_db,
-            authed,
-            &w_id,
-            &id,
-            &producer.created_by,
-            view_token.as_deref(),
-        )
-        .await?;
-    } else if producer.created_by != "anonymous" {
-        return Err(Error::BadRequest(
-            "As a non logged in user, you can only see jobs ran by anonymous users".to_string(),
-        ));
-    }
+    require_opt_authed_job_read_access(
+        &db,
+        &user_db,
+        &opt_authed,
+        &w_id,
+        &id,
+        &producer.created_by,
+        view_token.as_deref(),
+    )
+    .await?;
 
     let rows = sqlx::query!(
         r#"SELECT
@@ -10559,22 +11008,16 @@ async fn get_completed_job_timing(
 
     let result = not_found_if_none(result, "Completed Job", id.to_string())?;
 
-    if let Some(authed) = opt_authed.as_ref() {
-        require_job_read_access(
-            &db,
-            &user_db,
-            authed,
-            &w_id,
-            &id,
-            &result.created_by,
-            view_token.as_deref(),
-        )
-        .await?;
-    } else if result.created_by != "anonymous" {
-        return Err(Error::BadRequest(
-            "As a non logged in user, you can only see jobs ran by anonymous users".to_string(),
-        ));
-    }
+    require_opt_authed_job_read_access(
+        &db,
+        &user_db,
+        &opt_authed,
+        &w_id,
+        &id,
+        &result.created_by,
+        view_token.as_deref(),
+    )
+    .await?;
 
     Ok(Json(JobTiming {
         created_at: result.created_at,
@@ -10869,23 +11312,16 @@ async fn get_otel_traces(
 
     match job {
         Some(created_by) => {
-            if let Some(authed) = opt_authed.as_ref() {
-                require_job_read_access(
-                    &db,
-                    &user_db,
-                    authed,
-                    &w_id,
-                    &id,
-                    &created_by,
-                    view_token.as_deref(),
-                )
-                .await?;
-            } else if created_by != "anonymous" {
-                return Err(Error::BadRequest(
-                    "As a non logged in user, you can only see jobs ran by anonymous users"
-                        .to_string(),
-                ));
-            }
+            require_opt_authed_job_read_access(
+                &db,
+                &user_db,
+                &opt_authed,
+                &w_id,
+                &id,
+                &created_by,
+                view_token.as_deref(),
+            )
+            .await?;
         }
         None => {
             return Err(Error::NotFound(format!("Job {} not found", id)));
@@ -10938,6 +11374,8 @@ mod approval_view_gate_tests {
             folders: vec![],
             scopes: None,
             username_override: None,
+            username_override_is_token_label: false,
+            is_session_token: false,
             token_prefix: None,
             read_only: false,
         }
diff --git a/backend/windmill-api/src/lib.rs b/backend/windmill-api/src/lib.rs
index f4d30cbd77..e67420c53c 100644
--- a/backend/windmill-api/src/lib.rs
+++ b/backend/windmill-api/src/lib.rs
@@ -68,6 +68,7 @@ use windmill_common::error::AppError;
 mod ai;
 mod ai_skills;
 mod apps;
+mod apps_raw_bundle;
 pub use apps::invalidate_app_policy_cache;
 pub mod args;
 mod audit;
@@ -79,6 +80,7 @@ mod capture;
 mod concurrency_groups;
 mod db;
 mod db_health;
+mod dbt;
 mod docs;
 mod drafts;
 
@@ -105,6 +107,10 @@ mod runnables;
 #[cfg(all(feature = "private", feature = "parquet"))]
 pub mod s3_proxy_ee;
 mod s3_proxy_oss;
+#[cfg(all(feature = "private", feature = "parquet"))]
+pub mod storage_list_ee;
+#[cfg(feature = "parquet")]
+mod storage_list_oss;
 mod workspace_dependencies;
 
 mod approvals;
@@ -256,6 +262,24 @@ pub async fn add_webhook_allowed_origin(
     next.run(req).await
 }
 
+/// Scope the request in the deploy origin it declares, so the fork tally can tell
+/// a write applied by a sync from one authored in the workspace. Entered for
+/// every request, including unmarked ones: `deploy_origin::current` reads the
+/// scope's presence as "the caller is serving this write", which is what
+/// separates a request from a worker that tallies someone else's.
+async fn set_deploy_origin(
+    req: axum::extract::Request,
+    next: axum::middleware::Next,
+) -> axum::response::Response {
+    let origin = req
+        .headers()
+        .get(windmill_common::deploy_origin::DEPLOY_ORIGIN_HEADER)
+        .and_then(|v| v.to_str().ok())
+        .map(windmill_common::deploy_origin::DeployOrigin::from_header_value)
+        .unwrap_or(windmill_common::deploy_origin::DeployOrigin::Authored);
+    windmill_common::deploy_origin::scope(origin, next.run(req)).await
+}
+
 #[cfg(not(feature = "tantivy"))]
 type IndexReader = ();
 
@@ -328,6 +352,8 @@ async fn inject_agent_authed(
                 folders: Vec::new(),
                 scopes: None,
                 username_override: None,
+                username_override_is_token_label: false,
+                is_session_token: false,
                 token_prefix: None,
                 read_only: false,
             },
@@ -398,6 +424,27 @@ pub async fn run_server(
         .allow_headers([http::header::CONTENT_TYPE, http::header::AUTHORIZATION])
         .allow_origin(Any);
 
+    // MCP carries protocol state in its own headers: `MCP-Protocol-Version` from
+    // revision 2025-06-18 onward, plus `Mcp-Method` and `Mcp-Name` at 2026-07-28.
+    // None of them are CORS-simple, so a browser-based MCP client fails preflight
+    // unless they are allowed — hence a separate layer rather than widening the
+    // one every other route shares. (`Mcp-Param-*` is only sent for tool inputs
+    // annotated with `x-mcp-header`, which no tool here declares.)
+    let mcp_cors = CorsLayer::new()
+        .allow_methods([http::Method::GET, http::Method::POST, http::Method::DELETE])
+        .allow_headers([
+            http::header::CONTENT_TYPE,
+            http::header::AUTHORIZATION,
+            http::HeaderName::from_static("mcp-protocol-version"),
+            http::HeaderName::from_static("mcp-method"),
+            http::HeaderName::from_static("mcp-name"),
+        ])
+        // The 401 challenge is how a client discovers where to authorize (RFC 9728),
+        // and it is not a safelisted response header, so without this a browser
+        // client sees an empty one and has no way to begin the OAuth flow.
+        .expose_headers([http::header::WWW_AUTHENTICATE])
+        .allow_origin(Any);
+
     let sp_extension = Arc::new(saml_oss::build_sp_extension().await?);
 
     if server_mode {
@@ -568,6 +615,7 @@ pub async fn run_server(
                             "/concurrency_groups",
                             concurrency_groups::workspaced_service(),
                         )
+                        .nest("/dbt", dbt::workspaced_service())
                         .nest("/drafts", drafts::workspaced_service())
                         .nest("/embeddings", embeddings::workspaced_service())
                         .nest("/favorites", favorite::workspaced_service())
@@ -655,7 +703,14 @@ pub async fn run_server(
                                 .layer(Extension(argon2.clone()))
                                 .layer(cors.clone()),
                         )
-                        .nest("/variables", variables::workspaced_service())
+                        // CORS so a sandboxed raw app's opaque-origin bundle can
+                        // read variables with its frontend SDK token. Bearer-only:
+                        // the layer never allows credentials, so no cookie can ride
+                        // a cross-origin call. Consistent with resources/users.
+                        .nest(
+                            "/variables",
+                            variables::workspaced_service().layer(cors.clone()),
+                        )
                         .nest("/volumes", volumes_oss::workspaced_service())
                         .nest("/workers", windmill_api_workers::workspaced_service())
                         .nest("/workspaces", workspaces::workspaced_service())
@@ -786,13 +841,13 @@ pub async fn run_server(
                 // Deprecated, here for backwards compatibility: user should use /mcp/w/{workspace_id}/mcp instead
                 .nest(
                     "/mcp/w/{workspace_id}/sse",
-                    mcp_router.clone().layer(cors.clone()),
+                    mcp_router.clone().layer(mcp_cors.clone()),
                 )
                 .nest(
                     "/mcp/w/{workspace_id}/mcp",
-                    mcp_router.clone().layer(cors.clone()),
+                    mcp_router.clone().layer(mcp_cors.clone()),
                 )
-                .nest("/mcp/gateway", gateway_mcp_router.layer(cors.clone()))
+                .nest("/mcp/gateway", gateway_mcp_router.layer(mcp_cors.clone()))
                 .nest("/agent_workers", {
                     #[cfg(feature = "agent_worker_server")]
                     {
@@ -1079,6 +1134,8 @@ pub async fn run_server(
         tracing_init::log_context_middleware,
     ));
 
+    let app = app.layer(axum::middleware::from_fn(set_deploy_origin));
+
     let app = app.layer(CatchPanicLayer::custom(|err| {
         tracing::error!("panic in handler, returning 500: {:?}", err);
         Response::builder()
diff --git a/backend/windmill-api/src/mcp/auto_generated_endpoints.rs b/backend/windmill-api/src/mcp/auto_generated_endpoints.rs
index 71becbf9c3..937ae32bf8 100644
--- a/backend/windmill-api/src/mcp/auto_generated_endpoints.rs
+++ b/backend/windmill-api/src/mcp/auto_generated_endpoints.rs
@@ -701,7 +701,7 @@ Creates a new version of an existing script when called with the same path and t
                 },
                 "language": {
                         "type": "string",
-                        "description": "Possible values: python3, deno, go, bash, powershell, postgresql, mysql, bigquery, snowflake, mssql, oracledb, graphql, nativets, bun, php, rust, ansible, csharp, nu, java, ruby, rlang, duckdb, bunnative"
+                        "description": "Possible values: python3, deno, go, bash, powershell, postgresql, mysql, bigquery, snowflake, mssql, oracledb, graphql, nativets, bun, php, rust, ansible, csharp, nu, java, ruby, rlang, duckdb, bunnative, dbt"
                 },
                 "kind": {
                         "type": "string",
@@ -1073,11 +1073,62 @@ Creates a new version of an existing script when called with the same path and t
         query_field_renames: None,
         body_field_renames: None,
     },
+    EndpointTool {
+        name: Cow::Borrowed("listApps"),
+        description: Cow::Borrowed("list all apps"),
+        instructions: Cow::Borrowed("Lists every app, low-code and full-code alike. `raw_app` tells them apart: true is a full-code app, which getAppByPath then reads and updateApp deploys. An app with no `raw_app` field is low-code — the field is omitted rather than sent as false. A low-code app can only be read here — editing one is a job for its editor in the UI."),
+        path: Cow::Borrowed("/w/{workspace}/apps/list"),
+        method: Cow::Borrowed("GET"),
+        path_params_schema: None,
+        query_params_schema: Some(serde_json::json!({
+        "type": "object",
+        "properties": {
+                "page": {
+                        "type": "integer",
+                        "description": "which page to return (start at 1, default 1)"
+                },
+                "per_page": {
+                        "type": "integer",
+                        "description": "number of items to return for a given page (default 30, max 100)"
+                },
+                "path_start": {
+                        "type": "string",
+                        "description": "mask to filter matching starting path"
+                }
+        },
+        "required": []
+})),
+        body_schema: None,
+        query_field_renames: None,
+        body_field_renames: None,
+    },
+    EndpointTool {
+        name: Cow::Borrowed("getAppByPath"),
+        description: Cow::Borrowed("get app by path"),
+        instructions: Cow::Borrowed("Returns the app's whole `value`, which is what updateApp needs: it takes the whole thing, not a patch. A big enough app is truncated by the tool-result limit; sending that back fails the build rather than deploying something partial, so edit those in the app editor or with the CLI. `raw_app` says whether this is a full-code app (its value holds `files`/`runnables`) or a low-code one (a `grid`), and only a full-code app can be deployed through MCP."),
+        path: Cow::Borrowed("/w/{workspace}/apps/get/p/{path}"),
+        method: Cow::Borrowed("GET"),
+        path_params_schema: Some(serde_json::json!({
+        "type": "object",
+        "properties": {
+                "path": {
+                        "type": "string"
+                }
+        },
+        "required": [
+                "path"
+        ]
+})),
+        query_params_schema: None,
+        body_schema: None,
+        query_field_renames: None,
+        body_field_renames: None,
+    },
     EndpointTool {
         name: Cow::Borrowed("createApp"),
-        description: Cow::Borrowed("create app"),
-        instructions: Cow::Borrowed(""),
-        path: Cow::Borrowed("/w/{workspace}/apps/create"),
+        description: Cow::Borrowed("create a raw app from its sources, compiling them on a worker (which runs the app's own dependencies to do so)"),
+        instructions: Cow::Borrowed("Creates a raw (full-code) app: `value.files` holds its sources, keyed by path (`/index.tsx`, `/App.tsx`, `/package.json`), and needs an entry point (`/index.tsx`, `/index.ts` or `/index.js`). The sources are compiled on a worker by the same build the editor and the CLI run, so a compile error comes back as the error of this call. Compiling runs the app's own dependencies on a worker, so this tool can execute code there. Low-code apps are legacy and have no MCP tool at all — they are built in their editor."),
+        path: Cow::Borrowed("/w/{workspace}/apps/create_raw_source"),
         method: Cow::Borrowed("POST"),
         path_params_schema: None,
         query_params_schema: None,
@@ -1087,17 +1138,87 @@ Creates a new version of an existing script when called with the same path and t
                 "path": {
                         "type": "string"
                 },
-                "value": {
-                        "type": "object"
-                },
                 "summary": {
                         "type": "string"
                 },
-                "policy": {
-                        "type": "object"
+                "value": {
+                        "type": "object",
+                        "description": "The raw app's value. `files` maps each source path to its content and must contain an entry point; `runnables` and `data` are carried through unchanged.",
+                        "properties": {
+                                "files": {
+                                        "type": "object",
+                                        "additionalProperties": {
+                                                "type": "string"
+                                        }
+                                },
+                                "runnables": {
+                                        "type": "object"
+                                },
+                                "data": {
+                                        "type": "object"
+                                }
+                        },
+                        "required": [
+                                "files"
+                        ]
                 },
-                "deployment_message": {
-                        "type": "string"
+                "policy": {
+                        "type": "object",
+                        "properties": {
+                                "triggerables": {
+                                        "type": "object",
+                                        "additionalProperties": {
+                                                "type": "object"
+                                        }
+                                },
+                                "triggerables_v2": {
+                                        "type": "object",
+                                        "additionalProperties": {
+                                                "type": "object"
+                                        }
+                                },
+                                "s3_inputs": {
+                                        "type": "array",
+                                        "items": {
+                                                "type": "object"
+                                        }
+                                },
+                                "allowed_s3_keys": {
+                                        "type": "array",
+                                        "items": {
+                                                "type": "object",
+                                                "properties": {
+                                                        "s3_path": {
+                                                                "type": "string"
+                                                        },
+                                                        "resource": {
+                                                                "type": "string"
+                                                        }
+                                                }
+                                        }
+                                },
+                                "execution_mode": {
+                                        "type": "string",
+                                        "description": "Possible values: viewer, publisher, anonymous"
+                                },
+                                "on_behalf_of": {
+                                        "type": "string"
+                                },
+                                "on_behalf_of_email": {
+                                        "type": "string"
+                                },
+                                "sandbox": {
+                                        "type": "boolean",
+                                        "description": "Publisher opt-in to app sandbox isolation (alpha). When true the app is isolated from each viewer's Windmill session. When false/absent the app runs same-origin with the viewer's full session (the default, pre-isolation behavior).\n"
+                                },
+                                "frontend_sdk_scopes": {
+                                        "type": "array",
+                                        "items": {
+                                                "type": "string"
+                                        },
+                                        "description": "Raw apps: author-declared scopes for the frontend SDK token. Takes effect only when `sandbox` is also true — an unsandboxed bundle runs with the viewer's own session, so no token is advertised or minted for it and this list stays inert. On a sandboxed app a non-empty list lets viewers mint (after consenting) a short-lived token carrying their own identity restricted to these scopes, handed to the app bundle so `windmill-client` calls run as the viewer. Must be a subset of the server's curated allowlist (jobs:run, jobs:read, users:read, resources:read, variables:read).\n"
+                                }
+                        }
                 }
         },
         "required": [
@@ -1112,9 +1233,9 @@ Creates a new version of an existing script when called with the same path and t
     },
     EndpointTool {
         name: Cow::Borrowed("updateApp"),
-        description: Cow::Borrowed("update app"),
-        instructions: Cow::Borrowed(""),
-        path: Cow::Borrowed("/w/{workspace}/apps/update/{path}"),
+        description: Cow::Borrowed("update a raw app from its sources, compiling them on a worker (which runs the app's own dependencies to do so)"),
+        instructions: Cow::Borrowed("Use this to change a raw (full-code) app — an app whose `raw_app` field is true. Send the whole `value` (`files`, `runnables`, `data`), not a patch: read the current one with getAppByPath first and edit it. The sources are compiled on a worker by the same build the editor and the CLI run, so a compile error comes back as the error of this call. Compiling runs the app's own dependencies on a worker, so this tool can execute code there. Low-code apps are legacy and have no MCP tool at all — they are edited in their editor."),
+        path: Cow::Borrowed("/w/{workspace}/apps/update_raw_source/{path}"),
         method: Cow::Borrowed("POST"),
         path_params_schema: Some(serde_json::json!({
         "type": "object",
@@ -1135,19 +1256,92 @@ Creates a new version of an existing script when called with the same path and t
                         "type": "string"
                 },
                 "value": {
-                        "type": "object"
+                        "type": "object",
+                        "description": "The raw app's value. `files` maps each source path (e.g. `/index.tsx`, `/App.tsx`, `/package.json`) to its content and must contain an entry point (`/index.tsx`, `/index.ts` or `/index.js`); `runnables` and `data` are carried through unchanged.",
+                        "properties": {
+                                "files": {
+                                        "type": "object",
+                                        "additionalProperties": {
+                                                "type": "string"
+                                        }
+                                },
+                                "runnables": {
+                                        "type": "object"
+                                },
+                                "data": {
+                                        "type": "object"
+                                }
+                        },
+                        "required": [
+                                "files"
+                        ]
                 },
                 "policy": {
-                        "type": "object"
-                },
-                "deployment_message": {
-                        "type": "string"
+                        "type": "object",
+                        "properties": {
+                                "triggerables": {
+                                        "type": "object",
+                                        "additionalProperties": {
+                                                "type": "object"
+                                        }
+                                },
+                                "triggerables_v2": {
+                                        "type": "object",
+                                        "additionalProperties": {
+                                                "type": "object"
+                                        }
+                                },
+                                "s3_inputs": {
+                                        "type": "array",
+                                        "items": {
+                                                "type": "object"
+                                        }
+                                },
+                                "allowed_s3_keys": {
+                                        "type": "array",
+                                        "items": {
+                                                "type": "object",
+                                                "properties": {
+                                                        "s3_path": {
+                                                                "type": "string"
+                                                        },
+                                                        "resource": {
+                                                                "type": "string"
+                                                        }
+                                                }
+                                        }
+                                },
+                                "execution_mode": {
+                                        "type": "string",
+                                        "description": "Possible values: viewer, publisher, anonymous"
+                                },
+                                "on_behalf_of": {
+                                        "type": "string"
+                                },
+                                "on_behalf_of_email": {
+                                        "type": "string"
+                                },
+                                "sandbox": {
+                                        "type": "boolean",
+                                        "description": "Publisher opt-in to app sandbox isolation (alpha). When true the app is isolated from each viewer's Windmill session. When false/absent the app runs same-origin with the viewer's full session (the default, pre-isolation behavior).\n"
+                                },
+                                "frontend_sdk_scopes": {
+                                        "type": "array",
+                                        "items": {
+                                                "type": "string"
+                                        },
+                                        "description": "Raw apps: author-declared scopes for the frontend SDK token. Takes effect only when `sandbox` is also true — an unsandboxed bundle runs with the viewer's own session, so no token is advertised or minted for it and this list stays inert. On a sandboxed app a non-empty list lets viewers mint (after consenting) a short-lived token carrying their own identity restricted to these scopes, handed to the app bundle so `windmill-client` calls run as the viewer. Must be a subset of the server's curated allowlist (jobs:run, jobs:read, users:read, resources:read, variables:read).\n"
+                                }
+                        }
                 },
                 "path__body": {
                         "type": "string",
                         "description": "(body parameter). Defaults to `path` when omitted; set it only to change the path."
                 }
-        }
+        },
+        "required": [
+                "value"
+        ]
 })),
         query_field_renames: None,
         body_field_renames: Some(serde_json::json!({
@@ -1210,7 +1404,7 @@ Creates a new version of an existing script when called with the same path and t
                 },
                 "language": {
                         "type": "string",
-                        "description": "Possible values: python3, deno, go, bash, powershell, postgresql, mysql, bigquery, snowflake, mssql, oracledb, graphql, nativets, bun, php, rust, ansible, csharp, nu, java, ruby, rlang, duckdb, bunnative"
+                        "description": "Possible values: python3, deno, go, bash, powershell, postgresql, mysql, bigquery, snowflake, mssql, oracledb, graphql, nativets, bun, php, rust, ansible, csharp, nu, java, ruby, rlang, duckdb, bunnative, dbt"
                 },
                 "tag": {
                         "type": "string"
@@ -1242,7 +1436,7 @@ Creates a new version of an existing script when called with the same path and t
                                         },
                                         "language": {
                                                 "type": "string",
-                                                "description": "Possible values: python3, deno, go, bash, powershell, postgresql, mysql, bigquery, snowflake, mssql, oracledb, graphql, nativets, bun, php, rust, ansible, csharp, nu, java, ruby, rlang, duckdb, bunnative"
+                                                "description": "Possible values: python3, deno, go, bash, powershell, postgresql, mysql, bigquery, snowflake, mssql, oracledb, graphql, nativets, bun, php, rust, ansible, csharp, nu, java, ruby, rlang, duckdb, bunnative, dbt"
                                         },
                                         "lock": {
                                                 "type": "string",
@@ -1521,6 +1715,10 @@ Creates a new version of an existing script when called with the same path and t
                         "type": "boolean",
                         "description": "is the job skipped"
                 },
+                "resolved": {
+                        "type": "boolean",
+                        "description": "filter on whether a failure has been marked as handled. true keeps only resolved failures, false hides them"
+                },
                 "is_flow_step": {
                         "type": "boolean",
                         "description": "is the job a flow step"
diff --git a/backend/windmill-api/src/mcp/core.rs b/backend/windmill-api/src/mcp/core.rs
index 5d78536d86..af7e22fcba 100644
--- a/backend/windmill-api/src/mcp/core.rs
+++ b/backend/windmill-api/src/mcp/core.rs
@@ -570,12 +570,24 @@ pub async fn setup_mcp_server(
     let backend = WindmillBackend::new(db, user_db, base_internal_url, auth_cache);
     let runner = Runner::new(backend);
 
-    let service_config = StreamableHttpServerConfig {
-        sse_keep_alive: Some(Duration::from_secs(15)),
-        stateful_mode: false,
-        cancellation_token: cancellation_token.clone(),
-        sse_retry: Some(Duration::from_secs(15)),
-    };
+    let service_config = StreamableHttpServerConfig::default()
+        .with_sse_keep_alive(Some(Duration::from_secs(15)))
+        .with_sse_retry(Some(Duration::from_secs(15)))
+        .with_cancellation_token(cancellation_token.clone())
+        // Sessionless: every request re-resolves auth from its own bearer token, so
+        // there is no session to bind. This also makes legacy `initialize` clients
+        // take the same stateless path as 2026-07-28 ones.
+        .with_legacy_session_mode(false)
+        // rmcp's Host allowlist defaults to localhost, which guards an unauthenticated
+        // locally-bound server against DNS rebinding. This endpoint instead sits behind
+        // Windmill's own authentication, and is reached under whatever hostname the
+        // instance is served on, so keeping that default would reject every remote MCP
+        // client while adding nothing.
+        .disable_allowed_hosts()
+        // MCP bodies are ordinary API payloads — `createApp`/`updateApp` carry whole app
+        // sources — so they follow the instance's request size limit rather than rmcp's
+        // much smaller default, which would 413 them with no way to raise it.
+        .with_max_request_body_bytes(*crate::REQUEST_SIZE_LIMIT.read().await);
 
     let service =
         StreamableHttpService::new(move || Ok(runner.clone()), session_manager, service_config);
diff --git a/backend/windmill-api/src/mcp/utils.rs b/backend/windmill-api/src/mcp/utils.rs
index d68afe826d..3af0498ff3 100644
--- a/backend/windmill-api/src/mcp/utils.rs
+++ b/backend/windmill-api/src/mcp/utils.rs
@@ -551,7 +551,57 @@ fn jwt_scopes_for_proxied_route(
                 None,
             )
         })?;
-    Ok(Some(vec![scope]))
+    let mut scopes = vec![scope];
+    if let Some((tool, extras)) = extra_scopes_for_route(route_path) {
+        // Only when the token names this tool. `mcp:all` and `mcp:favorites` reach
+        // every endpoint without naming any, and they are the create-token and
+        // OAuth defaults — a token whose consent screen talks about scripts and
+        // flows must not come with this.
+        if caller_scopes.is_some_and(|s| selects_endpoint_tool(s, tool)) {
+            scopes.extend(extras.iter().map(|s| (*s).to_string()));
+        }
+    }
+    Ok(Some(scopes))
+}
+
+/// The tool a route belongs to and the scopes its handler requires beyond the
+/// one the route's own domain implies, added to the JWT minted for that single
+/// proxied request.
+///
+/// Minting is what keeps the grant *confined*: the JWT is built here and handed
+/// to the internal request, never to the client, so the MCP token itself stays
+/// `mcp:`-only and can't reach `/jobs/run/preview`. Putting the scope on the
+/// token instead would widen every request it makes, which is a far larger grant
+/// than the tool needs.
+fn extra_scopes_for_route(route_path: &str) -> Option<(&'static str, &'static [&'static str])> {
+    // Matched on segments: a runnable path is caller-chosen and can contain
+    // anything, so a script called `f/apps/update_raw_source/x` must not decide
+    // what its own request is minted.
+    let mut segments = route_path.split('/').skip_while(|s| *s != "w");
+    let (_, _ws) = (segments.next()?, segments.next()?);
+    if segments.next() != Some("apps") {
+        return None;
+    }
+    // Both deploy an app by compiling its sources, which runs the app's own
+    // dependencies on a worker — a token reaches that only by naming the tool.
+    // The names are the ones agents see (`x-mcp-tool-name`), not the operation ids.
+    //
+    // They are deliberately the names the retired low-code tools used, so a token
+    // issued before that switch reaches these instead — an accepted upgrade, not
+    // an oversight: MCP has one pair of app-write tools and they are these.
+    match segments.next() {
+        Some("create_raw_source") => Some(("createApp", &["jobs:run"])),
+        Some("update_raw_source") => Some(("updateApp", &["jobs:run"])),
+        _ => None,
+    }
+}
+
+/// Whether the token names `tool` rather than reaching it through a blanket
+/// grant. Parsed by `windmill-mcp`, which owns the scope grammar; `mcp:all` and
+/// `mcp:favorites` yield `*` or nothing, neither of which names a tool.
+fn selects_endpoint_tool(caller_scopes: &[String], tool: &str) -> bool {
+    windmill_mcp::common::scope::parse_mcp_scopes(caller_scopes)
+        .is_ok_and(|config| config.endpoints.iter().any(|e| e == tool))
 }
 
 /// Create HTTP request with authentication
@@ -668,6 +718,60 @@ mod tests {
         );
     }
 
+    #[test]
+    fn proxy_jwt_raw_app_create_needs_the_tool_named() {
+        // Same as the update route: creating an app compiles its sources too.
+        let route = "/api/w/ws/apps/create_raw_source";
+        let named = scopes(&["mcp:endpoints:createApp"]);
+        assert_eq!(
+            jwt_scopes_for_proxied_route(Some(&named), "POST", route).unwrap(),
+            Some(scopes(&["apps:write", "jobs:run"]))
+        );
+        let implicit = scopes(&["mcp:all"]);
+        assert_eq!(
+            jwt_scopes_for_proxied_route(Some(&implicit), "POST", route).unwrap(),
+            Some(scopes(&["apps:write"]))
+        );
+    }
+
+    #[test]
+    fn proxy_jwt_raw_app_source_deploy_needs_the_tool_named() {
+        // The handler requires jobs:run as well: compiling an app's sources runs
+        // its dependencies on a worker. It goes in the per-request JWT, not on the
+        // token — the token stays mcp:-only and so can't reach /jobs/run/preview —
+        // and only for a token that named this tool. The defaults (mcp:favorites
+        // on create, mcp:all through OAuth) reach every endpoint without naming
+        // one, and must not carry a capability their consent screen never showed.
+        let route = "/api/w/ws/apps/update_raw_source/u/admin/app";
+        let named = scopes(&["mcp:endpoints:listScripts,updateApp"]);
+        assert_eq!(
+            jwt_scopes_for_proxied_route(Some(&named), "POST", route).unwrap(),
+            Some(scopes(&["apps:write", "jobs:run"]))
+        );
+        for implicit in [
+            scopes(&["mcp:all"]),
+            scopes(&["mcp:favorites"]),
+            scopes(&["mcp:endpoints:*"]),
+        ] {
+            assert_eq!(
+                jwt_scopes_for_proxied_route(Some(&implicit), "POST", route).unwrap(),
+                Some(scopes(&["apps:write"])),
+                "a token that never named the tool must not get jobs:run"
+            );
+        }
+        // A runnable path is caller-chosen, so it must not select the extras of a
+        // route it merely spells out.
+        assert_eq!(
+            jwt_scopes_for_proxied_route(
+                Some(&named),
+                "POST",
+                "/api/w/ws/jobs/run/p/f/apps/update_raw_source/x"
+            )
+            .unwrap(),
+            Some(scopes(&["jobs:run:scripts"]))
+        );
+    }
+
     #[test]
     fn proxy_jwt_mixed_token_passes_through_caller_route_scope() {
         // The caller's route scope is preserved so the target handler's per-path
diff --git a/backend/windmill-api/src/offboarding.rs b/backend/windmill-api/src/offboarding.rs
index f9bf0e1449..f7f5831d0f 100644
--- a/backend/windmill-api/src/offboarding.rs
+++ b/backend/windmill-api/src/offboarding.rs
@@ -133,6 +133,10 @@ async fn get_offboard_preview(
 ) -> Result<OffboardPreview> {
     let user_prefix = format!("u/{}/%", username);
     let user_owner = format!("u/{}", username);
+    // Same form the mutation reassigns, so preview and execution cannot disagree. `usr.username`
+    // is constrained to `[\w-]+`, so a member is always named `u/{username}` — the address form a
+    // principal can also take names an account with no `usr` row, which is nobody offboardable.
+    let departing = windmill_common::users::username_to_permissioned_as(username);
 
     // ---- Owned objects (under u/{username}/) ----
     let scripts = sqlx::query_scalar!(
@@ -228,13 +232,13 @@ async fn get_offboard_preview(
 
     // ---- Operator references (not under user's path) ----
     let obo_scripts = sqlx::query_scalar!(
-        "SELECT path FROM script WHERE on_behalf_of_email = $1 AND NOT path LIKE $2 AND workspace_id = $3 AND NOT archived AND NOT deleted",
-        email, &user_prefix, w_id
+        "SELECT path FROM script WHERE on_behalf_of = $1 AND NOT path LIKE $2 AND workspace_id = $3 AND NOT archived AND NOT deleted",
+        &departing, &user_prefix, w_id
     ).fetch_all(db).await?;
 
     let obo_flows = sqlx::query_scalar!(
-        "SELECT path FROM flow WHERE on_behalf_of_email = $1 AND NOT path LIKE $2 AND workspace_id = $3 AND NOT archived",
-        email, &user_prefix, w_id
+        "SELECT path FROM flow WHERE on_behalf_of = $1 AND NOT path LIKE $2 AND workspace_id = $3 AND NOT archived",
+        &departing, &user_prefix, w_id
     ).fetch_all(db).await?;
 
     let obo_apps = sqlx::query_scalar!(
@@ -407,7 +411,6 @@ pub(crate) async fn offboard_workspace_user(
         &db,
         &w_id,
         &username,
-        &email,
         &req.reassign_to,
         &new_permissioned_as,
     )
@@ -563,7 +566,6 @@ pub(crate) async fn offboard_global_user(
                 &db,
                 &ws.workspace_id,
                 &ws.username,
-                &email,
                 &reassignment.reassign_to,
                 perm_as,
             )
@@ -798,14 +800,15 @@ async fn offboard_user_from_workspace<'c>(
     db: &DB,
     w_id: &str,
     username: &str,
-    email: &str,
     reassign_to: &str,
     new_permissioned_as: &str,
 ) -> Result<OffboardSummary> {
     let new_prefix = reassign_to.to_string();
+    let departing = windmill_common::users::username_to_permissioned_as(username);
 
-    // Resolve the new operator's email for on_behalf_of_email on scripts/flows/apps.
-    // resolve_new_permissioned_as already validated the user exists, and usr.email is NOT NULL.
+    // The app policy stores an address beside its principal, and script/flow keep one for the
+    // workers that still read it, so the replacement's is resolved here.
+    // resolve_new_permissioned_as already validated the user exists.
     let new_on_behalf_of_user_username = new_permissioned_as
         .strip_prefix("u/")
         .unwrap_or(new_permissioned_as);
@@ -839,10 +842,11 @@ async fn offboard_user_from_workspace<'c>(
     .unwrap_or(0);
 
     sqlx::query!(
-        "UPDATE script SET on_behalf_of_email = $1 WHERE on_behalf_of_email = $2 AND workspace_id = $3",
-        new_on_behalf_of_user_email,
-        email,
-        w_id
+        "UPDATE script SET on_behalf_of = $1, on_behalf_of_email = $4 WHERE on_behalf_of = $2 AND workspace_id = $3",
+        new_permissioned_as,
+        &departing,
+        w_id,
+        new_on_behalf_of_user_email
     )
     .execute(&mut **tx)
     .await?;
@@ -851,8 +855,8 @@ async fn offboard_user_from_workspace<'c>(
     let flows_reassigned = sqlx::query_scalar!(
         r#"WITH inserted AS (
             INSERT INTO flow
-                (workspace_id, path, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, labels, lock_error_logs)
-            SELECT workspace_id, REGEXP_REPLACE(path, 'u/' || $2 || '/(.*)', $1 || '/\1'), summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, labels, lock_error_logs
+                (workspace_id, path, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, labels, lock_error_logs)
+            SELECT workspace_id, REGEXP_REPLACE(path, 'u/' || $2 || '/(.*)', $1 || '/\1'), summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, labels, lock_error_logs
                 FROM flow
                 WHERE path LIKE ('u/' || $2 || '/%') AND workspace_id = $3
             RETURNING 1
@@ -879,10 +883,24 @@ async fn offboard_user_from_workspace<'c>(
     .await?;
 
     sqlx::query!(
-        "UPDATE flow SET on_behalf_of_email = $1 WHERE on_behalf_of_email = $2 AND workspace_id = $3",
-        new_on_behalf_of_user_email,
-        email,
-        w_id
+        "UPDATE flow SET on_behalf_of = $1, on_behalf_of_email = $4 WHERE on_behalf_of = $2 AND workspace_id = $3",
+        new_permissioned_as,
+        &departing,
+        w_id,
+        new_on_behalf_of_user_email
+    )
+    .execute(&mut **tx)
+    .await?;
+
+    // Drafts hold both halves in their value and are not confined to the offboarded user's
+    // paths, so a draft on a shared path would keep running as them. Both are rewritten:
+    // `deployDraft` sends the pair, and one naming two people is rejected.
+    sqlx::query!(
+        r#"UPDATE draft SET value = to_json(jsonb_set(jsonb_set(to_jsonb(value), ARRAY['on_behalf_of'], to_jsonb($1::text)), ARRAY['on_behalf_of_email'], to_jsonb($4::text))) WHERE typ IN ('script', 'flow') AND value->>'on_behalf_of' = $2 AND workspace_id = $3"#,
+        new_permissioned_as,
+        &departing,
+        w_id,
+        new_on_behalf_of_user_email
     )
     .execute(&mut **tx)
     .await?;
diff --git a/backend/windmill-api/src/storage_list_oss.rs b/backend/windmill-api/src/storage_list_oss.rs
new file mode 100644
index 0000000000..326071d41f
--- /dev/null
+++ b/backend/windmill-api/src/storage_list_oss.rs
@@ -0,0 +1,6 @@
+// OSS stub for paged object storage listing
+// The actual implementation is in storage_list_ee.rs (Enterprise Edition)
+
+#[cfg(all(feature = "private", feature = "parquet"))]
+#[allow(unused)]
+pub use crate::storage_list_ee::*;
diff --git a/backend/windmill-api/src/token.rs b/backend/windmill-api/src/token.rs
index c7229fe056..acb65d6cf0 100644
--- a/backend/windmill-api/src/token.rs
+++ b/backend/windmill-api/src/token.rs
@@ -143,14 +143,8 @@ fn build_standard_scope_domains() -> Vec<ScopeDomain> {
 
     STANDARD_DOMAINS
         .iter()
-        .map(|(key, name, desc, req)| ScopeDomain {
-            name: name.to_string(),
-            description: if desc.is_empty() {
-                None
-            } else {
-                Some(desc.to_string())
-            },
-            scopes: vec![
+        .map(|(key, name, desc, req)| {
+            let mut scopes = vec![
                 ScopeOption {
                     value: format!("{key}:read"),
                     label: "Read".to_string(),
@@ -161,7 +155,26 @@ fn build_standard_scope_domains() -> Vec<ScopeDomain> {
                     label: "Write".to_string(),
                     requires_resource_path: *req,
                 },
-            ],
+            ];
+            // `apps_u/execute_component` and `apps_u/upload_s3_file` are classified as
+            // Run actions, so running a deployed app's components needs `apps:run`:
+            // without it here no supported token can be granted that access.
+            if *key == "apps" {
+                scopes.push(ScopeOption {
+                    value: "apps:run".to_string(),
+                    label: "Run".to_string(),
+                    requires_resource_path: *req,
+                });
+            }
+            ScopeDomain {
+                name: name.to_string(),
+                description: if desc.is_empty() {
+                    None
+                } else {
+                    Some(desc.to_string())
+                },
+                scopes,
+            }
         })
         .collect()
 }
@@ -258,6 +271,22 @@ mod tests {
         assert!(!values.contains(&"docs:write"), "docs has no write surface");
     }
 
+    /// Running a deployed app's components is enforced as a Run action, so `apps:run`
+    /// must be selectable here or no supported token can be granted that access.
+    #[test]
+    fn apps_run_scope_is_exposed_and_path_selectable() {
+        let apps = ALL_SCOPES
+            .iter()
+            .find(|d| d.name == "Apps")
+            .expect("Apps domain must exist");
+        let opt = apps
+            .scopes
+            .iter()
+            .find(|s| s.value == "apps:run")
+            .expect("apps:run must be selectable");
+        assert!(opt.requires_resource_path, "apps:run is path-scoped");
+    }
+
     /// The `data_metrics` route enforces its own scope domain, so `data_metrics:read`
     /// must be grantable here or no token can ever reach it. It is read-only (the
     /// catalog is written at deploy) and path-selectable.
diff --git a/backend/windmill-api/src/tracing_init.rs b/backend/windmill-api/src/tracing_init.rs
index 09a3e5565e..56adeee184 100644
--- a/backend/windmill-api/src/tracing_init.rs
+++ b/backend/windmill-api/src/tracing_init.rs
@@ -79,7 +79,11 @@ impl<B> MakeSpan<B> for MyMakeSpan {
             .get(TRACING_HEADER.as_str())
             .and_then(|x| x.to_str().map(|x| x.to_string()).ok())
             .unwrap_or(Uuid::new_v4().to_string());
-        tracing::info_span!(
+        // ERROR level, not INFO: a span is only recorded by a layer whose filter
+        // enables it, so under RUST_LOG=error/warn an INFO span is dropped and the
+        // 4xx/5xx `response` events in `MyOnResponse` print with no uri, method or
+        // traceId.
+        tracing::error_span!(
             "request",
             method = %request.method(),
             uri = %request.uri(),
diff --git a/backend/windmill-api/src/triggers/handler.rs b/backend/windmill-api/src/triggers/handler.rs
index d86912d8d0..235e178609 100644
--- a/backend/windmill-api/src/triggers/handler.rs
+++ b/backend/windmill-api/src/triggers/handler.rs
@@ -187,14 +187,18 @@ pub async fn get_triggers_count_internal(
     .await?
     .unwrap_or(0);
 
+    // These counts are independent reads: they share a connection to avoid one acquire
+    // per trigger kind, but must not share a transaction. A single failing count would
+    // abort it and, since `trigger_count` falls back to 0 on error, silently zero every
+    // count after it.
     #[allow(unused)]
-    let mut tx = db.begin().await?;
+    let mut conn = db.acquire().await?;
 
     #[cfg(feature = "http_trigger")]
     let http_routes_count = {
         use crate::triggers::http::HttpTrigger;
         let count = HttpTrigger
-            .trigger_count(&mut tx, w_id, is_flow, path)
+            .trigger_count(&mut conn, w_id, is_flow, path)
             .await;
         count
     };
@@ -205,7 +209,7 @@ pub async fn get_triggers_count_internal(
     let websocket_count = {
         use crate::triggers::websocket::WebsocketTrigger;
         let count = WebsocketTrigger
-            .trigger_count(&mut tx, w_id, is_flow, path)
+            .trigger_count(&mut conn, w_id, is_flow, path)
             .await;
         count
     };
@@ -216,7 +220,7 @@ pub async fn get_triggers_count_internal(
     let kafka_count = {
         use crate::triggers::kafka::KafkaTrigger;
         let count = KafkaTrigger
-            .trigger_count(&mut tx, w_id, is_flow, path)
+            .trigger_count(&mut conn, w_id, is_flow, path)
             .await;
         count
     };
@@ -227,7 +231,7 @@ pub async fn get_triggers_count_internal(
     let nats_count = {
         use crate::triggers::nats::NatsTrigger;
         let count = NatsTrigger
-            .trigger_count(&mut tx, w_id, is_flow, path)
+            .trigger_count(&mut conn, w_id, is_flow, path)
             .await;
         count
     };
@@ -238,7 +242,7 @@ pub async fn get_triggers_count_internal(
     let postgres_count = {
         use crate::triggers::postgres::PostgresTrigger;
         let count = PostgresTrigger
-            .trigger_count(&mut tx, w_id, is_flow, path)
+            .trigger_count(&mut conn, w_id, is_flow, path)
             .await;
         count
     };
@@ -249,7 +253,7 @@ pub async fn get_triggers_count_internal(
     let mqtt_count = {
         use crate::triggers::mqtt::MqttTrigger;
         let count = MqttTrigger
-            .trigger_count(&mut tx, w_id, is_flow, path)
+            .trigger_count(&mut conn, w_id, is_flow, path)
             .await;
         count
     };
@@ -260,7 +264,7 @@ pub async fn get_triggers_count_internal(
     let amqp_count = {
         use crate::triggers::amqp::AmqpTrigger;
         let count = AmqpTrigger
-            .trigger_count(&mut tx, w_id, is_flow, path)
+            .trigger_count(&mut conn, w_id, is_flow, path)
             .await;
         count
     };
@@ -270,7 +274,9 @@ pub async fn get_triggers_count_internal(
     #[cfg(all(feature = "sqs_trigger", feature = "enterprise", feature = "private"))]
     let sqs_count = {
         use crate::triggers::sqs::SqsTrigger;
-        let count = SqsTrigger.trigger_count(&mut tx, w_id, is_flow, path).await;
+        let count = SqsTrigger
+            .trigger_count(&mut conn, w_id, is_flow, path)
+            .await;
         count
     };
     #[cfg(not(all(feature = "sqs_trigger", feature = "enterprise", feature = "private")))]
@@ -279,7 +285,9 @@ pub async fn get_triggers_count_internal(
     #[cfg(all(feature = "gcp_trigger", feature = "enterprise", feature = "private"))]
     let gcp_count = {
         use crate::triggers::gcp::GcpTrigger;
-        let count = GcpTrigger.trigger_count(&mut tx, w_id, is_flow, path).await;
+        let count = GcpTrigger
+            .trigger_count(&mut conn, w_id, is_flow, path)
+            .await;
         count
     };
     #[cfg(not(all(feature = "gcp_trigger", feature = "enterprise", feature = "private")))]
@@ -289,7 +297,7 @@ pub async fn get_triggers_count_internal(
     let azure_count = {
         use crate::triggers::azure::AzureTrigger;
         let count = AzureTrigger
-            .trigger_count(&mut tx, w_id, is_flow, path)
+            .trigger_count(&mut conn, w_id, is_flow, path)
             .await;
         count
     };
@@ -300,14 +308,14 @@ pub async fn get_triggers_count_internal(
     let email_count = {
         use crate::triggers::email::EmailTrigger;
         let count = EmailTrigger
-            .trigger_count(&mut tx, w_id, is_flow, path)
+            .trigger_count(&mut conn, w_id, is_flow, path)
             .await;
         count
     };
     #[cfg(not(all(feature = "smtp", feature = "enterprise", feature = "private")))]
     let email_count = 0;
 
-    tx.commit().await?;
+    drop(conn);
 
     let webhook_count = (if is_flow {
         sqlx::query_scalar!(
diff --git a/backend/windmill-api/src/triggers/http/handler.rs b/backend/windmill-api/src/triggers/http/handler.rs
index 0508586182..44cff6566a 100644
--- a/backend/windmill-api/src/triggers/http/handler.rs
+++ b/backend/windmill-api/src/triggers/http/handler.rs
@@ -579,6 +579,7 @@ async fn route_job(
                 None,
                 early_return,
                 has_failure_module,
+                false,
             );
 
             let body = axum::body::Body::from_stream(
diff --git a/backend/windmill-api/src/users.rs b/backend/windmill-api/src/users.rs
index 36b0d6c734..3ac80d6b00 100644
--- a/backend/windmill-api/src/users.rs
+++ b/backend/windmill-api/src/users.rs
@@ -462,11 +462,25 @@ async fn update_username_in_workpsace<'c>(
     .execute(&mut **tx)
     .await?;
 
+    // Canonicalised through `username_to_permissioned_as`, not `'u/' || name`: an
+    // email-shaped username is stored bare, so the prefixed form would miss those rows and
+    // leave them naming a user that no longer exists.
+    let old_principal = windmill_common::users::username_to_permissioned_as(old_username);
+    let new_principal = windmill_common::users::username_to_permissioned_as(new_username);
+    sqlx::query!(
+        "UPDATE script SET on_behalf_of = $1 WHERE on_behalf_of = $2 AND workspace_id = $3",
+        &new_principal,
+        &old_principal,
+        w_id
+    )
+    .execute(&mut **tx)
+    .await?;
+
     // ---- flows ----
     sqlx::query!(
         r#"INSERT INTO flow
-            (workspace_id, path, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at)
-        SELECT workspace_id, REGEXP_REPLACE(path,'u/' || $2 || '/(.*)','u/' || $1 || '/\1'), summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at
+            (workspace_id, path, summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at)
+        SELECT workspace_id, REGEXP_REPLACE(path,'u/' || $2 || '/(.*)','u/' || $1 || '/\1'), summary, description, archived, extra_perms, dependency_job, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at
             FROM flow
             WHERE path LIKE ('u/' || $2 || '/%') AND workspace_id = $3"#,
         new_username,
@@ -543,6 +557,15 @@ async fn update_username_in_workpsace<'c>(
     .execute(&mut **tx)
     .await?;
 
+    sqlx::query!(
+        "UPDATE flow SET on_behalf_of = $1 WHERE on_behalf_of = $2 AND workspace_id = $3",
+        &new_principal,
+        &old_principal,
+        w_id
+    )
+    .execute(&mut **tx)
+    .await?;
+
     // ---- draft ----
     sqlx::query!(
         r#"UPDATE draft SET path = REGEXP_REPLACE(path,'u/' || $2 || '/(.*)','u/' || $1 || '/\1') WHERE path LIKE ('u/' || $2 || '/%') AND workspace_id = $3"#,
@@ -561,6 +584,18 @@ async fn update_username_in_workpsace<'c>(
     ).execute(&mut **tx)
     .await?;
 
+    // A draft carries the principal in its value, so a rename must reach it there too —
+    // deploying a draft that still names the old principal would be rejected as a pair naming
+    // somebody who no longer exists. Through the same canonical form as the columns above: a
+    // legacy `group-ops` username is named `g/ops`, which `'u/' || …` would never match.
+    sqlx::query!(
+        r#"UPDATE draft SET value = to_json(jsonb_set(to_jsonb(value), ARRAY['on_behalf_of'], to_jsonb($1::text))) WHERE value->>'on_behalf_of' = $2 AND workspace_id = $3"#,
+        &new_principal,
+        &old_principal,
+        w_id
+    ).execute(&mut **tx)
+    .await?;
+
     // ---- app ----
     sqlx::query!(
         r#"UPDATE app SET path = REGEXP_REPLACE(path,'u/' || $2 || '/(.*)','u/' || $1 || '/\1') WHERE path LIKE ('u/' || $2 || '/%') AND workspace_id = $3"#,
diff --git a/backend/windmill-api/src/workspaces_export.rs b/backend/windmill-api/src/workspaces_export.rs
index a7458e617a..037971b19e 100644
--- a/backend/windmill-api/src/workspaces_export.rs
+++ b/backend/windmill-api/src/workspaces_export.rs
@@ -105,6 +105,10 @@ struct ScriptMetadata {
     pub has_preprocessor: Option<bool>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub on_behalf_of_email: Option<String>,
+    /// Emitted instead of the address from syncBehavior v1 on, where the CLI only needs to
+    /// know *that* the runnable has an identity — it re-reads the value itself on push.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub has_on_behalf_of: Option<bool>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub modules: Option<std::collections::HashMap<String, windmill_common::scripts::ScriptModule>>,
     #[serde(flatten)]
@@ -117,6 +121,42 @@ struct ScriptMetadata {
     pub extra_perms: serde_json::Value,
 }
 
+/// `syncBehavior` as the CLI writes it (`"v1"`); anything unparseable is v0, matching
+/// `parseSyncBehavior` on the client.
+fn parse_sync_behavior_version(value: Option<&str>) -> u32 {
+    value
+        .and_then(|v| v.strip_prefix('v'))
+        .and_then(|v| v.parse().ok())
+        .unwrap_or(0)
+}
+
+/// The address a runnable's principal resolves to, memoised for the duration of one export.
+///
+/// `on_behalf_of` is sparse — most runnables carry none, and those that do
+/// usually share a handful of identities — so this collapses to roughly one lookup per
+/// distinct principal instead of one per row.
+async fn derive_email(
+    cache: &mut HashMap<String, String>,
+    db: &DB,
+    w_id: &str,
+    permissioned_as: Option<&str>,
+) -> Result<Option<String>> {
+    let Some(permissioned_as) = permissioned_as else {
+        return Ok(None);
+    };
+    if let Some(hit) = cache.get(permissioned_as) {
+        return Ok(Some(hit.clone()));
+    }
+    // Uncached: the address goes into an archive a client redeploys from, and the write path
+    // validates the pair it sends back against an uncached lookup. The memo above still holds
+    // this to one query per distinct principal per export.
+    let email =
+        windmill_common::users::get_email_from_permissioned_as_uncached(permissioned_as, w_id, db)
+            .await?;
+    cache.insert(permissioned_as.to_string(), email.clone());
+    Ok(Some(email))
+}
+
 fn is_empty_extra_perms(value: &serde_json::Value) -> bool {
     value.as_object().is_some_and(|o| o.is_empty()) || value.is_null()
 }
@@ -298,6 +338,9 @@ pub(crate) struct ArchiveQueryParams {
     include_settings: Option<bool>,
     include_key: Option<bool>,
     include_workspace_dependencies: Option<bool>,
+    /// Default `false`: data table migrations ship in the tarball unless the repo
+    /// opted out of the `datatablemigration` object type.
+    skip_datatable_migrations: Option<bool>,
     default_ts: Option<String>,
     /// Settings format version: "v1" (default) returns legacy flat format, "v2" returns grouped format
     settings_version: Option<String>,
@@ -306,6 +349,10 @@ pub(crate) struct ArchiveQueryParams {
     /// identities that may not exist in the target workspace. `wmill sync pull`
     /// passes `true` to surface ACLs in the git-tracked yaml.
     preserve_extra_perms: Option<bool>,
+    /// The caller's `wmill.yaml` `syncBehavior`. From v1 the CLI strips the on-behalf-of
+    /// address from what it writes and keeps only a `has_on_behalf_of` marker, so the
+    /// tarball emits that marker directly and skips resolving any address at all.
+    sync_behavior_version: Option<String>,
 }
 
 /// How to handle `extra_perms` in the serialized output.
@@ -371,6 +418,7 @@ where
                     "edited_at",
                     "edited_by",
                     "permissioned_as",
+                    "on_behalf_of",
                     "archived",
                     "error",
                     "last_server_ping",
@@ -569,9 +617,11 @@ pub(crate) async fn tarball_workspace(
         include_settings,
         include_key,
         include_workspace_dependencies,
+        skip_datatable_migrations,
         default_ts,
         settings_version,
         preserve_extra_perms,
+        sync_behavior_version,
     }): Query<ArchiveQueryParams>,
 ) -> Result<([(HeaderName, String); 2], impl IntoResponse)> {
     tracing::info!(
@@ -687,6 +737,10 @@ pub(crate) async fn tarball_workspace(
         }
     }
 
+    // From v1 the CLI never writes the address, so resolving it would be pure waste on the
+    // default sync path; emit the marker it actually keeps instead.
+    let obo_marker_only = parse_sync_behavior_version(sync_behavior_version.as_deref()) >= 1;
+    let mut obo_cache: HashMap<String, String> = HashMap::new();
     {
         let scripts = sqlx::query_as::<_, Script<ScriptRunnableSettingsHandle>>(&format!(
             "SELECT {} FROM script as o WHERE workspace_id = $1 AND archived = false
@@ -699,7 +753,8 @@ pub(crate) async fn tarball_workspace(
         .await?;
 
         for script in scripts {
-            let script = windmill_common::scripts::prefetch_cached_script(script, &db).await?;
+            let script =
+                windmill_common::scripts::prefetch_cached_script_without_email(script, &db).await?;
             let ext = match script.language {
                 ScriptLang::Python3 => "py",
                 ScriptLang::Deno => {
@@ -736,11 +791,30 @@ pub(crate) async fn tarball_workspace(
                 ScriptLang::Java => "java",
                 ScriptLang::Ruby => "rb",
                 ScriptLang::Rlang => "r",
+                // A dbt script's content path is not `<path>.<ext>` — it is the
+                // descriptor inside the project folder, built below.
+                ScriptLang::Dbt => "",
                 // for related places search: ADD_NEW_LANG
             };
-            archive
-                .write_to_archive(&script.content, &format!("{}.{}", script.path, ext))
-                .await?;
+            if script.language == ScriptLang::Dbt {
+                // The descriptor belongs inside the project it configures, and
+                // is OPTIONAL: an unmodified dbt project is already a complete
+                // script. Writing an empty one would put a Windmill file in a
+                // directory that had none, so a project that names no descriptor
+                // exports without one.
+                if !script.content.trim().is_empty() {
+                    archive
+                        .write_to_archive(
+                            &script.content,
+                            &format!("{}__dbt/wm_dbt.yaml", script.path),
+                        )
+                        .await?;
+                }
+            } else {
+                archive
+                    .write_to_archive(&script.content, &format!("{}.{}", script.path, ext))
+                    .await?;
+            }
 
             let metadata = ScriptMetadata {
                 summary: script.summary,
@@ -763,7 +837,13 @@ pub(crate) async fn tarball_workspace(
                 auto_kind: script.auto_kind,
                 codebase: script.codebase,
                 has_preprocessor: script.has_preprocessor,
-                on_behalf_of_email: script.on_behalf_of_email,
+                on_behalf_of_email: if obo_marker_only {
+                    None
+                } else {
+                    derive_email(&mut obo_cache, &db, &w_id, script.on_behalf_of.as_deref()).await?
+                },
+                has_on_behalf_of: (obo_marker_only && script.on_behalf_of.is_some())
+                    .then_some(true),
                 modules: script.modules,
                 labels: script.labels,
                 // Same opt-in contract as flow/app: the tarball only surfaces
@@ -786,8 +866,9 @@ pub(crate) async fn tarball_workspace(
     if !skip_resources.unwrap_or(false) {
         let resources = sqlx::query_as!(
              Resource,
-             "SELECT workspace_id, path, value, description, resource_type, extra_perms, created_by, edited_at, labels FROM resource WHERE workspace_id = $1 AND resource_type != 'state' AND resource_type != 'cache'",
-             &w_id
+             "SELECT workspace_id, path, value, description, resource_type, extra_perms, created_by, edited_at, labels FROM resource WHERE workspace_id = $1 AND resource_type <> ALL($2)",
+             &w_id,
+             &windmill_store::resources::INTERNAL_RESOURCE_TYPES.map(|t| t.to_string())[..]
          )
          .fetch_all(&mut *tx)
          .await?;
@@ -825,7 +906,7 @@ pub(crate) async fn tarball_workspace(
 
     {
         let flows = sqlx::query_as::<_, Flow>(
-             "SELECT flow.workspace_id, flow.path, flow.summary, flow.description, flow.archived, flow.extra_perms, flow.dedicated_worker, flow.tag, flow.ws_error_handler_muted, flow.timeout, flow.visible_to_runner_only, flow.on_behalf_of_email, flow.labels, flow_version.schema, flow_version.value, flow_version.created_at as edited_at, flow_version.created_by as edited_by
+             "SELECT flow.workspace_id, flow.path, flow.summary, flow.description, flow.archived, flow.extra_perms, flow.dedicated_worker, flow.tag, flow.ws_error_handler_muted, flow.timeout, flow.visible_to_runner_only, flow.on_behalf_of, flow.labels, flow_version.schema, flow_version.value, flow_version.created_at as edited_at, flow_version.created_by as edited_by
              FROM flow
              LEFT JOIN flow_version ON flow_version.id = flow.versions[array_upper(flow.versions, 1)]
              WHERE flow.workspace_id = $1 AND flow.archived = false",
@@ -834,8 +915,24 @@ pub(crate) async fn tarball_workspace(
          .fetch_all(&mut *tx)
          .await?;
 
-        for flow in flows {
-            let flow_str = &to_string_without_metadata(&flow, new_kinds_extra_perms, None).unwrap();
+        for mut flow in flows {
+            let flow_marker = obo_marker_only && flow.on_behalf_of.is_some();
+            flow.on_behalf_of_email = if obo_marker_only {
+                None
+            } else {
+                derive_email(&mut obo_cache, &db, &w_id, flow.on_behalf_of.as_deref()).await?
+            };
+            let mut overrides = serde_json::Map::new();
+            if flow_marker {
+                overrides.insert("has_on_behalf_of".to_string(), Value::Bool(true));
+            }
+            let flow_str = &to_string_without_metadata_inner(
+                &flow,
+                new_kinds_extra_perms,
+                None,
+                (!overrides.is_empty()).then_some(&overrides),
+            )
+            .unwrap();
             archive
                 .write_to_archive(&flow_str, &format!("{}.flow.json", flow.path))
                 .await?;
@@ -1600,7 +1697,7 @@ pub(crate) async fn tarball_workspace(
             .await?;
     }
 
-    {
+    if !skip_datatable_migrations.unwrap_or(false) {
         // Data table migrations live in the `datatable_migrations` table; surface
         // them in the export as `migrations/datatable/<datatable>/<version>_<name>`
         // .up.sql (and .down.sql when present) so `wmill sync` treats them like any
diff --git a/backend/windmill-common/src/assets.rs b/backend/windmill-common/src/assets.rs
index d6a4156f38..117b41632a 100644
--- a/backend/windmill-common/src/assets.rs
+++ b/backend/windmill-common/src/assets.rs
@@ -175,6 +175,10 @@ fn is_write_access(access: Option<AssetUsageAccessType>) -> bool {
 /// producers). Resource / datatable / volume reads stay explicit-`// on`:
 /// a config/lookup read cascading is more often surprising than wanted.
 fn is_auto_trigger_kind(kind: AssetKind) -> bool {
+    // `Dbt` is deliberately NOT here. dbt is the only thing that can produce a
+    // warehouse relation (`// materialize` takes DuckLake targets only) and a dbt
+    // run does not dispatch, so a derived `dbt://` edge could never fire — it
+    // would draw a cascade arrow into a script nothing can wake.
     matches!(kind, AssetKind::Ducklake | AssetKind::S3Object)
 }
 
@@ -647,6 +651,7 @@ pub fn asset_kind_from_parser(parser_kind: windmill_parser::asset_parser::AssetK
         windmill_parser::asset_parser::AssetKind::Ducklake => AssetKind::Ducklake,
         windmill_parser::asset_parser::AssetKind::DataTable => AssetKind::DataTable,
         windmill_parser::asset_parser::AssetKind::Volume => AssetKind::Volume,
+        windmill_parser::asset_parser::AssetKind::Dbt => AssetKind::Dbt,
     }
 }
 
diff --git a/backend/windmill-common/src/auth.rs b/backend/windmill-common/src/auth.rs
index bd6bf1ef9d..8dfc3fc324 100644
--- a/backend/windmill-common/src/auth.rs
+++ b/backend/windmill-common/src/auth.rs
@@ -43,6 +43,29 @@ pub fn is_user_token(label: Option<&str>) -> bool {
     }
 }
 
+/// Whether `label` belongs to a namespace only the server mints, and which therefore must be
+/// rejected by `create_token`. Narrower than [`is_user_token`], which also drives label
+/// editability and expiry notifications and can afford to reserve more: `Ephemeral lsp token`
+/// and `debugger-token` are minted by the editor and the debugger through that same handler,
+/// so reserving them would break those features.
+///
+/// `username_override_from_label` trusts a label to name the entity acting only if it is in
+/// here, so anything added must be unmintable by a member.
+pub fn is_server_minted_label(label: &str) -> bool {
+    label.starts_with("ephemeral-webhook-")
+        || label.starts_with("ephemeral-script-end-user-")
+        || label == "ephemeral-script"
+        || label == "session"
+        || label.starts_with("mcp-oauth-")
+}
+
+/// Whether `label` is the one minted for a browser session at login. [`is_server_minted_label`]
+/// stops a member minting it directly, but `/users/refresh_token` hands one to any authenticated
+/// caller, so this attributes a request to the UI without proving it: never gate authority on it.
+pub fn is_session_label(label: Option<&str>) -> bool {
+    label == Some("session")
+}
+
 /// Hash a raw token using SHA-256 (hex-encoded, 64 chars).
 /// Used to store and look up tokens without keeping plaintext in the DB.
 pub fn hash_token(token: &str) -> String {
@@ -266,6 +289,7 @@ pub struct JobPerms {
     pub is_operator: bool,
     pub groups: Vec<String>,
     pub folders: Vec<serde_json::Value>,
+    pub end_user_email: Option<String>,
 }
 
 impl From<JobPerms> for Authed {
@@ -487,7 +511,7 @@ pub async fn get_job_perms<'a, E: sqlx::PgExecutor<'a>>(
 ) -> sqlx::Result<Option<JobPerms>> {
     sqlx::query_as!(
         JobPerms,
-        "SELECT email, username, is_admin, is_operator, groups, folders FROM job_perms WHERE job_id = $1 AND workspace_id = $2",
+        "SELECT email, username, is_admin, is_operator, groups, folders, end_user_email FROM job_perms WHERE job_id = $1 AND workspace_id = $2",
         job_id,
         w_id
     )
@@ -496,6 +520,31 @@ pub async fn get_job_perms<'a, E: sqlx::PgExecutor<'a>>(
     .await
 }
 
+/// A job token is refreshed once its remaining lifetime drops below this. It must exceed the
+/// 60s `jsonwebtoken` exp leeway, otherwise a token that still validates now could expire
+/// mid-orchestration after being judged fresh.
+pub const JOB_TOKEN_REFRESH_MARGIN_SECS: i64 = 120;
+
+/// Seconds until an internal job JWT expires, or `None` when `token` is not a decodable job
+/// JWT (e.g. the empty test token). The signature is intentionally not verified: the value only
+/// gates whether to refresh the token, never whose identity to assume.
+pub fn job_token_remaining_lifetime_secs(token: &str) -> Option<i64> {
+    let raw = token.strip_prefix("jwt_")?;
+    let claims: JWTAuthClaims = jwt::decode_without_verify(raw).ok()?;
+    Some(claims.exp as i64 - Utc::now().timestamp())
+}
+
+/// Label for an ephemeral job token. For a job run on behalf of an end user (its
+/// `permissioned_as` differs from its `created_by`) it encodes that end user so
+/// `username_override_from_label` can recover them; otherwise it is the plain script label.
+pub fn ephemeral_script_token_label(permissioned_as: &str, created_by: &str) -> String {
+    if permissioned_as != format!("u/{created_by}") && permissioned_as != created_by {
+        format!("ephemeral-script-end-user-{created_by}")
+    } else {
+        "ephemeral-script".to_string()
+    }
+}
+
 #[tracing::instrument(level = "trace", skip_all)]
 pub async fn create_token_for_owner(
     db: &DB,
@@ -679,6 +728,46 @@ pub mod aws {
 #[cfg(test)]
 mod tests {
     use super::is_user_token;
+    use super::{job_token_remaining_lifetime_secs, JWTAuthClaims, JOB_TOKEN_REFRESH_MARGIN_SECS};
+
+    fn job_jwt(exp_offset_secs: i64) -> String {
+        let claims = JWTAuthClaims {
+            email: String::new(),
+            username: String::new(),
+            is_admin: false,
+            is_operator: false,
+            groups: vec![],
+            folders: vec![],
+            label: None,
+            workspace_id: None,
+            workspace_ids: None,
+            exp: (chrono::Utc::now().timestamp() + exp_offset_secs) as usize,
+            job_id: None,
+            scopes: None,
+            audit_span: None,
+        };
+        // Signature is irrelevant — the gate decodes without verifying — so any key works.
+        let token = jsonwebtoken::encode(
+            &jsonwebtoken::Header::new(jsonwebtoken::Algorithm::HS256),
+            &claims,
+            &jsonwebtoken::EncodingKey::from_secret(b"test"),
+        )
+        .unwrap();
+        format!("jwt_{token}")
+    }
+
+    #[test]
+    fn remaining_lifetime_reflects_exp_and_flags_near_expiry() {
+        // A token minted for less than the margin reads as needing a refresh...
+        let short = job_token_remaining_lifetime_secs(&job_jwt(30)).unwrap();
+        assert!(short < JOB_TOKEN_REFRESH_MARGIN_SECS);
+        // ...a long-lived one does not...
+        let long = job_token_remaining_lifetime_secs(&job_jwt(10_000)).unwrap();
+        assert!(long >= JOB_TOKEN_REFRESH_MARGIN_SECS);
+        // ...and a non-JWT token (e.g. the empty test-run token) yields no lifetime.
+        assert!(job_token_remaining_lifetime_secs("not-a-jwt").is_none());
+        assert!(job_token_remaining_lifetime_secs("").is_none());
+    }
 
     #[test]
     fn user_tokens_are_editable() {
diff --git a/backend/windmill-common/src/azure_workload_identity.rs b/backend/windmill-common/src/azure_workload_identity.rs
new file mode 100644
index 0000000000..7be7fa0f15
--- /dev/null
+++ b/backend/windmill-common/src/azure_workload_identity.rs
@@ -0,0 +1,321 @@
+//! Azure Workload Identity Federation.
+//!
+//! The Kubernetes-projected service account token of the pod is exchanged with Entra
+//! ID for an access token, which Azure-hosted databases accept in place of a password.
+//! Nothing long-lived is stored on the Windmill instance.
+
+use std::collections::HashMap;
+use std::sync::{Arc, Mutex, RwLock};
+use std::time::{Duration, Instant};
+
+use serde_json::Value;
+
+use crate::error::{Error, Result};
+use crate::utils::HTTP_CLIENT;
+
+/// Entra ID scope of Azure SQL / SQL Server.
+pub const AZURE_SQL_SCOPE: &str = "https://database.windows.net/.default";
+
+/// Entra ID scope of Azure Database for PostgreSQL / MySQL.
+pub const AZURE_OSSRDBMS_SCOPE: &str = "https://ossrdbms-aad.database.windows.net/.default";
+
+/// A database resource whose password is this authenticates as the worker's workload
+/// identity, the way a `DATABASE_URL` whose password is `entraid` does for the instance
+/// database. Carrying the mode in the password is what lets an existing deployment turn
+/// it on: the resource type schemas live on the hub, and every database form already has
+/// a password field. Anyone whose password is literally this string authenticates as the
+/// worker's identity instead of failing to log in, which is why it is deliberately less
+/// password-shaped than the instance's `entraid`: that one is set by whoever runs the
+/// instance, this one sits where users keep their own secrets.
+///
+/// Compare it trimmed. A near-miss is otherwise forwarded to the server as a real
+/// password, and the resulting rejection is indistinguishable from an ordinary bad
+/// login, so the mode having been intended at all leaves no trace.
+pub const WORKLOAD_IDENTITY_PASSWORD: &str = "ms_entraid";
+
+/// Renew an access token this long before it expires.
+const TOKEN_REFRESH_BUFFER: Duration = Duration::from_secs(5 * 60);
+
+/// A token with less life than this left is not worth handing to a connection: opening
+/// one takes up to 20 seconds, and it authenticates at the far end of that.
+const TOKEN_MIN_LIFETIME: Duration = Duration::from_secs(60);
+
+/// How long a failed renewal suppresses the next attempt, as long as the current token
+/// still works. Without it every queued job retries the exchange in turn, so a
+/// throttling Entra ID would cost each of them the request's full latency.
+const REFRESH_RETRY_BACKOFF: Duration = Duration::from_secs(30);
+
+lazy_static::lazy_static! {
+    /// Access tokens keyed by identity and scope, shared by every job on the worker.
+    static ref TOKEN_CACHE: Mutex<HashMap<String, Arc<TokenSlot>>> = Mutex::new(HashMap::new());
+}
+
+#[derive(Default)]
+struct TokenSlot {
+    /// Read on the hit path, so it must never be held across the exchange.
+    token: RwLock<Option<CachedToken>>,
+    /// Held for the whole exchange, so a burst of jobs on a cold or expiring entry
+    /// makes one request to Entra ID instead of one per job. Guards the time of the
+    /// last failed exchange, which is what the waiting jobs need to see.
+    refreshing: tokio::sync::Mutex<Option<Instant>>,
+}
+
+struct CachedToken {
+    token: String,
+    expires_at: Instant,
+}
+
+impl TokenSlot {
+    fn token_valid_for(&self, remaining: Duration) -> Option<String> {
+        let cached = self.token.read().unwrap();
+        cached
+            .as_ref()
+            .filter(|cached| Instant::now() + remaining < cached.expires_at)
+            .map(|cached| cached.token.clone())
+    }
+}
+
+/// Whether to go to Entra ID, given the last failed exchange and whether the current
+/// token would still serve. A cold slot always tries: there is nothing to fall back on.
+fn should_attempt_refresh(last_failure: Option<Instant>, has_usable_token: bool) -> bool {
+    match last_failure {
+        Some(at) if has_usable_token => at.elapsed() >= REFRESH_RETRY_BACKOFF,
+        _ => true,
+    }
+}
+
+/// The federated credentials of the identity the worker authenticates as, all injected
+/// into the pod by the Azure workload identity webhook. The identity is the worker's,
+/// not the resource's: reaching two databases as two identities means two worker groups.
+pub struct WorkloadIdentityConfig {
+    tenant_id: String,
+    client_id: String,
+    federated_token_file: String,
+    authority_host: String,
+}
+
+impl WorkloadIdentityConfig {
+    pub fn resolve() -> Result<Self> {
+        fn required(env_var: &str) -> Result<String> {
+            std::env::var(env_var)
+                .ok()
+                .filter(|v| !v.is_empty())
+                .ok_or_else(|| {
+                    Error::BadConfig(format!(
+                        "Workload identity authentication requires the {} env var on the worker, \
+                         injected by the Azure workload identity webhook",
+                        env_var
+                    ))
+                })
+        }
+
+        Ok(Self {
+            tenant_id: required("AZURE_TENANT_ID")?,
+            client_id: required("AZURE_CLIENT_ID")?,
+            federated_token_file: required("AZURE_FEDERATED_TOKEN_FILE")?,
+            authority_host: std::env::var("AZURE_AUTHORITY_HOST")
+                .ok()
+                .filter(|v| !v.is_empty())
+                .unwrap_or_else(|| "login.microsoftonline.com".to_string()),
+        })
+    }
+
+    pub fn client_id(&self) -> &str {
+        &self.client_id
+    }
+
+    fn cache_key(&self, scope: &str) -> String {
+        format!(
+            "{}|{}|{}|{}",
+            self.authority_host, self.tenant_id, self.client_id, scope
+        )
+    }
+
+    /// AZURE_AUTHORITY_HOST is injected with a scheme and a trailing slash
+    /// (`https://login.microsoftonline.com/`), neither of which belongs in the path.
+    fn token_endpoint(&self) -> String {
+        let authority = self
+            .authority_host
+            .trim_start_matches("https://")
+            .trim_start_matches("http://")
+            .trim_end_matches('/');
+        format!("https://{}/{}/oauth2/v2.0/token", authority, self.tenant_id)
+    }
+
+    /// An Entra ID access token for `scope`, reusing the cached one while it is valid.
+    pub async fn access_token(&self, scope: &str) -> Result<String> {
+        let slot = self.slot(scope);
+        if let Some(token) = slot.token_valid_for(TOKEN_REFRESH_BUFFER) {
+            return Ok(token);
+        }
+
+        let mut last_failure = slot.refreshing.lock().await;
+        // Whoever held the lock may have just refreshed it.
+        if let Some(token) = slot.token_valid_for(TOKEN_REFRESH_BUFFER) {
+            return Ok(token);
+        }
+
+        // Inside the refresh buffer the previous token still works, and Entra ID
+        // throttles bursts: a failed renewal must not fail an otherwise fine job.
+        let usable = slot.token_valid_for(TOKEN_MIN_LIFETIME);
+        if !should_attempt_refresh(*last_failure, usable.is_some()) {
+            return Ok(usable.unwrap());
+        }
+
+        match self.request_token(scope).await {
+            Ok(fresh) => {
+                let token = fresh.token.clone();
+                *slot.token.write().unwrap() = Some(fresh);
+                *last_failure = None;
+                Ok(token)
+            }
+            Err(e) => {
+                *last_failure = Some(Instant::now());
+                // Check again rather than trusting the pre-request value: a request that
+                // times out eats 20 seconds of whatever the token had left.
+                match slot.token_valid_for(TOKEN_MIN_LIFETIME) {
+                    Some(token) => {
+                        tracing::warn!("Keeping the current Entra ID token, renewal failed: {e:#}");
+                        Ok(token)
+                    }
+                    None => Err(e),
+                }
+            }
+        }
+    }
+
+    fn slot(&self, scope: &str) -> Arc<TokenSlot> {
+        let mut cache = TOKEN_CACHE.lock().unwrap();
+        // Drop what has expired and that no in-flight request is holding.
+        cache.retain(|_, slot| {
+            Arc::strong_count(slot) > 1 || slot.token_valid_for(TOKEN_MIN_LIFETIME).is_some()
+        });
+        cache.entry(self.cache_key(scope)).or_default().clone()
+    }
+
+    async fn request_token(&self, scope: &str) -> Result<CachedToken> {
+        // The projected token rotates on disk, so it must be re-read on every exchange.
+        let assertion = tokio::fs::read_to_string(&self.federated_token_file)
+            .await
+            .map_err(|e| {
+                Error::ExecutionErr(format!(
+                    "Failed to read the federated token at {}: {}",
+                    self.federated_token_file, e
+                ))
+            })?;
+
+        let url = self.token_endpoint();
+        let response = HTTP_CLIENT
+            .post(&url)
+            .form(&[
+                ("grant_type", "client_credentials"),
+                ("client_id", self.client_id.as_str()),
+                (
+                    "client_assertion_type",
+                    "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
+                ),
+                ("client_assertion", assertion.trim()),
+                ("scope", scope),
+            ])
+            .send()
+            .await
+            .map_err(|e| {
+                Error::ExecutionErr(format!(
+                    "Failed to request an Entra ID token from {url}: {e}"
+                ))
+            })?;
+
+        let status = response.status();
+        let body: Value = response.json().await.map_err(|e| {
+            Error::ExecutionErr(format!("Failed to parse the Entra ID token response: {e}"))
+        })?;
+
+        if !status.is_success() {
+            return Err(Error::ExecutionErr(format!(
+                "Entra ID token request failed ({}): {} - {}",
+                status,
+                body["error"].as_str().unwrap_or("unknown"),
+                body["error_description"]
+                    .as_str()
+                    .unwrap_or("no description")
+            )));
+        }
+
+        let token = body["access_token"]
+            .as_str()
+            .ok_or_else(|| {
+                Error::ExecutionErr("Entra ID token response is missing access_token".to_string())
+            })?
+            .to_string();
+        let expires_in = body["expires_in"].as_u64().unwrap_or(3600);
+
+        Ok(CachedToken { token, expires_at: Instant::now() + Duration::from_secs(expires_in) })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn config(authority_host: &str) -> WorkloadIdentityConfig {
+        WorkloadIdentityConfig {
+            tenant_id: "tenant".to_string(),
+            client_id: "client".to_string(),
+            federated_token_file: "/var/run/secrets/azure/tokens/azure-identity-token".to_string(),
+            authority_host: authority_host.to_string(),
+        }
+    }
+
+    #[test]
+    fn test_token_endpoint() {
+        let expected = "https://login.microsoftonline.com/tenant/oauth2/v2.0/token";
+        assert_eq!(
+            config("login.microsoftonline.com").token_endpoint(),
+            expected
+        );
+        // The shape the workload identity webhook actually injects.
+        assert_eq!(
+            config("https://login.microsoftonline.com/").token_endpoint(),
+            expected
+        );
+    }
+
+    #[test]
+    fn test_cache_key_is_scoped() {
+        let config = config("login.microsoftonline.com");
+        assert_ne!(
+            config.cache_key(AZURE_SQL_SCOPE),
+            config.cache_key(AZURE_OSSRDBMS_SCOPE)
+        );
+    }
+
+    /// A recent failure must not be re-attempted by every job queued behind the
+    /// refresh lock, but only while there is a token left to serve them.
+    #[test]
+    fn test_failed_refresh_is_not_retried_by_every_caller() {
+        assert!(!should_attempt_refresh(Some(Instant::now()), true));
+        assert!(should_attempt_refresh(Some(Instant::now()), false));
+        assert!(should_attempt_refresh(
+            Instant::now().checked_sub(REFRESH_RETRY_BACKOFF),
+            true
+        ));
+        assert!(should_attempt_refresh(None, true));
+    }
+
+    /// A token inside the refresh buffer is no longer served as fresh, but is still
+    /// good enough to fall back on when the renewal itself fails.
+    #[test]
+    fn test_token_within_refresh_buffer_is_stale_but_usable() {
+        let slot = TokenSlot::default();
+        *slot.token.write().unwrap() = Some(CachedToken {
+            token: "tok".to_string(),
+            expires_at: Instant::now() + TOKEN_REFRESH_BUFFER - Duration::from_secs(60),
+        });
+
+        assert_eq!(slot.token_valid_for(TOKEN_REFRESH_BUFFER), None);
+        assert_eq!(
+            slot.token_valid_for(TOKEN_MIN_LIFETIME),
+            Some("tok".to_string())
+        );
+    }
+}
diff --git a/backend/windmill-common/src/cache.rs b/backend/windmill-common/src/cache.rs
index c5af3bfc1a..3c385da79f 100644
--- a/backend/windmill-common/src/cache.rs
+++ b/backend/windmill-common/src/cache.rs
@@ -699,7 +699,23 @@ pub mod script {
             Ok(RawScript {
                 content: r.content,
                 lock: r.lock,
-                modules: r.modules.and_then(|v| serde_json::from_value(v).ok()),
+                modules: r.modules.and_then(|v| match serde_json::from_value(v) {
+                    Ok(modules) => Some(modules),
+                    // Not fatal: a script whose `modules` column cannot be read
+                    // still runs, just without its own files. But the result is
+                    // then cached under the script's hash, which never changes,
+                    // so the degraded run is what every later one gets too --
+                    // and for dbt "no modules" means no project at all. Say so
+                    // loudly, or the only symptom is a script that behaves as
+                    // if its files were never there.
+                    Err(err) => {
+                        tracing::error!(
+                            "Script {hash} has modules that cannot be deserialized, \
+                             running it without them: {err:#}"
+                        );
+                        None
+                    }
+                }),
                 meta: Some(ScriptMetadata {
                     language: r.language,
                     envs: r.envs,
@@ -1085,7 +1101,12 @@ const _: () = {
             let content = src.get_utf8("code.txt")?;
             let lock = src.get_utf8("lock.txt").ok();
             let meta = src.get_json("info.json").ok();
-            Ok(Self { content, lock, meta, modules: None })
+            // Required, even when empty: a script's modules are part of what it
+            // IS, so an entry without them must fail to import and be refetched
+            // rather than serve the script stripped of its own files.
+            let modules: Option<std::collections::HashMap<String, ScriptModule>> =
+                src.get_json("modules.json")?;
+            Ok(Self { content, lock, meta, modules })
         }
     }
 
@@ -1101,6 +1122,7 @@ const _: () = {
             if let Some(lock) = self.lock.as_ref() {
                 dst.put("lock.txt", lock.as_bytes())?;
             }
+            dst.put("modules.json", serde_json::to_vec(&self.modules)?)?;
             Ok(())
         }
     }
@@ -1312,6 +1334,38 @@ mod tests {
         assert!(leftover.is_empty(), "temp files must be renamed/cleaned up");
     }
 
+    // The first fetch of a script goes to the database, every later one to this
+    // directory. A module lost in between makes a worker restart silently start
+    // running the script without its own files — for dbt, without its project.
+    #[test]
+    fn a_scripts_modules_survive_the_file_system_cache() {
+        use crate::scripts::ScriptModule;
+        let dir = tempfile::tempdir().unwrap();
+        let root = dir.path();
+
+        let data = ScriptData {
+            code: "profile: {}".to_string(),
+            lock: None,
+            modules: Some(std::collections::HashMap::from([(
+                "dbt_project.yml".to_string(),
+                ScriptModule {
+                    content: "name: p".to_string(),
+                    language: ScriptLang::Dbt,
+                    lock: None,
+                },
+            )])),
+        };
+        data.export(&root).unwrap();
+        let back = ScriptData::resolve(RawScript::import(&root).unwrap()).unwrap();
+        assert_eq!(back.modules.unwrap()["dbt_project.yml"].content, "name: p");
+
+        // An entry written before modules were cached has no `modules.json`.
+        // It must fail to import so the caller refetches, rather than serving a
+        // script stripped of its files for as long as the directory lives.
+        std::fs::remove_file(root.join("modules.json")).unwrap();
+        assert!(RawScript::import(&root).is_err());
+    }
+
     #[test]
     fn flow_data_extras_preserves_notes_and_groups() {
         let raw = serde_json::value::to_raw_value(&json!({
diff --git a/backend/windmill-common/src/client.rs b/backend/windmill-common/src/client.rs
index b454585dbe..7907cd6ea1 100644
--- a/backend/windmill-common/src/client.rs
+++ b/backend/windmill-common/src/client.rs
@@ -115,6 +115,59 @@ impl AuthedClient {
         }
     }
 
+    /// Whether the workspace configures this dbt warehouse. Resolves nothing.
+    pub async fn dbt_warehouse_exists(&self, name: &str) -> anyhow::Result<()> {
+        let url = format!(
+            "{}/api/w/{}/dbt/warehouse_exists/{}",
+            self.base_internal_url, self.workspace, name
+        );
+        let response = self.get(&url, vec![]).await?;
+        match response.status().as_u16() {
+            200u16 => Ok(()),
+            _ => Err(anyhow::anyhow!(response.text().await.unwrap_or_default())),
+        }
+    }
+
+    /// Record a run's settled dbt nodes, for a worker with no database.
+    ///
+    /// Posted with the JOB's token, not the agent's: the route takes the job
+    /// from the token, and the agent's own credential only authenticates
+    /// against the agent surface.
+    pub async fn record_dbt_run_progress(
+        &self,
+        req: &[crate::dbt_manifest::DbtRunProgressRequest],
+    ) -> anyhow::Result<()> {
+        let url = format!(
+            "{}/api/w/{}/dbt/run_progress",
+            self.base_internal_url, self.workspace
+        );
+        let response = self
+            .force_client
+            .as_ref()
+            .unwrap_or(&HTTP_CLIENT)
+            .post(&url)
+            .header(
+                reqwest::header::AUTHORIZATION,
+                reqwest::header::HeaderValue::from_str(&format!("Bearer {}", self.token))?,
+            )
+            .json(req)
+            .send()
+            .await?;
+        match response.status().as_u16() {
+            200u16 => Ok(()),
+            _ => Err(anyhow::anyhow!(response.text().await.unwrap_or_default())),
+        }
+    }
+
+    /// Where a dbt warehouse name points, for a worker with no database.
+    pub async fn get_dbt_warehouse<T: DeserializeOwned>(&self, name: &str) -> anyhow::Result<T> {
+        let url = format!(
+            "{}/api/w/{}/dbt/warehouse/{}",
+            self.base_internal_url, self.workspace, name
+        );
+        make_basic_get_request(self, &url, None, Some("decoding the dbt warehouse ref")).await
+    }
+
     pub async fn get_completed_job_result<T: DeserializeOwned>(
         &self,
         path: &str,
diff --git a/backend/windmill-common/src/dbt_manifest.rs b/backend/windmill-common/src/dbt_manifest.rs
new file mode 100644
index 0000000000..8fb124a33f
--- /dev/null
+++ b/backend/windmill-common/src/dbt_manifest.rs
@@ -0,0 +1,1826 @@
+//! Reading dbt's `target/manifest.json` into the asset graph.
+//!
+//! The manifest is dbt's own parsed project: every model, snapshot, seed,
+//! source and test, with the physical relation each resolves to and the
+//! `ref()`/`source()` edges between them. Ingesting it is what makes dbt models
+//! first-class assets rather than an opaque job (docs/dbt-runtime.md).
+//!
+//! Two things this module is deliberate about:
+//!
+//! * **Asset identity is the physical relation.** A model becomes
+//!   `dbt://<warehouse>/<schema>/<name>`: the scheme names dbt, which is the
+//!   only thing that creates one, but the PATH is the relation and never dbt's
+//!   own `unique_id`. Two projects meet at a handoff — one materializes a mart,
+//!   the next declares it a `source` — where `model.a.orders` and
+//!   `source.b.analytics.orders` differ but the relation does not, so keying on
+//!   the node id would leave each project an island; a native script reading the
+//!   same table would form no edge either. A dbt run does not trigger those
+//!   readers (decision 11, "No cascade from dbt"); sharing the node is what makes
+//!   the lineage one graph.
+//! * **The warehouse is identified by its workspace NAME**, matching the way
+//!   `ducklake://main.orders` names a lake. Connection details (host, account)
+//!   are never part of the key: the same warehouse is reachable under several
+//!   hostnames, and credential material has no business in an asset key. The
+//!   warehouse names the default database too, so relations in it need no
+//!   qualification; one that OVERRODE its database qualifies its schema segment
+//!   (`table_asset_path`), since two same-named relations in different databases
+//!   are not the same table. The accepted consequence is documented in
+//!   docs/dbt-runtime.md — two resources pointing at one physical warehouse do
+//!   not unify.
+//!
+//! # Mutator contract
+//!
+//! Every `pub` mutator in this module — the manifest ones
+//! (`replace_dbt_manifest`, `clear_dbt_manifest_version`,
+//! `clear_dbt_editor_graphs`),
+//! the snapshot sweep, and the retry-state ones (`move_dbt_run_state`,
+//! `clear_dbt_run_state`, `clear_dbt_run_state_if_path_retired`) — takes the
+//! workspace and the script to act on as plain arguments and enforces nothing:
+//! **the caller must already have verified write access to that script**,
+//! exactly like the sibling `assets::replace_static_asset_usage` each is called
+//! next to. The retry-state ones destroy a resumable failure and move saved
+//! invocation arguments between paths, so an unauthorized caller there hands one
+//! principal's arguments to another. A user-scoped
+//! transaction is not enforcement here — `dbt_node` and `dbt_edge` carry no RLS
+//! policy and grant `windmill_user` full access, deliberately, because the
+//! writer is the dependency job rather than a request.
+//!
+//! Every caller today satisfies it through the route that owns the script:
+//! `windmill-api-scripts::scripts` clears and moves from the create, archive,
+//! rename and delete handlers, each behind a `scripts:write:<path>` scope check
+//! plus that route's own owner or admin requirement; the worker replaces from
+//! the dependency job of the very script being deployed, and saves retry state
+//! for the script it just ran. A new call site that cannot name where it
+//! authorized is a bug.
+
+use std::collections::{BTreeMap, HashMap};
+
+use serde::{Deserialize, Serialize};
+use sqlx::{Postgres, Transaction};
+use windmill_parser::asset_parser::canonicalize_table_asset_path;
+
+use crate::assets::{AssetKind, AssetUsageAccessType, AssetWithAltAccessType};
+use crate::error::Result;
+
+#[derive(Deserialize, Debug, Default)]
+pub struct Manifest {
+    #[serde(default)]
+    pub metadata: ManifestMetadata,
+    #[serde(default)]
+    pub nodes: BTreeMap<String, ManifestNode>,
+    #[serde(default)]
+    pub sources: BTreeMap<String, ManifestNode>,
+    #[serde(default)]
+    pub parent_map: BTreeMap<String, Vec<String>>,
+}
+
+#[derive(Deserialize, Debug, Default)]
+pub struct ManifestMetadata {
+    #[serde(default)]
+    pub dbt_version: String,
+    #[serde(default)]
+    pub adapter_type: String,
+    #[serde(default)]
+    pub project_name: String,
+}
+
+#[derive(Deserialize, Debug, Default)]
+pub struct ManifestNode {
+    #[serde(default)]
+    pub resource_type: String,
+    #[serde(default)]
+    pub name: String,
+    #[serde(default)]
+    pub alias: Option<String>,
+    /// Sources only: the PHYSICAL table name. `name` is the logical one
+    /// `source()` refers to, and the two differ whenever a source is declared
+    /// with an `identifier`. Sources have no `alias`.
+    #[serde(default)]
+    pub identifier: Option<String>,
+    #[serde(default)]
+    pub schema: Option<String>,
+    /// dbt's resolved database (BigQuery's project, Snowflake's database). A
+    /// model can override it per node, so it is part of identity.
+    #[serde(default)]
+    pub database: Option<String>,
+    /// dbt leaves this null exactly for nodes with no physical relation:
+    /// ephemeral models (inlined as CTEs) and tests.
+    #[serde(default)]
+    pub relation_name: Option<String>,
+    #[serde(default)]
+    pub description: Option<String>,
+    #[serde(default)]
+    pub tags: Vec<String>,
+    #[serde(default)]
+    pub config: NodeConfig,
+    #[serde(default)]
+    pub test_metadata: Option<TestMetadata>,
+    #[serde(default)]
+    pub column_name: Option<String>,
+    #[serde(default)]
+    pub attached_node: Option<String>,
+    #[serde(default)]
+    pub columns: BTreeMap<String, ManifestColumn>,
+    #[serde(default)]
+    pub freshness: Option<serde_json::Value>,
+    /// The model's SQL as written, `{{ ref() }}` and all. `dbt parse` fills
+    /// this; `compiled_code` needs a `dbt compile`, which no phase here runs.
+    #[serde(default)]
+    pub raw_code: Option<String>,
+    /// Its path inside the dbt project, e.g. `models/staging/stg_orders.sql`.
+    #[serde(default)]
+    pub original_file_path: Option<String>,
+}
+
+#[derive(Deserialize, Debug, Default)]
+pub struct NodeConfig {
+    #[serde(default)]
+    pub materialized: Option<String>,
+    /// dbt allows a list for composite keys; only a single-column key maps onto
+    /// a Windmill `merge`/`scd2` strategy, so a composite one is left unmapped.
+    #[serde(default)]
+    pub unique_key: Option<serde_json::Value>,
+    #[serde(default)]
+    pub severity: Option<String>,
+}
+
+#[derive(Deserialize, Debug, Default)]
+pub struct ManifestColumn {
+    #[serde(default)]
+    pub description: Option<String>,
+}
+
+#[derive(Deserialize, Debug, Default)]
+pub struct TestMetadata {
+    #[serde(default)]
+    pub name: String,
+    #[serde(default)]
+    pub kwargs: serde_json::Value,
+    #[serde(default)]
+    pub namespace: Option<String>,
+}
+
+/// A content digest of the graph a row set describes.
+///
+/// Covers every stored field of the nodes, their `ref()` edges and the root the
+/// relations resolved under — more than the graph draws, which errs toward
+/// storing a snapshot rather than suppressing one that differs.
+fn graph_digest(ingested: &IngestedManifest, relation_root: &str) -> String {
+    use sha2::{Digest, Sha256};
+    // SHA-256, not `DefaultHasher`: this is written to the database and compared on
+    // later runs, possibly by a worker on another toolchain, and `DefaultHasher` is
+    // explicitly not stable across Rust releases. A drifting hash would store a full
+    // snapshot every run, looking exactly like the suppression never working.
+    let mut h = Sha256::new();
+    // Delimited and serialized, both parts the same way: `{:?}` renames a field
+    // with the struct, changing every digest once for nothing, and unseparated
+    // parts let one part's tail read as the next part's head.
+    h.update(relation_root.as_bytes());
+    h.update(b"\0");
+    h.update(
+        serde_json::to_string(&ingested.nodes)
+            .unwrap_or_default()
+            .as_bytes(),
+    );
+    h.update(b"\0");
+    h.update(
+        serde_json::to_string(&ingested.edges)
+            .unwrap_or_default()
+            .as_bytes(),
+    );
+    format!("{:x}", h.finalize())
+}
+
+/// The `job_id` of a graph that belongs to a deployed VERSION rather than to one
+/// run: what a static descriptor writes at deploy and all of its runs read.
+///
+/// A sentinel rather than NULL because `job_id` is part of the primary key, and
+/// Postgres does not treat two NULLs as the same key — every re-ingest would
+/// insert a new row set instead of replacing one.
+pub const DEPLOYED_GRAPH: uuid::Uuid = uuid::Uuid::nil();
+
+/// How many deploys of one script keep their graph.
+///
+/// A version's graph is what its own finished runs render from, so it cannot
+/// expire on a clock — a run page is as old as its job. It is bounded by COUNT
+/// instead: the newest deploys keep theirs and older ones are dropped, which
+/// makes growth `versions x models` per path rather than unbounded in time. A CI
+/// deploying on every commit would otherwise add a full model set per commit and
+/// nothing would ever reclaim it.
+///
+/// Generous on purpose. Losing a graph empties that version's run pages, so the
+/// bound exists to stop unbounded growth, not to be reached in normal use.
+pub const DEPLOYED_GRAPH_VERSIONS_KEPT: i64 = 50;
+
+/// How long a run's graph snapshot outlives it. Only dynamic descriptors write
+/// one, and the run page is the only reader.
+pub const RUN_GRAPH_RETENTION_DAYS: i32 = 30;
+
+/// Drop the run snapshots older than the retention window, across the instance.
+///
+/// How long a run's progress rows outlive it.
+///
+/// They exist for the run page, which reads them live and — for a run that left
+/// no `run_results.json`, cancelled or killed — afterwards. Bounded by age and
+/// swept by the writes themselves, so no background job has to know this table.
+const RUN_PROGRESS_RETENTION_DAYS: i32 = 30;
+
+/// Drop progress rows older than the retention above.
+///
+/// Called from EVERY writer, like `prune_dbt_run_graphs`: these rows carry no
+/// job foreign key on purpose, so nothing else reclaims them, and a writer that
+/// skips this is a configuration with no sweep at all — an agent-only workspace
+/// writes them exclusively through the API.
+///
+/// See the mutator contract above: this authorizes nothing.
+pub async fn prune_run_progress(db: &crate::DB, w_id: &str) {
+    let res = sqlx::query!(
+        "DELETE FROM dbt_run_progress
+          WHERE workspace_id = $1 AND updated_at < now() - make_interval(days => $2)",
+        w_id,
+        RUN_PROGRESS_RETENTION_DAYS,
+    )
+    .execute(db)
+    .await;
+    if let Err(e) = res {
+        tracing::warn!("pruning dbt run progress: {e:#}");
+    }
+}
+
+/// Called by everything that writes them — a run, a deploy, and the endpoint an
+/// agent worker publishes through — so this table needs no background sweep, the
+/// same shape `dbt_run_progress` uses. A writer that does not call it is a
+/// configuration with no sweep at all: an agent-only project is deployed once and
+/// never runs where the pool is reachable.
+///
+/// Also drops the deploy graphs of the running script beyond
+/// `DEPLOYED_GRAPH_VERSIONS_KEPT`, which is the only reclamation those have.
+///
+/// See the mutator contract above: this authorizes nothing.
+pub async fn prune_dbt_run_graphs(
+    db: &sqlx::Pool<Postgres>,
+    // The script this run belongs to. The version sweep is scoped to it rather
+    // than run instance-wide: unscoped it seq-scans every version of every
+    // script on the instance, on every dbt run, and past the keep-count is a
+    // rare state — so nearly every execution paid for it to reclaim nothing.
+    script_path: &str,
+    workspace_id: &str,
+) -> Result<()> {
+    // Markers first, then the rows they stand for: a marker outliving its nodes
+    // would report a snapshot the reader then finds empty, which is the very
+    // confusion the marker exists to remove. All three share one age predicate,
+    // so a row and its marker expire together.
+    sqlx::query!(
+        "DELETE FROM dbt_graph_snapshot
+          WHERE job_id <> '00000000-0000-0000-0000-000000000000'
+            AND ingested_at < now() - make_interval(days => $1)",
+        RUN_GRAPH_RETENTION_DAYS,
+    )
+    .execute(db)
+    .await?;
+    // Bounded by age on BOTH sides, and the sentinel spelled as a literal so the
+    // partial indexes apply: a bound parameter cannot be proven to match the
+    // index predicate, which turned this into a whole-table scan on every run.
+    sqlx::query!(
+        "DELETE FROM dbt_node
+          WHERE job_id <> '00000000-0000-0000-0000-000000000000'
+            AND ingested_at < now() - make_interval(days => $1)",
+        RUN_GRAPH_RETENTION_DAYS,
+    )
+    .execute(db)
+    .await?;
+    sqlx::query!(
+        "DELETE FROM dbt_edge
+          WHERE job_id <> '00000000-0000-0000-0000-000000000000'
+            AND ingested_at < now() - make_interval(days => $1)",
+        RUN_GRAPH_RETENTION_DAYS,
+    )
+    .execute(db)
+    .await?;
+    // In ONE transaction with the orphan sweep: a restart in the gap leaves graph
+    // rows whose marker is gone, and since the sweep runs only when a marker went,
+    // every later call computes `retired == 0` and skips them for good.
+    let mut tx = db.begin().await?;
+    // Ordered by the script's own `created_at`, so "newest" is the newest deploy
+    // and not the newest ingest: a late-finishing job must not promote an old
+    // version. Scoped to one (workspace, path), which the path index serves.
+    let retired = sqlx::query!(
+        "WITH keep AS (
+           SELECT hash FROM script
+            WHERE workspace_id = $2 AND path = $3 AND language = 'dbt'
+            ORDER BY created_at DESC LIMIT $1
+         )
+         DELETE FROM dbt_graph_snapshot g
+          WHERE g.workspace_id = $2 AND g.script_path = $3
+            AND g.job_id = '00000000-0000-0000-0000-000000000000'
+            AND NOT EXISTS (SELECT 1 FROM keep k WHERE k.hash = g.script_hash)",
+        DEPLOYED_GRAPH_VERSIONS_KEPT,
+        workspace_id,
+        script_path,
+    )
+    .execute(&mut *tx)
+    .await?
+    .rows_affected();
+    // Only when a marker actually went: these two are the complement of every
+    // partial index here — all of them `WHERE job_id <> DEPLOYED` — and past the
+    // keep-count is rare, so the ordinary run should pay for neither.
+    if retired > 0 {
+        for table in ["dbt_node", "dbt_edge"] {
+            sqlx::query(&format!(
+                "DELETE FROM {table} t
+                  WHERE t.workspace_id = $1 AND t.script_path = $2
+                    AND t.job_id = '00000000-0000-0000-0000-000000000000'
+                    AND NOT EXISTS (SELECT 1 FROM dbt_graph_snapshot g
+                                     WHERE g.workspace_id = t.workspace_id
+                                       AND g.script_path = t.script_path
+                                       AND g.script_hash = t.script_hash
+                                       AND g.job_id = t.job_id)"
+            ))
+            .bind(workspace_id)
+            .bind(script_path)
+            .execute(&mut *tx)
+            .await?;
+        }
+    }
+    tx.commit().await?;
+    Ok(())
+}
+
+/// Longest model body kept for display. Generous for a hand-written model and
+/// small enough that a generated one cannot bloat the sidecar.
+const MAX_SQL_BYTES: usize = 32 * 1024;
+
+fn truncate_sql(code: &str) -> String {
+    if code.len() <= MAX_SQL_BYTES {
+        return code.to_string();
+    }
+    // On a char boundary, so the result stays valid UTF-8.
+    let mut end = MAX_SQL_BYTES;
+    while end > 0 && !code.is_char_boundary(end) {
+        end -= 1;
+    }
+    format!("{}\n-- … truncated by Windmill …", &code[..end])
+}
+
+/// One ingested dbt node, ready to be written to `dbt_node`.
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Default)]
+#[serde(default)]
+pub struct IngestedNode {
+    pub unique_id: String,
+    pub resource_type: String,
+    pub name: String,
+    pub asset_path: Option<String>,
+    pub materialized: Option<String>,
+    pub materialize_strategy: Option<String>,
+    pub unique_key: Option<String>,
+    pub tags: Vec<String>,
+    pub description: Option<String>,
+    pub test_kind: Option<String>,
+    pub test_column: Option<String>,
+    pub test_args: Option<serde_json::Value>,
+    pub severity: Option<String>,
+    pub attached_node: Option<String>,
+    pub columns: Option<serde_json::Value>,
+    pub freshness: Option<serde_json::Value>,
+    /// The transform itself, for the graph to render. The copy taken at
+    /// deploy: the file itself is in the script's module bundle.
+    pub raw_code: Option<String>,
+    pub original_file_path: Option<String>,
+}
+
+// Serde: an agent worker cannot write these tables directly, so it posts the
+// whole manifest to the server, which stores it with the same function the SQL
+// path uses.
+#[derive(Debug, Default, Serialize, Deserialize)]
+// `default`: these cross the wire for an agent worker, and a field the serializer
+// skips must not make the whole manifest unparseable on the other side.
+#[serde(default)]
+pub struct IngestedManifest {
+    pub nodes: Vec<IngestedNode>,
+    pub edges: Vec<(String, String)>,
+    /// The `asset` rows the owning script produces (models) and consumes
+    /// (sources) — what the lineage graph is drawn from.
+    pub assets: Vec<AssetWithAltAccessType>,
+    pub dbt_version: String,
+    pub adapter_type: String,
+}
+
+/// dbt's `materialized` mapped onto Windmill's write strategy.
+///
+/// The mapping is exact for the four strategies Windmill has, and deliberately
+/// `None` where dbt has no analogue: `view` produces a relation but performs no
+/// write, and `ephemeral` produces no relation at all.
+pub fn materialize_strategy_for(materialized: &str, has_unique_key: bool) -> Option<String> {
+    match materialized {
+        "table" | "seed" => Some("replace".to_string()),
+        // Any `unique_key` makes it a merge — including a composite one, whose
+        // columns `single_unique_key` cannot name. Reporting `append` for those
+        // would describe an upsert as an insert-only write.
+        "incremental" | "microbatch" => Some(match has_unique_key {
+            true => "merge".to_string(),
+            false => "append".to_string(),
+        }),
+        "snapshot" => Some("scd2".to_string()),
+        _ => None,
+    }
+}
+
+/// Whether dbt declared any `unique_key`, composite or not.
+fn has_unique_key(v: Option<&serde_json::Value>) -> bool {
+    match v {
+        Some(serde_json::Value::String(s)) => !s.is_empty(),
+        Some(serde_json::Value::Array(a)) => !a.is_empty(),
+        _ => false,
+    }
+}
+
+fn single_unique_key(v: Option<&serde_json::Value>) -> Option<String> {
+    match v {
+        Some(serde_json::Value::String(s)) if !s.is_empty() => Some(s.clone()),
+        // A composite key has no single-column analogue; leave it unmapped
+        // rather than silently picking the first column.
+        _ => None,
+    }
+}
+
+/// `dbt://` path of the relation a node resolves to, or `None` when it has
+/// none. Assembles the parts; `table_asset_path` owns the spelling.
+fn asset_path_for(
+    node: &ManifestNode,
+    warehouse: &str,
+    default_database: Option<&str>,
+) -> Option<String> {
+    node.relation_name.as_ref()?;
+    // `schema` is dbt's RESOLVED schema; `config.schema` is only the suffix
+    // `generate_schema_name` combines with the target's (`schema: snapshots` under
+    // `analytics` lands in `analytics_snapshots`). Keying on the config value names
+    // a relation that does not exist, invisibly, until nothing links.
+    let schema = node.schema.as_deref()?;
+    // `identifier` for a source, `alias` for a model; `name` only when neither
+    // is set. Using `name` for a source declared `name: orders, identifier:
+    // raw_orders` would key the asset on a relation that does not exist, so no
+    // native script reading `raw_orders` could ever join it.
+    let name = node
+        .identifier
+        .as_deref()
+        .or(node.alias.as_deref())
+        .unwrap_or(&node.name);
+    table_asset_path(
+        warehouse,
+        node.database.as_deref(),
+        schema,
+        name,
+        default_database,
+    )
+}
+
+/// `asset.path`'s column width. A `dbt://` key is the only asset path assembled
+/// from warehouse identifiers rather than from a Windmill path, so it is the
+/// only one that can outgrow the column.
+pub const MAX_ASSET_PATH_LEN: usize = 255;
+
+/// The one derivation of a `dbt://` path from a relation's parts.
+///
+/// Three call sites need it and they MUST agree: the manifest ingest (which
+/// creates the graph node), the live progress events, and the end-of-run
+/// settlement (which both record status against it). A site that derives it
+/// differently records progress against a path no node has, and nothing looks
+/// broken — the run succeeds, the graph just never moves.
+///
+/// The resource names the warehouse and its default database, so a relation in
+/// that database uses the plain three-segment spelling. One that overrode its
+/// database is genuinely elsewhere and qualifies its schema segment as
+/// `<database>.<schema>`, so two same-named relations cannot collapse. A project
+/// that owns its `profiles.yml` reports its target's database the same way, so
+/// both kinds of project spell one relation identically; only where a target
+/// leaves its database implicit does every relation qualify, because assuming
+/// they all share a database is what would collapse them.
+pub fn table_asset_path(
+    warehouse: &str,
+    database: Option<&str>,
+    schema: &str,
+    name: &str,
+    default_database: Option<&str>,
+) -> Option<String> {
+    let qualified = match database.map(str::trim).filter(|d| !d.is_empty()) {
+        Some(db) if !default_database.is_some_and(|d| d.eq_ignore_ascii_case(db)) => {
+            format!("{db}.{schema}")
+        }
+        _ => schema.to_string(),
+    };
+    // `/` is the segment boundary, and `canonicalize_table_asset_path` recovers
+    // the components from the LAST two — so an identifier carrying one (legal
+    // when quoted) moves that boundary: `("a/b", "c")` and `("a", "b/c")` both
+    // spell `<warehouse>/a/b/c` and two relations share one node, one lineage
+    // and one progress row. Refused rather than encoded: the `dbt://` spelling
+    // is a contract (docs/dbt-runtime.md, decision 11) that annotations and the
+    // frontend parse too. The relation keeps its manifest row and gets no asset,
+    // exactly as an over-long one does.
+    if qualified.contains('/') || name.contains('/') {
+        return None;
+    }
+    let path = canonicalize_table_asset_path(&format!("{warehouse}/{qualified}/{name}"));
+    // The bound lives HERE because all three derivations must agree, and it is
+    // the column's: `asset.path` is VARCHAR(255), counted in CHARACTERS, and a
+    // `dbt://` key is the only asset path assembled from warehouse identifiers
+    // rather than from a Windmill path. Over it, the relation keeps its manifest
+    // row and gets no asset — the alternative is Postgres rejecting the insert
+    // and taking the graph down, or one swallowed `value too long` per node.
+    (path.chars().count() <= MAX_ASSET_PATH_LEN).then_some(path)
+}
+
+/// Parse a `manifest.json` into rows, edges and asset usages.
+///
+/// `warehouse` is the workspace warehouse's NAME, which the profile
+/// target points at, e.g. `main`.
+/// `selected` is the node set the descriptor's `select`/`exclude` resolves to,
+/// as reported by dbt itself (`dbt ls`). `None` means the whole project. It
+/// scopes what this script is recorded as owning: a script that builds only
+/// `tag:nightly` must not register as the producer of every other model, or the
+/// graph shows it owning models it never touches. Running several scripts
+/// with different selections is the intended shape (docs/dbt-runtime.md,
+/// decision 6), and this is what makes them compose.
+pub fn ingest_manifest(
+    manifest: &Manifest,
+    warehouse: &str,
+    // The profile target's database. Nodes in it use the plain three-segment
+    // spelling; a node that overrode it qualifies its schema segment.
+    default_database: Option<&str>,
+    selected: Option<&std::collections::HashSet<String>>,
+) -> IngestedManifest {
+    let mut out = IngestedManifest {
+        dbt_version: manifest.metadata.dbt_version.clone(),
+        adapter_type: manifest.metadata.adapter_type.clone(),
+        ..Default::default()
+    };
+    let mut assets: HashMap<(AssetKind, String), AssetUsageAccessType> = HashMap::new();
+
+    // A source is this script's input only if something it builds reads it, or a
+    // narrowly-selected script claims reads on tables it never touches. Without a
+    // selection it builds everything, and a source nothing reads is still not an
+    // input. The same set answers the cross-config question below.
+    let direct_parents: std::collections::HashSet<&str> = {
+        let mut out = std::collections::HashSet::new();
+        let mut queue: Vec<&str> = manifest
+            .parent_map
+            .iter()
+            .filter(|(child, _)| selected.is_none_or(|sel| sel.contains(child.as_str())))
+            // Only what the script BUILDS establishes a dependency. Selecting a
+            // model also selects its tests, and a `relationships` test depends
+            // on the model it points at — so counting test parents would make a
+            // staging-only script subscribe to a mart it merely asserts against.
+            .filter(|(child, _)| {
+                manifest
+                    .nodes
+                    .get(*child)
+                    .is_some_and(|n| n.resource_type != "test")
+            })
+            .flat_map(|(_, parents)| parents.iter().map(|p| p.as_str()))
+            .collect();
+        let mut seen: std::collections::HashSet<&str> = queue.iter().copied().collect();
+        while let Some(parent) = queue.pop() {
+            // An ephemeral model is inlined as a CTE, so it produces nothing to
+            // depend on — but whatever IT reads is still this script's real
+            // input. Stopping at it loses the subscription entirely, and the
+            // model then shows no upstream edge to its actual source.
+            let is_ephemeral = manifest
+                .nodes
+                .get(parent)
+                .is_some_and(|n| n.relation_name.is_none());
+            if !is_ephemeral {
+                out.insert(parent);
+                continue;
+            }
+            for grandparent in manifest.parent_map.get(parent).into_iter().flatten() {
+                if seen.insert(grandparent.as_str()) {
+                    queue.push(grandparent.as_str());
+                }
+            }
+        }
+        out
+    };
+    for (unique_id, node) in manifest.nodes.iter().chain(manifest.sources.iter()) {
+        // Whether this script BUILDS the node, as opposed to depending on it. Direct
+        // parents are kept either way, because an edge needs both endpoints: drop
+        // one and the `ref()` reaching it has nothing to point at, leaving two
+        // relations with no line between them.
+        let is_selected = selected.is_none_or(|sel| sel.contains(unique_id.as_str()));
+        let keep = match node.resource_type.as_str() {
+            "source" => direct_parents.contains(unique_id.as_str()),
+            _ => is_selected || direct_parents.contains(unique_id.as_str()),
+        };
+        if !keep {
+            continue;
+        }
+        let asset_path = asset_path_for(node, warehouse, default_database);
+        let materialized = node
+            .config
+            .materialized
+            .clone()
+            .or(match node.resource_type.as_str() {
+                // Sources and seeds carry no `materialized` of their own but their
+                // physical nature is fixed.
+                "source" => Some("source".to_string()),
+                _ => None,
+            });
+        let unique_key = single_unique_key(node.config.unique_key.as_ref());
+        let test = node.test_metadata.as_ref();
+        out.nodes.push(IngestedNode {
+            unique_id: unique_id.clone(),
+            resource_type: node.resource_type.clone(),
+            name: node.name.clone(),
+            asset_path: asset_path.clone(),
+            materialize_strategy: materialized.as_deref().and_then(|m| {
+                materialize_strategy_for(m, has_unique_key(node.config.unique_key.as_ref()))
+            }),
+            materialized,
+            unique_key,
+            tags: node.tags.clone(),
+            description: node.description.clone().filter(|d| !d.is_empty()),
+            // A package's test keeps its own name (`dbt_utils.accepted_range`)
+            // so it is legible rather than silently dropped for not being one
+            // of the four generic kinds.
+            test_kind: test.map(|t| match t.namespace.as_deref() {
+                Some(ns) if !ns.is_empty() => format!("{ns}.{}", t.name),
+                _ => t.name.clone(),
+            }),
+            test_column: node.column_name.clone(),
+            test_args: test.map(|t| t.kwargs.clone()),
+            severity: node.config.severity.clone(),
+            attached_node: node.attached_node.clone(),
+            columns: (!node.columns.is_empty()).then(|| {
+                serde_json::json!(node
+                    .columns
+                    .iter()
+                    .map(|(k, v)| (k.clone(), v.description.clone().unwrap_or_default()))
+                    .collect::<BTreeMap<_, _>>())
+            }),
+            freshness: node.freshness.clone(),
+            // The transform the graph renders. Capped: a project can hold
+            // thousands of models and this is duplicated per deploy, so a
+            // pathological file is truncated rather than allowed to bloat the
+            // sidecar. Tests carry generated SQL nobody reads — skipped.
+            raw_code: (node.resource_type != "test")
+                .then(|| node.raw_code.clone())
+                .flatten()
+                .filter(|c| !c.trim().is_empty())
+                .map(|c| truncate_sql(&c)),
+            original_file_path: node.original_file_path.clone().filter(|p| !p.is_empty()),
+        });
+
+        // The dbt script writes what it materializes and reads its sources.
+        // Internal `ref()`s between its own models are lineage inside the
+        // project, not usages of the script — modelling them as reads would
+        // make the script depend on its own output.
+        let Some(path) = asset_path else { continue };
+        let access = match node.resource_type.as_str() {
+            // A parent kept only to anchor an edge is read, not written: this
+            // script's selection does not build it, and claiming the write would
+            // make two scripts splitting one project both own the same relation.
+            "model" | "snapshot" | "seed" if is_selected => AssetUsageAccessType::W,
+            "model" | "snapshot" | "seed" => AssetUsageAccessType::R,
+            "source" => AssetUsageAccessType::R,
+            _ => continue,
+        };
+        let key = (AssetKind::Dbt, path);
+        let merged = match (assets.get(&key), access) {
+            (Some(AssetUsageAccessType::R), AssetUsageAccessType::W)
+            | (Some(AssetUsageAccessType::W), AssetUsageAccessType::R) => AssetUsageAccessType::RW,
+            (Some(existing), _) => *existing,
+            (None, a) => a,
+        };
+        assets.insert(key, merged);
+    }
+
+    out.nodes.sort_by(|a, b| a.unique_id.cmp(&b.unique_id));
+
+    let kept: std::collections::HashSet<&str> =
+        out.nodes.iter().map(|n| n.unique_id.as_str()).collect();
+    // An ephemeral model is inlined as a CTE, so it is a node with no relation
+    // and nothing to draw. Its edges are still real lineage though: dropping
+    // `A -> E` and `E -> B` loses the `A -> B` the reader needs. Walk through
+    // ephemeral parents to the nearest ones that do have a relation.
+    let is_ephemeral = |id: &str| {
+        manifest
+            .nodes
+            .get(id)
+            .is_some_and(|n| n.relation_name.is_none() && n.resource_type != "test")
+    };
+    let physical_parents = |child: &str| -> Vec<String> {
+        let mut out = Vec::new();
+        let mut seen = std::collections::HashSet::new();
+        let mut queue: Vec<&str> = manifest
+            .parent_map
+            .get(child)
+            .into_iter()
+            .flatten()
+            .map(|p| p.as_str())
+            .collect();
+        while let Some(p) = queue.pop() {
+            if !seen.insert(p.to_string()) {
+                continue;
+            }
+            if is_ephemeral(p) {
+                queue.extend(
+                    manifest
+                        .parent_map
+                        .get(p)
+                        .into_iter()
+                        .flatten()
+                        .map(|g| g.as_str()),
+                );
+            } else if kept.contains(p) {
+                out.push(p.to_string());
+            }
+        }
+        out
+    };
+    for child in manifest.parent_map.keys() {
+        if !kept.contains(child.as_str()) || is_ephemeral(child) {
+            continue;
+        }
+        for parent in physical_parents(child) {
+            out.edges.push((parent, child.clone()));
+        }
+    }
+    out.edges.sort();
+
+    let mut assets: Vec<_> = assets.into_iter().collect();
+    assets.sort_by(|(a, _), (b, _)| a.cmp(b));
+    out.assets = assets
+        .into_iter()
+        .map(|((kind, path), access)| AssetWithAltAccessType {
+            path,
+            kind,
+            access_type: Some(access),
+            alt_access_type: None,
+            columns: None,
+        })
+        .collect();
+    out
+}
+
+/// Replace the stored manifest of one dbt script. Wipe-and-reinsert per ingest,
+/// so a model deleted upstream disappears from the graph on the next deploy.
+///
+/// See the mutator contract above: this authorizes nothing.
+pub async fn replace_dbt_manifest(
+    tx: &mut Transaction<'_, Postgres>,
+    workspace_id: &str,
+    script_path: &str,
+    // The deployed version this graph describes. Rows are keyed by it, so two
+    // versions of one path coexist and an old run can still be shown the project
+    // as it was when it ran.
+    script_hash: i64,
+    // The run this graph is a snapshot of, for a dynamic descriptor whose model
+    // set depends on its arguments. `None` is the version's own graph as
+    // deployed — what a static descriptor writes once and all of its runs read.
+    job_id: Option<uuid::Uuid>,
+    ingested: &IngestedManifest,
+    // Where the profile put these relations, so a later run can tell whether the
+    // resource has moved since — see the migration.
+    relation_root: &str,
+) -> Result<()> {
+    let job_id = job_id.unwrap_or(DEPLOYED_GRAPH);
+    let digest = graph_digest(ingested, relation_root);
+    if job_id != DEPLOYED_GRAPH {
+        // A snapshot earns its storage only by DIFFERING from the version's graph.
+        // Marking a descriptor dynamic is conservative — a `{{ }}` in `vars` says
+        // the arguments feed dbt, not that they change which models exist — so the
+        // usual dynamic run duplicates a picture the read falls back to anyway.
+        let deployed = sqlx::query_scalar!(
+            "SELECT digest FROM dbt_graph_snapshot
+              WHERE workspace_id = $1 AND script_path = $2 AND script_hash = $3
+                AND job_id = $4",
+            workspace_id,
+            script_path,
+            script_hash,
+            DEPLOYED_GRAPH,
+        )
+        .fetch_optional(&mut **tx)
+        .await?;
+        if deployed.as_deref() == Some(digest.as_str()) {
+            return Ok(());
+        }
+    }
+    // Scoped to THIS version AND this run: wiping the path would take every
+    // other version's graph with it, and wiping the version would take every
+    // other run's snapshot — both are what keying exists to prevent.
+    sqlx::query!(
+        "DELETE FROM dbt_node WHERE workspace_id = $1 AND script_path = $2
+           AND script_hash = $3 AND job_id = $4",
+        workspace_id,
+        script_path,
+        script_hash,
+        job_id
+    )
+    .execute(&mut **tx)
+    .await?;
+    sqlx::query!(
+        "DELETE FROM dbt_edge WHERE workspace_id = $1 AND script_path = $2
+           AND script_hash = $3 AND job_id = $4",
+        workspace_id,
+        script_path,
+        script_hash,
+        job_id
+    )
+    .execute(&mut **tx)
+    .await?;
+    // The marker, before the rows: a graph with no nodes at all is a legitimate
+    // answer for a dynamic run that disabled every model, and the reader must be
+    // able to tell it from a run that stored nothing.
+    sqlx::query!(
+        // The `WHERE` is not optional: a versioned graph's key is a PARTIAL unique
+        // index (its version-less sibling is keyed by job alone), and Postgres
+        // infers no arbiter from a partial index unless the statement repeats its
+        // predicate.
+        "INSERT INTO dbt_graph_snapshot
+           (workspace_id, script_path, script_hash, job_id, digest, ingested_at)
+         VALUES ($1, $2, $3, $4, $5, now())
+         ON CONFLICT (workspace_id, script_path, script_hash, job_id)
+           WHERE script_hash IS NOT NULL
+         DO UPDATE SET digest = EXCLUDED.digest, ingested_at = now()",
+        workspace_id,
+        script_path,
+        script_hash,
+        job_id,
+        digest
+    )
+    .execute(&mut **tx)
+    .await?;
+
+    insert_graph_rows(
+        tx,
+        workspace_id,
+        script_path,
+        Some(script_hash),
+        job_id,
+        ingested,
+    )
+    .await
+}
+
+/// The node and edge rows of one stored graph, whichever provenance keys it.
+///
+/// `script_hash` is `None` for a graph parsed from the editor's buffer, which
+/// names no deployed version and is keyed to its own preview job.
+async fn insert_graph_rows(
+    tx: &mut Transaction<'_, Postgres>,
+    workspace_id: &str,
+    script_path: &str,
+    script_hash: Option<i64>,
+    job_id: uuid::Uuid,
+    ingested: &IngestedManifest,
+) -> Result<()> {
+    // Batched: a manifest carries a row per model, test, seed and snapshot, and
+    // one awaited statement each made publication scale with database latency
+    // while holding this transaction. Chunked because Postgres binds at most
+    // 65535 parameters per statement.
+    for chunk in ingested.nodes.chunks(NODE_INSERT_CHUNK) {
+        let mut q = sqlx::QueryBuilder::new(
+            "INSERT INTO dbt_node (workspace_id, script_path, script_hash, job_id, unique_id, \
+             resource_type, name, asset_path, materialized, materialize_strategy, unique_key, \
+             tags, description, test_kind, test_column, test_args, severity, attached_node, \
+             columns, freshness, raw_code, original_file_path) ",
+        );
+        q.push_values(chunk, |mut b, n| {
+            b.push_bind(workspace_id)
+                .push_bind(script_path)
+                .push_bind(script_hash)
+                .push_bind(job_id)
+                .push_bind(&n.unique_id)
+                .push_bind(&n.resource_type)
+                .push_bind(&n.name)
+                .push_bind(&n.asset_path)
+                .push_bind(&n.materialized)
+                .push_bind(&n.materialize_strategy)
+                .push_bind(&n.unique_key)
+                .push_bind(&n.tags)
+                .push_bind(&n.description)
+                .push_bind(&n.test_kind)
+                .push_bind(&n.test_column)
+                .push_bind(&n.test_args)
+                .push_bind(&n.severity)
+                .push_bind(&n.attached_node)
+                .push_bind(&n.columns)
+                .push_bind(&n.freshness)
+                .push_bind(&n.raw_code)
+                .push_bind(&n.original_file_path);
+        });
+        q.build().execute(&mut **tx).await?;
+    }
+
+    for chunk in ingested.edges.chunks(EDGE_INSERT_CHUNK) {
+        let mut q = sqlx::QueryBuilder::new(
+            "INSERT INTO dbt_edge (workspace_id, script_path, script_hash, job_id, \
+             parent_unique_id, child_unique_id) ",
+        );
+        q.push_values(chunk, |mut b, (parent, child)| {
+            b.push_bind(workspace_id)
+                .push_bind(script_path)
+                .push_bind(script_hash)
+                .push_bind(job_id)
+                .push_bind(parent)
+                .push_bind(child);
+        });
+        q.push(" ON CONFLICT DO NOTHING");
+        q.build().execute(&mut **tx).await?;
+    }
+    Ok(())
+}
+
+/// How many buffer parses of one script, by one principal, keep their graph.
+///
+/// The editor reads back only the refresh it just launched, so one would do; the
+/// slack covers a session where several tabs or a retried job are in flight.
+pub const DBT_EDITOR_GRAPHS_KEPT: i64 = 5;
+
+/// Store the graph a `parse` of the EDITOR's buffer produced.
+///
+/// The third provenance: not the version's graph, and not a run's snapshot of a
+/// version. A buffer differs from what is deployed — that is the point of
+/// refreshing it — and a project being written may have no deployed version at
+/// all, so these rows carry no `script_hash` and are keyed to the preview job
+/// that parsed them. `GET /jobs/dbt_graph/{id}` is the only way back to them;
+/// nothing reaches them through the path, which is what keeps a `jobs:run`
+/// principal from rewriting a deployed project's graph.
+///
+/// Unlike a run's snapshot this is never suppressed by matching the deployed
+/// digest: the editor pins to its own job, so a buffer that happens to agree
+/// with the deploy must still leave something to pin to.
+///
+/// See the mutator contract above: this authorizes nothing.
+pub async fn replace_dbt_editor_graph(
+    tx: &mut Transaction<'_, Postgres>,
+    workspace_id: &str,
+    script_path: &str,
+    // The preview job that parsed the buffer, which is this graph's whole key.
+    job_id: uuid::Uuid,
+    // The identity that ran it, which is what the retention below is bounded
+    // per. A preview's PATH is chosen by a caller who needs only `jobs:run`, so
+    // a count per path alone would let one caller's parses evict the graphs of
+    // whoever is actually editing that script.
+    permissioned_as: &str,
+    ingested: &IngestedManifest,
+    relation_root: &str,
+) -> Result<()> {
+    // By job alone, so re-executing one — a zombie recovered onto another
+    // worker — replaces its rows rather than colliding with them.
+    for table in ["dbt_node", "dbt_edge", "dbt_graph_snapshot"] {
+        sqlx::query(&format!(
+            "DELETE FROM {table} WHERE workspace_id = $1 AND job_id = $2 AND script_hash IS NULL"
+        ))
+        .bind(workspace_id)
+        .bind(job_id)
+        .execute(&mut **tx)
+        .await?;
+    }
+    // The marker, before the rows: a project whose models are all disabled
+    // parses to an empty graph, and the reader has to tell that from a refresh
+    // that stored nothing.
+    sqlx::query!(
+        "INSERT INTO dbt_graph_snapshot
+           (workspace_id, script_path, script_hash, job_id, permissioned_as, digest, ingested_at)
+         VALUES ($1, $2, NULL, $3, $4, $5, now())",
+        workspace_id,
+        script_path,
+        job_id,
+        permissioned_as,
+        graph_digest(ingested, relation_root),
+    )
+    .execute(&mut **tx)
+    .await?;
+    insert_graph_rows(tx, workspace_id, script_path, None, job_id, ingested).await?;
+    // Bounded here rather than by a sweep: a refresh is a click, and the ones
+    // before it are dead the moment this one lands. The rows go with their
+    // marker, in this transaction, so no restart can strand either half.
+    //
+    // Per (path, PRINCIPAL): the path is the caller's to name, so a bound over
+    // it alone is a way to retire someone else's refreshes with nothing but
+    // `jobs:run`. Each identity reclaims only its own.
+    let retired: Vec<uuid::Uuid> = sqlx::query_scalar!(
+        "DELETE FROM dbt_graph_snapshot g
+          WHERE g.workspace_id = $1 AND g.script_path = $2 AND g.script_hash IS NULL
+            AND g.permissioned_as IS NOT DISTINCT FROM $4
+            AND g.job_id NOT IN (
+              SELECT job_id FROM dbt_graph_snapshot
+               WHERE workspace_id = $1 AND script_path = $2 AND script_hash IS NULL
+                 AND permissioned_as IS NOT DISTINCT FROM $4
+               ORDER BY ingested_at DESC LIMIT $3)
+        RETURNING g.job_id",
+        workspace_id,
+        script_path,
+        DBT_EDITOR_GRAPHS_KEPT,
+        permissioned_as,
+    )
+    .fetch_all(&mut **tx)
+    .await?;
+    if !retired.is_empty() {
+        for table in ["dbt_node", "dbt_edge"] {
+            sqlx::query(&format!(
+                "DELETE FROM {table} WHERE workspace_id = $1 AND job_id = ANY($2) \
+                   AND script_hash IS NULL"
+            ))
+            .bind(workspace_id)
+            .bind(&retired)
+            .execute(&mut **tx)
+            .await?;
+        }
+    }
+    Ok(())
+}
+
+/// Rows per statement, chosen so 22 columns stay under Postgres's 65535-bind
+/// ceiling with room to spare.
+const NODE_INSERT_CHUNK: usize = 2000;
+/// Six columns, so the same ceiling allows far more.
+const EDGE_INSERT_CHUNK: usize = 8000;
+
+/// Clear one VERSION's graph: the delete-by-hash route, which only soft-deletes
+/// its `script` row and so fires no cascade, and the ingest that finds no
+/// warehouse identity left to key assets on. Both target a single `hash`, and the
+/// other versions of the path stay live and keep needing their own models, SQL
+/// and lineage.
+///
+/// There is no path-wide sibling. The routes that remove the `script` rows
+/// outright let the tables' `ON DELETE CASCADE` take the graph, which is also
+/// what keeps them from locking it ahead of the script row and deadlocking with
+/// a concurrent publication.
+///
+/// See the mutator contract above: this authorizes nothing.
+pub async fn clear_dbt_manifest_version(
+    tx: &mut Transaction<'_, Postgres>,
+    workspace_id: &str,
+    script_path: &str,
+    script_hash: i64,
+) -> Result<()> {
+    sqlx::query!(
+        "DELETE FROM dbt_node WHERE workspace_id = $1 AND script_path = $2 AND script_hash = $3",
+        workspace_id,
+        script_path,
+        script_hash
+    )
+    .execute(&mut **tx)
+    .await?;
+    sqlx::query!(
+        "DELETE FROM dbt_edge WHERE workspace_id = $1 AND script_path = $2 AND script_hash = $3",
+        workspace_id,
+        script_path,
+        script_hash
+    )
+    .execute(&mut **tx)
+    .await?;
+    // The marker too, and every job's: a marker left standing for rows that are
+    // gone is read as a snapshot, and its digest still answers the suppression
+    // check — so an identical run would write nothing and then render an empty
+    // graph.
+    sqlx::query!(
+        "DELETE FROM dbt_graph_snapshot
+          WHERE workspace_id = $1 AND script_path = $2 AND script_hash = $3",
+        workspace_id,
+        script_path,
+        script_hash
+    )
+    .execute(&mut **tx)
+    .await?;
+    Ok(())
+}
+
+/// Drop the EDITOR graphs of one path, for the routes that delete the script
+/// outright.
+///
+/// The versioned rows need no such call: they cascade off `script`, which is
+/// what keeps a delete from locking the graph ahead of the script row. A
+/// version-less row cannot ride that cascade — its `script_hash` is NULL, which
+/// satisfies the composite foreign key without referencing anything — so
+/// retiring the path is the one thing that has to reach them by hand.
+///
+/// Call it AFTER the `script` delete, like the retry state beside it: every dbt
+/// writer takes the script row first, so a sidecar taken ahead of it deadlocks
+/// one of the pair.
+///
+/// See the mutator contract above: this authorizes nothing.
+pub async fn clear_dbt_editor_graphs(
+    tx: &mut Transaction<'_, Postgres>,
+    workspace_id: &str,
+    script_path: &str,
+) -> Result<()> {
+    for table in ["dbt_node", "dbt_edge", "dbt_graph_snapshot"] {
+        sqlx::query(&format!(
+            "DELETE FROM {table}
+              WHERE workspace_id = $1 AND script_path = $2 AND script_hash IS NULL"
+        ))
+        .bind(workspace_id)
+        .bind(script_path)
+        .execute(&mut **tx)
+        .await?;
+    }
+    Ok(())
+}
+
+/// Move a dbt script's saved retry state to its new path.
+///
+/// Keyed by path like the sidecar, but unlike the sidecar it is not
+/// regenerated by anything: the deploy re-ingests a manifest, while these are
+/// the results of a run that already happened. Clearing on rename would throw
+/// away a resumable failure for a cosmetic change, so it travels instead.
+///
+/// See the mutator contract above: this authorizes nothing.
+pub async fn move_dbt_run_state(
+    tx: &mut Transaction<'_, Postgres>,
+    workspace_id: &str,
+    old_path: &str,
+    new_path: &str,
+) -> Result<()> {
+    // The destination may already hold state from a script that lived there
+    // before; the incoming row is the newer truth for this project.
+    sqlx::query!(
+        "DELETE FROM dbt_run_state WHERE workspace_id = $1 AND script_path = $2",
+        workspace_id,
+        new_path
+    )
+    .execute(&mut **tx)
+    .await?;
+    sqlx::query!(
+        "UPDATE dbt_run_state SET script_path = $3 WHERE workspace_id = $1 AND script_path = $2",
+        workspace_id,
+        old_path,
+        new_path
+    )
+    .execute(&mut **tx)
+    .await?;
+    Ok(())
+}
+
+/// Drop the saved retry state, but only once NO live version of the path is
+/// left.
+///
+/// `dbt_run_state`'s key is the path and the principal — one saved run per script
+/// per identity it executes as, not
+/// one per version — so archiving or deleting a single version must not take it
+/// with them: the live version's `dbt retry` would be refused and the
+/// partial-failure resume lost. It does not need to be version-scoped either,
+/// because `identity` already refuses a resume whose project, warehouse or
+/// engine moved.
+///
+/// See the mutator contract above: this authorizes nothing.
+pub async fn clear_dbt_run_state_if_path_retired(
+    tx: &mut Transaction<'_, Postgres>,
+    workspace_id: &str,
+    script_path: &str,
+) -> Result<()> {
+    sqlx::query!(
+        "DELETE FROM dbt_run_state WHERE workspace_id = $1 AND script_path = $2
+           AND NOT EXISTS (SELECT 1 FROM script
+                            WHERE workspace_id = $1 AND path = $2
+                              AND deleted = false AND archived = false)",
+        workspace_id,
+        script_path
+    )
+    .execute(&mut **tx)
+    .await?;
+    Ok(())
+}
+
+/// Drop a dbt script's saved retry state.
+///
+/// Archive and delete: `run_results` is not small, the invocation arguments it
+/// carries are the user's, and a script later created at the same path would
+/// otherwise inherit a stranger's resumable failure.
+///
+/// See the mutator contract above: this authorizes nothing.
+pub async fn clear_dbt_run_state(
+    tx: &mut Transaction<'_, Postgres>,
+    workspace_id: &str,
+    script_path: &str,
+) -> Result<()> {
+    sqlx::query!(
+        "DELETE FROM dbt_run_state WHERE workspace_id = $1 AND script_path = $2",
+        workspace_id,
+        script_path
+    )
+    .execute(&mut **tx)
+    .await?;
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    // Captured from a real `dbt parse` (dbt-core 1.12 / postgres); the same
+    // shape is emitted by dbt-core 2.0 (manifest schema v12 in both).
+    const MANIFEST: &str = r#"{
+      "metadata": {"dbt_version": "1.12.0", "adapter_type": "postgres", "project_name": "jaffle_shop"},
+      "nodes": {
+        "model.jaffle_shop.customers": {
+          "resource_type": "model", "name": "customers", "alias": "customers",
+          "schema": "jaffle_dbt", "relation_name": "\"wh\".\"jaffle_dbt\".\"customers\"",
+          "tags": ["nightly"], "config": {"materialized": "table"},
+          "columns": {"customer_id": {"description": "pk"}},
+          "raw_code": "select * from {{ ref('stg_customers') }}",
+          "original_file_path": "models/customers.sql"
+        },
+        "model.jaffle_shop.orders_daily": {
+          "resource_type": "model", "name": "orders_daily", "alias": "orders_daily",
+          "schema": "jaffle_dbt", "relation_name": "\"wh\".\"jaffle_dbt\".\"orders_daily\"",
+          "config": {"materialized": "incremental", "unique_key": "order_id"}
+        },
+        "model.jaffle_shop.order_events": {
+          "resource_type": "model", "name": "order_events", "alias": "order_events",
+          "schema": "jaffle_dbt", "database": "archive",
+          "relation_name": "\"archive\".\"jaffle_dbt\".\"order_events\"",
+          "config": {"materialized": "incremental"}
+        },
+        "model.jaffle_shop.composite_key": {
+          "resource_type": "model", "name": "composite_key", "alias": "composite_key",
+          "schema": "jaffle_dbt", "database": "wh",
+          "relation_name": "\"wh\".\"jaffle_dbt\".\"composite_key\"",
+          "config": {"materialized": "incremental", "unique_key": ["a", "b"]}
+        },
+        "model.jaffle_shop.stg_customers": {
+          "resource_type": "model", "name": "stg_customers", "alias": "stg_customers",
+          "schema": "jaffle_dbt", "relation_name": "\"wh\".\"jaffle_dbt\".\"stg_customers\"",
+          "config": {"materialized": "view"}
+        },
+        "test.jaffle_shop.relationships_orders_daily_customer_id.ab": {
+          "resource_type": "test", "name": "relationships_orders_daily_customer_id",
+          "column_name": "customer_id", "attached_node": "model.jaffle_shop.orders_daily",
+          "config": {"materialized": "test", "severity": "ERROR"},
+          "test_metadata": {"name": "relationships",
+                            "kwargs": {"to": "ref('stg_customers')", "field": "customer_id"},
+                            "namespace": null}
+        },
+        "model.jaffle_shop.ephemeral_helper": {
+          "resource_type": "model", "name": "ephemeral_helper", "schema": "jaffle_dbt",
+          "relation_name": null, "config": {"materialized": "ephemeral"}
+        },
+        "snapshot.jaffle_shop.customers_snapshot": {
+          "resource_type": "snapshot", "name": "customers_snapshot", "alias": "customers_snapshot",
+          "schema": "jaffle_dbt_snapshots",
+          "relation_name": "\"wh\".\"jaffle_dbt_snapshots\".\"customers_snapshot\"",
+          "config": {"materialized": "snapshot", "unique_key": "customer_id",
+                     "schema": "snapshots"}
+        },
+        "test.jaffle_shop.unique_customers_customer_id.c5": {
+          "resource_type": "test", "name": "unique_customers_customer_id",
+          "column_name": "customer_id", "attached_node": "model.jaffle_shop.customers",
+          "config": {"materialized": "test", "severity": "ERROR"},
+          "test_metadata": {"name": "unique", "kwargs": {"column_name": "customer_id"}, "namespace": null}
+        },
+        "test.jaffle_shop.accepted_values_orders_daily_status.14": {
+          "resource_type": "test", "name": "accepted_values_orders_daily_status",
+          "column_name": "status", "attached_node": "model.jaffle_shop.orders_daily",
+          "config": {"materialized": "test", "severity": "ERROR"},
+          "test_metadata": {"name": "accepted_values",
+                            "kwargs": {"values": ["completed"], "column_name": "status"},
+                            "namespace": null}
+        },
+        "test.jaffle_shop.dbt_utils_accepted_range_customers_n_orders__0.cb": {
+          "resource_type": "test", "name": "dbt_utils_accepted_range_customers_n_orders__0",
+          "column_name": "n_orders", "attached_node": "model.jaffle_shop.customers",
+          "config": {"materialized": "test", "severity": "warn"},
+          "test_metadata": {"name": "accepted_range", "kwargs": {"min_value": 0},
+                            "namespace": "dbt_utils"}
+        }
+      },
+      "sources": {
+        "source.jaffle_shop.jaffle_raw.raw_orders": {
+          "resource_type": "source", "name": "orders", "identifier": "raw_orders",
+          "schema": "jaffle_raw",
+          "relation_name": "\"wh\".\"jaffle_raw\".\"raw_orders\"",
+          "freshness": {"warn_after": {"count": 1000, "period": "day"}}
+        }
+      },
+      "parent_map": {
+        "model.jaffle_shop.customers": ["model.jaffle_shop.orders_daily"],
+        "model.jaffle_shop.orders_daily": ["source.jaffle_shop.jaffle_raw.raw_orders"],
+        "model.jaffle_shop.stg_customers": ["source.jaffle_shop.jaffle_raw.raw_customers"],
+        "test.jaffle_shop.relationships_orders_daily_customer_id.ab":
+          ["model.jaffle_shop.orders_daily", "model.jaffle_shop.stg_customers"]
+      }
+    }"#;
+
+    fn ingested() -> IngestedManifest {
+        let m: Manifest = serde_json::from_str(MANIFEST).unwrap();
+        ingest_manifest(&m, "main", Some("wh"), None)
+    }
+
+    fn node<'a>(i: &'a IngestedManifest, id: &str) -> &'a IngestedNode {
+        i.nodes.iter().find(|n| n.unique_id == id).unwrap()
+    }
+
+    // dbt's four materializations must land on Windmill's four write
+    // strategies, or the graph shows a model's write semantics wrong.
+    #[test]
+    fn materializations_map_onto_write_strategies() {
+        let i = ingested();
+        for (id, expected) in [
+            ("model.jaffle_shop.customers", Some("replace")),
+            ("model.jaffle_shop.orders_daily", Some("merge")),
+            ("model.jaffle_shop.order_events", Some("append")),
+            // A composite key is still an upsert; only its columns are
+            // unmappable, so `unique_key` stays NULL while the strategy is merge.
+            ("model.jaffle_shop.composite_key", Some("merge")),
+            ("snapshot.jaffle_shop.customers_snapshot", Some("scd2")),
+            // `ephemeral` is inlined as a CTE and writes nothing; `view`
+            // produces a relation but performs no write. Neither has a
+            // strategy, and inventing one would misreport the model.
+            ("model.jaffle_shop.ephemeral_helper", None),
+        ] {
+            assert_eq!(
+                node(&i, id).materialize_strategy.as_deref(),
+                expected,
+                "{id}"
+            );
+        }
+    }
+
+    // The four dbt generic tests are the four `// data_test` kinds. Package
+    // tests keep their namespaced name instead of being dropped.
+    #[test]
+    fn generic_tests_carry_their_kind_column_and_severity() {
+        let i = ingested();
+        let unique = node(&i, "test.jaffle_shop.unique_customers_customer_id.c5");
+        assert_eq!(unique.test_kind.as_deref(), Some("unique"));
+        assert_eq!(unique.test_column.as_deref(), Some("customer_id"));
+        assert_eq!(
+            unique.attached_node.as_deref(),
+            Some("model.jaffle_shop.customers")
+        );
+        assert_eq!(unique.severity.as_deref(), Some("ERROR"));
+
+        let av = node(
+            &i,
+            "test.jaffle_shop.accepted_values_orders_daily_status.14",
+        );
+        assert_eq!(av.test_kind.as_deref(), Some("accepted_values"));
+        assert_eq!(av.test_args.as_ref().unwrap()["values"][0], "completed");
+
+        let pkg = node(
+            &i,
+            "test.jaffle_shop.dbt_utils_accepted_range_customers_n_orders__0.cb",
+        );
+        assert_eq!(pkg.test_kind.as_deref(), Some("dbt_utils.accepted_range"));
+        // dbt-core 1.x echoes the author's casing, 2.x uppercases it — readers
+        // must compare case-insensitively.
+        assert_eq!(pkg.severity.as_deref(), Some("warn"));
+    }
+
+    // A source's `name` is what `source()` refers to; its `identifier` is the
+    // table. Keying on the logical name would name a relation that does not
+    // exist, so nothing reading the real one could ever join it.
+    #[test]
+    fn sources_key_on_their_identifier_not_their_logical_name() {
+        let i = ingested();
+        assert_eq!(
+            node(&i, "source.jaffle_shop.jaffle_raw.raw_orders")
+                .asset_path
+                .as_deref(),
+            Some("main/jaffle_raw/raw_orders")
+        );
+    }
+
+    // The whole reason for `dbt://`: a model's key is the physical relation,
+    // so a native script reading the same table lands on the same node.
+    // Identifiers are canonicalized, and the database appears only when a model
+    // overrode the target's.
+    #[test]
+    fn models_become_table_assets_keyed_on_the_warehouse() {
+        let i = ingested();
+        assert_eq!(
+            node(&i, "model.jaffle_shop.customers")
+                .asset_path
+                .as_deref(),
+            Some("main/jaffle_dbt/customers")
+        );
+        // `order_events` overrode its database. Dropping that would collapse it
+        // onto a same-named relation in the target's own database, merging their
+        // lineage and cascading into each other's consumers.
+        assert_eq!(
+            node(&i, "model.jaffle_shop.order_events")
+                .asset_path
+                .as_deref(),
+            Some("main/archive.jaffle_dbt/order_events")
+        );
+        // `config.schema` on the snapshot is the custom SUFFIX (`snapshots`);
+        // the relation actually lives in the resolved `jaffle_dbt_snapshots`.
+        // Keying on the config value would name a table that does not exist.
+        assert_eq!(
+            node(&i, "snapshot.jaffle_shop.customers_snapshot")
+                .asset_path
+                .as_deref(),
+            Some("main/jaffle_dbt_snapshots/customers_snapshot")
+        );
+        // No physical relation, no asset: nothing to key a `dbt://` path on.
+        assert_eq!(
+            node(&i, "model.jaffle_shop.ephemeral_helper").asset_path,
+            None
+        );
+        assert_eq!(
+            node(&i, "test.jaffle_shop.unique_customers_customer_id.c5").asset_path,
+            None
+        );
+    }
+
+    // `/` is what separates the segments a `dbt://` key is read back by, and a
+    // quoted identifier may legally contain one — so two different relations
+    // would spell the same key and share a node, its lineage and its progress.
+    #[test]
+    fn a_relation_whose_identifier_carries_a_separator_gets_no_key() {
+        // The collision: `schema="a/b", name="c"` against `schema="a", name="b/c"`.
+        assert_eq!(table_asset_path("main", None, "a/b", "c", None), None);
+        assert_eq!(table_asset_path("main", None, "a", "b/c", None), None);
+        // A qualifying database is part of the same segment, so it counts too.
+        assert_eq!(
+            table_asset_path("main", Some("d/b"), "s", "t", Some("other")),
+            None
+        );
+        assert_eq!(
+            table_asset_path("main", None, "a", "c", None).as_deref(),
+            Some("main/a/c")
+        );
+    }
+
+    // Models are what the script produces; sources are what it consumes. Get
+    // this backwards and the cascade either never fires or fires on itself.
+    #[test]
+    fn script_writes_its_models_and_reads_its_sources() {
+        let i = ingested();
+        let got: Vec<(String, Option<AssetUsageAccessType>)> = i
+            .assets
+            .iter()
+            .map(|a| {
+                assert_eq!(a.kind, AssetKind::Dbt);
+                (a.path.clone(), a.access_type)
+            })
+            .collect();
+        assert_eq!(
+            got,
+            vec![
+                (
+                    "main/archive.jaffle_dbt/order_events".into(),
+                    Some(AssetUsageAccessType::W)
+                ),
+                (
+                    "main/jaffle_dbt/composite_key".into(),
+                    Some(AssetUsageAccessType::W)
+                ),
+                (
+                    "main/jaffle_dbt/customers".into(),
+                    Some(AssetUsageAccessType::W)
+                ),
+                (
+                    "main/jaffle_dbt/orders_daily".into(),
+                    Some(AssetUsageAccessType::W)
+                ),
+                (
+                    "main/jaffle_dbt/stg_customers".into(),
+                    Some(AssetUsageAccessType::W)
+                ),
+                (
+                    "main/jaffle_dbt_snapshots/customers_snapshot".into(),
+                    Some(AssetUsageAccessType::W)
+                ),
+                (
+                    "main/jaffle_raw/raw_orders".into(),
+                    Some(AssetUsageAccessType::R)
+                ),
+            ]
+        );
+    }
+
+    // Splitting a project across scripts only composes if the seam still draws:
+    // a script selecting a model whose parent another script builds must keep
+    // that parent as an endpoint, or the two relations sit on the graph with no
+    // line between them and the lineage silently stops at the selection border.
+    #[test]
+    fn a_parent_outside_the_selection_still_anchors_its_edge() {
+        let m: Manifest = serde_json::from_str(MANIFEST).unwrap();
+        // `customers` depends on `orders_daily`, which this script does not build.
+        let sel: std::collections::HashSet<String> = ["model.jaffle_shop.customers".to_string()]
+            .into_iter()
+            .collect();
+        let i = ingest_manifest(&m, "main", Some("wh"), Some(&sel));
+        let owned: Vec<&str> = i
+            .assets
+            .iter()
+            .filter(|a| a.access_type == Some(AssetUsageAccessType::W))
+            .map(|a| a.path.as_str())
+            .collect();
+        // The parent is NOT claimed as a write: the other script builds it.
+        assert_eq!(owned, vec!["main/jaffle_dbt/customers"]);
+        let reads: Vec<&str> = i
+            .assets
+            .iter()
+            .filter(|a| a.access_type == Some(AssetUsageAccessType::R))
+            .map(|a| a.path.as_str())
+            .collect();
+        assert!(
+            reads.contains(&"main/jaffle_dbt/orders_daily"),
+            "the unselected parent is an input, got {reads:?}"
+        );
+        assert!(
+            i.edges.contains(&(
+                "model.jaffle_shop.orders_daily".to_string(),
+                "model.jaffle_shop.customers".to_string()
+            )),
+            "the cross-selection edge must survive, got {:?}",
+            i.edges
+        );
+    }
+
+    // A script that builds a subset must not register as the producer of the
+    // whole project: two scripts splitting one project would each claim all of it.
+    #[test]
+    fn selection_scopes_what_the_script_owns() {
+        let m: Manifest = serde_json::from_str(MANIFEST).unwrap();
+        let sel: std::collections::HashSet<String> = ["model.jaffle_shop.orders_daily".to_string()]
+            .into_iter()
+            .collect();
+        let i = ingest_manifest(&m, "main", Some("wh"), Some(&sel));
+        let owned: Vec<&str> = i
+            .assets
+            .iter()
+            .filter(|a| a.access_type == Some(AssetUsageAccessType::W))
+            .map(|a| a.path.as_str())
+            .collect();
+        assert_eq!(owned, vec!["main/jaffle_dbt/orders_daily"]);
+        // The source the selected model reads is kept — that is how the graph
+        // knows the input. A source only unselected models read is NOT, or the
+        // script would subscribe to tables it never touches.
+        let reads: Vec<&str> = i
+            .assets
+            .iter()
+            .filter(|a| a.access_type == Some(AssetUsageAccessType::R))
+            .map(|a| a.path.as_str())
+            .collect();
+        assert_eq!(reads, vec!["main/jaffle_raw/raw_orders"]);
+        // Edges to nodes this script does not own are dropped with them.
+        assert_eq!(
+            i.edges,
+            vec![(
+                "source.jaffle_shop.jaffle_raw.raw_orders".to_string(),
+                "model.jaffle_shop.orders_daily".to_string()
+            )]
+        );
+    }
+
+    // The graph renders a model by its own SQL, so the ingest has to carry it —
+    // and a test's generated body is noise nobody reads.
+    #[test]
+    fn models_carry_their_sql_and_tests_do_not() {
+        let i = ingested();
+        let m = node(&i, "model.jaffle_shop.customers");
+        assert!(
+            m.raw_code.as_deref().is_some_and(|c| !c.is_empty()),
+            "{:?}",
+            m.raw_code
+        );
+        assert_eq!(
+            m.original_file_path.as_deref(),
+            Some("models/customers.sql")
+        );
+        let t = i.nodes.iter().find(|n| n.resource_type == "test").unwrap();
+        assert_eq!(t.raw_code, None);
+    }
+
+    // A read is an upstream edge, so a source no model reads must not
+    // become one — otherwise loading an unused table dispatches the whole dbt
+    // script. This holds for the unselected, whole-project case too, which is
+    // the common one.
+    #[test]
+    fn a_source_nothing_reads_is_not_an_input() {
+        let mut v: serde_json::Value = serde_json::from_str(MANIFEST).unwrap();
+        v["sources"]["source.jaffle_shop.jaffle_raw.unused"] = serde_json::json!({
+            "resource_type": "source", "name": "unused", "identifier": "unused",
+            "schema": "jaffle_raw", "relation_name": "\"wh\".\"jaffle_raw\".\"unused\""
+        });
+        let m: Manifest = serde_json::from_value(v).unwrap();
+        let i = ingest_manifest(&m, "main", Some("wh"), None);
+        let reads: Vec<&str> = i
+            .assets
+            .iter()
+            .filter(|a| a.access_type == Some(AssetUsageAccessType::R))
+            .map(|a| a.path.as_str())
+            .collect();
+        assert!(
+            !reads.contains(&"main/jaffle_raw/unused"),
+            "unused source registered as a read: {reads:?}"
+        );
+        assert!(reads.contains(&"main/jaffle_raw/raw_orders"), "{reads:?}");
+    }
+
+    // Splitting a project across scripts only composes if the downstream one
+    // reads what the upstream one writes: without that read there is no edge
+    // so the seam between two scripts splitting one project still draws.
+    #[test]
+    fn a_selected_script_reads_the_upstream_models_another_script_builds() {
+        let m: Manifest = serde_json::from_str(MANIFEST).unwrap();
+        // `customers` is selected; its parent `orders_daily` is built elsewhere.
+        let sel: std::collections::HashSet<String> = ["model.jaffle_shop.customers".to_string()]
+            .into_iter()
+            .collect();
+        let i = ingest_manifest(&m, "main", Some("wh"), Some(&sel));
+        let by_access = |t: AssetUsageAccessType| -> Vec<&str> {
+            i.assets
+                .iter()
+                .filter(|a| a.access_type == Some(t))
+                .map(|a| a.path.as_str())
+                .collect()
+        };
+        assert_eq!(
+            by_access(AssetUsageAccessType::W),
+            vec!["main/jaffle_dbt/customers"]
+        );
+        assert_eq!(
+            by_access(AssetUsageAccessType::R),
+            vec!["main/jaffle_dbt/orders_daily"]
+        );
+
+        // Selecting a model also selects its tests, and the `relationships`
+        // test on orders_daily points at stg_customers. A script that only
+        // builds staging models must not end up subscribed to the mart it is
+        // merely asserted against.
+        let staging: std::collections::HashSet<String> = [
+            "model.jaffle_shop.stg_customers".to_string(),
+            "test.jaffle_shop.relationships_orders_daily_customer_id.ab".to_string(),
+        ]
+        .into_iter()
+        .collect();
+        let i = ingest_manifest(&m, "main", Some("wh"), Some(&staging));
+        assert!(
+            !i.assets.iter().any(|a| a.path.ends_with("/orders_daily")),
+            "a test's dependency must not become a read: {:?}",
+            i.assets.iter().map(|a| &a.path).collect::<Vec<_>>()
+        );
+    }
+
+    // An ephemeral parent is inlined as a CTE and produces nothing to depend on,
+    // but what IT reads is still the selected model's real input — stopping
+    // there loses the edge and the model shows no upstream.
+    #[test]
+    fn dependencies_traverse_through_ephemeral_parents() {
+        let m: Manifest = serde_json::from_str(
+            r#"{"nodes":{
+              "model.p.mart":{"resource_type":"model","name":"mart","alias":"mart",
+                "schema":"s","database":"wh","relation_name":"\"wh\".\"s\".\"mart\"",
+                "config":{"materialized":"table"}},
+              "model.p.helper":{"resource_type":"model","name":"helper","schema":"s",
+                "relation_name":null,"config":{"materialized":"ephemeral"}},
+              "model.p.base":{"resource_type":"model","name":"base","alias":"base",
+                "schema":"s","database":"wh","relation_name":"\"wh\".\"s\".\"base\"",
+                "config":{"materialized":"view"}}},
+              "parent_map":{"model.p.mart":["model.p.helper"],
+                            "model.p.helper":["model.p.base"]}}"#,
+        )
+        .unwrap();
+        let sel: std::collections::HashSet<String> =
+            ["model.p.mart".to_string()].into_iter().collect();
+        let i = ingest_manifest(&m, "main", Some("wh"), Some(&sel));
+        let reads: Vec<&str> = i
+            .assets
+            .iter()
+            .filter(|a| a.access_type == Some(AssetUsageAccessType::R))
+            .map(|a| a.path.as_str())
+            .collect();
+        assert_eq!(reads, vec!["main/s/base"]);
+    }
+
+    // `A -> ephemeral -> B` must still read as `A -> B`: the ephemeral node has
+    // no relation to draw, but the lineage it carries is real, and dropping both
+    // of its edges leaves the reader with none.
+    #[test]
+    fn lineage_contracts_through_ephemeral_models() {
+        let m: Manifest = serde_json::from_str(
+            r#"{"nodes":{
+              "model.p.a":{"resource_type":"model","name":"a","alias":"a","schema":"s",
+                "database":"wh","relation_name":"\"wh\".\"s\".\"a\"",
+                "config":{"materialized":"view"}},
+              "model.p.e":{"resource_type":"model","name":"e","schema":"s",
+                "relation_name":null,"config":{"materialized":"ephemeral"}},
+              "model.p.b":{"resource_type":"model","name":"b","alias":"b","schema":"s",
+                "database":"wh","relation_name":"\"wh\".\"s\".\"b\"",
+                "config":{"materialized":"table"}}},
+              "parent_map":{"model.p.e":["model.p.a"],"model.p.b":["model.p.e"]}}"#,
+        )
+        .unwrap();
+        let i = ingest_manifest(&m, "main", Some("wh"), None);
+        assert_eq!(
+            i.edges,
+            vec![("model.p.a".to_string(), "model.p.b".to_string())]
+        );
+    }
+
+    #[test]
+    fn ref_edges_come_from_the_parent_map() {
+        let i = ingested();
+        assert_eq!(
+            i.edges,
+            vec![
+                (
+                    "model.jaffle_shop.orders_daily".to_string(),
+                    "model.jaffle_shop.customers".to_string()
+                ),
+                // A test's own edges are kept — the graph renders them — even
+                // though they do not make the script depend on what they assert.
+                (
+                    "model.jaffle_shop.orders_daily".to_string(),
+                    "test.jaffle_shop.relationships_orders_daily_customer_id.ab".to_string()
+                ),
+                (
+                    "model.jaffle_shop.stg_customers".to_string(),
+                    "test.jaffle_shop.relationships_orders_daily_customer_id.ab".to_string()
+                ),
+                (
+                    "source.jaffle_shop.jaffle_raw.raw_orders".to_string(),
+                    "model.jaffle_shop.orders_daily".to_string()
+                ),
+            ]
+        );
+    }
+
+    /// The whole manifest crosses the wire when an agent worker publishes its
+    /// graph, so what `ingest_manifest` produces has to survive its own
+    /// serializer. A field skipped when empty and required on the way back makes
+    /// every publish a 422 — invisible to a normal worker, which writes the rows
+    /// directly.
+    #[test]
+    fn an_ingested_manifest_survives_the_agent_wire() {
+        let manifest: Manifest = serde_json::from_str(
+            r#"{"nodes":{"model.p.customers":{
+                 "resource_type":"model","name":"customers","alias":"customers",
+                 "schema":"analytics","database":"wh",
+                 "relation_name":"\"wh\".\"analytics\".\"customers\""}},
+               "parent_map":{"model.p.customers":[]}}"#,
+        )
+        .unwrap();
+        let ingested = ingest_manifest(&manifest, "main", Some("wh"), None);
+        assert!(!ingested.assets.is_empty(), "fixture must produce an asset");
+
+        let wire = serde_json::to_value(&ingested).unwrap();
+        let back: IngestedManifest = serde_json::from_value(wire.clone())
+            .unwrap_or_else(|e| panic!("agent publish would 422: {e}\npayload: {wire}"));
+        assert_eq!(back.nodes.len(), ingested.nodes.len());
+        assert_eq!(back.assets.len(), ingested.assets.len());
+        assert_eq!(back.assets[0].path, ingested.assets[0].path);
+    }
+}
+
+/// Record one model's state for THIS RUN.
+///
+/// NO AUTHORIZATION: writes whatever `w_id`/`job_id` it is given. Callers MUST
+/// already have established that the job is theirs — the API route takes the id
+/// from the token rather than the body for exactly this reason — and MUST pass a
+/// job that belongs to that workspace.
+///
+/// Alongside `record_materialization`, never instead of it: that table holds the
+/// current state of a relation, one row, and its `job_id` is only the last
+/// writer — two runs of a project building the same models overwrite each
+/// other's. The run page needs what THIS job did, so it gets its own rows.
+///
+/// Shared with the API because an agent worker has no database and posts its
+/// settled outcomes to a route that calls this same function — two spellings of
+/// the row would drift.
+pub async fn record_run_progress(
+    db: &crate::DB,
+    w_id: &str,
+    job_id: &uuid::Uuid,
+    asset_path: &str,
+    status: crate::materialization::MaterializationStatus,
+    row_count: Option<i64>,
+    error: Option<&str>,
+) {
+    let res = sqlx::query!(
+        "INSERT INTO dbt_run_progress
+           (workspace_id, job_id, asset_kind, asset_path, status, row_count, error, updated_at)
+         VALUES ($1, $2, 'dbt', $3, $4, $5, $6, now())
+         ON CONFLICT (workspace_id, job_id, asset_kind, asset_path)
+         DO UPDATE SET status = EXCLUDED.status, row_count = EXCLUDED.row_count,
+                       error = EXCLUDED.error, updated_at = now()",
+        w_id,
+        job_id,
+        asset_path,
+        status as crate::materialization::MaterializationStatus,
+        row_count,
+        error,
+    )
+    .execute(db)
+    .await;
+    if let Err(e) = res {
+        // Progress is a display, not the run: a failure here must not fail a
+        // build that is otherwise fine.
+        tracing::warn!("recording dbt run progress for {asset_path}: {e:#}");
+    }
+}
+
+/// One settled node, posted by a worker that has no database.
+#[derive(serde::Serialize, serde::Deserialize)]
+pub struct DbtRunProgressRequest {
+    pub asset_path: String,
+    pub status: crate::materialization::MaterializationStatus,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub row_count: Option<i64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+}
diff --git a/backend/windmill-common/src/deploy_origin.rs b/backend/windmill-common/src/deploy_origin.rs
new file mode 100644
index 0000000000..2f37ec5a8b
--- /dev/null
+++ b/backend/windmill-common/src/deploy_origin.rs
@@ -0,0 +1,130 @@
+/*
+ * Author: Ruben Fiszel
+ * Copyright: Windmill Labs, Inc 2022
+ * This file and its contents are licensed under the AGPLv3 License.
+ * Please see the included NOTICE for copyright information and
+ * LICENSE-AGPL for a copy of the license.
+ */
+
+//! Where a deploy event came from, for the fork tally (`workspace_diff` — see the
+//! `workspace_diff_last_event` migration for what the tally does with it).
+//!
+//! A client that applies a state computed elsewhere (a git-sync pull, a
+//! workspace-to-workspace deploy) says so with [`DEPLOY_ORIGIN_HEADER`]; the API
+//! scopes it for the request and the tally records it alongside the counters.
+//! Anything unmarked is [`DeployOrigin::Authored`].
+//!
+//! The flag is evidence for a UI offer, never authority. Claiming `sync` cannot
+//! make the merge propose a removal — that needs `authored` — but it is not inert
+//! either: `compare_workspaces` excludes a parent-only `sync` row from both sides
+//! of its `all_ahead_items_visible` comparison, so stamping `sync` on a row the
+//! caller cannot see suppresses the "changes not visible to your user" warning
+//! that `authored` would raise. That flag is a visibility guarantee rather than an
+//! authorization boundary (each item is re-authorized at deploy time), and this
+//! matches how an untallied row already behaves, so it is bounded — but do not
+//! read the header as unable to affect anything.
+
+/// Request header a sync client sets to mark its writes as applied rather than
+/// authored. Only `sync` is meaningful; any other value reads as authored.
+pub const DEPLOY_ORIGIN_HEADER: &str = "x-windmill-deploy-origin";
+
+/// Who caused a deploy event at a path.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum DeployOrigin {
+    /// Written in this workspace by whoever made the request.
+    Authored,
+    /// Applied to this workspace by a sync (git-sync pull, cross-workspace deploy).
+    Sync,
+}
+
+impl DeployOrigin {
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            DeployOrigin::Authored => "authored",
+            DeployOrigin::Sync => "sync",
+        }
+    }
+
+    pub fn from_header_value(value: &str) -> Self {
+        if value.trim().eq_ignore_ascii_case("sync") {
+            DeployOrigin::Sync
+        } else {
+            DeployOrigin::Authored
+        }
+    }
+}
+
+/// What a deploy event did to the path it is recorded against.
+///
+/// Create and update are one value: at the point the tally runs, the write has
+/// already committed and no item kind carries a signal that separates them.
+/// Existence *after* the event is what the merge direction needs, and the
+/// comparison recomputes that per side (`exists_in_source` / `exists_in_fork`).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum DeployEventKind {
+    /// The path holds an item after the event.
+    Write,
+    /// The path holds no item after the event.
+    Delete,
+    /// The path was vacated by a rename to another path.
+    RenameFrom,
+}
+
+impl DeployEventKind {
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            DeployEventKind::Write => "write",
+            DeployEventKind::Delete => "delete",
+            DeployEventKind::RenameFrom => "rename_from",
+        }
+    }
+}
+
+tokio::task_local! {
+    static REQUEST_DEPLOY_ORIGIN: DeployOrigin;
+}
+
+/// Run `f` with `origin` as the origin of every deploy event it causes. Entered
+/// for every request, marked or not, so that being in scope at all means "this
+/// task is serving the write it is about to report" — see [`current`].
+///
+/// Task-locals do not cross `tokio::spawn`, and the tally is spawned: read
+/// [`current`] on the request task and carry the value into the spawned future.
+pub async fn scope<F: std::future::Future>(origin: DeployOrigin, f: F) -> F::Output {
+    REQUEST_DEPLOY_ORIGIN.scope(origin, f).await
+}
+
+/// The origin in scope, or `None` where there is no scope to read.
+///
+/// `None` is what a worker gets. A dependency job reports a deploy that
+/// committed before the job was even queued and finishes whenever lock
+/// generation finishes, so its reading of the workspace describes whoever wrote
+/// last, not its own event. Nothing outside a request can answer for that, so
+/// nothing outside a request is asked to.
+pub fn current() -> Option<DeployOrigin> {
+    REQUEST_DEPLOY_ORIGIN.try_with(|origin| *origin).ok()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The whole worker side of the tally rests on this: a deploy reported from
+    /// anywhere but the task that served it records no evidence, without each
+    /// call site remembering to say so.
+    #[tokio::test]
+    async fn origin_is_absent_outside_a_request() {
+        assert_eq!(current(), None);
+        assert_eq!(
+            scope(DeployOrigin::Authored, async { current() }).await,
+            Some(DeployOrigin::Authored)
+        );
+        // Not through a spawn, which is why `handle_deployment_metadata` reads it
+        // before spawning the tally rather than inside.
+        let spawned = scope(DeployOrigin::Sync, async {
+            tokio::spawn(async { current() }).await.unwrap()
+        })
+        .await;
+        assert_eq!(spawned, None);
+    }
+}
diff --git a/backend/windmill-common/src/email_oss.rs b/backend/windmill-common/src/email_oss.rs
index 2813ebe458..38d634699b 100644
--- a/backend/windmill-common/src/email_oss.rs
+++ b/backend/windmill-common/src/email_oss.rs
@@ -5,6 +5,11 @@ pub use crate::email_ee::*;
 #[cfg(not(feature = "private"))]
 use crate::server::Smtp;
 
+/// Every send below is a no-op in this build, so callers that report success to a user (the
+/// instance-settings SMTP test) have to say so instead of claiming the email went out.
+#[cfg(not(feature = "private"))]
+pub const SMTP_ENABLED: bool = false;
+
 #[cfg(not(feature = "private"))]
 pub async fn send_email(
     _subject: &str,
diff --git a/backend/windmill-common/src/folders.rs b/backend/windmill-common/src/folders.rs
index 0c40faf09f..2a6ba935b6 100644
--- a/backend/windmill-common/src/folders.rs
+++ b/backend/windmill-common/src/folders.rs
@@ -64,19 +64,25 @@ pub async fn resolve_folder_default_permissioned_as(
     Ok(None)
 }
 
-/// Email-valued variant of [`resolve_folder_default_permissioned_as`]. Used by
-/// flows and scripts which store `on_behalf_of_email` rather than `permissioned_as`.
-pub async fn resolve_folder_default_on_behalf_of_email(
+/// On-behalf-of variant of [`resolve_folder_default_permissioned_as`], for flows and
+/// scripts which store the identity as an `(email, permissioned_as)` pair.
+///
+/// Reads folder rules through the non-RLS pool and authorizes nothing: callers must already
+/// be authorized for `w_id`.
+pub async fn resolve_folder_default_on_behalf_of(
     db: &Pool<Postgres>,
     w_id: &str,
     path: &str,
-) -> Result<Option<String>> {
+) -> Result<Option<(String, String)>> {
     let Some(permissioned_as) = resolve_folder_default_permissioned_as(db, w_id, path).await?
     else {
         return Ok(None);
     };
-    let email = crate::users::get_email_from_permissioned_as(&permissioned_as, w_id, db).await?;
-    Ok(Some(email))
+    // Uncached: this pair is written straight onto the runnable, where a stale address would
+    // contradict the principal it is stored beside.
+    let email =
+        crate::users::get_email_from_permissioned_as_uncached(&permissioned_as, w_id, db).await?;
+    Ok(Some((email, permissioned_as)))
 }
 
 async fn ensure_permissioned_as_exists(
diff --git a/backend/windmill-common/src/global_settings.rs b/backend/windmill-common/src/global_settings.rs
index 427077fdb9..c9b5a46989 100644
--- a/backend/windmill-common/src/global_settings.rs
+++ b/backend/windmill-common/src/global_settings.rs
@@ -123,7 +123,8 @@ pub const GITHUB_APP_WEBHOOK_BASE_URL_SETTING: &str = "github_app_webhook_base_u
 /// reconcile logs.
 pub fn validate_webhook_base_url(value: &str) -> Result<(), String> {
     let value = value.trim();
-    let url = url::Url::parse(value).map_err(|e| format!("must be an absolute http(s) URL: {e}"))?;
+    let url =
+        url::Url::parse(value).map_err(|e| format!("must be an absolute http(s) URL: {e}"))?;
     if !url.username().is_empty() || url.password().is_some() {
         return Err(
             "must not embed a username or password: the receiver URL is stored in workspace settings, where it is readable by workspace admins".to_string(),
@@ -298,6 +299,7 @@ pub const ENV_SETTINGS: &[&str] = &[
     "GLOBAL_ERROR_HANDLER_PATH_IN_ADMINS_WORKSPACE",
     "MAX_WAIT_FOR_SIGINT",
     "MAX_WAIT_FOR_SIGTERM",
+    "JOB_OOM_SCORE_ADJ",
     "WORKER_GROUP",
     "SAML_METADATA",
     "INSTANCE_IS_DEV",
diff --git a/backend/windmill-common/src/instance_config.rs b/backend/windmill-common/src/instance_config.rs
index 41b5cfd5e3..f47875bc8b 100644
--- a/backend/windmill-common/src/instance_config.rs
+++ b/backend/windmill-common/src/instance_config.rs
@@ -1320,7 +1320,9 @@ pub async fn sync_global_settings_declarative(
                 serde_json::Value::Object(_) => "an object",
                 _ => "a non-string value",
             };
-            return Err(anyhow::anyhow!("{webhook_key} must be a URL string, got {kind}"));
+            return Err(anyhow::anyhow!(
+                "{webhook_key} must be a URL string, got {kind}"
+            ));
         }
     }
 
diff --git a/backend/windmill-common/src/jobs.rs b/backend/windmill-common/src/jobs.rs
index e9d6aa95fb..3546381885 100644
--- a/backend/windmill-common/src/jobs.rs
+++ b/backend/windmill-common/src/jobs.rs
@@ -17,7 +17,6 @@ use crate::{
     flows::get_full_hub_flow_by_path,
     get_latest_deployed_hash_for_path, get_latest_flow_version_info_for_path,
     scripts::{get_full_hub_script_by_path, ScriptHash, ScriptLang},
-    users::username_to_permissioned_as,
     utils::{StripPath, HTTP_CLIENT},
     worker::{to_raw_value, CUSTOM_TAGS_PER_WORKSPACE, WINDMILL_DIR},
     workspaces::workspace_with_fork_ancestors,
@@ -114,6 +113,12 @@ pub async fn script_path_to_payload<'e>(
                 None,
             )
         } else {
+            let script_info =
+                get_latest_deployed_hash_for_path(db_authed, db.clone(), w_id, script_path)
+                    .await?
+                    .prefetch_cached(&db)
+                    .await?;
+            let on_behalf_of = script_info.on_behalf_of(w_id, &db).await?;
             let ScriptHashInfo {
                 hash,
                 tag,
@@ -131,23 +136,9 @@ pub async fn script_path_to_payload<'e>(
                 delete_after_secs,
                 timeout,
                 has_preprocessor,
-                on_behalf_of_email,
-                created_by,
                 labels,
                 ..
-            } = get_latest_deployed_hash_for_path(db_authed, db.clone(), w_id, script_path)
-                .await?
-                .prefetch_cached(&db)
-                .await?;
-
-            let on_behalf_of = if let Some(email) = on_behalf_of_email {
-                Some(OnBehalfOf {
-                    email,
-                    permissioned_as: username_to_permissioned_as(created_by.as_str()),
-                })
-            } else {
-                None
-            };
+            } = script_info;
 
             (
                 JobPayload::ScriptHash {
diff --git a/backend/windmill-common/src/lib.rs b/backend/windmill-common/src/lib.rs
index 30a5edad32..a8de6d74c5 100644
--- a/backend/windmill-common/src/lib.rs
+++ b/backend/windmill-common/src/lib.rs
@@ -29,6 +29,8 @@ use sqlx::{Acquire, Postgres};
 pub mod agent_workers;
 pub mod apps;
 pub mod assets;
+pub mod azure_workload_identity;
+pub mod dbt_manifest;
 pub mod audit;
 pub mod auth;
 #[cfg(feature = "benchmark")]
@@ -42,6 +44,7 @@ mod db_entra_ee;
 #[cfg(all(feature = "enterprise", feature = "private"))]
 mod db_iam_ee;
 pub mod db_params;
+pub mod deploy_origin;
 #[cfg(feature = "private")]
 pub mod deployment_requests_ee;
 pub mod deployment_requests_oss;
@@ -192,24 +195,111 @@ pub fn check_on_behalf_of_preservation(
     None
 }
 
-/// Determines the on_behalf_of_email value to use when creating/updating a flow or script.
-/// - If `on_behalf_of_email` is None, returns None
-/// - If `preserve` is true and the user is admin or in the deployers group, returns the original value
-/// - Otherwise, returns the authenticated user's email
-pub fn resolve_on_behalf_of_email<'a>(
-    on_behalf_of_email: Option<&'a str>,
+/// Resolves the identity to store when creating/updating a flow or script.
+///
+/// The permissioned_as is the only stored identity — it decides what the job may access,
+/// and the address is derived from it at read time — so the two can never name different
+/// accounts. Callers may supply either: a bare email (every client written before the
+/// principal existed) is resolved to the principal it names, and an email that names
+/// nobody is rejected rather than recorded, since it could only produce a runnable that
+/// cannot authenticate.
+///
+/// Returns `None` when the runnable has no on-behalf-of identity, and the caller's own
+/// identity when they are not allowed to preserve someone else's.
+///
+/// Resolves through the non-RLS pool and authorizes nothing itself — `authed` decides only
+/// whether preservation is allowed, and its role flags are not re-checked against `w_id`.
+/// Callers must already be authorized for the workspace they pass.
+pub async fn resolve_on_behalf_of(
+    on_behalf_of_email: Option<&str>,
+    on_behalf_of: Option<&str>,
     preserve: bool,
-    authed: &'a impl db::Authable,
-) -> Option<&'a str> {
-    if on_behalf_of_email.is_some() {
-        if preserve && can_preserve_on_behalf_of(authed) {
-            on_behalf_of_email
-        } else {
-            Some(authed.email())
-        }
-    } else {
-        None
+    authed: &impl db::Authable,
+    w_id: &str,
+    db: &sqlx::Pool<Postgres>,
+) -> error::Result<Option<String>> {
+    if on_behalf_of_email.is_none() && on_behalf_of.is_none() {
+        return Ok(None);
     }
+    // Through the same width check as every other branch: the caller's own identity is
+    // address-shaped when they act without a `usr` row, and one too wide for a job row is no
+    // more enqueueable for naming themselves.
+    if !(preserve && can_preserve_on_behalf_of(authed)) {
+        return reject_unenqueueable(users::username_to_permissioned_as(authed.username()));
+    }
+    let permissioned_as = match on_behalf_of {
+        Some(permissioned_as) => {
+            // The principal wins, but a caller that also names a contradictory address has a
+            // bug worth surfacing: that is exactly how a workspace deploy once shipped one
+            // workspace's principal beside another's address.
+            if let Some(email) = on_behalf_of_email {
+                let named =
+                    users::get_email_from_permissioned_as_uncached(permissioned_as, w_id, db)
+                        .await?;
+                if named != email {
+                    return Err(Error::BadRequest(format!(
+                        "on_behalf_of '{permissioned_as}' resolves to '{named}', \
+                         not to on_behalf_of_email '{email}'. Both must name the same account."
+                    )));
+                }
+            }
+            // A bare address is canonical only for an account whose username is that address,
+            // or for a superadmin acting outside their workspaces. Sent for an ordinary member
+            // — which is what a folder rule naming an address produces — it is canonicalized to
+            // `u/{username}`: the bare branch of `fetch_authed_from_permissioned_as` grants
+            // neither their groups nor their folders, so storing it verbatim would run the job
+            // with less access than the account it names.
+            let canonical = if permissioned_as.starts_with(users::PERMISSIONED_AS_USER_PREFIX)
+                || permissioned_as.starts_with(users::PERMISSIONED_AS_GROUP_PREFIX)
+            {
+                None
+            } else {
+                users::permissioned_as_from_email(w_id, permissioned_as, db).await?
+            };
+            match canonical {
+                Some(canonical) => canonical,
+                None => {
+                    // Symmetric with the address branch below: an identity that names nobody
+                    // would only produce a runnable that cannot authenticate, and an unknown
+                    // prefix takes the least-privileged branch of
+                    // `fetch_authed_from_permissioned_as` rather than failing.
+                    if !users::permissioned_as_exists(w_id, permissioned_as, db).await? {
+                        return Err(Error::BadRequest(format!(
+                            "on_behalf_of '{permissioned_as}' names no user or \
+                             group in this workspace."
+                        )));
+                    }
+                    permissioned_as.to_string()
+                }
+            }
+        }
+        None => {
+            let email = on_behalf_of_email.unwrap_or_default();
+            users::permissioned_as_from_email(w_id, email, db)
+                .await?
+                .ok_or_else(|| {
+                    Error::BadRequest(format!(
+                        "on_behalf_of_email '{email}' names no user or group in this workspace, so \
+                         there is no identity to run as. Pass on_behalf_of, or use \
+                         the address of a workspace member."
+                    ))
+                })?
+        }
+    };
+    reject_unenqueueable(permissioned_as)
+}
+
+/// Every principal ends up on `v2_job.permissioned_as`, which is narrower than the columns it is
+/// stored in, so an identity that cannot be enqueued is refused at the deploy that records it
+/// rather than at the first run of a runnable that looks fine.
+fn reject_unenqueueable(permissioned_as: String) -> error::Result<Option<String>> {
+    if permissioned_as.chars().count() > users::PERMISSIONED_AS_MAX_LEN {
+        return Err(Error::BadRequest(format!(
+            "the identity '{permissioned_as}' is longer than the {} characters a job can carry",
+            users::PERMISSIONED_AS_MAX_LEN
+        )));
+    }
+    Ok(Some(permissioned_as))
 }
 
 #[macro_export]
@@ -704,6 +794,23 @@ ta9ELulniZau8zUAtwqwecxodzl+KO8NYj0a9PGgAM64dMqkRtRA8P4UP350Nag3\n\
         assert!(pg(Some("allow"), None).to_uri().contains("sslmode=prefer"));
         assert!(pg(None, None).to_uri().contains("sslmode=prefer"));
     }
+
+    /// The other paths default a missing login to `postgres`; Entra must not, or the
+    /// server rejects a role the resource never named.
+    #[test]
+    fn entra_login_rejects_a_missing_user() {
+        let mut db = pg(None, None);
+        assert_eq!(db.entra_login().unwrap(), "u");
+        assert_eq!(db.login_name(), "u");
+
+        db.user = None;
+        assert_eq!(db.login_name(), "postgres");
+
+        for blank in [None, Some(""), Some("  ")] {
+            db.user = blank.map(|u: &str| u.to_string());
+            assert!(db.entra_login().is_err(), "{blank:?} is not a login");
+        }
+    }
 }
 
 #[derive(Serialize, Debug)]
@@ -770,6 +877,11 @@ impl Future for TokioPgConnection {
 }
 
 impl PgDatabase {
+    /// The role the connection logs in as, whichever way it authenticates.
+    pub fn login_name(&self) -> &str {
+        self.user.as_deref().unwrap_or("postgres")
+    }
+
     pub fn to_uri(&self) -> String {
         let sslmode = match self.sslmode.as_deref() {
             Some("allow") => "prefer".to_string(),
@@ -788,7 +900,7 @@ impl PgDatabase {
         };
         format!(
             "postgres://{user}:{password}@{host}:{port}/{dbname}?sslmode={sslmode}",
-            user = urlencoding::encode(&self.user.as_deref().unwrap_or("postgres")),
+            user = urlencoding::encode(self.login_name()),
             password = urlencoding::encode(&self.password.as_deref().unwrap_or("")),
             host = host,
             port = self.port.unwrap_or(5432),
@@ -965,9 +1077,6 @@ impl PgDatabase {
     pub async fn connect_with_iam(
         &self,
     ) -> Result<(tokio_postgres::Client, TokioPgConnection), error::Error> {
-        use native_tls::TlsConnector;
-        use postgres_native_tls::MakeTlsConnector;
-
         // Resolve region: resource field takes priority, then env var
         let region = match self.region.as_deref() {
             Some(r) => r.to_string(),
@@ -979,7 +1088,7 @@ impl PgDatabase {
         };
 
         let port = self.port.unwrap_or(5432);
-        let user = self.user.as_deref().unwrap_or("postgres");
+        let user = self.login_name();
 
         let token = db_iam_ee::generate_auth_token(&region, &self.host, port as u64, user)
             .await
@@ -987,7 +1096,64 @@ impl PgDatabase {
                 error::Error::InternalErr(format!("IAM token generation failed: {e:#}"))
             })?;
 
-        // RDS IAM auth requires SSL.
+        self.connect_with_token("IAM RDS", user, &token).await
+    }
+
+    /// The role an Entra-authenticated connection logs in as. Azure maps each Entra
+    /// principal to a role of its own (`pgaadauth_create_principal`), so unlike the
+    /// other paths this one has no sensible default: `postgres` would send the server a
+    /// role name the resource never mentions, and the rejection then names a value the
+    /// user never configured.
+    pub fn entra_login(&self) -> error::Result<&str> {
+        self.user
+            .as_deref()
+            .map(str::trim)
+            .filter(|u| !u.is_empty())
+            .ok_or_else(|| {
+                error::Error::BadRequest(
+                    "Azure workload identity authentication requires `user` on the resource. \
+                     Set it to the Postgres role the worker's Entra principal is mapped to, \
+                     as created by pgaadauth_create_principal."
+                        .to_string(),
+                )
+            })
+    }
+
+    /// Connect to Azure Database for PostgreSQL as the worker's federated identity.
+    /// The Entra ID access token replaces the password.
+    #[cfg(feature = "enterprise")]
+    pub async fn connect_with_workload_identity(
+        &self,
+    ) -> Result<(tokio_postgres::Client, TokioPgConnection), error::Error> {
+        // Before the token exchange: a missing login is worth reporting without first
+        // spending a round trip to Entra ID on it.
+        let user = self.entra_login()?;
+
+        let workload_identity = azure_workload_identity::WorkloadIdentityConfig::resolve()?;
+        let token = workload_identity
+            .access_token(azure_workload_identity::AZURE_OSSRDBMS_SCOPE)
+            .await?;
+
+        self.connect_with_token("Azure workload identity", user, &token)
+            .await
+    }
+
+    /// Connect with an externally issued access token in place of the password.
+    /// Both issuers (AWS IAM, Entra ID) mandate TLS, so encryption is forced on
+    /// regardless of the resource's sslmode; the sslmode still selects how far the
+    /// server's certificate is verified.
+    #[cfg(feature = "enterprise")]
+    async fn connect_with_token(
+        &self,
+        auth_kind: &str,
+        user: &str,
+        token: &str,
+    ) -> Result<(tokio_postgres::Client, TokioPgConnection), error::Error> {
+        use native_tls::TlsConnector;
+        use postgres_native_tls::MakeTlsConnector;
+
+        let port = self.port.unwrap_or(5432);
+
         let mut connector = TlsConnector::builder();
         let verified = Self::configure_pg_tls_verification(
             &mut connector,
@@ -996,19 +1162,19 @@ impl PgDatabase {
             self.accept_invalid_certs,
         )?;
         if !verified {
-            tracing::warn!("IAM RDS auth without certificate verification: TLS certificate verification is disabled. Provide root_certificate_pem (and set sslmode=verify-full) to enforce verification.");
+            tracing::warn!("{auth_kind} auth without certificate verification: TLS certificate verification is disabled. Provide root_certificate_pem (and set sslmode=verify-full) to enforce verification.");
         }
 
-        tracing::info!("Creating new IAM RDS connection to {}", &self.host);
+        tracing::info!("Creating new {auth_kind} connection to {}", &self.host);
 
-        // Use Config builder directly to pass the IAM token as the password.
+        // Use Config builder directly to pass the token as the password.
         // This avoids needing to URL-encode the token into a connection string.
         let mut config = tokio_postgres::Config::new();
         config
             .host(&self.host)
             .port(port as u16)
             .user(user)
-            .password(&token)
+            .password(token)
             .dbname(&self.dbname)
             .ssl_mode(tokio_postgres::config::SslMode::Require);
 
@@ -1520,13 +1686,74 @@ pub struct ScriptHashInfo<SR> {
     pub delete_after_secs: Option<i32>,
     pub timeout: Option<i32>,
     pub has_preprocessor: Option<bool>,
-    pub on_behalf_of_email: Option<String>,
+    pub on_behalf_of: Option<String>,
     pub created_by: String,
     pub labels: Option<Vec<String>>,
     #[sqlx(flatten)]
     pub runnable_settings: SR,
 }
 
+impl<SR> ScriptHashInfo<SR> {
+    /// The identity this script runs as, or `None` when it runs as its caller. The address
+    /// is derived from the principal rather than stored, so the two cannot disagree.
+    ///
+    /// Reads through the non-RLS pool and authorizes nothing: callers must already be
+    /// authorized for `w_id` and for this script.
+    pub async fn on_behalf_of(
+        &self,
+        w_id: &str,
+        db: &DB,
+    ) -> error::Result<Option<jobs::OnBehalfOf>> {
+        on_behalf_of_from_permissioned_as(self.on_behalf_of.as_deref(), w_id, db).await
+    }
+}
+
+/// The address to store beside the principal, or `None` once no worker needs it.
+///
+/// A worker predating [`MIN_VERSION_SUPPORTS_ON_BEHALF_OF_PRINCIPAL`] reads `on_behalf_of_email`
+/// and nothing else, so a deploy has to keep filling it while one may still be live — otherwise
+/// a runnable deployed mid-upgrade runs as its deployer there. Once every worker is new the
+/// column is dead weight and a later release drops it.
+///
+/// Reads through the non-RLS pool and authorizes nothing: callers must already be authorized
+/// for `w_id`.
+pub async fn legacy_on_behalf_of_email(
+    permissioned_as: Option<&str>,
+    w_id: &str,
+    db: &DB,
+) -> error::Result<Option<String>> {
+    let Some(permissioned_as) = permissioned_as else {
+        return Ok(None);
+    };
+    if min_version::MIN_VERSION_SUPPORTS_ON_BEHALF_OF_PRINCIPAL.met_conservatively() {
+        return Ok(None);
+    }
+    Ok(Some(
+        users::get_email_from_permissioned_as_uncached(permissioned_as, w_id, db).await?,
+    ))
+}
+
+/// Shared by [`ScriptHashInfo::on_behalf_of`] and [`FlowVersionInfo::on_behalf_of`].
+///
+/// Reads identity data through the non-RLS pool and enforces nothing itself: it answers who a
+/// row already says it runs as. Callers must have authorized `w_id` — and the row they read it
+/// from — before dispatching a job with what it returns.
+pub async fn on_behalf_of_from_permissioned_as(
+    permissioned_as: Option<&str>,
+    w_id: &str,
+    db: &DB,
+) -> error::Result<Option<jobs::OnBehalfOf>> {
+    let Some(permissioned_as) = permissioned_as else {
+        return Ok(None);
+    };
+    // Uncached: the address is copied onto the job row, where it stays for the life of the run
+    // and decides the superadmin flag and the instance groups. Nothing evicts the cache across
+    // processes, so a cached read would keep minting jobs under an address the account no longer
+    // holds for up to a minute after it moves.
+    let email = users::get_email_from_permissioned_as_uncached(permissioned_as, w_id, db).await?;
+    Ok(Some(jobs::OnBehalfOf { email, permissioned_as: permissioned_as.to_string() }))
+}
+
 impl ScriptHashInfo<ScriptRunnableSettingsHandle> {
     pub async fn prefetch_cached<'a>(
         self,
@@ -1551,7 +1778,7 @@ impl ScriptHashInfo<ScriptRunnableSettingsHandle> {
             delete_after_secs: self.delete_after_secs,
             timeout: self.timeout,
             has_preprocessor: self.has_preprocessor,
-            on_behalf_of_email: self.on_behalf_of_email,
+            on_behalf_of: self.on_behalf_of,
             created_by: self.created_by,
             labels: self.labels,
             runnable_settings: ScriptRunnableSettingsInline {
@@ -1770,7 +1997,7 @@ async fn get_script_info_for_hash_inner<'e, E: sqlx::PgExecutor<'e>>(
                 delete_after_secs,
                 timeout,
                 has_preprocessor,
-                on_behalf_of_email,
+                on_behalf_of,
                 created_by,
                 labels,
                 path
@@ -1790,12 +2017,26 @@ pub struct FlowVersionInfo {
     pub has_preprocessor: Option<bool>,
     pub has_failure_module: Option<bool>,
     pub chat_input_enabled: Option<bool>,
-    pub on_behalf_of_email: Option<String>,
+    pub on_behalf_of: Option<String>,
     pub edited_by: String,
     pub dedicated_worker: Option<bool>,
     pub labels: Option<Vec<String>>,
 }
 
+impl FlowVersionInfo {
+    /// The identity this flow runs as, or `None` when it runs as its caller.
+    ///
+    /// Same contract as [`ScriptHashInfo::on_behalf_of`]: callers must already be authorized
+    /// for `w_id` and for this flow.
+    pub async fn on_behalf_of(
+        &self,
+        w_id: &str,
+        db: &DB,
+    ) -> error::Result<Option<jobs::OnBehalfOf>> {
+        on_behalf_of_from_permissioned_as(self.on_behalf_of.as_deref(), w_id, db).await
+    }
+}
+
 struct CachedFlowPath(String);
 
 impl Into<u64> for CachedFlowPath {
@@ -1921,7 +2162,7 @@ pub fn get_flow_version_info_from_version<
                                     (flow_version.value->>'chat_input_enabled')::boolean as chat_input_enabled,
                                     flow.tag,
                                     flow.dedicated_worker,
-                                    flow.on_behalf_of_email,
+                                    flow.on_behalf_of,
                                     flow.edited_by,
                                     flow.labels
                                 FROM
@@ -2037,6 +2278,7 @@ async fn get_latest_flow_version_for_path<'e, E: sqlx::PgExecutor<'e>>(
 
 pub async fn get_latest_hash_for_path<'c, E: sqlx::PgExecutor<'c>>(
     db: E,
+    db2: &DB,
     w_id: &str,
     script_path: &str,
     require_locked: bool,
@@ -2054,13 +2296,12 @@ pub async fn get_latest_hash_for_path<'c, E: sqlx::PgExecutor<'c>>(
     Option<bool>,
     Option<i16>,
     Option<i32>,
-    Option<String>,
-    String,
+    Option<jobs::OnBehalfOf>,
     Option<i64>,
     Option<Vec<String>>,
 )> {
     let r_o = sqlx::query!(
-            "select hash, tag, concurrency_key, concurrent_limit, concurrency_time_window_s, debounce_key, debounce_delay_s, cache_ttl, cache_ignore_s3_path, runnable_settings_handle, language as \"language: ScriptLang\", dedicated_worker, priority, timeout, on_behalf_of_email, created_by, labels FROM script
+            "select hash, tag, concurrency_key, concurrent_limit, concurrency_time_window_s, debounce_key, debounce_delay_s, cache_ttl, cache_ignore_s3_path, runnable_settings_handle, language as \"language: ScriptLang\", dedicated_worker, priority, timeout, on_behalf_of, created_by, labels FROM script
              WHERE path = $1 AND workspace_id = $2 AND archived = false AND (lock IS NOT NULL OR $3 = false)
              ORDER BY created_at DESC LIMIT 1",
             script_path,
@@ -2072,6 +2313,9 @@ pub async fn get_latest_hash_for_path<'c, E: sqlx::PgExecutor<'c>>(
 
     let script = utils::not_found_if_none(r_o, "script", script_path)?;
 
+    let on_behalf_of =
+        on_behalf_of_from_permissioned_as(script.on_behalf_of.as_deref(), w_id, db2).await?;
+
     Ok((
         scripts::ScriptHash(script.hash),
         script.tag,
@@ -2086,8 +2330,7 @@ pub async fn get_latest_hash_for_path<'c, E: sqlx::PgExecutor<'c>>(
         script.dedicated_worker,
         script.priority,
         script.timeout,
-        script.on_behalf_of_email,
-        script.created_by,
+        on_behalf_of,
         script.runnable_settings_handle,
         script.labels,
     ))
diff --git a/backend/windmill-common/src/min_version.rs b/backend/windmill-common/src/min_version.rs
index 45d356bb44..80b3871f3d 100644
--- a/backend/windmill-common/src/min_version.rs
+++ b/backend/windmill-common/src/min_version.rs
@@ -3,6 +3,11 @@ use semver::Version;
 
 // ============ Feature Definitions ============
 
+// The release that stops reading `script`/`flow`.`on_behalf_of_email`. It must name the release
+// this actually ships in: set below it, the compatibility write stops while a worker that still
+// reads that column is live, and those runnables run as their deployer with no error anywhere.
+pub const MIN_VERSION_SUPPORTS_ON_BEHALF_OF_PRINCIPAL: VC =
+    vc(1, 776, 0, "On-behalf-of principal");
 pub const MIN_VERSION_SUPPORTS_NODE_DEBOUNCING: VC = vc(1, 658, 0, "Flow node debouncing");
 pub const MIN_VERSION_SUPPORTS_TOKEN_HASH: VC = vc(1, 659, 0, "Token hash storage");
 pub const MIN_VERSION_SUPPORTS_SYNC_JOBS_DEBOUNCING: VC = vc(1, 602, 0, "Sync jobs debouncing");
@@ -90,6 +95,16 @@ impl VersionConstraint {
         &self.available_since <= &**min
     }
 
+    /// [`met`](Self::met) for a compatibility write rather than a feature switch.
+    ///
+    /// `met` assumes the best when no worker has reported a version yet, which is what you want
+    /// before turning something on. Dropping a write that an old worker still reads is the
+    /// opposite risk, so an unknown fleet counts as old.
+    pub fn met_conservatively(&self) -> bool {
+        let min = MIN_VERSION.load();
+        **min != Version::new(0, 0, 0) && self.available_since <= **min
+    }
+
     pub async fn assert(&self) -> error::Result<()> {
         if self.met().await {
             Ok(())
diff --git a/backend/windmill-common/src/query_builders.rs b/backend/windmill-common/src/query_builders.rs
index c315a564af..60d74f189d 100644
--- a/backend/windmill-common/src/query_builders.rs
+++ b/backend/windmill-common/src/query_builders.rs
@@ -524,6 +524,26 @@ fn cols_to_simple(cols: &[ColumnDef]) -> Vec<SimpleColumn> {
         .collect()
 }
 
+/// DuckDB's `concat` doubles as list concatenation, so a LIST or ARRAY beside a
+/// VARCHAR is a binder error rather than an implicit cast, and quicksearch
+/// concatenates every visible column, so one of them makes the table
+/// unpreviewable. Everything else concatenates as text and stays uncast: the
+/// frontend twin of this predicate feeds app policy digests that a changed
+/// string invalidates.
+fn duckdb_quicksearch_columns(column_defs: &[ColumnDef]) -> String {
+    visible_column_defs(column_defs)
+        .map(|c| {
+            let quoted = render_db_quoted_identifier(&c.field, DbType::Duckdb);
+            if c.datatype.trim_end().ends_with(']') {
+                format!("CAST({} AS VARCHAR)", quoted)
+            } else {
+                quoted
+            }
+        })
+        .collect::<Vec<_>>()
+        .join(", ")
+}
+
 /// MSSQL `text`, `ntext`, and `image` types cannot be used with the `=` operator.
 /// This function wraps the column/param in CAST(...) when needed.
 fn mssql_needs_cast_for_eq(datatype: &str) -> bool {
@@ -578,10 +598,14 @@ fn qi(identifier: &str, db_type: DbType) -> String {
     render_db_quoted_identifier(identifier, db_type)
 }
 
+/// The columns a table preview shows, in the order [`build_visible_field_list`]
+/// renders them.
+fn visible_column_defs(column_defs: &[ColumnDef]) -> impl Iterator<Item = &ColumnDef> {
+    column_defs.iter().filter(|c| c.ignored != Some(true))
+}
+
 pub fn build_visible_field_list(column_defs: &[ColumnDef], db_type: DbType) -> Vec<String> {
-    column_defs
-        .iter()
-        .filter(|c| c.ignored != Some(true))
+    visible_column_defs(column_defs)
         .map(|c| render_db_quoted_identifier(&c.field, db_type))
         .collect()
 }
@@ -1019,7 +1043,7 @@ pub fn make_select_query(
 
             let quicksearch = format!(
                 "($quicksearch = '' OR CONCAT({}) ILIKE '%' || $quicksearch || '%')",
-                filtered_columns.join(", ")
+                duckdb_quicksearch_columns(column_defs)
             );
 
             query.push_str(&format!(
@@ -1188,7 +1212,7 @@ pub fn make_count_query(
             if !filtered_columns.is_empty() {
                 quicksearch_condition.push_str(&format!(
                     " ($quicksearch = '' OR CONCAT(' ', {}) LIKE CONCAT('%', $quicksearch, '%'))",
-                    filtered_columns.join(", ")
+                    duckdb_quicksearch_columns(column_defs)
                 ));
             } else {
                 quicksearch_condition.push_str(" ($quicksearch = '' OR 1 = 1)");
@@ -3130,6 +3154,40 @@ mod tests {
         assert!(result.contains("LIMIT $limit::INT OFFSET $offset::INT"));
     }
 
+    /// Both the SELECT and the COUNT build the quicksearch predicate; fixing only
+    /// one leaves the grid rendering while the row count errors out.
+    #[test]
+    fn test_duckdb_quicksearch_casts_only_list_columns() {
+        let cols = vec![
+            col("id", "VARCHAR"),
+            col("tags", "VARCHAR[]"),
+            col("pos", "INTEGER[3]"),
+            col("meta", "STRUCT(a INTEGER)"),
+        ];
+
+        let select =
+            make_select_query("my_table", &cols, None, DbType::Duckdb, None, None).unwrap();
+        assert!(
+            select.contains(
+                "CONCAT(\"id\", CAST(\"tags\" AS VARCHAR), CAST(\"pos\" AS VARCHAR), \"meta\") ILIKE"
+            ),
+            "got:\n{}",
+            select
+        );
+        // The projection stays untouched: casting there would change the types
+        // the caller reads back.
+        assert!(select.contains("SELECT \"id\", \"tags\", \"pos\", \"meta\" FROM \"my_table\""));
+
+        let count = make_count_query(DbType::Duckdb, "my_table", None, &cols, None).unwrap();
+        assert!(
+            count.contains(
+                "CONCAT(' ', \"id\", CAST(\"tags\" AS VARCHAR), CAST(\"pos\" AS VARCHAR), \"meta\") LIKE"
+            ),
+            "got:\n{}",
+            count
+        );
+    }
+
     // -----------------------------------------------------------------------
     // SELECT - error cases
     // -----------------------------------------------------------------------
diff --git a/backend/windmill-common/src/scripts.rs b/backend/windmill-common/src/scripts.rs
index f3abf14e1c..31219621e9 100644
--- a/backend/windmill-common/src/scripts.rs
+++ b/backend/windmill-common/src/scripts.rs
@@ -72,6 +72,38 @@ pub async fn prefetch_cached_script(
     script: Script<ScriptRunnableSettingsHandle>,
     db: &DB,
 ) -> crate::error::Result<Script<ScriptRunnableSettingsInline>> {
+    prefetch_cached_script_inner(script, db, true).await
+}
+
+/// [`prefetch_cached_script`] without deriving the address, for callers that resolve it
+/// themselves — the workspace export memoizes one lookup per distinct principal, and skips it
+/// altogether for clients that only want the marker.
+pub async fn prefetch_cached_script_without_email(
+    script: Script<ScriptRunnableSettingsHandle>,
+    db: &DB,
+) -> crate::error::Result<Script<ScriptRunnableSettingsInline>> {
+    prefetch_cached_script_inner(script, db, false).await
+}
+
+async fn prefetch_cached_script_inner(
+    script: Script<ScriptRunnableSettingsHandle>,
+    db: &DB,
+    derive_email: bool,
+) -> crate::error::Result<Script<ScriptRunnableSettingsInline>> {
+    let derived_email = match script.on_behalf_of.as_deref().filter(|_| derive_email) {
+        // Uncached: the client preserves this pair and sends it back, where the write path
+        // validates it against an uncached lookup. A cached address would pair a live principal
+        // with an address the account no longer holds, and the redeploy would be rejected.
+        Some(permissioned_as) => Some(
+            crate::users::get_email_from_permissioned_as_uncached(
+                permissioned_as,
+                &script.workspace_id,
+                db,
+            )
+            .await?,
+        ),
+        None => None,
+    };
     let rs = runnable_settings::from_handle(script.runnable_settings.runnable_settings_handle, db)
         .await?;
     let (debouncing_settings, concurrency_settings) =
@@ -111,7 +143,9 @@ pub async fn prefetch_cached_script(
         auto_kind: script.auto_kind,
         codebase: script.codebase,
         has_preprocessor: script.has_preprocessor,
-        on_behalf_of_email: script.on_behalf_of_email,
+        // Derived, not stored: see the field's doc comment.
+        on_behalf_of_email: derived_email,
+        on_behalf_of: script.on_behalf_of,
         assets: script.assets,
         modules: script.modules,
         labels: script.labels,
@@ -387,6 +421,7 @@ pub async fn clone_script<'c>(
         codebase: s.codebase,
         has_preprocessor: s.has_preprocessor,
         on_behalf_of_email: s.on_behalf_of_email,
+        on_behalf_of: s.on_behalf_of,
         preserve_on_behalf_of: None,
         assets: s.assets,
         modules: s.modules,
@@ -411,14 +446,14 @@ pub async fn clone_script<'c>(
     envs, concurrent_limit, concurrency_time_window_s, cache_ttl, cache_ignore_s3_path, \
     dedicated_worker, ws_error_handler_muted, priority, restart_unless_cancelled, \
     delete_after_use, delete_after_secs, timeout, concurrency_key, visible_to_runner_only, auto_kind, \
-    codebase, has_preprocessor, on_behalf_of_email, schema_validation, assets, debounce_key, debounce_delay_s, runnable_settings_handle, modules, labels)
+    codebase, has_preprocessor, on_behalf_of, on_behalf_of_email, schema_validation, assets, debounce_key, debounce_delay_s, runnable_settings_handle, modules, labels)
 
     SELECT  workspace_id, $1, path, array_prepend($2::bigint, COALESCE(parent_hashes, '{}'::bigint[])), summary, description, \
             content, created_by, schema, is_template, extra_perms, NULL, language, kind, tag, \
             envs, concurrent_limit, concurrency_time_window_s, cache_ttl, cache_ignore_s3_path, \
             dedicated_worker, ws_error_handler_muted, priority, restart_unless_cancelled, \
             delete_after_use, delete_after_secs, timeout, concurrency_key, visible_to_runner_only, auto_kind, \
-            codebase, has_preprocessor, on_behalf_of_email, schema_validation, assets, debounce_key, debounce_delay_s, runnable_settings_handle, modules, labels
+            codebase, has_preprocessor, on_behalf_of, on_behalf_of_email, schema_validation, assets, debounce_key, debounce_delay_s, runnable_settings_handle, modules, labels
 
     FROM script WHERE hash = $2 AND workspace_id = $3;
             ", new_hash, s.hash.0, w_id).execute(&mut *tx).await?;
diff --git a/backend/windmill-common/src/ssrf.rs b/backend/windmill-common/src/ssrf.rs
index 99471acfe9..4c50f597ff 100644
--- a/backend/windmill-common/src/ssrf.rs
+++ b/backend/windmill-common/src/ssrf.rs
@@ -280,7 +280,10 @@ fn is_private_ipv4(ip: &Ipv4Addr) -> bool {
         || ip.is_private()        // 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
         || ip.is_link_local()     // 169.254.0.0/16 (AWS IMDS lives here)
         || ip.is_broadcast()      // 255.255.255.255
-        || ip.is_unspecified()    // 0.0.0.0
+        // RFC 1122 "this network": the whole /8, not just the unspecified
+        // address `is_unspecified()` matches — stacks that map 0.x.y.z onto the
+        // local host make `0.0.0.1` a bypass.
+        || ip.octets()[0] == 0    // 0.0.0.0/8
         || ip.is_documentation()  // 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24
         // CGNAT / shared address space
         || (ip.octets()[0] == 100 && (ip.octets()[1] & 0xC0) == 64) // 100.64.0.0/10
@@ -362,6 +365,9 @@ mod tests {
         assert!(is_private_ipv4(&"192.168.1.1".parse().unwrap()));
         assert!(is_private_ipv4(&"169.254.169.254".parse().unwrap()));
         assert!(is_private_ipv4(&"0.0.0.0".parse().unwrap()));
+        // The whole 0.0.0.0/8 block, not just the unspecified address.
+        assert!(is_private_ipv4(&"0.0.0.1".parse().unwrap()));
+        assert!(is_private_ipv4(&"0.255.255.255".parse().unwrap()));
         assert!(is_private_ipv4(&"100.64.0.1".parse().unwrap()));
         assert!(!is_private_ipv4(&"8.8.8.8".parse().unwrap()));
         assert!(!is_private_ipv4(&"1.1.1.1".parse().unwrap()));
diff --git a/backend/windmill-common/src/triggers.rs b/backend/windmill-common/src/triggers.rs
index d667363ebb..8fef198ebd 100644
--- a/backend/windmill-common/src/triggers.rs
+++ b/backend/windmill-common/src/triggers.rs
@@ -8,27 +8,59 @@ lazy_static! {
         Cache::new(1000);
 }
 
+/// Marks a moved trigger as not yet re-pointed at its new path.
+///
+/// Written in the same statement that moves the row, so it is committed before the rename returns.
+/// Re-pointing the webhook happens afterwards and off the request, and its outcome — success or
+/// failure — replaces this. Anything that stops it getting that far, a shutdown included, leaves
+/// the trigger visibly unfinished rather than quietly pointing at a path nothing serves.
+pub const REREGISTRATION_PENDING: &str =
+    "The runnable was renamed and the webhook registered on the service has not been re-pointed at \
+     it yet. If this persists, save the trigger again.";
+
+/// A `native_trigger` row carried onto the new path by a rename. The webhook registered on
+/// the external service embeds the runnable path, so each of these still has to be
+/// re-registered — see `windmill_native_triggers::rename`.
+#[derive(Debug, Clone)]
+pub struct MovedNativeTrigger {
+    pub service_name: String,
+    pub external_id: String,
+    /// Where this rename put the trigger. Re-registration mints a `jobs:run:*` token for the
+    /// runnable it finds, so it must confirm the row still names this one: anything that moved it
+    /// afterwards was authorized separately, and its choice is not this rename's to overwrite.
+    pub script_path: String,
+    pub is_flow: bool,
+}
+
 /// Update `script_path` across all trigger tables when a runnable (script or flow) is renamed.
 /// For long-running triggers (with `server_id`), also resets `server_id = NULL` to force
 /// the heartbeat-based restart mechanism to pick up the new config.
+///
+/// Returns the `native_trigger` rows that moved.
 pub async fn update_triggers_script_path(
     tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
     new_path: &str,
     old_path: &str,
     w_id: &str,
     is_flow: bool,
-) -> Result<(), sqlx::Error> {
-    // Triggers without server_id (request/response or webhook-based)
-    sqlx::query!(
+) -> Result<Vec<MovedNativeTrigger>, sqlx::Error> {
+    // Triggers without server_id (request/response or webhook-based).
+    // `native_trigger` rows are only listed when a runnable still exists at `script_path`,
+    // so a row left behind on the old path is invisible in the UI and unrecoverable.
+    let moved_native_triggers = sqlx::query_as!(
+        MovedNativeTrigger,
         "WITH \
-         t1 AS (UPDATE http_trigger SET script_path = $1 WHERE script_path = $2 AND workspace_id = $3 AND is_flow = $4) \
-         UPDATE email_trigger SET script_path = $1 WHERE script_path = $2 AND workspace_id = $3 AND is_flow = $4",
+         t1 AS (UPDATE http_trigger SET script_path = $1 WHERE script_path = $2 AND workspace_id = $3 AND is_flow = $4), \
+         t2 AS (UPDATE email_trigger SET script_path = $1 WHERE script_path = $2 AND workspace_id = $3 AND is_flow = $4) \
+         UPDATE native_trigger SET script_path = $1, updated_at = NOW(), error = $5 WHERE script_path = $2 AND workspace_id = $3 AND is_flow = $4 \
+         RETURNING service_name::text AS \"service_name!\", external_id, script_path, is_flow",
         new_path,
         old_path,
         w_id,
         is_flow,
+        REREGISTRATION_PENDING,
     )
-    .execute(&mut **tx)
+    .fetch_all(&mut **tx)
     .await?;
 
     // Triggers with server_id (long-running listeners, reset server_id to force restart)
@@ -50,5 +82,5 @@ pub async fn update_triggers_script_path(
     .execute(&mut **tx)
     .await?;
 
-    Ok(())
+    Ok(moved_native_triggers)
 }
diff --git a/backend/windmill-common/src/users.rs b/backend/windmill-common/src/users.rs
index 1837e4dc4b..925fe32a4a 100644
--- a/backend/windmill-common/src/users.rs
+++ b/backend/windmill-common/src/users.rs
@@ -27,15 +27,27 @@ pub const PERMISSIONED_AS_USER_PREFIX: &str = "u/";
 pub const PERMISSIONED_AS_GROUP_PREFIX: &str = "g/";
 /// Prefix for group-based usernames: "group-"
 pub const USERNAME_GROUP_PREFIX: &str = "group-";
+/// Widest principal a job row can carry (`v2_job.permissioned_as`), which is narrower than the
+/// columns runnables and triggers store one in.
+pub const PERMISSIONED_AS_MAX_LEN: usize = 55;
 
+/// An email-shaped username is its own principal, which is how a superadmin acting without a
+/// `usr` row is named (`usr.username` is constrained to `[\w-]+`, so a member never is). It is
+/// decided before the group convention — an address is never a group's username — and one
+/// containing `/` is prefixed, since readers split on the first `/` and would otherwise take
+/// `g/alice@example.com` for a group.
 pub fn username_to_permissioned_as(user: &str) -> String {
     if user.contains('@') {
-        user.to_string()
-    } else if let Some(group) = user.strip_prefix(USERNAME_GROUP_PREFIX) {
-        format!("{}{}", PERMISSIONED_AS_GROUP_PREFIX, group)
-    } else {
-        format!("{}{}", PERMISSIONED_AS_USER_PREFIX, user)
+        return if user.contains('/') {
+            format!("{}{}", PERMISSIONED_AS_USER_PREFIX, user)
+        } else {
+            user.to_string()
+        };
     }
+    if let Some(group) = user.strip_prefix(USERNAME_GROUP_PREFIX) {
+        return format!("{}{}", PERMISSIONED_AS_GROUP_PREFIX, group);
+    }
+    format!("{}{}", PERMISSIONED_AS_USER_PREFIX, user)
 }
 
 /// Borrowed key for zero-allocation cache lookups via `Equivalent<(String, String)>`.
@@ -81,6 +93,128 @@ pub async fn resolve_username_to_email<'c>(
     .flatten())
 }
 
+/// Whether a permissioned_as names something that exists in this workspace.
+///
+/// An existence probe over the non-RLS pool, no authorization of its own: callers must
+/// already be authorized for `w_id`. Same contract for [`permissioned_as_from_email`] and
+/// [`resolve_username_to_email`].
+///
+/// Accepts the three forms `username_to_permissioned_as` can produce: `u/{username}`,
+/// `g/{group}`, and a bare address when the username is itself email-shaped. Anything else
+/// is malformed — `fetch_authed_from_permissioned_as` would take its least-privileged
+/// branch rather than fail, so callers reject instead of storing it.
+///
+/// Decided prefix first, like `fetch_authed_from_permissioned_as` and
+/// [`get_email_from_permissioned_as`]: a group name may contain `@` while a username never
+/// carries a `u/`/`g/` prefix, so a bare address is only ever what is left over. Validating
+/// by a different rule than dispatch reads by is what lets a stored identity run as someone
+/// else.
+pub async fn permissioned_as_exists(
+    workspace_id: &str,
+    permissioned_as: &str,
+    db: &sqlx::Pool<sqlx::Postgres>,
+) -> crate::error::Result<bool> {
+    if let Some(username) = permissioned_as.strip_prefix(PERMISSIONED_AS_USER_PREFIX) {
+        return Ok(resolve_username_to_email(workspace_id, username, db)
+            .await?
+            .is_some());
+    }
+    if let Some(group) = permissioned_as.strip_prefix(PERMISSIONED_AS_GROUP_PREFIX) {
+        return Ok(sqlx::query_scalar!(
+            "SELECT EXISTS(SELECT 1 FROM group_ WHERE workspace_id = $1 AND name = $2)",
+            workspace_id,
+            group
+        )
+        .fetch_one(db)
+        .await?
+        .unwrap_or(false));
+    }
+    // The bare form names an account acting without a `usr` row, not anyone who merely holds
+    // that address: `u/{username}` is the canonical principal for a member, and the bare branch
+    // of `fetch_authed_from_permissioned_as` grants neither their groups nor their folders.
+    // Anything unprefixed that is not an address at all is malformed.
+    if !permissioned_as.contains('@') {
+        return Ok(false);
+    }
+    Ok(sqlx::query_scalar!(
+        "SELECT EXISTS(
+            SELECT 1 FROM usr WHERE workspace_id = $1 AND username = $2
+            UNION ALL
+            SELECT 1 FROM password WHERE email = $2 AND super_admin
+        )",
+        workspace_id,
+        permissioned_as
+    )
+    .fetch_one(db)
+    .await?
+    .unwrap_or(false))
+}
+
+/// Drop a cached address so a transactional email change is visible immediately.
+///
+/// The address is derived at dispatch and feeds the instance-superadmin check and
+/// `email_to_igroup`, so serving a stale one would run jobs with the wrong authorization
+/// for up to the cache TTL.
+pub fn invalidate_email_cache(workspace_id: &str, username: &str) {
+    EMAIL_CACHE.remove(&(workspace_id.to_string(), username.to_string()));
+}
+
+/// Inverse of [`get_email_from_permissioned_as`]: the principal an on-behalf-of email
+/// names in this workspace, for callers that supply the email alone.
+///
+/// Mirrors [`resolve_username_to_email`] branch for branch, including its fallback to
+/// `password` — a superadmin acting in a workspace they are not a member of has no `usr`
+/// row, and dropping them here would hand their runnables back to the deployer while
+/// keeping their superadmin email.
+///
+/// `None` when the email names nobody at all — an address outside the workspace that is
+/// not a superadmin's, or a group that no longer exists. Callers then leave the identity
+/// unrecorded rather than storing a principal that cannot authenticate.
+///
+/// Reads through the non-RLS pool and authorizes nothing: callers must already be authorized
+/// for `workspace_id`.
+pub async fn permissioned_as_from_email(
+    workspace_id: &str,
+    email: &str,
+    db: &sqlx::Pool<sqlx::Postgres>,
+) -> crate::error::Result<Option<String>> {
+    let mut conn = db.acquire().await?;
+    // A real account always wins: the synthetic group namespace below is not reserved,
+    // so a user may legitimately hold a `group-*@windmill.dev` address, and resolving it
+    // to the like-named group would hand their runnables that group's folder access.
+    if let Some(username) = sqlx::query_scalar!(
+        "SELECT COALESCE(
+            (SELECT username FROM usr WHERE workspace_id = $1 AND email = $2),
+            (SELECT COALESCE(username, email) FROM password WHERE email = $2 AND super_admin = true)
+        )",
+        workspace_id,
+        email
+    )
+    .fetch_optional(&mut *conn)
+    .await?
+    .flatten()
+    {
+        return Ok(Some(username_to_permissioned_as(&username)));
+    }
+    // Groups have no address of their own; `get_email_from_permissioned_as` mints this
+    // synthetic one, so it is the only form that can be read back as a group.
+    let Some(group) = email
+        .strip_prefix(USERNAME_GROUP_PREFIX)
+        .and_then(|rest| rest.strip_suffix("@windmill.dev"))
+    else {
+        return Ok(None);
+    };
+    let exists = sqlx::query_scalar!(
+        "SELECT EXISTS(SELECT 1 FROM group_ WHERE workspace_id = $1 AND name = $2)",
+        workspace_id,
+        group
+    )
+    .fetch_one(&mut *conn)
+    .await?
+    .unwrap_or(false);
+    Ok(exists.then(|| format!("{}{}", PERMISSIONED_AS_GROUP_PREFIX, group)))
+}
+
 /// Get email from permissioned_as string.
 /// - "u/{username}" → resolve via [`resolve_username_to_email`] (cached)
 /// - "g/{group}" → "group-{group}@windmill.dev"
@@ -89,12 +223,38 @@ pub async fn get_email_from_permissioned_as<'c>(
     permissioned_as: &str,
     workspace_id: &str,
     db: impl sqlx::PgExecutor<'c>,
+) -> crate::error::Result<String> {
+    get_email_from_permissioned_as_inner(permissioned_as, workspace_id, db, true).await
+}
+
+/// [`get_email_from_permissioned_as`] without the address cache. Nothing evicts that cache
+/// across processes, so for a minute after an email change it still serves the old address —
+/// fine where the address only labels something on screen, wrong where it decides whether a
+/// write is accepted or is copied onto a job row that outlives the window.
+///
+/// Reads through the non-RLS pool and authorizes nothing, like the cached one: callers must
+/// already be authorized for `workspace_id`.
+pub async fn get_email_from_permissioned_as_uncached<'c>(
+    permissioned_as: &str,
+    workspace_id: &str,
+    db: impl sqlx::PgExecutor<'c>,
+) -> crate::error::Result<String> {
+    get_email_from_permissioned_as_inner(permissioned_as, workspace_id, db, false).await
+}
+
+async fn get_email_from_permissioned_as_inner<'c>(
+    permissioned_as: &str,
+    workspace_id: &str,
+    db: impl sqlx::PgExecutor<'c>,
+    use_cache: bool,
 ) -> crate::error::Result<String> {
     if let Some(username) = permissioned_as.strip_prefix(PERMISSIONED_AS_USER_PREFIX) {
-        let lookup = EmailCacheKey(workspace_id, username);
-        if let Some((email, cached_at)) = EMAIL_CACHE.get(&lookup) {
-            if cached_at.elapsed().as_secs() < EMAIL_CACHE_TTL_SECS {
-                return Ok(email);
+        if use_cache {
+            let lookup = EmailCacheKey(workspace_id, username);
+            if let Some((email, cached_at)) = EMAIL_CACHE.get(&lookup) {
+                if cached_at.elapsed().as_secs() < EMAIL_CACHE_TTL_SECS {
+                    return Ok(email);
+                }
             }
         }
         let email = resolve_username_to_email(workspace_id, username, db)
@@ -172,6 +332,19 @@ mod tests {
             username_to_permissioned_as("alice@example.com"),
             "alice@example.com"
         );
+        assert_eq!(
+            username_to_permissioned_as("g/alice@example.com"),
+            "u/g/alice@example.com"
+        );
+        // The `group-` convention is for usernames, and an address is never one.
+        assert_eq!(
+            username_to_permissioned_as("group-ops/alice@example.com"),
+            "u/group-ops/alice@example.com"
+        );
+        assert_eq!(
+            username_to_permissioned_as("group-ops@example.com"),
+            "group-ops@example.com"
+        );
         assert_eq!(username_to_permissioned_as("group-all"), "g/all");
         assert_eq!(username_to_permissioned_as("group-my-team"), "g/my-team");
     }
diff --git a/backend/windmill-common/src/utils.rs b/backend/windmill-common/src/utils.rs
index 2bd6f1b204..6d13515d1f 100644
--- a/backend/windmill-common/src/utils.rs
+++ b/backend/windmill-common/src/utils.rs
@@ -222,6 +222,89 @@ pub fn escape_ilike_pattern(s: &str) -> String {
         .replace('_', "\\_")
 }
 
+lazy_static::lazy_static! {
+    /// `[\p{Alphabetic}\p{Nd}_-]`, not `[\w-]`: Postgres' `\w` is `alnum` plus
+    /// underscore, while Rust's also covers combining marks, connector
+    /// punctuation and join controls. Spelling it out keeps these in step with
+    /// the CHECK constraints below, which are the real authority — a character
+    /// accepted here and rejected there puts the raw constraint violation back
+    /// on the wire, which is what this guard exists to prevent.
+    static ref PROPER_CHAR: &'static str = r"\p{Alphabetic}\p{Nd}_-";
+
+    /// Mirrors the `proper_id` CHECK shared by `script`, `flow`, `variable`,
+    /// `resource` and `schedule`.
+    static ref PROPER_PATH_RE: regex::Regex =
+        regex::Regex::new(&format!(r"^[ufg](/[{}]+){{2,}}$", *PROPER_CHAR)).unwrap();
+    /// Mirrors the `proper_name` CHECK on `resource_type.name`, which
+    /// `resource.resource_type` references without a foreign key of its own.
+    static ref PROPER_TYPE_NAME_RE: regex::Regex =
+        regex::Regex::new(&format!(r"^[{}]{{1,50}}$", *PROPER_CHAR)).unwrap();
+}
+
+/// Reject a path the `proper_id` constraint would reject anyway, so the caller
+/// gets a plain 400 instead of the raw Postgres constraint-violation string,
+/// which names the table and constraint and echoes the input back.
+pub fn check_proper_path(path: &str) -> Result<()> {
+    // The column is varchar(255); without this an over-long but well-formed path
+    // still reaches Postgres and leaks the same kind of message back.
+    if path.chars().count() > 255 {
+        return Err(Error::BadRequest(
+            "Invalid path: it must be at most 255 characters".to_string(),
+        ));
+    }
+    if !PROPER_PATH_RE.is_match(path) {
+        return Err(Error::BadRequest(
+            "Invalid path: it must be of the form u/<user>/<name>, f/<folder>/<name> or \
+             g/<group>/<name>, where every segment contains only alphanumeric characters, \
+             '_' or '-'"
+                .to_string(),
+        ));
+    }
+    Ok(())
+}
+
+/// Replace a Postgres rejection with a message that says what the caller did
+/// wrong and nothing about the schema. The raw error names the table and the
+/// constraint and echoes the input back.
+///
+/// This, not `check_proper_path`, is what makes the leak unreachable: Postgres
+/// classifies `\w` by the database's `LC_CTYPE`, so no fixed Rust charset can
+/// mirror `proper_id` across deployments (`u/usér/nom` is valid under a UTF-8
+/// locale and rejected under `C`). The pre-checks exist to give the common cases
+/// a precise message; this catches whatever they let through.
+pub fn sanitize_db_error(e: sqlx::Error) -> Error {
+    let Some(db_err) = e.as_database_error() else {
+        return Error::from(e);
+    };
+    match db_err.code().as_deref() {
+        // check_violation — `proper_id` / `proper_name` and friends
+        Some("23514") => Error::BadRequest(
+            "Invalid path or name: it does not match the required format".to_string(),
+        ),
+        // string_data_right_truncation
+        Some("22001") => Error::BadRequest("A field exceeds its maximum length".to_string()),
+        // insufficient_privilege — row-level security rejected the row
+        Some("42501") => {
+            Error::NotAuthorized("You don't have write permission at this path".to_string())
+        }
+        _ => Error::from(e),
+    }
+}
+
+/// Confine a resource type name to the charset `resource_type.name` already
+/// enforces. `resource.resource_type` has no such constraint of its own, so
+/// without this any string up to 50 chars can be stored and later rendered as
+/// the type of a resource everyone in the workspace sees.
+pub fn check_proper_type_name(name: &str) -> Result<()> {
+    if !PROPER_TYPE_NAME_RE.is_match(name) {
+        return Err(Error::BadRequest(
+            "Invalid resource type: it must be 1 to 50 alphanumeric characters, '_' or '-'"
+                .to_string(),
+        ));
+    }
+    Ok(())
+}
+
 pub fn require_admin(is_admin: bool, username: &str) -> Result<()> {
     if !is_admin {
         Err(Error::RequireAdmin(username.to_string()))
@@ -1388,6 +1471,58 @@ pub fn truncate_with_ellipsis(s: &str, max_chars: usize) -> String {
 mod tests {
     use super::*;
 
+    /// The guards are only safe because they are never stricter than the DB
+    /// constraints they front. Narrowing `\w` to ASCII reads equivalent and
+    /// compiles, but would start rejecting paths that already deploy today.
+    #[test]
+    fn proper_path_matches_the_db_constraint() {
+        for ok in [
+            "u/admin/foo",
+            "f/some-folder/bar/baz",
+            "g/all/x",
+            "u/usér/nom",
+        ] {
+            assert!(check_proper_path(ok).is_ok(), "{ok} should be accepted");
+        }
+        for bad in [
+            "a/admin/foo",
+            "u/admin",
+            "u/admin/foo/",
+            "u/admin/lawful_variable/x<script>alert(1)</script>",
+            "<script>alert(1)</script>",
+            // Postgres' `\w` covers neither join controls nor combining marks;
+            // Rust's `\w` covers both, so `[\w-]` here would pass these through
+            // to the constraint and leak its message back to the caller.
+            "u/admin/a\u{200C}b",
+            "u/admin/a\u{0301}b",
+            "u/admin/a\u{203F}b",
+        ] {
+            assert!(check_proper_path(bad).is_err(), "{bad} should be rejected");
+        }
+        assert!(check_proper_path(&format!("u/admin/{}", "a".repeat(300))).is_err());
+    }
+
+    #[test]
+    fn proper_type_name_matches_the_db_constraint() {
+        for ok in ["postgresql", "c_aws_account", "my-type", &"a".repeat(50)] {
+            assert!(
+                check_proper_type_name(ok).is_ok(),
+                "{ok} should be accepted"
+            );
+        }
+        for bad in [
+            "",
+            &"a".repeat(51),
+            "<img src=x onerror=prompt('hacked')>",
+            "a\u{200C}b",
+        ] {
+            assert!(
+                check_proper_type_name(bad).is_err(),
+                "{bad} should be rejected"
+            );
+        }
+    }
+
     #[test]
     fn truncate_handles_multibyte_at_boundary() {
         // Byte 25 of this string falls inside a 2-byte 'а'; naive `&s[..25]` would panic.
diff --git a/backend/windmill-common/src/variables.rs b/backend/windmill-common/src/variables.rs
index b43eb07e9c..8310051d75 100644
--- a/backend/windmill-common/src/variables.rs
+++ b/backend/windmill-common/src/variables.rs
@@ -192,14 +192,25 @@ pub async fn generate_approval_token(
     Ok(hex::encode(mac.finalize().into_bytes()))
 }
 
-/// Stateless read-share signature for a job: `HMAC(workspace_key, job_id || "view_token")`.
+/// Domain separator of the member-audience view token (see [`generate_view_token`]).
+pub const VIEW_TOKEN_DOMAIN: &[u8] = b"view_token";
+
+/// Domain separator of the public-audience view token (see [`generate_view_token`]).
+/// Distinct from [`VIEW_TOKEN_DOMAIN`] so that already-shared member links keep granting
+/// only what they were minted for: going public is always an explicit new mint.
+pub const PUBLIC_VIEW_TOKEN_DOMAIN: &[u8] = b"public_view_token";
+
+/// Stateless read-share signature for a job: `HMAC(workspace_key, job_id || domain)`.
 /// Mirrors [`generate_approval_token`] but in a distinct domain so an approval token can
 /// never be used as a view token (or vice-versa). Used to build a "share read link" that
-/// grants an authenticated workspace member read access to a job (and its flow subtree)
-/// they otherwise lack ACL on. No expiry/revocation (stateless), like the approval token.
+/// grants read access to a job (and its flow subtree) to someone who otherwise lacks ACL
+/// on it: an authenticated workspace member under [`VIEW_TOKEN_DOMAIN`], anyone holding
+/// the link (logged in or not) under [`PUBLIC_VIEW_TOKEN_DOMAIN`]. No expiry/revocation
+/// (stateless), like the approval token.
 pub async fn generate_view_token(
     w_id: &str,
     job_id: uuid::Uuid,
+    domain: &[u8],
     db: &DB,
 ) -> crate::error::Result<String> {
     use hmac::{Hmac, Mac};
@@ -208,7 +219,7 @@ pub async fn generate_view_token(
     let mut mac = Hmac::<Sha256>::new_from_slice(key.as_bytes())
         .map_err(|e| crate::Error::internal_err(format!("HMAC key error: {e}")))?;
     mac.update(job_id.as_bytes());
-    mac.update(b"view_token");
+    mac.update(domain);
     Ok(hex::encode(mac.finalize().into_bytes()))
 }
 
@@ -470,7 +481,7 @@ pub async fn get_reserved_variables(
     ContextualVariable {
         name: "WM_END_USER_EMAIL".to_string(),
         value: end_user_email.unwrap_or_else(|| "".to_string()),
-        description: "Email of the end user that executed the current script. Only available when triggered from an app.".to_string(),
+        description: "Email of the end user that executed the current script, propagated to flow steps. Only set when the run was triggered from an app (empty otherwise).".to_string(),
         is_custom: false,
     },
     ContextualVariable {
diff --git a/backend/windmill-common/src/worker.rs b/backend/windmill-common/src/worker.rs
index b9dd29c00a..acc474c868 100644
--- a/backend/windmill-common/src/worker.rs
+++ b/backend/windmill-common/src/worker.rs
@@ -217,6 +217,33 @@ pub const CONCURRENCY_KEY_MAX_QUEUED_DEFAULT: u32 = 10_000;
 /// the setting is cleared or malformed. A workspace spans many keys, so this sits well above
 /// the per-key cap.
 pub const WORKSPACE_MAX_QUEUED_JOBS_DEFAULT: u32 = 20_000;
+/// Default for [`JOB_OOM_SCORE_ADJ`]; also the value used when the env var is out of range or
+/// unparseable.
+pub const JOB_OOM_SCORE_ADJ_DEFAULT: i32 = 1000;
+
+/// procfs accepts -1000..=1000, but a job must never be *less* killable than the worker that
+/// supervises it, so negative adjustments are rejected rather than clamped.
+fn parse_job_oom_score_adj(raw: Option<&str>) -> i32 {
+    let Some(raw) = raw else {
+        return JOB_OOM_SCORE_ADJ_DEFAULT;
+    };
+    match raw.trim().parse::<i32>() {
+        Ok(v) if (0..=1000).contains(&v) => v,
+        Ok(v) => {
+            tracing::warn!(
+                "JOB_OOM_SCORE_ADJ={v} is outside the accepted 0..=1000 range, \
+                using {JOB_OOM_SCORE_ADJ_DEFAULT}"
+            );
+            JOB_OOM_SCORE_ADJ_DEFAULT
+        }
+        Err(e) => {
+            tracing::warn!(
+                "Could not parse JOB_OOM_SCORE_ADJ='{raw}': {e}, using {JOB_OOM_SCORE_ADJ_DEFAULT}"
+            );
+            JOB_OOM_SCORE_ADJ_DEFAULT
+        }
+    }
+}
 lazy_static::lazy_static! {
     pub static ref WORKER_GROUP: String = std::env::var("WORKER_GROUP").unwrap_or_else(|_| {
         #[cfg(not(feature = "enterprise"))]
@@ -240,6 +267,15 @@ lazy_static::lazy_static! {
 
     pub static ref LIMIT_WINDOWS_TO_1CU: bool = std::env::var("LIMIT_WINDOWS_TO_1CU").ok().is_some_and(|x| x == "1" || x == "true");
 
+    /// `oom_score_adj` applied to job subprocesses. The kernel adds it to the process's memory
+    /// use expressed in permille of host RAM, so the job only reliably outranks the worker once
+    /// the gap between their two adjustments exceeds the worker's own footprint in permille; the
+    /// default maximizes that margin. Userspace OOM daemons (earlyoom, systemd-oomd, nohang) rank
+    /// every process on the host by the same score, so at 1000 a tiny job outranks multi-GB
+    /// processes and gets killed first. Lowering this trades margin over the worker for a fairer
+    /// ranking against everything else on the host.
+    pub static ref JOB_OOM_SCORE_ADJ: i32 = parse_job_oom_score_adj(std::env::var("JOB_OOM_SCORE_ADJ").ok().as_deref());
+
     pub static ref CGROUP_V2_PATH_RE: Regex = Regex::new(r#"(?m)^0::(/.*)$"#).unwrap();
     pub static ref CGROUP_V2_CPU_RE: Regex = Regex::new(r#"(?m)^(\d+) \S+$"#).unwrap();
     pub static ref CGROUP_V1_INACTIVE_FILE_RE: Regex = Regex::new(r#"(?m)^total_inactive_file (\d+)$"#).unwrap();
@@ -269,6 +305,7 @@ lazy_static::lazy_static! {
         "ruby".to_string(),
         "rlang".to_string(),
         "duckdb".to_string(),
+        "dbt".to_string(),
         // for related places search: ADD_NEW_LANG
         "dependency".to_string(),
         "flow".to_string(),
@@ -2441,6 +2478,26 @@ mod tests {
         ids.iter().map(|s| s.to_string()).collect()
     }
 
+    #[test]
+    fn test_parse_job_oom_score_adj() {
+        assert_eq!(parse_job_oom_score_adj(Some("300")), 300);
+        assert_eq!(parse_job_oom_score_adj(Some(" 0\n")), 0);
+        assert_eq!(parse_job_oom_score_adj(None), JOB_OOM_SCORE_ADJ_DEFAULT);
+        // Out of range and unparseable both fall back rather than weaken the worker's protection.
+        assert_eq!(
+            parse_job_oom_score_adj(Some("-500")),
+            JOB_OOM_SCORE_ADJ_DEFAULT
+        );
+        assert_eq!(
+            parse_job_oom_score_adj(Some("1001")),
+            JOB_OOM_SCORE_ADJ_DEFAULT
+        );
+        assert_eq!(
+            parse_job_oom_score_adj(Some("high")),
+            JOB_OOM_SCORE_ADJ_DEFAULT
+        );
+    }
+
     #[test]
     fn test_bash_sandbox_image_annotation() {
         // `# sandbox <image>` selects the container runtime and returns the image.
diff --git a/backend/windmill-common/src/workspaces.rs b/backend/windmill-common/src/workspaces.rs
index 2af5afaf77..d570e7ec32 100644
--- a/backend/windmill-common/src/workspaces.rs
+++ b/backend/windmill-common/src/workspaces.rs
@@ -70,6 +70,7 @@ bitflags::bitflags! {
         const DISABLE_WORKSPACE_FORKING =           1 << 1;
         const RESTRICT_DEPLOY_TO_DEPLOYERS =        1 << 2;
         const RESTRICT_ANONYMOUS_APP_DEPLOYMENT =   1 << 3;
+        const RESTRICT_PUBLIC_RUN_SHARING =         1 << 4;
     }
 }
 
@@ -81,6 +82,7 @@ pub enum ProtectionRuleKind {
     DisableWorkspaceForking,
     RestrictDeployToDeployers,
     RestrictAnonymousAppDeployment,
+    RestrictPublicRunSharing,
 }
 
 impl ProtectionRuleKind {
@@ -98,6 +100,9 @@ impl ProtectionRuleKind {
             ProtectionRuleKind::RestrictAnonymousAppDeployment => {
                 ProtectionRules::RESTRICT_ANONYMOUS_APP_DEPLOYMENT
             }
+            ProtectionRuleKind::RestrictPublicRunSharing => {
+                ProtectionRules::RESTRICT_PUBLIC_RUN_SHARING
+            }
         }
     }
 
@@ -113,6 +118,9 @@ impl ProtectionRuleKind {
             ProtectionRuleKind::RestrictAnonymousAppDeployment => {
                 "Making an app publicly accessible without login (anonymous execution mode) is restricted in this workspace"
             }
+            ProtectionRuleKind::RestrictPublicRunSharing => {
+                "Sharing a run publicly (readable without login) is restricted in this workspace"
+            }
         }
     }
 }
@@ -167,7 +175,7 @@ pub enum ObjectType {
     DatatableMigration,
 }
 
-pub const LATEST_GIT_SYNC_SCRIPT_PATH: &str = "hub/28809/sync-script-to-git-repo-windmill";
+pub const LATEST_GIT_SYNC_SCRIPT_PATH: &str = "hub/28871/sync-script-to-git-repo-windmill";
 
 /// Hub script that applies a repository's state back into a workspace
 /// (the repo → Windmill / "pull" direction). Same script the UI runs from
@@ -175,7 +183,7 @@ pub const LATEST_GIT_SYNC_SCRIPT_PATH: &str = "hub/28809/sync-script-to-git-repo
 /// ignores the slug, so the slug is kept free of characters that would be
 /// percent-encoded into the run URL (a `:` becomes `%3A`, which some hardened
 /// reverse proxies reject as double-encoding when the client re-encodes it).
-pub const GIT_SYNC_PULL_SCRIPT_PATH: &str = "hub/28808/git-sync-init-repository-windmill";
+pub const GIT_SYNC_PULL_SCRIPT_PATH: &str = "hub/28890/git-sync-init-repository-windmill";
 
 /// Prefix used to identify fork workspaces. A workspace whose id starts with this string is a
 /// fork of another workspace.
@@ -310,7 +318,7 @@ fn is_false(b: &bool) -> bool {
     !*b
 }
 
-#[derive(Serialize, Deserialize, Debug)]
+#[derive(Serialize, Deserialize, Debug, Clone)]
 pub struct GitRepositorySettings {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub exclude_types_override: Option<Vec<ObjectType>>,
@@ -508,7 +516,7 @@ impl AutoPullSettings {
     }
 }
 
-#[derive(Serialize, Deserialize, Debug)]
+#[derive(Serialize, Deserialize, Debug, Clone)]
 pub struct GitSyncSettings {
     pub include_path: Vec<String>,
     pub include_type: Vec<ObjectType>,
@@ -1525,10 +1533,12 @@ pub async fn resolve_fork_branch_target(
         .fetch_optional(db)
         .await?
     } else if branch != expected_base {
-        // Environment-label branch (`dev`/`staging`) of a dev-workspace child.
-        // Dev workspaces only exist directly under a root, so no recursion here.
-        // The tracked-branch guard keeps a label that collides with the tracked
-        // branch from double-routing (the parent's own pull already covers it).
+        // Environment-label branch (`dev`, `staging`, ...) of a dev-workspace child.
+        // Direct children only: a dev nested under another dev is parent-managed
+        // by that dev, which holds no auto-pull config of its own, so no branch
+        // pushed to this repo routes to it. The tracked-branch guard keeps a
+        // label that collides with the tracked branch from double-routing (the
+        // parent's own pull already covers it).
         sqlx::query_scalar!(
             "SELECT id FROM workspace \
              WHERE parent_workspace_id = $1 AND NOT deleted AND is_dev_workspace \
@@ -2477,4 +2487,144 @@ mod tests {
         assert!(msg.contains("staging"), "{msg}");
         assert!(msg.contains("tab=windmill_data_tables"), "{msg}");
     }
+
+    #[test]
+    fn test_dbt_warehouse_name_length_bound() {
+        assert!(validate_dbt_warehouse_name(&"a".repeat(MAX_DBT_WAREHOUSE_NAME_LEN)).is_ok());
+        assert!(validate_dbt_warehouse_name(&"a".repeat(MAX_DBT_WAREHOUSE_NAME_LEN + 1)).is_err());
+    }
+}
+
+/// Whether a workspace configures this warehouse, without resolving it.
+///
+/// For the one caller that needs the NAME and nothing else: a project bringing
+/// its own `profiles.yml` names a warehouse to say where its assets belong, and
+/// decrypting a connection it will never open to answer that would be waste.
+///
+/// NO AUTHORIZATION, like the resolver it delegates to: it reads workspace
+/// settings for whatever `w_id` it is given, so callers MUST already be scoped
+/// to that workspace.
+pub async fn dbt_warehouse_exists(db: &DB, w_id: &str, warehouse: &str) -> Result<()> {
+    dbt_warehouse_resource(db, w_id, warehouse)
+        .await
+        .map(|_| ())
+}
+
+/// The longest warehouse name a workspace may configure.
+///
+/// It is the first segment of every `dbt://<warehouse>/<schema>/<name>` key, and
+/// those land in `asset.path`, a VARCHAR(255). A name near that width would push
+/// ordinary relations past the column, and the ingest's own bound would then
+/// skip them — a graph quietly missing models. 64 leaves room for two 63-char
+/// identifiers, which is Postgres's own limit; warehouses that allow longer ones
+/// still rely on that ingest bound as the backstop.
+pub const MAX_DBT_WAREHOUSE_NAME_LEN: usize = 64;
+
+/// A warehouse name is a URL path segment for a worker with no database, so a
+/// name that could re-cut the path (or the query) is refused — at every place a
+/// name enters, not only where one is written, since a descriptor names one too.
+pub fn validate_dbt_warehouse_name(name: &str) -> Result<()> {
+    if name.is_empty()
+        || !name
+            .chars()
+            .all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '-')
+    {
+        return Err(Error::BadRequest(format!(
+            "`{name}` is not a usable dbt warehouse name: use letters, digits, `_` and `-`"
+        )));
+    }
+    if name.chars().count() > MAX_DBT_WAREHOUSE_NAME_LEN {
+        return Err(Error::BadRequest(format!(
+            "`{name}` is too long for a dbt warehouse name (max {MAX_DBT_WAREHOUSE_NAME_LEN}): it \
+             prefixes every asset path this warehouse's models are keyed on"
+        )));
+    }
+    Ok(())
+}
+
+/// A dbt warehouse's resolved connection: the value a `profiles.yml` is rendered
+/// from, and the target the workspace names for it.
+///
+/// Carries CREDENTIALS. dbt is unpermissioned by design (docs/dbt-runtime.md,
+/// Decision 24), so this is served to a running job rather than gated on the
+/// runner's access to the resource — but it must never reach a route a user can
+/// browse.
+#[derive(serde::Serialize, serde::Deserialize)]
+pub struct DbtWarehouseConnection {
+    pub value: serde_json::Value,
+    /// Omitted rather than null when absent, so the wire shape matches the
+    /// schema generated clients validate against.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub target: Option<String>,
+    /// What the value IS, which its shape cannot say: a `dbt_profile`'s value is a
+    /// `profiles.yml` output block and every other type's is a connection to translate,
+    /// and both are objects carrying a `type`. Defaulted so a worker still resolves
+    /// against a server predating the field — which serves no `dbt_profile` anyway.
+    #[serde(default)]
+    pub resource_type: String,
+}
+
+/// The resource type whose value is a `profiles.yml` output block, taken as it
+/// is rather than translated.
+pub const DBT_PROFILE_RESOURCE_TYPE: &str = "dbt_profile";
+
+/// The warehouse a dbt project runs against, by name — `main` when the
+/// descriptor names none.
+///
+/// NO AUTHORIZATION: reads workspace settings for whatever `w_id` it is given.
+/// Callers MUST already be scoped to that workspace — a running job, or a route
+/// that checked its token. What it returns is a POINTER; resolving it is a
+/// separate step, and dbt warehouses are unpermissioned there (Decision 24), so
+/// the pointer is not the last line of defence. A descriptor cannot name a
+/// resource at all, which is what makes the workspace the only place a
+/// warehouse is configured — and
+/// what lets asset identity key on the NAME (`dbt://main/analytics/orders`),
+/// one spelling every project on that warehouse shares.
+pub async fn dbt_warehouse_resource(
+    db: &DB,
+    w_id: &str,
+    warehouse: &str,
+) -> Result<(String, Option<String>)> {
+    let cfg = sqlx::query_scalar!(
+        "SELECT dbt_warehouses FROM workspace_settings WHERE workspace_id = $1",
+        w_id
+    )
+    .fetch_optional(db)
+    .await?
+    .flatten()
+    .unwrap_or(serde_json::Value::Null);
+    let entry = cfg.get(warehouse).cloned().ok_or_else(|| {
+        let configured = cfg
+            .as_object()
+            .map(|o| o.keys().cloned().collect::<Vec<_>>())
+            .unwrap_or_default();
+        Error::NotFound(if configured.is_empty() {
+            format!(
+                "no dbt warehouse is configured for this workspace — an admin adds one under \
+                 Settings → dbt, and a project reaches it by name (`{warehouse}` here)"
+            )
+        } else {
+            format!(
+                "dbt warehouse `{warehouse}` is not configured for this workspace (configured: \
+                 {})",
+                configured.join(", ")
+            )
+        })
+    })?;
+    let path = entry
+        .get("resource_path")
+        .and_then(|p| p.as_str())
+        .ok_or_else(|| {
+            Error::internal_err(format!(
+                "dbt warehouse `{warehouse}` names no resource_path"
+            ))
+        })?;
+    // Stored with or without the prefix, like the storage configs; the caller
+    // resolves a bare path.
+    let path = path.strip_prefix("$res:").unwrap_or(path).to_string();
+    let target = entry
+        .get("target")
+        .and_then(|t| t.as_str())
+        .map(|t| t.to_string());
+    Ok((path, target))
 }
diff --git a/backend/windmill-common/tests/dbt_graph_storage.rs b/backend/windmill-common/tests/dbt_graph_storage.rs
new file mode 100644
index 0000000000..7b4971312a
--- /dev/null
+++ b/backend/windmill-common/tests/dbt_graph_storage.rs
@@ -0,0 +1,554 @@
+//! The dbt graph's storage invariants, against a real database.
+//!
+//! Every defect found in this area across review was DB-shaped — which row set
+//! a read resolves to, which rows a clear takes, whether a snapshot exists at
+//! all — and none of it is reachable from a unit test on a pure function. These
+//! pin the answers that took several rounds to settle.
+
+use sqlx::{Pool, Postgres};
+use windmill_common::dbt_manifest::{
+    clear_dbt_editor_graphs, clear_dbt_manifest_version, prune_dbt_run_graphs,
+    replace_dbt_editor_graph, replace_dbt_manifest, IngestedManifest, IngestedNode,
+    DBT_EDITOR_GRAPHS_KEPT, DEPLOYED_GRAPH, DEPLOYED_GRAPH_VERSIONS_KEPT,
+};
+
+const WS: &str = "test-workspace";
+const PATH: &str = "f/test/proj";
+/// The principal an editor parse runs as. Retention is bounded per identity,
+/// so the tests have to name one.
+const ME: &str = "u/me";
+
+async fn deploy_script(db: &Pool<Postgres>, hash: i64) {
+    sqlx::query!(
+        "INSERT INTO script (workspace_id, hash, path, summary, description, content, created_by,
+                             language, lock)
+         VALUES ($1, $2, $3, '', '', 'profile: {}', 'test-user', 'dbt', '')",
+        WS,
+        hash,
+        PATH,
+    )
+    .execute(db)
+    .await
+    .unwrap();
+}
+
+fn manifest(names: &[&str]) -> IngestedManifest {
+    IngestedManifest {
+        nodes: names
+            .iter()
+            .map(|n| IngestedNode {
+                unique_id: format!("model.p.{n}"),
+                resource_type: "model".to_string(),
+                name: n.to_string(),
+                asset_path: Some(format!("u/a/wh/s/{n}")),
+                raw_code: Some(format!("select 1 as {n}")),
+                ..Default::default()
+            })
+            .collect(),
+        // Chained, so the edge insert actually runs: `ref()` lineage is in every
+        // real project, and a fixture with no edges leaves that statement
+        // unexecuted by every test in this file.
+        edges: names
+            .windows(2)
+            .map(|w| (format!("model.p.{}", w[0]), format!("model.p.{}", w[1])))
+            .collect(),
+        ..Default::default()
+    }
+}
+
+/// Edges for one version, so a test can assert the batched insert ran at all.
+async fn edges_for(db: &Pool<Postgres>, hash: i64) -> i64 {
+    sqlx::query_scalar!(
+        "SELECT count(*) FROM dbt_edge WHERE workspace_id = $1 AND script_hash = $2",
+        WS,
+        hash
+    )
+    .fetch_one(db)
+    .await
+    .unwrap()
+    .unwrap_or(0)
+}
+
+async fn nodes_for(db: &Pool<Postgres>, hash: i64, job: uuid::Uuid) -> i64 {
+    sqlx::query_scalar!(
+        "SELECT count(*) FROM dbt_node WHERE workspace_id = $1 AND script_hash = $2 AND job_id = $3",
+        WS,
+        hash,
+        job
+    )
+    .fetch_one(db)
+    .await
+    .unwrap()
+    .unwrap_or(0)
+}
+
+async fn markers_for_path(db: &Pool<Postgres>) -> i64 {
+    sqlx::query_scalar!(
+        "SELECT count(*) FROM dbt_graph_snapshot WHERE workspace_id = $1 AND script_path = $2",
+        WS,
+        PATH
+    )
+    .fetch_one(db)
+    .await
+    .unwrap()
+    .unwrap_or(0)
+}
+
+async fn markers(db: &Pool<Postgres>, hash: i64) -> i64 {
+    sqlx::query_scalar!(
+        "SELECT count(*) FROM dbt_graph_snapshot WHERE workspace_id = $1 AND script_hash = $2",
+        WS,
+        hash
+    )
+    .fetch_one(db)
+    .await
+    .unwrap()
+    .unwrap_or(0)
+}
+
+/// A run whose graph matches the version's stores nothing. Marking a descriptor
+/// dynamic is conservative — a `{{ }}` in `vars` says the arguments reach dbt,
+/// not that they change which models exist — so the usual dynamic run resolves
+/// to exactly the deployed graph, and storing a copy per run is what filled the
+/// table with an unchanging picture.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn an_identical_run_stores_no_snapshot(db: Pool<Postgres>) {
+    deploy_script(&db, 1).await;
+    let m = manifest(&["a", "b"]);
+    let job = uuid::Uuid::from_u128(7);
+
+    let mut tx = db.begin().await.unwrap();
+    replace_dbt_manifest(&mut tx, WS, PATH, 1, None, &m, "root")
+        .await
+        .unwrap();
+    replace_dbt_manifest(&mut tx, WS, PATH, 1, Some(job), &m, "root")
+        .await
+        .unwrap();
+    tx.commit().await.unwrap();
+
+    assert_eq!(nodes_for(&db, 1, DEPLOYED_GRAPH).await, 2);
+    assert_eq!(
+        nodes_for(&db, 1, job).await,
+        0,
+        "identical run must not snapshot"
+    );
+    assert_eq!(markers(&db, 1).await, 1, "and leaves no marker of its own");
+}
+
+/// A run whose model set differs keeps its own, and the version's is untouched:
+/// this is what lets an older run page render the project that run built.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn a_differing_run_keeps_its_own_snapshot(db: Pool<Postgres>) {
+    deploy_script(&db, 1).await;
+    let job = uuid::Uuid::from_u128(7);
+
+    let mut tx = db.begin().await.unwrap();
+    replace_dbt_manifest(&mut tx, WS, PATH, 1, None, &manifest(&["a"]), "root")
+        .await
+        .unwrap();
+    replace_dbt_manifest(
+        &mut tx,
+        WS,
+        PATH,
+        1,
+        Some(job),
+        &manifest(&["a", "b"]),
+        "root",
+    )
+    .await
+    .unwrap();
+    tx.commit().await.unwrap();
+
+    assert_eq!(nodes_for(&db, 1, DEPLOYED_GRAPH).await, 1);
+    assert_eq!(nodes_for(&db, 1, job).await, 2);
+}
+
+/// A dynamic run can disable every model. That empty graph is an answer, and it
+/// has to be distinguishable from a run that stored nothing — otherwise the run
+/// page falls back to the deployed models and shows what the run never built.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn an_empty_run_graph_is_still_a_snapshot(db: Pool<Postgres>) {
+    deploy_script(&db, 1).await;
+    let job = uuid::Uuid::from_u128(7);
+
+    let mut tx = db.begin().await.unwrap();
+    replace_dbt_manifest(&mut tx, WS, PATH, 1, None, &manifest(&["a"]), "root")
+        .await
+        .unwrap();
+    replace_dbt_manifest(
+        &mut tx,
+        WS,
+        PATH,
+        1,
+        Some(job),
+        &IngestedManifest::default(),
+        "root",
+    )
+    .await
+    .unwrap();
+    tx.commit().await.unwrap();
+
+    assert_eq!(nodes_for(&db, 1, job).await, 0);
+    let marker = sqlx::query_scalar!(
+        "SELECT count(*) FROM dbt_graph_snapshot WHERE workspace_id = $1 AND job_id = $2",
+        WS,
+        job
+    )
+    .fetch_one(&db)
+    .await
+    .unwrap()
+    .unwrap_or(0);
+    assert_eq!(marker, 1, "an empty graph still has a marker");
+}
+
+/// Archiving or deleting ONE version must leave every other version's graph
+/// alone: the routes act on a single hash, and the other versions stay live and
+/// keep needing their own models, SQL and lineage.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn clearing_one_version_leaves_the_others(db: Pool<Postgres>) {
+    deploy_script(&db, 1).await;
+    deploy_script(&db, 2).await;
+    let mut tx = db.begin().await.unwrap();
+    replace_dbt_manifest(&mut tx, WS, PATH, 1, None, &manifest(&["a"]), "root")
+        .await
+        .unwrap();
+    replace_dbt_manifest(&mut tx, WS, PATH, 2, None, &manifest(&["a", "b"]), "root")
+        .await
+        .unwrap();
+    tx.commit().await.unwrap();
+
+    let mut tx = db.begin().await.unwrap();
+    clear_dbt_manifest_version(&mut tx, WS, PATH, 1)
+        .await
+        .unwrap();
+    tx.commit().await.unwrap();
+
+    assert_eq!(nodes_for(&db, 1, DEPLOYED_GRAPH).await, 0);
+    assert_eq!(markers(&db, 1).await, 0, "the marker goes with the rows");
+    assert_eq!(
+        nodes_for(&db, 2, DEPLOYED_GRAPH).await,
+        2,
+        "the other version survives"
+    );
+    assert_eq!(markers(&db, 2).await, 1);
+    // The lineage is stored and cleared with its nodes. Asserted here because
+    // this is where two versions coexist: it pins the batched edge insert
+    // against a real database as well as the version scoping.
+    assert_eq!(edges_for(&db, 1).await, 0, "the cleared version's edges go");
+    assert_eq!(edges_for(&db, 2).await, 1, "the other version keeps its own");
+}
+
+/// The routes that hard-delete a path clear no graph rows: they delete the
+/// `script` rows and let `ON DELETE CASCADE` take the sidecars, since taking
+/// those first would lock them ahead of the script row and deadlock a concurrent
+/// publication. So the cascade has to reach every sidecar, snapshots and markers
+/// included.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn deleting_the_script_cascades_to_every_sidecar(db: Pool<Postgres>) {
+    deploy_script(&db, 1).await;
+    deploy_script(&db, 2).await;
+    let job = uuid::Uuid::from_u128(7);
+    let mut tx = db.begin().await.unwrap();
+    replace_dbt_manifest(&mut tx, WS, PATH, 1, None, &manifest(&["a", "b"]), "root")
+        .await
+        .unwrap();
+    replace_dbt_manifest(&mut tx, WS, PATH, 1, Some(job), &manifest(&["a"]), "root")
+        .await
+        .unwrap();
+    replace_dbt_manifest(&mut tx, WS, PATH, 2, None, &manifest(&["b", "c"]), "root")
+        .await
+        .unwrap();
+    tx.commit().await.unwrap();
+    assert_eq!(markers_for_path(&db).await, 3, "two versions and one run");
+
+    sqlx::query!(
+        "DELETE FROM script WHERE workspace_id = $1 AND path = $2",
+        WS,
+        PATH
+    )
+    .execute(&db)
+    .await
+    .unwrap();
+
+    assert_eq!(nodes_for(&db, 1, DEPLOYED_GRAPH).await, 0);
+    assert_eq!(nodes_for(&db, 1, job).await, 0, "a run's snapshot goes too");
+    assert_eq!(nodes_for(&db, 2, DEPLOYED_GRAPH).await, 0);
+    assert_eq!(edges_for(&db, 1).await, 0);
+    assert_eq!(edges_for(&db, 2).await, 0);
+    assert_eq!(markers_for_path(&db).await, 0);
+}
+
+/// The sweep ages out run snapshots and never a version's own graph, which is
+/// what its runs render from for as long as the version exists.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn the_sweep_takes_old_snapshots_and_spares_the_version(db: Pool<Postgres>) {
+    deploy_script(&db, 1).await;
+    let old = uuid::Uuid::from_u128(7);
+    let recent = uuid::Uuid::from_u128(8);
+
+    let mut tx = db.begin().await.unwrap();
+    replace_dbt_manifest(&mut tx, WS, PATH, 1, None, &manifest(&["a"]), "root")
+        .await
+        .unwrap();
+    replace_dbt_manifest(
+        &mut tx,
+        WS,
+        PATH,
+        1,
+        Some(old),
+        &manifest(&["a", "b"]),
+        "root",
+    )
+    .await
+    .unwrap();
+    replace_dbt_manifest(
+        &mut tx,
+        WS,
+        PATH,
+        1,
+        Some(recent),
+        &manifest(&["a", "c"]),
+        "root",
+    )
+    .await
+    .unwrap();
+    tx.commit().await.unwrap();
+
+    // Age one snapshot past the window, rows and marker together.
+    for t in ["dbt_node", "dbt_edge", "dbt_graph_snapshot"] {
+        sqlx::query(&format!(
+            "UPDATE {t} SET ingested_at = now() - interval '400 days' WHERE job_id = $1"
+        ))
+        .bind(old)
+        .execute(&db)
+        .await
+        .unwrap();
+    }
+
+    prune_dbt_run_graphs(&db, PATH, WS).await.unwrap();
+
+    assert_eq!(nodes_for(&db, 1, old).await, 0, "the aged snapshot goes");
+    assert_eq!(nodes_for(&db, 1, recent).await, 2, "the recent one stays");
+    assert_eq!(
+        nodes_for(&db, 1, DEPLOYED_GRAPH).await,
+        1,
+        "and a version's own graph is never swept"
+    );
+}
+
+/// A version's graph cannot expire on a clock — a run page is as old as its job
+/// — so growth is bounded by deploy COUNT instead. The newest deploys keep
+/// theirs; past that the oldest are reclaimed, which is what stops a CI that
+/// deploys on every commit from adding a model set per commit forever.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn only_the_newest_deploys_keep_their_graph(db: Pool<Postgres>) {
+    let over = DEPLOYED_GRAPH_VERSIONS_KEPT + 3;
+    for h in 1..=over {
+        deploy_script(&db, h).await;
+        let mut tx = db.begin().await.unwrap();
+        replace_dbt_manifest(&mut tx, WS, PATH, h, None, &manifest(&["a"]), "root")
+            .await
+            .unwrap();
+        tx.commit().await.unwrap();
+    }
+    assert_eq!(markers_for_path(&db).await, over, "every deploy stored one");
+
+    prune_dbt_run_graphs(&db, PATH, WS).await.unwrap();
+
+    assert_eq!(
+        markers_for_path(&db).await,
+        DEPLOYED_GRAPH_VERSIONS_KEPT,
+        "the bound holds"
+    );
+    // The newest is always among them: losing the live version's graph would
+    // empty the page of every run of it.
+    assert_eq!(nodes_for(&db, over, DEPLOYED_GRAPH).await, 1);
+    assert_eq!(nodes_for(&db, 1, DEPLOYED_GRAPH).await, 0, "the oldest is reclaimed");
+}
+
+/// The third provenance: a `parse` of the EDITOR's buffer, which names no
+/// deployed version. It cannot borrow the deployed hash — the buffer differs
+/// from it, and a project being written may have no deployed version at all — so
+/// it is keyed to the parse job alone and leaves the version's graph untouched.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn an_editor_parse_is_keyed_to_its_job_and_no_version(db: Pool<Postgres>) {
+    deploy_script(&db, 1).await;
+    let job = uuid::Uuid::from_u128(7);
+
+    let mut tx = db.begin().await.unwrap();
+    replace_dbt_manifest(&mut tx, WS, PATH, 1, None, &manifest(&["a"]), "root")
+        .await
+        .unwrap();
+    replace_dbt_editor_graph(&mut tx, WS, PATH, job, ME, &manifest(&["a", "b"]), "root")
+        .await
+        .unwrap();
+    tx.commit().await.unwrap();
+
+    assert_eq!(
+        editor_nodes(&db, job).await,
+        2,
+        "the buffer's own models are stored"
+    );
+    assert_eq!(
+        nodes_for(&db, 1, DEPLOYED_GRAPH).await,
+        1,
+        "and the deployed version's graph is untouched"
+    );
+    assert_eq!(
+        nodes_for(&db, 1, job).await,
+        0,
+        "nothing is attributed to the version"
+    );
+}
+
+/// A buffer identical to the deploy still stores a graph, unlike a run's
+/// snapshot: the editor pins to its own job, so suppressing the write would
+/// leave it nothing to pin to and its provenance label would claim a parse that
+/// is not on screen.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn an_editor_parse_matching_the_deploy_still_stores(db: Pool<Postgres>) {
+    deploy_script(&db, 1).await;
+    let job = uuid::Uuid::from_u128(7);
+    let m = manifest(&["a"]);
+
+    let mut tx = db.begin().await.unwrap();
+    replace_dbt_manifest(&mut tx, WS, PATH, 1, None, &m, "root")
+        .await
+        .unwrap();
+    replace_dbt_editor_graph(&mut tx, WS, PATH, job, ME, &m, "root")
+        .await
+        .unwrap();
+    tx.commit().await.unwrap();
+
+    assert_eq!(editor_nodes(&db, job).await, 1);
+}
+
+/// Bounded per (path, principal) as each refresh lands: the ones before it are
+/// dead the moment a newer parse arrives, and a click that stored a full model
+/// set forever would be the editor's own leak.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn only_the_newest_editor_parses_are_kept(db: Pool<Postgres>) {
+    let over = DBT_EDITOR_GRAPHS_KEPT + 2;
+    for i in 1..=over {
+        let mut tx = db.begin().await.unwrap();
+        replace_dbt_editor_graph(
+            &mut tx,
+            WS,
+            PATH,
+            uuid::Uuid::from_u128(i as u128),
+            ME,
+            &manifest(&["a"]),
+            "root",
+        )
+        .await
+        .unwrap();
+        tx.commit().await.unwrap();
+    }
+    assert_eq!(
+        editor_markers(&db).await,
+        DBT_EDITOR_GRAPHS_KEPT,
+        "the bound holds"
+    );
+    assert_eq!(
+        editor_nodes(&db, uuid::Uuid::from_u128(over as u128)).await,
+        1,
+        "the newest is always among them"
+    );
+    assert_eq!(
+        editor_nodes(&db, uuid::Uuid::from_u128(1)).await,
+        0,
+        "and its rows go with its marker"
+    );
+}
+
+/// Archiving or deleting ONE version must not take an editor's graph with it —
+/// that graph describes a buffer, not a version.
+///
+/// Retiring the whole PATH must, and cannot rely on the cascade the versioned
+/// rows ride: a version-less row leaves `script_hash` NULL, which satisfies the
+/// composite foreign key without referencing anything, so deleting the script
+/// takes the version's graph and leaves the editor's behind.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn a_version_clear_spares_editor_graphs_and_a_path_clear_does_not(db: Pool<Postgres>) {
+    deploy_script(&db, 1).await;
+    let job = uuid::Uuid::from_u128(7);
+
+    let mut tx = db.begin().await.unwrap();
+    replace_dbt_manifest(&mut tx, WS, PATH, 1, None, &manifest(&["a"]), "root")
+        .await
+        .unwrap();
+    replace_dbt_editor_graph(&mut tx, WS, PATH, job, ME, &manifest(&["a"]), "root")
+        .await
+        .unwrap();
+    clear_dbt_manifest_version(&mut tx, WS, PATH, 1).await.unwrap();
+    tx.commit().await.unwrap();
+
+    assert_eq!(nodes_for(&db, 1, DEPLOYED_GRAPH).await, 0);
+    assert_eq!(editor_nodes(&db, job).await, 1, "the buffer's graph survives");
+
+    let mut tx = db.begin().await.unwrap();
+    clear_dbt_editor_graphs(&mut tx, WS, PATH).await.unwrap();
+    tx.commit().await.unwrap();
+
+    assert_eq!(editor_nodes(&db, job).await, 0, "retiring the path takes it");
+}
+
+/// A preview names its own PATH and needs only `jobs:run`, so a bound over the
+/// path alone is a way to retire the graphs of whoever is actually editing that
+/// script. Each identity reclaims only its own.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn one_principal_cannot_evict_another_s_editor_graphs(db: Pool<Postgres>) {
+    let mine = uuid::Uuid::from_u128(1);
+    let mut tx = db.begin().await.unwrap();
+    replace_dbt_editor_graph(&mut tx, WS, PATH, mine, ME, &manifest(&["a"]), "root")
+        .await
+        .unwrap();
+    // Someone else, parsing the same path far more often than the bound allows.
+    for i in 0..(DBT_EDITOR_GRAPHS_KEPT + 3) {
+        replace_dbt_editor_graph(
+            &mut tx,
+            WS,
+            PATH,
+            uuid::Uuid::from_u128(100 + i as u128),
+            "u/squatter",
+            &manifest(&["a"]),
+            "root",
+        )
+        .await
+        .unwrap();
+    }
+    tx.commit().await.unwrap();
+
+    assert_eq!(
+        editor_nodes(&db, mine).await,
+        1,
+        "another principal's parses must not retire this one's graph"
+    );
+}
+
+/// Nodes of one editor parse.
+async fn editor_nodes(db: &Pool<Postgres>, job: uuid::Uuid) -> i64 {
+    sqlx::query_scalar!(
+        "SELECT count(*) FROM dbt_node
+          WHERE workspace_id = $1 AND job_id = $2 AND script_hash IS NULL",
+        WS,
+        job
+    )
+    .fetch_one(db)
+    .await
+    .unwrap()
+    .unwrap_or(0)
+}
+
+async fn editor_markers(db: &Pool<Postgres>) -> i64 {
+    sqlx::query_scalar!(
+        "SELECT count(*) FROM dbt_graph_snapshot
+          WHERE workspace_id = $1 AND script_path = $2 AND script_hash IS NULL",
+        WS,
+        PATH
+    )
+    .fetch_one(db)
+    .await
+    .unwrap()
+    .unwrap_or(0)
+}
diff --git a/backend/windmill-dep-map/src/trigger_dependents.rs b/backend/windmill-dep-map/src/trigger_dependents.rs
index 1254e41ed1..51a7fd4b90 100644
--- a/backend/windmill-dep-map/src/trigger_dependents.rs
+++ b/backend/windmill-dep-map/src/trigger_dependents.rs
@@ -188,6 +188,7 @@ pub async fn trigger_dependents_to_recompute_dependencies(
             email,
             permissioned_as.to_string(),
             Some("trigger.dependents.to.recompute.dependencies"),
+            None,
             Some(Utc::now() + Duration::seconds(*DEPENDENCY_JOB_DEBOUNCE_DELAY as i64)),
             None,
             None,
diff --git a/backend/windmill-git-sync/src/git_sync_oss.rs b/backend/windmill-git-sync/src/git_sync_oss.rs
index 5cf1995525..2e04033f35 100644
--- a/backend/windmill-git-sync/src/git_sync_oss.rs
+++ b/backend/windmill-git-sync/src/git_sync_oss.rs
@@ -29,6 +29,7 @@ pub async fn tally_deployed_object_changes(
     _obj: &DeployedObject,
     _db: &DB,
     _renamed_from: Option<&str>,
+    _origin: Option<windmill_common::deploy_origin::DeployOrigin>,
 ) -> Result<()> {
     // Workspace forks are an enterprise feature and not part of the open-source version
     return Ok(());
diff --git a/backend/windmill-git-sync/src/lib.rs b/backend/windmill-git-sync/src/lib.rs
index 1f6e8f5811..2bfc7d2f77 100644
--- a/backend/windmill-git-sync/src/lib.rs
+++ b/backend/windmill-git-sync/src/lib.rs
@@ -162,6 +162,27 @@ impl DeployedObject {
         }
     }
 
+    /// The repo-relative path git sync syncs on: what the sync item carries, and
+    /// therefore what the CLI turns into `--extra-includes` globs and `git add`
+    /// pathspecs.
+    ///
+    /// It only differs from [`Self::get_path`] for data table migrations, whose
+    /// object path (`<datatable>/<version>_<name>`, the `workspace_diff` key) is
+    /// relative to the `migrations/datatable/` prefix the workspace export writes
+    /// them under. Without the prefix the CLI derives globs that match no file,
+    /// so nothing gets staged and the push silently commits nothing.
+    pub fn get_git_sync_path(&self) -> String {
+        match self {
+            DeployedObject::DatatableMigration { path } => {
+                format!("migrations/datatable/{path}")
+            }
+            _ => self.get_path(),
+        }
+    }
+
+    /// Whether the object skips the repo's include/exclude path filters. True for
+    /// every kind that lives outside the `f/`/`u/` path namespaces those filters
+    /// are written against — the object-type filter is what governs them instead.
     pub fn get_ignore_regex_filter(&self) -> bool {
         match self {
             Self::User { .. }
@@ -169,7 +190,8 @@ impl DeployedObject {
             | Self::ResourceType { .. }
             | Self::Settings { .. }
             | Self::Key { .. }
-            | Self::WorkspaceDependencies { .. } => true,
+            | Self::WorkspaceDependencies { .. }
+            | Self::DatatableMigration { .. } => true,
             _ => false,
         }
     }
@@ -238,6 +260,165 @@ impl DeployedObject {
     }
 }
 
+/// Record, from the request that made it, that a rename left `vacated` empty.
+/// Only its path and kind are read, so build it naming the path the rename left.
+///
+/// A deploy whose metadata is handled by its dependency job needs this: that job
+/// runs at an unknown remove from the write, and the row it would write is
+/// deleted as soon as the two workspaces agree on the path — so a claim it made
+/// could reappear later against an item the parent has since recreated. Call
+/// once the rename has committed; the tally reads what the path holds now.
+pub async fn tally_rename_vacated_path(
+    db: &DB,
+    w_id: &str,
+    vacated: DeployedObject,
+) -> windmill_common::error::Result<()> {
+    tally_deployed_object_changes(
+        w_id,
+        &vacated,
+        db,
+        None,
+        windmill_common::deploy_origin::current(),
+    )
+    .await
+}
+
+/// Item kinds whose `workspace_diff` path is the `path` column of a table named
+/// after the kind. Interpolated into SQL, so it must stay a hardcoded allowlist —
+/// and, unlike the `sqlx::query!` arms below, a wrong name here is not a compile
+/// error, so `workspace_comparison.rs` sweeps this list against a live database.
+pub const PATH_KEYED_TABLES: &[&str] = &[
+    "resource",
+    "variable",
+    "schedule",
+    "http_trigger",
+    "websocket_trigger",
+    "kafka_trigger",
+    "nats_trigger",
+    "postgres_trigger",
+    "mqtt_trigger",
+    "amqp_trigger",
+    "sqs_trigger",
+    "gcp_trigger",
+    "azure_trigger",
+    "email_trigger",
+];
+
+/// What the deploy event that just committed did to `path`: [`DeployEventKind::Write`]
+/// if the workspace still holds an item there, [`DeployEventKind::Delete`] if it does
+/// not. `None` for a kind this does not know how to probe, so an unmapped kind is
+/// recorded as no evidence rather than as a deletion.
+///
+/// Existence mirrors the comparison's (`compare_two_*`): an archived script or flow
+/// counts as absent. Runs on `&db` (no RLS) — the caller is a post-commit tally, not
+/// a user-facing read.
+pub async fn probe_deploy_event_kind(
+    db: &DB,
+    w_id: &str,
+    kind: &str,
+    path: &str,
+) -> windmill_common::error::Result<Option<windmill_common::deploy_origin::DeployEventKind>> {
+    use windmill_common::deploy_origin::DeployEventKind;
+
+    let exists: Option<bool> = match kind {
+        "script" => Some(
+            sqlx::query_scalar!(
+                "SELECT EXISTS(SELECT 1 FROM script WHERE workspace_id = $1 AND path = $2 AND archived = false)",
+                w_id,
+                path
+            )
+            .fetch_one(db)
+            .await?
+            .unwrap_or(false),
+        ),
+        "flow" => Some(
+            sqlx::query_scalar!(
+                "SELECT EXISTS(SELECT 1 FROM flow WHERE workspace_id = $1 AND path = $2 AND archived = false)",
+                w_id,
+                path
+            )
+            .fetch_one(db)
+            .await?
+            .unwrap_or(false),
+        ),
+        // Raw apps live in the `app` table too, keyed by path like a regular app.
+        "app" | "raw_app" => Some(
+            sqlx::query_scalar!(
+                "SELECT EXISTS(SELECT 1 FROM app WHERE workspace_id = $1 AND path = $2)",
+                w_id,
+                path
+            )
+            .fetch_one(db)
+            .await?
+            .unwrap_or(false),
+        ),
+        "folder" => {
+            let name = path.strip_prefix("f/").unwrap_or(path);
+            Some(
+                sqlx::query_scalar!(
+                    "SELECT EXISTS(SELECT 1 FROM folder WHERE workspace_id = $1 AND name = $2)",
+                    w_id,
+                    name
+                )
+                .fetch_one(db)
+                .await?
+                .unwrap_or(false),
+            )
+        }
+        "resource_type" => Some(
+            sqlx::query_scalar!(
+                "SELECT EXISTS(SELECT 1 FROM resource_type WHERE workspace_id = $1 AND name = $2)",
+                w_id,
+                path
+            )
+            .fetch_one(db)
+            .await?
+            .unwrap_or(false),
+        ),
+        // Identified by (datatable, timestamp), which survives a rename of the
+        // migration's `name` segment; the full path does not.
+        "datatable_migration" => match path
+            .split_once('/')
+            .and_then(|(dt, rest)| Some((dt, rest.split_once('_')?.0.parse::<i64>().ok()?)))
+        {
+            Some((datatable, timestamp)) => Some(
+                sqlx::query_scalar!(
+                    "SELECT EXISTS(SELECT 1 FROM datatable_migrations \
+                     WHERE workspace_id = $1 AND datatable = $2 AND timestamp = $3)",
+                    w_id,
+                    datatable,
+                    timestamp
+                )
+                .fetch_one(db)
+                .await?
+                .unwrap_or(false),
+            ),
+            None => None,
+        },
+        k if PATH_KEYED_TABLES.contains(&k) => {
+            // SAFETY: `k` comes from the hardcoded PATH_KEYED_TABLES allowlist.
+            let sql =
+                format!("SELECT EXISTS(SELECT 1 FROM {k} WHERE workspace_id = $1 AND path = $2)");
+            Some(
+                sqlx::query_scalar(&sql)
+                    .bind(w_id)
+                    .bind(path)
+                    .fetch_one(db)
+                    .await?,
+            )
+        }
+        _ => None,
+    };
+
+    Ok(exists.map(|exists| {
+        if exists {
+            DeployEventKind::Write
+        } else {
+            DeployEventKind::Delete
+        }
+    }))
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -297,6 +478,32 @@ mod tests {
         assert_eq!(obj.get_path(), "workspace-dependencies/python");
     }
 
+    // --- DeployedObject::get_git_sync_path tests ---
+
+    #[test]
+    fn test_get_git_sync_path_datatable_migration_is_repo_relative() {
+        let obj = DeployedObject::DatatableMigration {
+            path: "mydb/20260101000000_add_users".to_string(),
+        };
+        // The object path keys `workspace_diff`; the git-sync path must carry the
+        // export's prefix or the CLI stages nothing.
+        assert_eq!(obj.get_path(), "mydb/20260101000000_add_users");
+        assert_eq!(
+            obj.get_git_sync_path(),
+            "migrations/datatable/mydb/20260101000000_add_users"
+        );
+    }
+
+    #[test]
+    fn test_get_git_sync_path_defaults_to_object_path() {
+        let obj = DeployedObject::Script {
+            hash: ScriptHash(123),
+            path: "f/folder/script".to_string(),
+            parent_path: None,
+        };
+        assert_eq!(obj.get_git_sync_path(), obj.get_path());
+    }
+
     // --- DeployedObject::get_ignore_regex_filter tests ---
 
     #[test]
@@ -337,6 +544,17 @@ mod tests {
         assert!(obj.get_ignore_regex_filter());
     }
 
+    #[test]
+    fn test_ignore_regex_filter_datatable_migration() {
+        // `migrations/datatable/**` is outside the `f/`/`u/` namespaces the path
+        // filters are written against; the `datatablemigration` include type is
+        // what governs these.
+        let obj = DeployedObject::DatatableMigration {
+            path: "mydb/20260101000000_add_users".to_string(),
+        };
+        assert!(obj.get_ignore_regex_filter());
+    }
+
     #[test]
     fn test_ignore_regex_filter_script() {
         let obj = DeployedObject::Script {
diff --git a/backend/windmill-mcp/Cargo.toml b/backend/windmill-mcp/Cargo.toml
index 36e0d03d18..8ac23e885d 100644
--- a/backend/windmill-mcp/Cargo.toml
+++ b/backend/windmill-mcp/Cargo.toml
@@ -17,7 +17,7 @@ auth = ["rmcp/auth", "dep:oauth2", "dep:sqlx", "dep:chrono"]
 oauth2 = { version = "5.0", optional = true }
 windmill-common = { workspace = true, default-features = false }
 anyhow.workspace = true
-reqwest = { version = "=0.12", features = ["json", "stream", "gzip"] }
+reqwest.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 tracing.workspace = true
diff --git a/backend/windmill-mcp/src/client/mod.rs b/backend/windmill-mcp/src/client/mod.rs
index f61a1c3f85..863d6b0355 100644
--- a/backend/windmill-mcp/src/client/mod.rs
+++ b/backend/windmill-mcp/src/client/mod.rs
@@ -85,10 +85,7 @@ impl McpClient {
             // and does not legitimately rely on redirects.
             .redirect(reqwest::redirect::Policy::none());
         // Pin DNS to the address validated above so the connect cannot rebind to
-        // an internal IP between the check and the request. `apply_dns_pinning`
-        // lives on windmill-common's reqwest, but this crate resolves a
-        // different reqwest version (via rmcp), so pin directly with the
-        // std-typed host/addrs the validation surfaced. Empty addrs (IP literal
+        // an internal IP between the check and the request. Empty addrs (IP literal
         // or ALLOW_PRIVATE_MCP_SERVER_URLS) leave resolution untouched.
         if !validated.addrs.is_empty() {
             client_builder = client_builder.resolve_to_addrs(&validated.host, &validated.addrs);
@@ -102,19 +99,11 @@ impl McpClient {
         let transport = StreamableHttpClientTransport::with_client(reqwest_client, config);
 
         // Set up client info
-        let client_info = ClientInfo {
-            protocol_version: Default::default(),
-            capabilities: ClientCapabilities::default(),
-            client_info: Implementation {
-                name: "windmill-ai-agent".to_string(),
-                title: Some("Windmill AI Agent".to_string()),
-                version: env!("CARGO_PKG_VERSION").to_string(),
-                description: None,
-                website_url: None,
-                icons: None,
-            },
-            meta: None,
-        };
+        let client_info = ClientInfo::new(
+            ClientCapabilities::default(),
+            Implementation::new("windmill-ai-agent", env!("CARGO_PKG_VERSION"))
+                .with_title("Windmill AI Agent"),
+        );
 
         // Initialize the connection
         let client = client_info
@@ -143,14 +132,14 @@ impl McpClient {
         let mcp_args =
             Self::openai_args_to_mcp_args(arguments).context("Failed to parse tool arguments")?;
 
+        let mut params = CallToolRequestParams::new(name.to_string());
+        if let Some(args) = mcp_args {
+            params = params.with_arguments(args);
+        }
+
         let result = self
             .client
-            .call_tool(CallToolRequestParams {
-                name: name.to_string().into(),
-                arguments: mcp_args,
-                task: None,
-                meta: None,
-            })
+            .call_tool(params)
             .await
             .context(format!("Failed to call MCP tool: {}", name))?;
 
diff --git a/backend/windmill-mcp/src/client_registration.rs b/backend/windmill-mcp/src/client_registration.rs
index 637b76df80..3aa39e840b 100644
--- a/backend/windmill-mcp/src/client_registration.rs
+++ b/backend/windmill-mcp/src/client_registration.rs
@@ -170,7 +170,7 @@ pub async fn get_or_refresh_mcp_client(
         .map_err(|e| error::Error::BadRequest(format!("Failed to create auth manager: {e}")))?;
     // Discovery hits the well-known endpoint on the MCP server host validated
     // above; pin to that address so it cannot rebind between check and connect.
-    // Limitation: rmcp's discover_metadata may additionally follow server-supplied
+    // Limitation: rmcp's resolve_metadata may additionally follow server-supplied
     // metadata URLs (resource_metadata / authorization_servers) on other hosts,
     // which this per-host pin does not cover — a pre-existing gap in rmcp discovery
     // that a validating resolver would need to close, out of scope for this pin.
@@ -181,8 +181,7 @@ pub async fn get_or_refresh_mcp_client(
         .with_client(discovery_client)
         .map_err(|e| error::Error::BadRequest(format!("Failed to configure auth manager: {e}")))?;
 
-    let metadata = manager
-        .discover_metadata()
+    let metadata = crate::oauth::discover_authorization_metadata(&manager)
         .await
         .map_err(|e| error::Error::BadRequest(format!("OAuth discovery failed: {e}")))?;
 
diff --git a/backend/windmill-mcp/src/lib.rs b/backend/windmill-mcp/src/lib.rs
index d5eb0b9597..33a20be2f0 100644
--- a/backend/windmill-mcp/src/lib.rs
+++ b/backend/windmill-mcp/src/lib.rs
@@ -40,10 +40,30 @@ pub mod oauth {
 
     use std::time::Duration;
 
-    pub use rmcp::transport::auth::AuthorizationManager;
+    use rmcp::transport::auth::AuthorizationMetadataSource;
+    pub use rmcp::transport::auth::{AuthorizationManager, AuthorizationMetadata};
 
     const DEFAULT_OAUTH_HTTP_TIMEOUT: Duration = Duration::from_secs(30);
 
+    /// Discover the MCP server's OAuth metadata, refusing endpoints the server
+    /// never advertised.
+    ///
+    /// When a server publishes no metadata at all, rmcp's `resolve_metadata`
+    /// falls back to inventing `/authorize`, `/token` and `/register` on the
+    /// server's own host. Dynamic client registration and the token exchange
+    /// both carry secrets, so they must only ever reach endpoints the server
+    /// actually published — a guessed path would send them somewhere the
+    /// operator never designated as an authorization server.
+    pub async fn discover_authorization_metadata(
+        manager: &AuthorizationManager,
+    ) -> anyhow::Result<AuthorizationMetadata> {
+        let resolution = manager.resolve_metadata().await?;
+        if resolution.source == AuthorizationMetadataSource::LegacyEndpointFallback {
+            anyhow::bail!("MCP server does not publish OAuth authorization metadata");
+        }
+        Ok(resolution.metadata)
+    }
+
     pub fn no_redirect_http_client() -> Result<reqwest::Client, reqwest::Error> {
         no_redirect_http_client_with_timeout(DEFAULT_OAUTH_HTTP_TIMEOUT)
     }
@@ -61,11 +81,8 @@ pub mod oauth {
     /// guard validated for the request URL so the connect cannot rebind to an
     /// internal IP after the check (TOCTOU). The OAuth DCR/discovery/token
     /// requests target author-controlled URLs and carry secrets, so they must
-    /// go through this rather than the unpinned client. `apply_dns_pinning`
-    /// lives on windmill-common's reqwest, which this crate resolves at a
-    /// different version (via rmcp), so pin directly with the std-typed
-    /// host/addrs. Empty `addrs` (IP literal or ALLOW_PRIVATE_MCP_SERVER_URLS)
-    /// leaves resolution untouched.
+    /// go through this rather than the unpinned client. Empty `addrs` (IP literal
+    /// or ALLOW_PRIVATE_MCP_SERVER_URLS) leaves resolution untouched.
     pub fn no_redirect_http_client_pinned(
         target: &windmill_common::ssrf::ValidatedTarget,
     ) -> Result<reqwest::Client, reqwest::Error> {
@@ -124,5 +141,41 @@ pub mod oauth {
 
             handle.join().unwrap();
         }
+
+        /// A server publishing no OAuth metadata must be rejected, not have its
+        /// endpoints guessed: rmcp's own fallback would invent `/authorize`,
+        /// `/token` and `/register` on that host, and DCR and the token exchange
+        /// send secrets to whatever comes back.
+        #[tokio::test]
+        async fn discovery_refuses_endpoints_the_server_never_published() {
+            let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+            let addr = listener.local_addr().unwrap();
+
+            let handle = thread::spawn(move || {
+                // Every discovery probe 404s, which is what a plain MCP server
+                // with no authorization server looks like.
+                while let Ok((mut stream, _)) = listener.accept() {
+                    let mut buffer = [0u8; 2048];
+                    let _ = stream.read(&mut buffer);
+                    let _ = std::io::Write::write_all(
+                        &mut stream,
+                        b"HTTP/1.1 404 Not Found\r\ncontent-length: 0\r\nconnection: close\r\n\r\n",
+                    );
+                }
+            });
+
+            let manager = AuthorizationManager::new(format!("http://{addr}/mcp"))
+                .await
+                .expect("manager should construct");
+            let err = discover_authorization_metadata(&manager)
+                .await
+                .expect_err("must not fall back to guessed endpoints");
+            assert!(
+                err.to_string().contains("does not publish OAuth"),
+                "unexpected error: {err}"
+            );
+
+            drop(handle);
+        }
     }
 }
diff --git a/backend/windmill-mcp/src/server/endpoints.rs b/backend/windmill-mcp/src/server/endpoints.rs
index 9e3adffc0b..cea2896caa 100644
--- a/backend/windmill-mcp/src/server/endpoints.rs
+++ b/backend/windmill-mcp/src/server/endpoints.rs
@@ -59,17 +59,13 @@ pub fn endpoint_tool_to_mcp_tool(tool: &EndpointTool) -> Tool {
     // Create annotations based on HTTP method and endpoint characteristics
     let annotations = create_endpoint_annotations(tool);
 
-    Tool {
-        name: tool.name.clone(),
-        description: Some(description.into()),
-        input_schema: Arc::new(combined_schema.as_object().unwrap().clone()),
-        title: Some(tool.name.to_string()),
-        output_schema: None,
-        icons: None,
-        annotations: Some(annotations),
-        meta: None,
-        execution: None,
-    }
+    Tool::new(
+        tool.name.clone(),
+        description,
+        Arc::new(combined_schema.as_object().unwrap().clone()),
+    )
+    .with_title(tool.name.to_string())
+    .with_annotations(annotations)
 }
 
 /// Convert an endpoint tool to an MCP tool for multi-workspace mode.
@@ -130,26 +126,19 @@ pub fn list_workspaces_tool() -> Tool {
         "required": []
     });
 
-    Tool {
-        name: Cow::Borrowed("list_workspaces"),
-        description: Some(
-            "List the Windmill workspaces this token can access. Use the returned workspace ids as the `workspace_id` argument of the other tools."
-                .into(),
-        ),
-        input_schema: Arc::new(schema.as_object().unwrap().clone()),
-        title: Some("List accessible workspaces".to_string()),
-        output_schema: None,
-        icons: None,
-        annotations: Some(ToolAnnotations {
-            title: Some("List accessible workspaces".to_string()),
-            read_only_hint: Some(true),
-            destructive_hint: Some(false),
-            idempotent_hint: Some(true),
-            open_world_hint: Some(false),
-        }),
-        meta: None,
-        execution: None,
-    }
+    Tool::new(
+        Cow::Borrowed("list_workspaces"),
+        "List the Windmill workspaces this token can access. Use the returned workspace ids as the `workspace_id` argument of the other tools.",
+        Arc::new(schema.as_object().unwrap().clone()),
+    )
+    .with_title("List accessible workspaces")
+    .with_annotations(
+        ToolAnnotations::with_title("List accessible workspaces")
+            .read_only(true)
+            .destructive(false)
+            .idempotent(true)
+            .open_world(false),
+    )
 }
 
 /// Create appropriate annotations for endpoint tools based on HTTP method
@@ -166,13 +155,11 @@ fn create_endpoint_annotations(tool: &EndpointTool) -> ToolAnnotations {
         _ => (false, true, false, true),    // Default: assume can modify and be destructive
     };
 
-    ToolAnnotations {
-        title: Some(format!("{} {}", method, tool.path)),
-        read_only_hint: Some(read_only),
-        destructive_hint: Some(destructive),
-        idempotent_hint: Some(idempotent),
-        open_world_hint: Some(open_world),
-    }
+    ToolAnnotations::with_title(format!("{} {}", method, tool.path))
+        .read_only(read_only)
+        .destructive(destructive)
+        .idempotent(idempotent)
+        .open_world(open_world)
 }
 
 /// Merge schema into combined properties and required fields
diff --git a/backend/windmill-mcp/src/server/mod.rs b/backend/windmill-mcp/src/server/mod.rs
index da7032418b..19c7e43df6 100644
--- a/backend/windmill-mcp/src/server/mod.rs
+++ b/backend/windmill-mcp/src/server/mod.rs
@@ -23,10 +23,10 @@ pub use tools::create_tool_from_item;
 // Re-export rmcp types for convenience
 pub use rmcp::handler::server::ServerHandler;
 pub use rmcp::model::{
-    Annotated, CallToolRequestParams, CallToolResult, Content, Implementation,
-    InitializeRequestParams, InitializeResult, ListPromptsResult, ListResourceTemplatesResult,
-    ListResourcesResult, ListToolsResult, PaginatedRequestParams, ProtocolVersion, RawContent,
-    RawTextContent, ServerCapabilities, ServerInfo, Tool, ToolAnnotations,
+    CallToolRequestParams, CallToolResult, ContentBlock, Implementation, InitializeRequestParams,
+    InitializeResult, ListPromptsResult, ListResourceTemplatesResult, ListResourcesResult,
+    ListToolsResult, PaginatedRequestParams, ProtocolVersion, ServerCapabilities, ServerInfo, Tool,
+    ToolAnnotations,
 };
 pub use rmcp::service::{RequestContext, RoleServer};
 pub use rmcp::transport::streamable_http_server::{
diff --git a/backend/windmill-mcp/src/server/runner.rs b/backend/windmill-mcp/src/server/runner.rs
index f9d8c5d876..e8248920ed 100644
--- a/backend/windmill-mcp/src/server/runner.rs
+++ b/backend/windmill-mcp/src/server/runner.rs
@@ -17,16 +17,42 @@ use crate::server::endpoints::{
 use crate::server::tools::create_tool_from_item;
 use rmcp::handler::server::ServerHandler;
 use rmcp::model::{
-    CallToolRequestParams, CallToolResult, Content, Implementation, InitializeRequestParams,
-    InitializeResult, ListPromptsResult, ListResourceTemplatesResult, ListResourcesResult,
-    ListToolsResult, PaginatedRequestParams, ProtocolVersion, ServerCapabilities, ServerInfo,
+    CacheScope, CallToolRequestParams, CallToolResponse, CallToolResult, ContentBlock,
+    Implementation, InitializeResult, ListPromptsResult, ListResourceTemplatesResult,
+    ListResourcesResult, ListToolsResult, PaginatedRequestParams, ProtocolVersion,
+    ServerCapabilities, ServerInfo,
 };
 use rmcp::service::{RequestContext, RoleServer};
 use rmcp::ErrorData;
 use serde_json::Value;
+use std::borrow::Cow;
 use std::collections::{HashMap, HashSet};
 use std::sync::Arc;
 
+/// Protocol revisions this server is willing to speak. `2026-07-28` is served
+/// statelessly with per-request metadata; the older revisions keep the
+/// `initialize` handshake, so both eras are answered on the same endpoint.
+const SUPPORTED_PROTOCOL_VERSIONS: &[ProtocolVersion] = &[
+    ProtocolVersion::V_2024_11_05,
+    ProtocolVersion::V_2025_03_26,
+    ProtocolVersion::V_2025_06_18,
+    ProtocolVersion::V_2025_11_25,
+    ProtocolVersion::V_2026_07_28,
+];
+
+/// SEP-2549 cache hints, required on every list result at `2026-07-28` — rmcp
+/// leaves them unset, and a strict client rejects the response without them.
+///
+/// Zero because nothing here is cacheable: the listing is rebuilt from the
+/// workspace's scripts and flows, which change at any time, and this server
+/// advertises no `listChanged` capability, so a client that cached a stale list
+/// would have no way to learn it had gone stale.
+const LIST_TTL_MS: u64 = 0;
+/// Every listing is filtered by the caller's token scopes and workspace
+/// membership, so no two callers necessarily see the same tools — a shared
+/// cache entry would leak one token's view to another.
+const LIST_CACHE_SCOPE: CacheScope = CacheScope::Private;
+
 // Re-export from http crate for extracting request parts
 use http::request::Parts as HttpParts;
 
@@ -127,7 +153,9 @@ impl<B: McpBackend> Runner<B> {
 }
 
 /// How an endpoint tool interacts with the token's `mcp:scripts:` / `mcp:flows:`
-/// path scopes.
+/// path scopes. Mirrored in
+/// `frontend/src/lib/components/mcp/endpointScopePolicy.ts` so the scope picker
+/// only advertises tools this policy will actually list — keep the two in sync.
 enum EndpointPathPolicy {
     /// Executes the script/flow named by the `path` argument. Gated by the
     /// script/flow scope alone (an endpoint scope is not enough to run things):
@@ -305,24 +333,26 @@ fn find_matching_path<T: ToolableItem>(candidates: Vec<T>, request_name: &str) -
 
 impl<B: McpBackend> ServerHandler for Runner<B> {
     fn get_info(&self) -> ServerInfo {
-        ServerInfo {
-            protocol_version: ProtocolVersion::default(),
-            capabilities: ServerCapabilities::builder().enable_tools().build(),
-            server_info: Implementation::from_build_env(),
-            instructions: Some(
+        // Not `Implementation::from_build_env()`: its `env!` expands inside rmcp, so it
+        // would name the SDK crate rather than this server.
+        let server_info = Implementation::new("windmill", env!("CARGO_PKG_VERSION"))
+            .with_title("Windmill")
+            .with_website_url("https://windmill.dev");
+
+        InitializeResult::new(ServerCapabilities::builder().enable_tools().build())
+            .with_server_info(server_info)
+            .with_instructions(
                 "This server provides a list of scripts and flows the user can run on Windmill. \
-                 Each flow and script is a tool callable with their respective arguments."
-                    .to_string(),
-            ),
-        }
+                 Each flow and script is a tool callable with their respective arguments.",
+            )
     }
 
-    async fn initialize(
-        &self,
-        _request: InitializeRequestParams,
-        _context: RequestContext<RoleServer>,
-    ) -> Result<InitializeResult, ErrorData> {
-        Ok(self.get_info())
+    /// Pinned rather than left to rmcp's default (every version the SDK knows), so a
+    /// future SDK revision cannot start advertising a version this server has not been
+    /// exercised against. Bounds `initialize` negotiation, `server/discover`, and
+    /// per-request version validation alike.
+    fn supported_protocol_versions(&self) -> Cow<'static, [ProtocolVersion]> {
+        Cow::Borrowed(SUPPORTED_PROTOCOL_VERSIONS)
     }
 
     async fn list_tools(
@@ -357,7 +387,7 @@ impl<B: McpBackend> ServerHandler for Runner<B> {
         &self,
         request: CallToolRequestParams,
         context: RequestContext<RoleServer>,
-    ) -> Result<CallToolResult, ErrorData> {
+    ) -> Result<CallToolResponse, ErrorData> {
         let (auth, mode) = Self::extract_context(&context)?;
 
         // Parse MCP scopes for authorization
@@ -368,7 +398,9 @@ impl<B: McpBackend> ServerHandler for Runner<B> {
 
         let args = request.arguments.map(Value::Object).unwrap_or(Value::Null);
 
-        match mode {
+        // Every tool here runs to completion in one round trip: none of them ask the
+        // client for input, so the MRTR variants of `CallToolResponse` are never built.
+        let result = match mode {
             McpMode::Single(workspace_id) => {
                 self.call_tool_single(
                     &auth,
@@ -384,7 +416,8 @@ impl<B: McpBackend> ServerHandler for Runner<B> {
                 self.call_tool_multi(&auth, &token, &scope_config, read_only, request.name, args)
                     .await
             }
-        }
+        }?;
+        Ok(result.into())
     }
 
     async fn list_resources(
@@ -392,7 +425,9 @@ impl<B: McpBackend> ServerHandler for Runner<B> {
         _request: Option<PaginatedRequestParams>,
         _context: RequestContext<RoleServer>,
     ) -> Result<ListResourcesResult, ErrorData> {
-        Ok(ListResourcesResult { resources: vec![], next_cursor: None, meta: None })
+        Ok(ListResourcesResult::with_all_items(vec![])
+            .with_ttl_ms(LIST_TTL_MS)
+            .with_cache_scope(LIST_CACHE_SCOPE))
     }
 
     async fn list_prompts(
@@ -400,7 +435,9 @@ impl<B: McpBackend> ServerHandler for Runner<B> {
         _request: Option<PaginatedRequestParams>,
         _context: RequestContext<RoleServer>,
     ) -> Result<ListPromptsResult, ErrorData> {
-        Ok(ListPromptsResult::default())
+        Ok(ListPromptsResult::default()
+            .with_ttl_ms(LIST_TTL_MS)
+            .with_cache_scope(LIST_CACHE_SCOPE))
     }
 
     async fn list_resource_templates(
@@ -408,7 +445,9 @@ impl<B: McpBackend> ServerHandler for Runner<B> {
         _request: Option<PaginatedRequestParams>,
         _context: RequestContext<RoleServer>,
     ) -> Result<ListResourceTemplatesResult, ErrorData> {
-        Ok(ListResourceTemplatesResult::default())
+        Ok(ListResourceTemplatesResult::default()
+            .with_ttl_ms(LIST_TTL_MS)
+            .with_cache_scope(LIST_CACHE_SCOPE))
     }
 }
 
@@ -545,7 +584,9 @@ impl<B: McpBackend> Runner<B> {
             tools.push(endpoint_tool_to_mcp_tool(&endpoint_tool));
         }
 
-        Ok(ListToolsResult { tools, next_cursor: None, meta: None })
+        Ok(ListToolsResult::with_all_items(tools)
+            .with_ttl_ms(LIST_TTL_MS)
+            .with_cache_scope(LIST_CACHE_SCOPE))
     }
 
     /// Handle a tool call for a single, bound workspace.
@@ -573,7 +614,7 @@ impl<B: McpBackend> Runner<B> {
                     .await
                     .map_err(|e| ErrorData::internal_error(e.message, None))?;
 
-                return Ok(CallToolResult::success(vec![Content::text(
+                return Ok(CallToolResult::success(vec![ContentBlock::text(
                     truncate_tool_result(
                         serde_json::to_string_pretty(&result).unwrap_or_else(|_| "{}".to_string()),
                     ),
@@ -697,7 +738,7 @@ impl<B: McpBackend> Runner<B> {
         };
 
         match result {
-            Ok(value) => Ok(CallToolResult::success(vec![Content::text(
+            Ok(value) => Ok(CallToolResult::success(vec![ContentBlock::text(
                 truncate_tool_result(
                     serde_json::to_string_pretty(&value).unwrap_or_else(|_| "{}".to_string()),
                 ),
@@ -731,7 +772,9 @@ impl<B: McpBackend> Runner<B> {
             tools.push(endpoint_tool_to_mcp_tool_multi(&endpoint_tool));
         }
 
-        ListToolsResult { tools, next_cursor: None, meta: None }
+        ListToolsResult::with_all_items(tools)
+            .with_ttl_ms(LIST_TTL_MS)
+            .with_cache_scope(LIST_CACHE_SCOPE)
     }
 
     /// Handle a tool call for a multi-workspace session. `base_auth` is the
@@ -752,7 +795,7 @@ impl<B: McpBackend> Runner<B> {
                 .list_accessible_workspaces(base_auth)
                 .await
                 .map_err(|e| ErrorData::internal_error(e.message, None))?;
-            return Ok(CallToolResult::success(vec![Content::text(
+            return Ok(CallToolResult::success(vec![ContentBlock::text(
                 serde_json::to_string_pretty(&workspaces).unwrap_or_else(|_| "[]".to_string()),
             )]));
         }
@@ -825,7 +868,7 @@ impl<B: McpBackend> Runner<B> {
             .await
             .map_err(|e| ErrorData::internal_error(e.message, None))?;
 
-        Ok(CallToolResult::success(vec![Content::text(
+        Ok(CallToolResult::success(vec![ContentBlock::text(
             truncate_tool_result(
                 serde_json::to_string_pretty(&result).unwrap_or_else(|_| "{}".to_string()),
             ),
diff --git a/backend/windmill-mcp/src/server/tools.rs b/backend/windmill-mcp/src/server/tools.rs
index 50ed03426b..efdf86ed22 100644
--- a/backend/windmill-mcp/src/server/tools.rs
+++ b/backend/windmill-mcp/src/server/tools.rs
@@ -190,21 +190,17 @@ pub fn create_tool_from_item<T: ToolableItem, B: McpBackend>(
         }
     };
 
-    Tool {
-        name: Cow::Owned(path),
-        description: Some(Cow::Owned(description)),
-        input_schema: Arc::new(input_schema_map),
-        title: Some(title.clone()),
-        output_schema: None,
-        icons: None,
-        annotations: Some(ToolAnnotations {
-            title: Some(title),
-            read_only_hint: Some(false),  // Can modify environment
-            destructive_hint: Some(true), // Can potentially be destructive
-            idempotent_hint: Some(false), // Are not guaranteed to be idempotent
-            open_world_hint: Some(true),  // Can interact with external services
-        }),
-        meta: None,
-        execution: None,
-    }
+    Tool::new(
+        Cow::Owned(path),
+        Cow::Owned(description),
+        Arc::new(input_schema_map),
+    )
+    .with_title(title.clone())
+    .with_annotations(
+        ToolAnnotations::with_title(title)
+            .read_only(false) // Can modify environment
+            .destructive(true) // Can potentially be destructive
+            .idempotent(false) // Are not guaranteed to be idempotent
+            .open_world(true), // Can interact with external services
+    )
 }
diff --git a/backend/windmill-native-triggers/src/github/external.rs b/backend/windmill-native-triggers/src/github/external.rs
index d31b2ae207..2c23e02bef 100644
--- a/backend/windmill-native-triggers/src/github/external.rs
+++ b/backend/windmill-native-triggers/src/github/external.rs
@@ -232,7 +232,10 @@ impl External for GitHub {
                 Err(e) => {
                     errors.push(crate::sync::SyncError {
                         resource_path: trigger.script_path.clone(),
-                        error_message: format!("Failed to verify GitHub webhook: {}", e),
+                        error_message: format!(
+                            "Failed to verify GitHub webhook: {}",
+                            crate::external_error_message(&e)
+                        ),
                         error_type: "api_error".to_string(),
                     });
                 }
@@ -288,6 +291,31 @@ impl External for GitHub {
     fn additional_routes(&self) -> axum::Router {
         routes::github_routes(self.clone())
     }
+
+    fn error_hint(&self, status: StatusCode) -> Option<&'static str> {
+        match status {
+            StatusCode::UNAUTHORIZED => {
+                Some("reconnect the GitHub integration from Workspace settings > Integrations.")
+            }
+            StatusCode::FORBIDDEN => Some(
+                "check that the OAuth app is authorized for the organization and that the \
+                 connected GitHub account has the access this needs — managing webhooks requires \
+                 admin rights on the repository.",
+            ),
+            _ => None,
+        }
+    }
+
+    /// GitHub answers 403 to both throttling and a permission failure, and words the throttle
+    /// two ways: the primary and secondary limits say "rate limit", the older secondary
+    /// response says "abuse detection mechanism".
+    fn is_transient_response(&self, status: StatusCode, body: &str) -> bool {
+        if status != StatusCode::FORBIDDEN {
+            return false;
+        }
+        let body = body.to_ascii_lowercase();
+        body.contains("rate limit") || body.contains("abuse detection")
+    }
 }
 
 impl GitHub {
diff --git a/backend/windmill-native-triggers/src/github/routes.rs b/backend/windmill-native-triggers/src/github/routes.rs
index b2196f2249..68de93b6a9 100644
--- a/backend/windmill-native-triggers/src/github/routes.rs
+++ b/backend/windmill-native-triggers/src/github/routes.rs
@@ -5,7 +5,10 @@ use http::Method;
 use windmill_api_auth::ApiAuthed;
 use windmill_common::{error::JsonResult, DB};
 
-use crate::{get_workspace_integration, require_native_integration_use, External, ServiceName};
+use crate::{
+    get_workspace_integration, map_external_error, require_native_integration_use, External,
+    ServiceName,
+};
 
 use super::{GitHub, GithubApiRepoResponse, GithubRepoEntry};
 
@@ -33,7 +36,8 @@ async fn list_repos(
 
         let repos: Vec<GithubApiRepoResponse> = handler
             .http_client_request::<_, ()>(&url, Method::GET, &workspace_id, &db, None, None)
-            .await?;
+            .await
+            .map_err(map_external_error)?;
 
         let count = repos.len();
         all_entries.extend(repos.into_iter().map(|r| GithubRepoEntry {
diff --git a/backend/windmill-native-triggers/src/google/external.rs b/backend/windmill-native-triggers/src/google/external.rs
index 616f8d3f63..1c5a2dd9ec 100644
--- a/backend/windmill-native-triggers/src/google/external.rs
+++ b/backend/windmill-native-triggers/src/google/external.rs
@@ -11,7 +11,8 @@ use windmill_common::{
 use windmill_queue::PushArgsOwned;
 
 use crate::{
-    generate_webhook_service_url, rotate_webhook_token,
+    generate_webhook_service_url,
+    lock::TriggerLock,
     sync::{SyncAction, SyncError, TriggerSyncInfo},
     update_native_trigger_error, update_native_trigger_service_config, External, NativeTrigger,
     NativeTriggerData, ServiceName,
@@ -198,6 +199,26 @@ impl External for Google {
     fn additional_routes(&self) -> axum::Router {
         routes::google_routes(self.clone())
     }
+
+    fn error_hint(&self, status: http::StatusCode) -> Option<&'static str> {
+        match status {
+            http::StatusCode::UNAUTHORIZED => {
+                Some("reconnect the Google integration from Workspace settings > Integrations.")
+            }
+            http::StatusCode::FORBIDDEN => Some(
+                "the connected Google account is missing access to this resource or the scope the \
+                 integration was granted does not cover it.",
+            ),
+            _ => None,
+        }
+    }
+
+    /// Google answers 403 to a quota being spent as well as to a permission failure. Every
+    /// throttling reason it defines sits in the `usageLimits` domain, so matching the domain
+    /// covers the group without an allowlist to extend each time one is added.
+    fn is_transient_response(&self, status: http::StatusCode, body: &str) -> bool {
+        status == http::StatusCode::FORBIDDEN && body.contains("usageLimits")
+    }
 }
 
 // Helper methods for creating trigger type-specific watches
@@ -342,10 +363,11 @@ impl Google {
             .transpose()?
             .ok_or_else(|| Error::InternalErr("Missing service config".to_string()))?;
 
-        let rotated = match rotate_webhook_token(
+        let rotated = match crate::rotate_webhook_token(
             db,
             &trigger.webhook_token_hash,
             ServiceName::Google,
+            crate::webhook_token_scopes(&trigger.script_path, trigger.is_flow),
         )
         .await?
         {
@@ -477,7 +499,7 @@ enum RenewOutcome {
     Skipped,
 }
 
-/// Renew one Google watch channel under a row lock.
+/// Renew one Google watch channel under `TriggerLock`.
 /// `sync_all_triggers` runs on every replica with no leader election — without
 /// the lock, parallel renewals orphan the losers' new tokens and Google channels.
 async fn try_renew_channel_locked(
@@ -486,22 +508,31 @@ async fn try_renew_channel_locked(
     workspace_id: &str,
     trigger: &NativeTrigger,
 ) -> Result<RenewOutcome> {
-    let mut tx = db.begin().await?;
+    // Renewal stops the live channel and creates a replacement, exactly like a re-registration
+    // does — so the two must not overlap, or each stops the channel the other just made and one
+    // is left orphaned, delivering a second copy of every event. Skipping is fine: the sweep runs
+    // again. Excluding them through this lock rather than by holding the row itself is what keeps
+    // a rename's `UPDATE native_trigger` from having to wait on a third party's API.
+    let Some(lock) =
+        TriggerLock::try_acquire(db, workspace_id, ServiceName::Google, &trigger.external_id)
+            .await?
+    else {
+        return Ok(RenewOutcome::Skipped);
+    };
 
     let row = sqlx::query!(
         r#"
-        SELECT service_config, webhook_token_hash
+        SELECT service_config, webhook_token_hash, script_path, is_flow
         FROM native_trigger
         WHERE workspace_id = $1
           AND service_name = $2
           AND external_id = $3
-        FOR UPDATE SKIP LOCKED
         "#,
         workspace_id,
         ServiceName::Google as ServiceName,
         trigger.external_id,
     )
-    .fetch_optional(&mut *tx)
+    .fetch_optional(db)
     .await?;
 
     let Some(row) = row else {
@@ -522,10 +553,14 @@ async fn try_renew_channel_locked(
         return Ok(RenewOutcome::Skipped);
     }
 
-    // Use freshly-read fields — webhook_token_hash may have rotated since list time.
+    // Use freshly-read fields — the listing this came from predates the lock, so a rename may
+    // have moved the runnable since. Renewing against the listed path would build the channel's
+    // callback URL from a path that no longer resolves.
     let fresh_trigger = NativeTrigger {
         service_config: Some(service_config),
         webhook_token_hash: row.webhook_token_hash,
+        script_path: row.script_path,
+        is_flow: row.is_flow,
         ..trigger.clone()
     };
 
@@ -533,6 +568,8 @@ async fn try_renew_channel_locked(
         .renew_channel(workspace_id, &fresh_trigger, db)
         .await?;
 
+    let mut tx = db.begin().await?;
+
     // Past this point a new Google channel exists. Any failure leaks it.
     if let Err(e) = update_native_trigger_service_config(
         &mut *tx,
@@ -577,6 +614,8 @@ async fn try_renew_channel_locked(
         ),
     }
 
+    lock.release().await?;
+
     Ok(RenewOutcome::Renewed)
 }
 
@@ -637,7 +676,10 @@ async fn renew_expiring_channels(
                     workspace_id,
                     ServiceName::Google,
                     &trigger.external_id,
-                    Some(&format!("Channel renewal failed: {}", e)),
+                    Some(&format!(
+                        "Channel renewal failed: {}",
+                        crate::external_error_message(&e)
+                    )),
                 )
                 .await;
 
diff --git a/backend/windmill-native-triggers/src/google/routes.rs b/backend/windmill-native-triggers/src/google/routes.rs
index c5f7611f10..306a7e54e2 100644
--- a/backend/windmill-native-triggers/src/google/routes.rs
+++ b/backend/windmill-native-triggers/src/google/routes.rs
@@ -10,7 +10,10 @@ use serde::{Deserialize, Serialize};
 use windmill_api_auth::ApiAuthed;
 use windmill_common::{error::JsonResult, DB};
 
-use crate::{get_workspace_integration, require_native_integration_use, External, ServiceName};
+use crate::{
+    get_workspace_integration, map_external_error, require_native_integration_use, External,
+    ServiceName,
+};
 
 use super::Google;
 
@@ -100,7 +103,8 @@ async fn list_calendars(
 
     let response: GoogleCalendarListResponse = handler
         .http_client_request::<_, ()>(&url, Method::GET, &workspace_id, &db, None, None)
-        .await?;
+        .await
+        .map_err(map_external_error)?;
 
     let calendars = response
         .items
@@ -153,7 +157,8 @@ async fn list_drive_files(
 
     let response: DriveApiResponse = handler
         .http_client_request::<_, ()>(&url, Method::GET, &workspace_id, &db, None, None)
-        .await?;
+        .await
+        .map_err(map_external_error)?;
 
     let files = response
         .files
@@ -206,7 +211,8 @@ async fn list_shared_drives(
 
     let response: SharedDrivesApiResponse = handler
         .http_client_request::<_, ()>(&url, Method::GET, &workspace_id, &db, None, None)
-        .await?;
+        .await
+        .map_err(map_external_error)?;
 
     let drives = response
         .drives
diff --git a/backend/windmill-native-triggers/src/handler.rs b/backend/windmill-native-triggers/src/handler.rs
index fda28af407..cc6c61be81 100644
--- a/backend/windmill-native-triggers/src/handler.rs
+++ b/backend/windmill-native-triggers/src/handler.rs
@@ -1,7 +1,10 @@
 use crate::{
-    decrypt_oauth_data, delete_native_trigger, delete_token_by_hash, get_native_trigger,
-    list_native_triggers, rotate_webhook_token, store_native_trigger, update_native_trigger_error,
-    webhook_token_label, External, NativeTrigger, NativeTriggerConfig, NativeTriggerData,
+    classify_read_failure, decrypt_oauth_data, delete_native_trigger, delete_token_by_hash,
+    get_native_trigger, list_native_triggers, lock::TriggerLock, map_external_error,
+    map_external_error_with, rotate_webhook_token, store_native_trigger,
+    sync::EXTERNAL_TRIGGER_MISSING_ERROR, update_native_trigger_error,
+    update_native_trigger_if_runnable_unchanged, webhook_token_label, webhook_token_scopes,
+    External, ExternalReadFailure, NativeTrigger, NativeTriggerConfig, NativeTriggerData,
     ServiceName,
 };
 use axum::{
@@ -52,6 +55,51 @@ async fn require_is_writer_on_runnable(
     }
 }
 
+/// A trigger may only point at a live runnable.
+///
+/// The webhook URL is built from this path, so a trigger pointed at a path the runnable has left
+/// keeps delivering there: for a flow the row is gone and the trigger vanishes from listings,
+/// for a script the abandoned version is still resolvable and fires stale code indefinitely. A
+/// client that loaded before a rename submits the old path in good faith, so this needs no
+/// concurrency to happen. The writer checks above do not cover it: they return early for admins
+/// and path owners without ever looking at the runnable.
+async fn require_runnable_exists(db: &DB, w_id: &str, path: &str, is_flow: bool) -> Result<()> {
+    let exists = if is_flow {
+        sqlx::query_scalar!(
+            "SELECT EXISTS(SELECT 1 FROM flow WHERE path = $1 AND workspace_id = $2)",
+            path,
+            w_id
+        )
+        .fetch_one(db)
+        .await?
+    } else {
+        // Renaming a script archives the version at the old path instead of removing it, so a
+        // plain existence check would still accept a path the script has moved off. Every deploy
+        // archives its parent, leaving exactly one non-archived version at a live path and none
+        // at an abandoned one. Soft-delete sets `archived` too, and `deleted` is checked because
+        // it, not `archived`, is what stops a version from being resolved for execution.
+        sqlx::query_scalar!(
+            "SELECT EXISTS(SELECT 1 FROM script WHERE path = $1 AND workspace_id = $2 \
+             AND archived = false AND deleted = false)",
+            path,
+            w_id
+        )
+        .fetch_one(db)
+        .await?
+    };
+
+    if exists.unwrap_or(false) {
+        Ok(())
+    } else {
+        Err(Error::BadRequest(format!(
+            "There is no {kind} at {path} to trigger. If the {kind} was renamed since this page \
+             was loaded, reload and try again; otherwise point this trigger at an existing {kind} \
+             or delete it.",
+            kind = if is_flow { "flow" } else { "script" }
+        )))
+    }
+}
+
 #[derive(Debug, Deserialize)]
 pub struct ListQuery {
     pub page: Option<usize>,
@@ -65,6 +113,10 @@ pub struct FullTriggerResponse<T: Serialize> {
     #[serde(flatten)]
     pub windmill_data: NativeTrigger,
     pub external_data: Option<T>,
+    /// Why `external_data` is missing, when the service could not be read. The stored
+    /// configuration is still returned so the trigger stays viewable and editable.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub external_error: Option<String>,
 }
 
 #[derive(Debug, Serialize)]
@@ -72,7 +124,7 @@ pub struct CreateTriggerResponse {
     pub external_id: String,
 }
 
-async fn new_webhook_token(
+pub(crate) async fn new_webhook_token(
     tx: &mut PgConnection,
     db: &DB,
     authed: &ApiAuthed,
@@ -81,9 +133,7 @@ async fn new_webhook_token(
     workspace_id: &str,
     service_name: ServiceName,
 ) -> Result<String> {
-    let kind = if is_flow { "flows" } else { "scripts" };
-
-    let scopes = vec![format!("jobs:run:{kind}:{script_path}")];
+    let scopes = webhook_token_scopes(script_path, is_flow);
     let label = webhook_token_label(service_name);
     let expiration = service_name
         .webhook_token_expiration()
@@ -121,6 +171,7 @@ async fn create_native_trigger<T: External>(
         db.clone(),
     )
     .await?;
+    require_runnable_exists(&db, &workspace_id, &data.script_path, data.is_flow).await?;
 
     let mut tx = user_db.begin(&authed).await?;
 
@@ -148,7 +199,8 @@ async fn create_native_trigger<T: External>(
             &db,
             &mut tx,
         )
-        .await?;
+        .await
+        .map_err(map_external_error)?;
 
     let (external_id, _) = handler.external_id_and_metadata_from_response(&resp);
 
@@ -169,7 +221,8 @@ async fn create_native_trigger<T: External>(
                     &db,
                     &mut tx,
                 )
-                .await?
+                .await
+                .map_err(map_external_error)?
         };
 
     let config = NativeTriggerConfig {
@@ -225,11 +278,14 @@ async fn update_native_trigger_handler<T: External>(
         db.clone(),
     )
     .await?;
+    require_runnable_exists(&db, &workspace_id, &data.script_path, data.is_flow).await?;
 
     let integration_service = service_name.integration_service();
     let oauth_data: T::OAuthData =
         decrypt_oauth_data(&db, &workspace_id, integration_service).await?;
 
+    let lock = TriggerLock::acquire(&db, &workspace_id, service_name, &external_id).await?;
+
     let mut tx = user_db.clone().begin(&authed).await?;
 
     let existing = get_native_trigger(&mut *tx, &workspace_id, service_name, &external_id)
@@ -260,7 +316,14 @@ async fn update_native_trigger_handler<T: External>(
         token
     } else {
         // Same runnable — rotate the token (mints a fresh label + expiration)
-        match rotate_webhook_token(&db, &existing.webhook_token_hash, service_name).await? {
+        match rotate_webhook_token(
+            &db,
+            &existing.webhook_token_hash,
+            service_name,
+            webhook_token_scopes(&data.script_path, data.is_flow),
+        )
+        .await?
+        {
             Some(rotated) => {
                 old_token_hash_to_delete = Some(rotated.old_token_hash);
                 rotated.new_token
@@ -294,7 +357,8 @@ async fn update_native_trigger_handler<T: External>(
             &db,
             &mut tx,
         )
-        .await?;
+        .await
+        .map_err(map_external_error)?;
 
     let config = NativeTriggerConfig {
         script_path: data.script_path.clone(),
@@ -302,7 +366,11 @@ async fn update_native_trigger_handler<T: External>(
         webhook_token,
     };
 
-    store_native_trigger(
+    // `existing` was read before the network call, and a rename writes `script_path` from the
+    // deploy transaction, which this lock does not cover. Writing a stale path back would undo the
+    // rename and drop the trigger out of every listing, so refuse the edit instead. The rename's
+    // own re-registration is queued behind this lock and puts the service back in step.
+    let applied = update_native_trigger_if_runnable_unchanged(
         &mut *tx,
         &workspace_id,
         service_name,
@@ -310,9 +378,18 @@ async fn update_native_trigger_handler<T: External>(
         &config,
         service_config,
         data.summary.as_deref(),
+        &existing.script_path,
+        existing.is_flow,
     )
     .await?;
 
+    if !applied {
+        return Err(Error::BadRequest(format!(
+            "The runnable of {external_id} was renamed while this trigger was being saved, so the \
+             edit was not applied. Reload and save again."
+        )));
+    }
+
     audit_log(
         &mut *tx,
         &authed,
@@ -326,6 +403,8 @@ async fn update_native_trigger_handler<T: External>(
 
     tx.commit().await?;
 
+    lock.release().await?;
+
     // Everything succeeded — clean up old token (best-effort)
     if let Some(old_hash) = old_token_hash_to_delete {
         if let Err(e) = delete_token_by_hash(&db, &old_hash).await {
@@ -373,10 +452,14 @@ async fn get_native_trigger_handler<T: External>(
         .get(&workspace_id, &oauth_data, &external_id, &db, &mut tx)
         .await;
 
+    let mut external_error = None;
+
     let external_data = match native_trigger {
         Ok(Some(native_cfg)) => {
-            // Clear error if it was set
-            if windmill_trigger.error.is_some() {
+            // Only the "no longer exists" error is disproven by the trigger being there; other
+            // paths record failures (e.g. a webhook still aimed at a pre-rename path) that a
+            // successful fetch says nothing about.
+            if windmill_trigger.error.as_deref() == Some(EXTERNAL_TRIGGER_MISSING_ERROR) {
                 update_native_trigger_error(
                     &mut *tx,
                     &workspace_id,
@@ -389,33 +472,54 @@ async fn get_native_trigger_handler<T: External>(
             Some(native_cfg)
         }
         Ok(None) => None,
-        Err(Error::NotFound(_)) => {
-            let error_msg = "Trigger no longer exists on external service".to_string();
-            tracing::warn!(
-                "Native trigger no longer exists on external service {}, setting error",
-                service_name
-            );
+        Err(e) => match classify_read_failure(e) {
+            ExternalReadFailure::Missing => {
+                let error_msg = EXTERNAL_TRIGGER_MISSING_ERROR.to_string();
+                tracing::warn!(
+                    "Native trigger no longer exists on external service {}, setting error",
+                    service_name
+                );
 
-            update_native_trigger_error(
-                &mut *tx,
-                &workspace_id,
-                service_name,
-                &external_id,
-                Some(&error_msg),
-            )
-            .await?;
+                update_native_trigger_error(
+                    &mut *tx,
+                    &workspace_id,
+                    service_name,
+                    &external_id,
+                    Some(&error_msg),
+                )
+                .await?;
 
-            tx.commit().await?;
+                tx.commit().await?;
 
-            return Err(Error::NotFound(format!(
-                "Trigger '{}' no longer exists on external service {}",
-                external_id, service_name
-            )));
-        }
-        Err(e) => return Err(e),
+                return Err(Error::NotFound(format!(
+                    "Trigger '{}' no longer exists on external service {}",
+                    external_id, service_name
+                )));
+            }
+            // The service being unreadable says nothing about the trigger Windmill stores, and
+            // failing here would leave the editor with no configuration to show at all. Report
+            // what the service said alongside the stored configuration instead.
+            ExternalReadFailure::Unreadable(message) => {
+                tracing::warn!(
+                    "Could not read trigger '{}' from {}, returning the stored configuration: {}",
+                    external_id,
+                    service_name,
+                    message
+                );
+                external_error = Some(message);
+                None
+            }
+            ExternalReadFailure::Internal(e) => return Err(e),
+        },
     };
 
-    let full_resp = Json(FullTriggerResponse { windmill_data: windmill_trigger, external_data });
+    tx.commit().await?;
+
+    let full_resp = Json(FullTriggerResponse {
+        windmill_data: windmill_trigger,
+        external_data,
+        external_error,
+    });
 
     Ok(full_resp)
 }
@@ -428,6 +532,8 @@ async fn delete_native_trigger_handler<T: External>(
     Extension(user_db): Extension<UserDB>,
     Path((workspace_id, external_id)): Path<(String, String)>,
 ) -> Result<String> {
+    let lock = TriggerLock::acquire(&db, &workspace_id, service_name, &external_id).await?;
+
     let mut tx = user_db.begin(&authed).await?;
 
     let existing = get_native_trigger(&mut *tx, &workspace_id, service_name, &external_id)
@@ -452,7 +558,17 @@ async fn delete_native_trigger_handler<T: External>(
 
     handler
         .delete(&workspace_id, &oauth_data, &external_id, &db, &mut tx)
-        .await?;
+        .await
+        .map_err(|e| {
+            map_external_error_with(e, |m| {
+                let end = if m.ends_with(['.', '!', '?']) {
+                    ""
+                } else {
+                    "."
+                };
+                format!("{m}{end} The trigger was kept in Windmill, so it can still fire.")
+            })
+        })?;
 
     let deleted =
         delete_native_trigger(&mut *tx, &workspace_id, service_name, &external_id).await?;
@@ -482,6 +598,7 @@ async fn delete_native_trigger_handler<T: External>(
     .await?;
 
     tx.commit().await?;
+    lock.release().await?;
 
     Ok(format!("Native trigger deleted"))
 }
diff --git a/backend/windmill-native-triggers/src/lib.rs b/backend/windmill-native-triggers/src/lib.rs
index a81217d8d5..4400091ed6 100644
--- a/backend/windmill-native-triggers/src/lib.rs
+++ b/backend/windmill-native-triggers/src/lib.rs
@@ -54,13 +54,17 @@ use windmill_common::{
 use windmill_queue::PushArgsOwned;
 
 #[cfg(feature = "native_trigger")]
-use windmill_oauth::{OClient, RefreshToken, Url, OAUTH_HTTP_CLIENT};
+use windmill_oauth::{ErrorField, ExecuteError, OClient, RefreshToken, Url, OAUTH_HTTP_CLIENT};
 
 use windmill_api_auth::ApiAuthed;
 pub mod handler;
+pub(crate) mod lock;
 pub mod sync;
 pub mod workspace_integrations;
 
+#[cfg(feature = "native_trigger")]
+pub mod rename;
+
 // Service modules - add new services here:
 #[cfg(feature = "native_trigger")]
 pub mod github;
@@ -361,6 +365,23 @@ pub trait External: Send + Sync + 'static {
         axum::Router::new()
     }
 
+    /// Pull the human-readable message out of an error body, when the service wraps it in an
+    /// envelope. Returning `None` (default) shows the body as-is.
+    fn describe_error_body(&self, _body: &str) -> Option<String> {
+        None
+    }
+
+    /// What the user has to do about a rejection, appended to the service's own message.
+    fn error_hint(&self, _status: StatusCode) -> Option<&'static str> {
+        None
+    }
+
+    /// Whether the service is telling us it cannot serve the request right now, when the
+    /// status alone would read as a refusal. GitHub and Google both answer 403 to throttling.
+    fn is_transient_response(&self, _status: StatusCode, _body: &str) -> bool {
+        false
+    }
+
     async fn http_client_request<T: DeserializeOwned + Send, B: Serialize + Send + Sync>(
         &self,
         url: &str,
@@ -384,13 +405,14 @@ pub trait External: Send + Sync + 'static {
 
         match result {
             Ok(response) => Ok(response),
-            Err(err)
-                if err.status() == Some(StatusCode::UNAUTHORIZED)
-                    || err.status() == Some(StatusCode::FORBIDDEN) =>
-            {
+            // Only an expired or revoked token is worth a refresh. A 403 means the account
+            // behind the token is authenticated and still not allowed, which minting a new
+            // token for that same account cannot change; retrying would only burn a refresh
+            // rotation per request and bury the service's own explanation.
+            Err(err) if err.status() == Some(StatusCode::UNAUTHORIZED) => {
                 tracing::info!(
-                    "HTTP auth error ({}), attempting token refresh",
-                    err.status().unwrap()
+                    "HTTP 401 from {}, attempting token refresh",
+                    Self::DISPLAY_NAME
                 );
 
                 let refreshed_oauth_config = refresh_oauth_tokens(
@@ -398,7 +420,16 @@ pub trait External: Send + Sync + 'static {
                     Self::REFRESH_ENDPOINT,
                     Self::AUTH_ENDPOINT,
                 )
-                .await?;
+                .await
+                .map_err(|f| {
+                    self.external_error(
+                        f.rejected.then_some(StatusCode::UNAUTHORIZED),
+                        format!(
+                            "the stored credentials could not be refreshed: {}",
+                            f.message
+                        ),
+                    )
+                })?;
 
                 task::spawn({
                     let db_clone = db.clone();
@@ -418,7 +449,7 @@ pub trait External: Send + Sync + 'static {
                     }
                 });
 
-                let response = make_http_request(
+                make_http_request(
                     url,
                     method,
                     headers,
@@ -426,12 +457,122 @@ pub trait External: Send + Sync + 'static {
                     &refreshed_oauth_config.access_token,
                 )
                 .await
-                .map_err(to_anyhow)?;
-                Ok(response)
+                .map_err(|e| self.external_api_error(e))
             }
-            Err(e) => Err(to_anyhow(e).into()),
+            Err(e) => Err(self.external_api_error(e)),
         }
     }
+
+    /// Wrap a failed provider call so the status stays inspectable by internal callers (a 404
+    /// means the trigger is gone, not that the call broke) and the message stays readable by
+    /// the time it reaches a user.
+    fn external_api_error(&self, e: HttpRequestError) -> Error {
+        let (detail, transient) = match &e {
+            HttpRequestError::ApiError { status, body } => (
+                self.describe_error_body(body)
+                    .unwrap_or_else(|| body.to_string()),
+                self.is_transient_response(*status, body),
+            ),
+            // A reqwest error names the request it was making, never why it failed: the reason
+            // (refused, DNS, TLS) lives one link down the source chain.
+            other => (error_source_chain(other), false),
+        };
+        self.external_error_inner(e.status(), detail, transient)
+    }
+
+    fn external_error(&self, status: Option<StatusCode>, detail: String) -> Error {
+        self.external_error_inner(status, detail, false)
+    }
+
+    fn external_error_inner(
+        &self,
+        status: Option<StatusCode>,
+        detail: String,
+        transient: bool,
+    ) -> Error {
+        to_anyhow(ExternalApiError {
+            service: Self::DISPLAY_NAME,
+            status,
+            detail: truncate_detail(&detail),
+            // Guidance about permissions on a throttled request sends the reader after a
+            // problem they do not have.
+            hint: if transient {
+                None
+            } else {
+                status.and_then(|s| self.error_hint(s))
+            },
+            transient,
+        })
+        .into()
+    }
+}
+
+/// A native trigger provider refused or could not serve a request.
+#[derive(Debug)]
+pub struct ExternalApiError {
+    pub service: &'static str,
+    pub status: Option<StatusCode>,
+    pub detail: String,
+    pub hint: Option<&'static str>,
+    /// The service could not serve the request now, whatever the status suggests: providers
+    /// overload 403 for throttling, and a refusal and an outage want opposite reactions.
+    pub transient: bool,
+}
+
+impl ExternalApiError {
+    fn is_transient(&self) -> bool {
+        self.transient || self.status.is_some_and(is_transient_status)
+    }
+}
+
+impl std::fmt::Display for ExternalApiError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self.status {
+            Some(status) if self.is_transient() => write!(
+                f,
+                "{} failed to serve the request ({}): {}",
+                self.service, status, self.detail
+            )?,
+            Some(status) => write!(
+                f,
+                "{} rejected the request ({}): {}",
+                self.service, status, self.detail
+            )?,
+            // No status covers both never reaching the service and not being able to read what
+            // it answered, so the wording may not commit to either.
+            None => write!(f, "Request to {} failed: {}", self.service, self.detail)?,
+        }
+        if let Some(hint) = self.hint {
+            write!(f, " — {}", hint)?;
+        }
+        Ok(())
+    }
+}
+
+impl std::error::Error for ExternalApiError {}
+
+fn error_source_chain(e: &dyn std::error::Error) -> String {
+    let mut msg = e.to_string();
+    let mut source = e.source();
+    while let Some(cause) = source {
+        let cause = cause.to_string();
+        // reqwest repeats "error sending request for url (…)" at two levels of the chain.
+        if !msg.contains(&cause) {
+            msg.push_str(&format!(": {cause}"));
+        }
+        source = source.and_then(|c| c.source());
+    }
+    msg
+}
+
+/// Provider bodies are unbounded and end up in toasts and `native_trigger.error`.
+fn truncate_detail(detail: &str) -> String {
+    const MAX: usize = 400;
+    let detail = detail.trim();
+    match detail.char_indices().nth(MAX) {
+        Some((idx, _)) => format!("{}…", &detail[..idx]),
+        None => detail.to_string(),
+    }
 }
 
 #[derive(Debug, Serialize, Deserialize)]
@@ -533,17 +674,83 @@ impl HttpRequestError {
     }
 }
 
-/// Extract the HTTP status code from an error returned by `http_client_request`.
-/// Returns `None` if the error didn't originate from an HTTP call.
-pub fn http_error_status(e: &windmill_common::error::Error) -> Option<StatusCode> {
+/// `Some` only for a failure the service itself produced. Everything else — a query, a
+/// decryption, a serialization — is Windmill's own and must not be reported as the service's.
+pub fn as_external_error(e: &Error) -> Option<&ExternalApiError> {
     match e {
-        windmill_common::error::Error::Anyhow { error, .. } => error
-            .downcast_ref::<HttpRequestError>()
-            .and_then(|e| e.status()),
+        Error::Anyhow { error, .. } => error.downcast_ref::<ExternalApiError>(),
         _ => None,
     }
 }
 
+/// Extract the HTTP status code from an error returned by `http_client_request`.
+/// Returns `None` if the error didn't originate from an HTTP call.
+pub fn http_error_status(e: &Error) -> Option<StatusCode> {
+    as_external_error(e).and_then(|e| e.status)
+}
+
+/// The message to show a user for a failed provider call, without the internal decoration
+/// `Error`'s own `Display` adds. Non-provider errors are rendered as-is.
+pub fn external_error_message(e: &Error) -> String {
+    as_external_error(e).map_or_else(|| e.to_string(), |ext| ext.to_string())
+}
+
+/// What a failed read of a trigger from its service means for the response.
+#[derive(Debug)]
+pub enum ExternalReadFailure {
+    /// The service answered that the trigger is gone.
+    Missing,
+    /// The service could not be read, which says nothing about the stored trigger.
+    Unreadable(String),
+    /// Windmill's own failure, wearing no service's name.
+    Internal(Error),
+}
+
+pub fn classify_read_failure(e: Error) -> ExternalReadFailure {
+    match as_external_error(&e) {
+        Some(ext) if ext.status == Some(StatusCode::NOT_FOUND) => ExternalReadFailure::Missing,
+        Some(ext) => ExternalReadFailure::Unreadable(ext.to_string()),
+        None => ExternalReadFailure::Internal(e),
+    }
+}
+
+/// Turn a provider failure into something a client can read and act on.
+///
+/// Without this every rejection reaches the browser as a 500 carrying a raw upstream body.
+/// The provider's status is deliberately not mirrored: a 401/403 answered by Windmill reads as
+/// a Windmill permission problem, when the account that lacks rights is the one connected to
+/// the *provider*. Errors that did not come from a provider call pass through untouched.
+pub fn map_external_error(e: Error) -> Error {
+    map_external_error_with(e, |message| message)
+}
+
+/// `map_external_error` with a chance to add what the failure means for Windmill's own state.
+pub fn map_external_error_with(e: Error, decorate: impl FnOnce(String) -> String) -> Error {
+    let Some((status, transient, message)) =
+        as_external_error(&e).map(|ext| (ext.status, ext.is_transient(), ext.to_string()))
+    else {
+        return e;
+    };
+    let message = decorate(message);
+    match status {
+        // A refusal is the caller's to fix; being unable to serve the request now is not, and
+        // the two want different reactions from whoever reads it.
+        _ if transient => Error::BadGateway(message),
+        Some(StatusCode::NOT_FOUND) => Error::NotFound(message),
+        Some(_) => Error::BadRequest(message),
+        // No status at all: the provider was unreachable or answered something undecodable.
+        None => Error::BadGateway(message),
+    }
+}
+
+fn is_transient_status(status: StatusCode) -> bool {
+    status.is_server_error()
+        || matches!(
+            status,
+            StatusCode::REQUEST_TIMEOUT | StatusCode::TOO_MANY_REQUESTS
+        )
+}
+
 /// Read OAuth client_id and client_secret from instance-level global settings.
 /// Used when a workspace integration has `instance_shared: true`.
 async fn get_instance_oauth_credentials(
@@ -648,24 +855,98 @@ struct RefreshTokenResponse {
     refresh_token: Option<String>,
 }
 
+/// Why an OAuth token refresh did not produce a new token.
+#[derive(Debug)]
+pub struct RefreshFailure {
+    /// The token endpoint refused the grant, so the stored credentials are what to fix.
+    ///
+    /// Nothing else about the answer is carried further. The status a caller reads off an
+    /// `ExternalApiError` says what the call for the *trigger* answered, and 404 there means
+    /// the trigger is gone — it records that on the row and lets a delete drop it. A wrong
+    /// base URL 404s the token endpoint while the webhook is perfectly alive.
+    pub rejected: bool,
+    pub message: String,
+}
+
+#[cfg(feature = "native_trigger")]
+impl RefreshFailure {
+    fn rejected(message: String) -> Self {
+        RefreshFailure { rejected: true, message }
+    }
+
+    fn outage(message: String) -> Self {
+        RefreshFailure { rejected: false, message }
+    }
+}
+
+/// Whether a token endpoint's answer means reconnecting the integration is the fix, rather
+/// than the endpoint failing to serve a grant that may well be valid.
+///
+/// Used when the answer carried no OAuth error code to read. The body is checked because no
+/// status reliably reports a refusal: GitHub answers `bad_refresh_token` with HTTP 200. The
+/// status is the last resort — on a token endpoint these three most often mean the stored
+/// grant is spent, and there is nothing better to go on.
+pub fn grant_refused(status: Option<StatusCode>, body: &str) -> bool {
+    body.contains("invalid_grant")
+        || body.contains("bad_refresh_token")
+        || matches!(
+            status,
+            Some(StatusCode::BAD_REQUEST | StatusCode::UNAUTHORIZED | StatusCode::FORBIDDEN)
+        )
+}
+
+/// Whether an OAuth error code (RFC 6749 §5.2) means the credentials Windmill stored are what
+/// needs replacing. The rest — a malformed request, an unsupported grant type, a scope the
+/// server will not grant — are faults in how the integration asks, which reconnecting as the
+/// same user will reproduce exactly.
+#[cfg(feature = "native_trigger")]
+fn code_means_reconnect(code: &ErrorField) -> bool {
+    matches!(code, ErrorField::InvalidGrant | ErrorField::InvalidClient)
+}
+
+#[cfg(feature = "native_trigger")]
+fn refresh_failure_from(e: ExecuteError) -> RefreshFailure {
+    let rejected = match &e {
+        // A code says exactly what was refused, so nothing else needs guessing at.
+        ExecuteError::ErrorResponse { error, .. } => code_means_reconnect(&error.error),
+        // A body that would not deserialize is where a refusal hides when the status says
+        // nothing, and it is the only place the reason is written down.
+        ExecuteError::BadResponse { status, body, .. } => {
+            grant_refused(Some(*status), &String::from_utf8_lossy(body))
+        }
+        _ => grant_refused(e.status(), ""),
+    };
+    let message = match &e {
+        ExecuteError::BadResponse { body, .. } => {
+            format!("{e}: {}", String::from_utf8_lossy(body))
+        }
+        _ => error_source_chain(&e),
+    };
+    if rejected {
+        RefreshFailure::rejected(message)
+    } else {
+        RefreshFailure::outage(message)
+    }
+}
+
 /// Refresh OAuth tokens using windmill-oauth.
 #[cfg(feature = "native_trigger")]
 pub async fn refresh_oauth_tokens(
     oauth_config: &OAuthConfig,
     refresh_endpoint: &str,
     auth_endpoint: &str,
-) -> Result<OAuthConfig> {
+) -> std::result::Result<OAuthConfig, RefreshFailure> {
     let refresh_token_str = oauth_config
         .refresh_token
         .as_ref()
-        .ok_or_else(|| Error::InternalErr("No refresh token available".to_string()))?;
+        .ok_or_else(|| RefreshFailure::rejected("no refresh token is stored".to_string()))?;
 
     // Build OAuth client for token refresh
     // Auth URL is not used for refresh, but required by the client constructor
     let auth_url = Url::parse(&resolve_endpoint(&oauth_config.base_url, auth_endpoint))
-        .map_err(|e| Error::InternalErr(format!("Invalid auth URL: {}", e)))?;
+        .map_err(|e| RefreshFailure::outage(format!("invalid auth URL: {e}")))?;
     let token_url = Url::parse(&resolve_endpoint(&oauth_config.base_url, refresh_endpoint))
-        .map_err(|e| Error::InternalErr(format!("Invalid token URL: {}", e)))?;
+        .map_err(|e| RefreshFailure::outage(format!("invalid token URL: {e}")))?;
 
     let mut client = OClient::new(oauth_config.client_id.clone(), auth_url, token_url);
     client.set_client_secret(oauth_config.client_secret.clone());
@@ -675,7 +956,7 @@ pub async fn refresh_oauth_tokens(
         .with_client(&*OAUTH_HTTP_CLIENT)
         .execute()
         .await
-        .map_err(|e| Error::InternalErr(format!("Failed to refresh token: {:?}", e)))?;
+        .map_err(refresh_failure_from)?;
 
     Ok(OAuthConfig {
         base_url: oauth_config.base_url.clone(),
@@ -694,10 +975,11 @@ pub async fn refresh_oauth_tokens(
     _oauth_config: &OAuthConfig,
     _refresh_endpoint: &str,
     _auth_endpoint: &str,
-) -> Result<OAuthConfig> {
-    Err(Error::InternalErr(
-        "Native triggers feature is not enabled".to_string(),
-    ))
+) -> std::result::Result<OAuthConfig, RefreshFailure> {
+    Err(RefreshFailure {
+        rejected: false,
+        message: "the native_trigger feature is not enabled".to_string(),
+    })
 }
 
 async fn update_oauth_token_resource(
@@ -770,23 +1052,37 @@ async fn update_oauth_token_resource(
     }
 }
 
+/// The scopes a webhook token must carry to run one runnable, and nothing else.
+///
+/// Always derived from the runnable the trigger points at *now*. A token that outlives a rename
+/// carries the old path, and a webhook presenting it is refused however correct the URL is.
+pub fn webhook_token_scopes(script_path: &str, is_flow: bool) -> Vec<String> {
+    let kind = if is_flow { "flows" } else { "scripts" };
+    vec![format!("jobs:run:{kind}:{script_path}")]
+}
+
 /// Create a new webhook token, minting a fresh `ephemeral-webhook-{service}-{rd5}`
 /// label and the per-service expiration (see `ServiceName::webhook_token_expiration`).
 /// The old token is **not** deleted — callers must call `delete_token_by_hash` on
 /// `old_token_hash` after the trigger row has been successfully updated.
 ///
 /// Returns `Ok(None)` if the old token no longer exists (e.g. manually deleted by user).
+///
+/// `scopes` is applied rather than carried over: the old token's scopes name whatever runnable it
+/// was minted for, which a rename may since have moved. Copying them is how a re-save "succeeds"
+/// while every callback it authorises is refused.
 pub async fn rotate_webhook_token(
     db: &DB,
     old_token_hash: &str,
     service_name: ServiceName,
+    scopes: Vec<String>,
 ) -> Result<Option<RotatedToken>> {
     use windmill_common::auth::{hash_token, TOKEN_PREFIX_LEN};
     use windmill_common::min_version::MIN_VERSION_SUPPORTS_TOKEN_HASH;
     use windmill_common::utils::rd_string;
 
     let old = match sqlx::query!(
-        "SELECT email, scopes, workspace_id, super_admin, owner FROM token WHERE token_hash = $1",
+        "SELECT email, workspace_id, super_admin, owner FROM token WHERE token_hash = $1",
         old_token_hash
     )
     .fetch_optional(db)
@@ -825,7 +1121,7 @@ pub async fn rotate_webhook_token(
         old.email,
         new_label,
         old.super_admin,
-        old.scopes.as_deref(),
+        Some(scopes.as_slice()),
         old.workspace_id,
         old.owner,
         new_expiration,
@@ -920,6 +1216,114 @@ pub async fn store_native_trigger<'c, E: sqlx::Executor<'c, Database = Postgres>
     Ok(())
 }
 
+/// Record the outcome of re-registering a webhook: the token that now authenticates it and the
+/// config the service resolved.
+///
+/// Deliberately not `store_native_trigger`: the runnable a trigger points at belongs to whoever
+/// renamed or edited it, not to the re-registration, which only ever holds the path as it stood
+/// before its network call. Writing that path back would undo a rename that landed in between.
+///
+/// Conditional on `updated_at` — the row version — for the same reason. `TriggerLock` does not
+/// cover the rename's own `UPDATE`, because deploys must never block on a third party, so another
+/// write can land *during* this registration's network call. Recording then would attach a token
+/// for state that no longer holds and, worse, clear the `REREGISTRATION_PENDING` a newer rename
+/// set to protect itself. Comparing the path alone would not catch it: a save at the same path, or
+/// a rename away and back, leaves the path equal while the token has moved on.
+///
+/// Returns `false` when the row changed, leaving it untouched for whoever wrote it to finish.
+pub(crate) async fn record_reregistration<'c, E: sqlx::Executor<'c, Database = Postgres>>(
+    db: E,
+    workspace_id: &str,
+    service_name: ServiceName,
+    external_id: &str,
+    webhook_token: &str,
+    service_config: serde_json::Value,
+    expected_updated_at: DateTime<Utc>,
+) -> Result<bool> {
+    use windmill_common::auth::hash_token;
+
+    let applied = sqlx::query_scalar!(
+        r#"
+        UPDATE native_trigger
+        SET webhook_token_hash = $1, service_config = $2, error = NULL, updated_at = NOW()
+        WHERE
+            workspace_id = $3
+            AND service_name = $4
+            AND external_id = $5
+            AND updated_at = $6
+        RETURNING 1 AS "applied!"
+        "#,
+        hash_token(webhook_token),
+        sqlx::types::Json(service_config) as _,
+        workspace_id,
+        service_name as ServiceName,
+        external_id,
+        expected_updated_at,
+    )
+    .fetch_optional(db)
+    .await?
+    .is_some();
+
+    Ok(applied)
+}
+
+/// Apply a trigger edit, unless the runnable moved under it in the meantime.
+///
+/// A rename writes `native_trigger.script_path` from inside the deploy transaction, which is not
+/// under `TriggerLock` — so an edit holding the lock across its network call can still have the
+/// ground shift beneath it. Writing its snapshot's path back would undo the rename and hide the
+/// trigger from every listing, which is the bug this whole change exists to fix, so refuse instead.
+///
+/// Callers MUST have verified write access to `config.script_path`.
+///
+/// Returns `false` when the runnable moved; the edit is then stale and the caller should say so.
+pub(crate) async fn update_native_trigger_if_runnable_unchanged<
+    'c,
+    E: sqlx::Executor<'c, Database = Postgres>,
+>(
+    db: E,
+    workspace_id: &str,
+    service_name: ServiceName,
+    external_id: &str,
+    config: &NativeTriggerConfig,
+    service_config: serde_json::Value,
+    summary: Option<&str>,
+    expected_script_path: &str,
+    expected_is_flow: bool,
+) -> Result<bool> {
+    use windmill_common::auth::hash_token;
+
+    let applied = sqlx::query_scalar!(
+        r#"
+        UPDATE native_trigger
+        SET script_path = $1, is_flow = $2, webhook_token_hash = $3, service_config = $4,
+            summary = $5, error = NULL, updated_at = NOW()
+        WHERE
+            workspace_id = $6
+            AND service_name = $7
+            AND external_id = $8
+            AND script_path = $9
+            AND is_flow = $10
+        RETURNING 1 AS "applied!"
+        "#,
+        config.script_path,
+        config.is_flow,
+        hash_token(&config.webhook_token),
+        sqlx::types::Json(service_config) as _,
+        summary,
+        workspace_id,
+        service_name as ServiceName,
+        external_id,
+        expected_script_path,
+        expected_is_flow,
+    )
+    .fetch_optional(db)
+    .await?
+    .is_some();
+
+    Ok(applied)
+}
+
 pub async fn update_native_trigger<'c, E: sqlx::Executor<'c, Database = Postgres>>(
     db: E,
     workspace_id: &str,
diff --git a/backend/windmill-native-triggers/src/lock.rs b/backend/windmill-native-triggers/src/lock.rs
new file mode 100644
index 0000000000..577025ada3
--- /dev/null
+++ b/backend/windmill-native-triggers/src/lock.rs
@@ -0,0 +1,136 @@
+//! Serializing the operations that mutate a trigger's external registration.
+
+use std::sync::Arc;
+
+use sqlx::{Connection, PgConnection};
+use tokio::sync::{OwnedSemaphorePermit, Semaphore};
+use windmill_common::{
+    error::{Error, Result},
+    DB,
+};
+
+use crate::ServiceName;
+
+/// How long to wait for whoever holds the lock before giving up.
+///
+/// A waiter parks on its own connection, and that connection is outside the pool and so outside
+/// its limits — enough of them queued on one trigger would eat into what the server has for
+/// everything else. Waiting is bounded instead: the holder is doing a network call with its own
+/// timeout, so anything longer than this is not worth a connection, and the caller gets a plain
+/// "busy, try again" rather than an open-ended stall.
+const LOCK_WAIT: &str = "45s";
+
+/// Ceiling on how many of these connections can exist at once.
+///
+/// Each is opened outside the pool, so nothing else caps them: a burst of renames or repeated
+/// requests against one trigger would otherwise eat into what the server has for every other
+/// workload. Waiting for a permit costs nothing — the operation was going to queue on the lock
+/// anyway — and it is generous enough that ordinary use never reaches it.
+const MAX_CONCURRENT_LOCKS: usize = 32;
+
+lazy_static::lazy_static! {
+    static ref LOCK_SLOTS: Arc<Semaphore> = Arc::new(Semaphore::new(MAX_CONCURRENT_LOCKS));
+}
+
+/// Held for the whole of a read → register → record cycle on one trigger.
+///
+/// Registering a webhook is a read-modify-write spanning a network round-trip, against state held
+/// both here and on the external service. Two of them interleaving desynchronises the two: whoever
+/// writes the row last wins in the database, whoever calls the service last wins there, and they
+/// need not be the same operation — which is how a trigger ends up pointing somewhere the service
+/// is not calling, or a deleted trigger keeps firing.
+///
+/// A Postgres advisory lock makes them take turns. It is deliberately not a row lock: a rename's
+/// own `UPDATE native_trigger` must not block behind a re-registration's network call, and only
+/// code that takes the same key here waits.
+///
+/// The lock lives on its own connection, opened outside the pool. Holders keep it for as long as
+/// the external call takes and go on to need pool connections of their own to finish and release
+/// it, so taking it from the pool would let a handful of concurrent renames hold every connection
+/// while each waits for one more. Being off-pool also makes the lock impossible to strand: it is
+/// session-scoped, and a dropped or crashed connection releases it, whereas a pooled connection
+/// would carry it back into the pool.
+pub(crate) struct TriggerLock {
+    conn: Option<PgConnection>,
+    _slot: OwnedSemaphorePermit,
+}
+
+impl TriggerLock {
+    pub(crate) async fn acquire(
+        db: &DB,
+        w_id: &str,
+        service_name: ServiceName,
+        external_id: &str,
+    ) -> Result<Self> {
+        let (mut conn, slot) = Self::open(db).await?;
+        sqlx::query_scalar!(
+            "SELECT pg_advisory_lock(hashtextextended($1, 0))",
+            Self::key(w_id, service_name, external_id)
+        )
+        .fetch_one(&mut conn)
+        .await
+        .map_err(|e| {
+            Error::BadRequest(format!(
+                "Another operation on {external_id} is still running after {LOCK_WAIT}; try again \
+                 shortly ({e})"
+            ))
+        })?;
+        Ok(Self { conn: Some(conn), _slot: slot })
+    }
+
+    /// Take the lock only if it is free, for callers that would rather come back later than wait
+    /// out someone else's network call — the background renewal sweep, which runs again shortly.
+    pub(crate) async fn try_acquire(
+        db: &DB,
+        w_id: &str,
+        service_name: ServiceName,
+        external_id: &str,
+    ) -> Result<Option<Self>> {
+        let (mut conn, slot) = Self::open(db).await?;
+        let acquired = sqlx::query_scalar!(
+            r#"SELECT pg_try_advisory_lock(hashtextextended($1, 0)) AS "acquired!""#,
+            Self::key(w_id, service_name, external_id)
+        )
+        .fetch_one(&mut conn)
+        .await?;
+        Ok(acquired.then_some(Self { conn: Some(conn), _slot: slot }))
+    }
+
+    /// The lock's own connection, lent to the work it protects.
+    ///
+    /// Callers need a connection to hand the external service adapter, and it is held for the
+    /// whole network call. Taking that from the pool is what starves it: a handful of concurrent
+    /// renames would each pin one for as long as the remote takes to answer. This one is already
+    /// dedicated and idle for exactly that window.
+    pub(crate) fn conn(&mut self) -> &mut PgConnection {
+        self.conn
+            .as_mut()
+            .expect("lock connection is only taken on release")
+    }
+
+    pub(crate) async fn release(mut self) -> Result<()> {
+        if let Some(conn) = self.conn.take() {
+            // Closing the connection is what ends the session and its locks; unlocking first only
+            // makes that explicit at the call site.
+            conn.close().await?;
+        }
+        Ok(())
+    }
+
+    async fn open(db: &DB) -> Result<(PgConnection, OwnedSemaphorePermit)> {
+        let slot = LOCK_SLOTS
+            .clone()
+            .acquire_owned()
+            .await
+            .map_err(|e| Error::internal_err(format!("trigger lock slots closed: {e}")))?;
+        let mut conn = PgConnection::connect_with(&db.connect_options()).await?;
+        sqlx::query(&format!("SET lock_timeout = '{LOCK_WAIT}'"))
+            .execute(&mut conn)
+            .await?;
+        Ok((conn, slot))
+    }
+
+    fn key(w_id: &str, service_name: ServiceName, external_id: &str) -> String {
+        format!("native_trigger:{w_id}:{service_name}:{external_id}")
+    }
+}
diff --git a/backend/windmill-native-triggers/src/nextcloud/external.rs b/backend/windmill-native-triggers/src/nextcloud/external.rs
index b296ddb15b..763ad6fbb6 100644
--- a/backend/windmill-native-triggers/src/nextcloud/external.rs
+++ b/backend/windmill-native-triggers/src/nextcloud/external.rs
@@ -9,13 +9,14 @@ use windmill_common::{
 };
 
 use crate::{
-    generate_webhook_service_url,
+    generate_webhook_service_url, http_error_status,
     nextcloud::{
         routes, NextCloud, NextCloudOAuthData, NextCloudTriggerData, NextcloudServiceConfig,
         OcsResponse,
     },
     External, NativeTriggerData, ServiceName,
 };
+use http::StatusCode;
 
 lazy_static::lazy_static! {
     pub static ref TOKEN_NEEDED: Box<serde_json::value::RawValue> = to_raw_value(&serde_json::json!({
@@ -172,19 +173,28 @@ impl External for NextCloud {
             )
             .await?;
 
-        // Fetch back the updated state and convert to JSON config
-        let trigger_data = self
-            .get(w_id, oauth_data, external_id, db, tx)
-            .await?
-            .ok_or_else(|| {
-                Error::InternalErr(format!(
-                    "Failed to fetch back trigger {} after update",
-                    external_id
-                ))
-            })?;
-        serde_json::to_value(&trigger_data).map_err(|e| {
-            Error::internal_err(format!("Failed to convert trigger data to JSON: {}", e))
-        })
+        // The webhook is already updated at this point, so the read-back is an enrichment (it
+        // picks up whatever Nextcloud resolved server-side), not a second chance to fail. Failing
+        // here would report a webhook that is in fact installed as un-installed, and callers would
+        // then unwind a token the service is already using.
+        let read_back = match self.get(w_id, oauth_data, external_id, db, tx).await {
+            Ok(Some(trigger_data)) => serde_json::to_value(&trigger_data).ok(),
+            Ok(None) => None,
+            Err(e) => {
+                tracing::warn!(
+                    "Nextcloud webhook {external_id} was updated but could not be read back, \
+                     storing the requested config: {e:#}"
+                );
+                None
+            }
+        };
+
+        match read_back {
+            Some(config) => Ok(config),
+            None => serde_json::to_value(&data.service_config).map_err(|e| {
+                Error::internal_err(format!("Failed to convert trigger data to JSON: {}", e))
+            }),
+        }
     }
 
     async fn get(
@@ -226,11 +236,13 @@ impl External for NextCloud {
         let mut headers = HashMap::new();
         headers.insert("OCS-APIRequest".to_string(), "true".to_string());
 
+        // A webhook already removed in Nextcloud is the outcome this call wants, so only 404 is
+        // swallowed; anything else would leave a live webhook behind while Windmill forgets it.
         let _: serde_json::Value = self
             .http_client_request::<_, ()>(&url, Method::DELETE, w_id, db, Some(headers), None)
             .await
-            .or_else(|e| match &e {
-                Error::InternalErr(msg) if msg.contains("404") => Ok(serde_json::Value::Null),
+            .or_else(|e| match http_error_status(&e) {
+                Some(StatusCode::NOT_FOUND) => Ok(serde_json::Value::Null),
                 _ => Err(e),
             })?;
 
@@ -256,7 +268,10 @@ impl External for NextCloud {
                 );
                 errors.push(crate::sync::SyncError {
                     resource_path: format!("workspace:{}", workspace_id),
-                    error_message: format!("Failed to fetch external triggers: {}", e),
+                    error_message: format!(
+                        "Failed to fetch external triggers: {}",
+                        crate::external_error_message(&e)
+                    ),
                     error_type: "external_service_error".to_string(),
                 });
                 return;
@@ -294,6 +309,28 @@ impl External for NextCloud {
     fn additional_routes(&self) -> axum::Router {
         routes::nextcloud_routes(self.clone())
     }
+
+    fn describe_error_body(&self, body: &str) -> Option<String> {
+        let ocs: OcsResponse<serde_json::Value> = serde_json::from_str(body).ok()?;
+        Some(ocs.ocs.meta.message).filter(|m| !m.is_empty())
+    }
+
+    /// Appended to every failed call of this service, so a hint may not assert what the caller
+    /// was doing — only name the requirement that most often explains the status.
+    fn error_hint(&self, status: StatusCode) -> Option<&'static str> {
+        match status {
+            StatusCode::UNAUTHORIZED => {
+                Some("reconnect the Nextcloud integration from Workspace settings > Integrations.")
+            }
+            StatusCode::FORBIDDEN => Some(
+                "Nextcloud grants webhook management to administrators only, and a Windmill \
+                 admin is a different thing. If the connected Nextcloud account is not an admin \
+                 there and holds no delegated admin rights for the Webhooks setting, reconnect \
+                 the integration from Workspace settings > Integrations with one that does.",
+            ),
+            _ => None,
+        }
+    }
 }
 
 impl NextCloud {
diff --git a/backend/windmill-native-triggers/src/nextcloud/routes.rs b/backend/windmill-native-triggers/src/nextcloud/routes.rs
index 2f54124d64..a1c679602c 100644
--- a/backend/windmill-native-triggers/src/nextcloud/routes.rs
+++ b/backend/windmill-native-triggers/src/nextcloud/routes.rs
@@ -10,7 +10,7 @@ use windmill_common::{
 use windmill_api_auth::ApiAuthed;
 
 use crate::{
-    get_workspace_integration,
+    get_workspace_integration, map_external_error,
     nextcloud::{NextCloudEventType, OcsResponse},
     require_native_integration_use, External, ServiceName,
 };
@@ -47,7 +47,8 @@ async fn list_available_events<T: External>(
             Some(headers),
             None,
         )
-        .await?;
+        .await
+        .map_err(map_external_error)?;
 
     let events = serde_json::from_str(&ocs_response.ocs.data)
         .map_err(|e| Error::InternalErr(format!("Failed to parse NextCloud events data: {}", e)))?;
diff --git a/backend/windmill-native-triggers/src/rename.rs b/backend/windmill-native-triggers/src/rename.rs
new file mode 100644
index 0000000000..a7168f5c7e
--- /dev/null
+++ b/backend/windmill-native-triggers/src/rename.rs
@@ -0,0 +1,244 @@
+//! Keeping native triggers usable when their runnable is renamed.
+
+use std::collections::HashMap;
+
+use windmill_api_auth::ApiAuthed;
+use windmill_audit::{audit_oss::audit_log, ActionKind};
+use windmill_common::{
+    error::{Error, Result},
+    triggers::MovedNativeTrigger,
+    DB,
+};
+
+use crate::{
+    decrypt_oauth_data, delete_token_by_hash, get_native_trigger, github::GitHub, google::Google,
+    handler::new_webhook_token, lock::TriggerLock, nextcloud::NextCloud, record_reregistration,
+    update_native_trigger_error, External, NativeTriggerData, ServiceName,
+};
+
+/// Re-register the webhooks of the native triggers a rename moved onto a new runnable path.
+///
+/// The URL held by the external service embeds the runnable path and a token scoped to it, so
+/// after a rename the registration points at a path that no longer resolves.
+///
+/// `moved` comes from `windmill_common::triggers::update_triggers_script_path`. Callers MUST have
+/// already committed that rename and verified the caller's write access to the path the rows now
+/// carry — this mints fresh `jobs:run:*` tokens for it. Run it *after* the commit: repointing a
+/// webhook is not undoable, so doing it while the deploy transaction can still roll back would
+/// strand the trigger on a path and token that never existed.
+///
+/// The replacement token belongs to `authed`, so the runnable now executes as whoever deployed the
+/// rename rather than as the trigger's previous owner — the same identity swap a manual trigger
+/// edit performs, since a path-scoped token cannot outlive the path it names.
+///
+/// A service that rejects the update gets the failure recorded on its trigger row rather than
+/// propagated: the runnable is renamed either way, and the user can retry by re-saving the trigger.
+pub async fn reregister_triggers_after_rename(
+    db: &DB,
+    authed: &ApiAuthed,
+    w_id: &str,
+    moved: &[MovedNativeTrigger],
+) {
+    let mut by_service: HashMap<ServiceName, Vec<&MovedNativeTrigger>> = HashMap::new();
+    for trigger in moved {
+        match ServiceName::try_from(trigger.service_name.clone()) {
+            Ok(service) => by_service.entry(service).or_default().push(trigger),
+            Err(e) => tracing::error!(
+                "Unknown native trigger service '{}' on trigger '{}' in workspace '{w_id}': {e:#}",
+                trigger.service_name,
+                trigger.external_id
+            ),
+        }
+    }
+
+    for (service, of_service) in by_service {
+        match service {
+            ServiceName::Nextcloud => {
+                reregister_service(db, authed, w_id, &of_service, NextCloud).await
+            }
+            ServiceName::Google => reregister_service(db, authed, w_id, &of_service, Google).await,
+            ServiceName::Github => reregister_service(db, authed, w_id, &of_service, GitHub).await,
+        }
+    }
+}
+
+async fn reregister_service<T: External>(
+    db: &DB,
+    authed: &ApiAuthed,
+    w_id: &str,
+    moved: &[&MovedNativeTrigger],
+    handler: T,
+) {
+    let oauth_data: T::OAuthData =
+        match decrypt_oauth_data(db, w_id, T::SERVICE_NAME.integration_service()).await {
+            Ok(oauth_data) => oauth_data,
+            Err(e) => {
+                for trigger in moved {
+                    record_failure::<T>(db, w_id, &trigger.external_id, &e).await;
+                }
+                return;
+            }
+        };
+
+    for trigger in moved {
+        if let Err(e) = reregister_one(db, authed, w_id, &handler, &oauth_data, trigger).await {
+            record_failure::<T>(db, w_id, &trigger.external_id, &e).await;
+        }
+    }
+}
+
+/// Point one trigger's webhook at the runnable the rename moved it to.
+///
+/// `TriggerLock` excludes the other operations that touch a registration — edits, deletes, channel
+/// renewal, another re-registration — for the whole span including the network call. Renames are
+/// not among them: they move the row from inside the runnable's own transaction without taking
+/// this lock, so a further rename can still land mid-call. That is why the write-back is
+/// additionally conditional on `updated_at` rather than trusting the row read here.
+async fn reregister_one<T: External>(
+    db: &DB,
+    authed: &ApiAuthed,
+    w_id: &str,
+    handler: &T,
+    oauth_data: &T::OAuthData,
+    moved: &MovedNativeTrigger,
+) -> Result<()> {
+    let external_id = moved.external_id.as_str();
+    let mut lock = TriggerLock::acquire(db, w_id, T::SERVICE_NAME, external_id).await?;
+
+    let trigger = get_native_trigger(db, w_id, T::SERVICE_NAME, external_id)
+        .await?
+        .ok_or_else(|| Error::NotFound(format!("Native trigger not found: {external_id}")))?;
+
+    // Something took the lock first and pointed the trigger elsewhere. That operation authorized
+    // its own destination and installed its own registration; re-registering here would overwrite
+    // both with a token minted for a runnable this rename never authorized.
+    if trigger.script_path != moved.script_path || trigger.is_flow != moved.is_flow {
+        tracing::info!(
+            "Skipping re-registration of the {} trigger '{external_id}': it was moved to '{}' \
+             after the rename that queued this",
+            T::SERVICE_NAME,
+            trigger.script_path
+        );
+        return lock.release().await;
+    }
+
+    let service_config: T::ServiceConfig = serde_json::from_value(
+        trigger
+            .service_config
+            .clone()
+            .unwrap_or(serde_json::Value::Null),
+    )
+    .map_err(|e| Error::internal_err(format!("stored trigger config cannot be read back: {e}")))?;
+
+    let data = NativeTriggerData {
+        script_path: trigger.script_path.clone(),
+        is_flow: trigger.is_flow,
+        service_config,
+        summary: trigger.summary.clone(),
+    };
+
+    // The token is scoped to the runnable path and only its hash is kept, so pointing the webhook
+    // at the new path means minting a replacement rather than reusing the old one. Commit it
+    // before handing it out: a service may call back the moment it accepts the new URL.
+    let mut tx = db.begin().await?;
+    let webhook_token = new_webhook_token(
+        &mut tx,
+        db,
+        authed,
+        &trigger.script_path,
+        trigger.is_flow,
+        w_id,
+        T::SERVICE_NAME,
+    )
+    .await?;
+    tx.commit().await?;
+
+    let updated = handler
+        .update(
+            w_id,
+            oauth_data,
+            external_id,
+            &webhook_token,
+            &data,
+            db,
+            lock.conn(),
+        )
+        .await;
+
+    // A failed `update` does not mean the service never installed the token — Nextcloud mutates and
+    // then reads back, and any service can fail on the response after committing the mutation. So
+    // the token stays valid; deleting one the service did install would turn a webhook that still
+    // works into one that 401s.
+    let service_config = updated.inspect_err(|_| {
+        tracing::warn!(
+            "The webhook token minted for the {} trigger '{external_id}' was kept even though no \
+             row references it, since the service may have installed it",
+            T::SERVICE_NAME
+        )
+    })?;
+
+    let mut tx = db.begin().await?;
+
+    let applied = record_reregistration(
+        &mut *tx,
+        w_id,
+        T::SERVICE_NAME,
+        external_id,
+        &webhook_token,
+        service_config,
+        trigger.updated_at,
+    )
+    .await?;
+
+    if !applied {
+        // Written again while this was on the network — another rename, a save, or a disconnect
+        // that removed the row. Leave whatever is there now, including a newer rename's pending
+        // marker, for its own writer to finish, and keep this token: the service may be holding
+        // it. If the row is gone outright, the disconnect path revokes every token it deletes.
+        tx.rollback().await?;
+        tracing::info!(
+            "Discarding the re-registration of the {} trigger '{external_id}': the row changed \
+             while the service was being updated",
+            T::SERVICE_NAME
+        );
+        return lock.release().await;
+    }
+
+    delete_token_by_hash(&mut *tx, &trigger.webhook_token_hash).await?;
+
+    audit_log(
+        &mut *tx,
+        authed,
+        &format!("native_triggers.{}.update", T::SERVICE_NAME),
+        ActionKind::Update,
+        w_id,
+        Some(external_id),
+        Some([("reason", "runnable renamed")].into()),
+    )
+    .await?;
+
+    tx.commit().await?;
+    lock.release().await?;
+
+    Ok(())
+}
+
+async fn record_failure<T: External>(db: &DB, w_id: &str, external_id: &str, err: &Error) {
+    tracing::error!(
+        "Failed to re-register the {} trigger '{external_id}' in workspace '{w_id}' after rename: {err:#}",
+        T::SERVICE_NAME,
+    );
+    let message = format!(
+        "Could not re-point the webhook registered on {} at the renamed runnable, so it is no \
+         longer known to be delivering: {err}. Save the trigger again to retry.",
+        T::DISPLAY_NAME
+    );
+    if let Err(e) =
+        update_native_trigger_error(db, w_id, T::SERVICE_NAME, external_id, Some(&message)).await
+    {
+        tracing::error!(
+            "Failed to record the re-registration failure of the {} trigger '{external_id}': {e:#}",
+            T::SERVICE_NAME,
+        );
+    }
+}
diff --git a/backend/windmill-native-triggers/src/sync.rs b/backend/windmill-native-triggers/src/sync.rs
index a544ea1625..bc259f048e 100644
--- a/backend/windmill-native-triggers/src/sync.rs
+++ b/backend/windmill-native-triggers/src/sync.rs
@@ -12,6 +12,11 @@ use crate::{
     update_native_trigger_service_config, External, NativeTrigger,
 };
 
+/// The one `native_trigger.error` an existence check owns. Finding the trigger on the service
+/// may only clear this value: every other failure recorded there — a webhook left aimed at a
+/// pre-rename path, a channel that failed to renew — is one existence cannot disprove.
+pub const EXTERNAL_TRIGGER_MISSING_ERROR: &str = "Trigger no longer exists on external service";
+
 #[derive(Debug, Serialize)]
 pub struct TriggerSyncInfo {
     pub external_id: String,
@@ -290,7 +295,7 @@ pub async fn reconcile_with_external_state(
     for trigger in windmill_triggers {
         if !external_trigger_map.contains_key(&trigger.external_id) {
             // Trigger no longer exists on external service - set error
-            let error_msg = "Trigger no longer exists on external service".to_string();
+            let error_msg = EXTERNAL_TRIGGER_MISSING_ERROR.to_string();
 
             if trigger.error.as_deref() != Some(&error_msg) {
                 tracing::info!(
@@ -336,8 +341,10 @@ pub async fn reconcile_with_external_state(
             // Trigger exists on external service
             let external_service_config = external_trigger_map.get(&trigger.external_id).unwrap();
 
-            // Clear error if it was set
-            if trigger.error.is_some() {
+            // Only clear the error this reconciler itself sets. Existence says nothing about the
+            // failures other paths record — a webhook left aimed at a pre-rename path is present
+            // here yet still broken, and wiping its error would erase the only signal the user has.
+            if trigger.error.as_deref() == Some(EXTERNAL_TRIGGER_MISSING_ERROR) {
                 tracing::info!(
                     "Trigger (external_id: '{}', script_path: '{}') exists on external service, clearing error",
                     trigger.external_id,
diff --git a/backend/windmill-native-triggers/src/workspace_integrations.rs b/backend/windmill-native-triggers/src/workspace_integrations.rs
index 18f431812a..eccfa56f19 100644
--- a/backend/windmill-native-triggers/src/workspace_integrations.rs
+++ b/backend/windmill-native-triggers/src/workspace_integrations.rs
@@ -344,24 +344,26 @@ async fn delete_triggers_for_service(db: &DB, workspace_id: &str, service_name:
     }
     // For Google: skip remote cleanup (watch channels expire naturally)
 
-    // Bulk delete all triggers
-    if let Err(e) = sqlx::query!(
-        "DELETE FROM native_trigger WHERE workspace_id = $1 AND service_name = $2",
+    // Revoke the tokens the deleted rows actually named, not the ones listed above: a
+    // re-registration running concurrently mints a replacement, and leaving that alive would let a
+    // disconnected integration keep starting jobs.
+    let deleted_token_hashes = sqlx::query_scalar!(
+        "DELETE FROM native_trigger WHERE workspace_id = $1 AND service_name = $2 RETURNING webhook_token_hash",
         workspace_id,
         service_name as ServiceName
     )
-    .execute(db)
+    .fetch_all(db)
     .await
-    {
+    .unwrap_or_else(|e| {
         tracing::error!("Failed to delete native triggers for service {service_name:?} in workspace {workspace_id}: {e}");
-    }
+        Vec::new()
+    });
 
-    // Delete all associated webhook tokens
-    for trigger in &triggers {
-        if let Err(e) = delete_token_by_hash(db, &trigger.webhook_token_hash).await {
+    for webhook_token_hash in &deleted_token_hashes {
+        if let Err(e) = delete_token_by_hash(db, webhook_token_hash).await {
             tracing::error!(
                 "Failed to delete webhook token with hash {}: {e}",
-                trigger.webhook_token_hash
+                webhook_token_hash
             );
         }
     }
diff --git a/backend/windmill-oauth/src/lib.rs b/backend/windmill-oauth/src/lib.rs
index e314f13d75..32648a2115 100644
--- a/backend/windmill-oauth/src/lib.rs
+++ b/backend/windmill-oauth/src/lib.rs
@@ -32,7 +32,8 @@ pub type DB = sqlx::Pool<sqlx::Postgres>;
 
 // Re-export oauth2 types that consumers need (also used internally)
 pub use oauth2::{
-    helpers, AccessToken, AuthType, Client as OClient, RefreshToken, Scope, State, Url,
+    helpers, AccessToken, AuthType, Client as OClient, ErrorField, ExecuteError, RefreshToken,
+    Scope, State, Url,
 };
 
 // Re-export reqwest Client (version 0.12 compatible with async-oauth2)
diff --git a/backend/windmill-object-store/src/lib.rs b/backend/windmill-object-store/src/lib.rs
index 9121f6183d..2482cf14dd 100644
--- a/backend/windmill-object-store/src/lib.rs
+++ b/backend/windmill-object-store/src/lib.rs
@@ -355,10 +355,41 @@ pub async fn attempt_fetch_bytes(
     return Ok(bytes);
 }
 
+/// Whether an S3 resource carries static credentials. When it does not, the
+/// ambient AWS chain (env, profile, ECS/EC2 instance role) is used instead.
+/// Shared so callers that sign requests by hand resolve credentials on exactly the
+/// same condition as `build_s3_client`.
+#[cfg(feature = "parquet")]
+pub fn s3_resource_has_static_credentials(s3_resource: &S3Resource) -> bool {
+    s3_resource.access_key.as_ref().is_some_and(|x| x != "")
+        || s3_resource.secret_key.as_ref().is_some_and(|x| x != "")
+}
+
+/// Ambient AWS credentials from the shared, cached provider backing
+/// `build_s3_client`. Callers that sign their own requests must go through this
+/// rather than resolving the default chain themselves: the cache is what keeps a
+/// burst of requests from hitting the instance metadata service once each.
+///
+/// These are the **instance's own** credentials, not any caller's, and they are
+/// returned in the clear. A caller therefore MUST:
+/// - authorize the request target itself — reaching this function implies no
+///   permission check, and the credentials typically outrank the requesting user;
+/// - use them only to sign a request it has already authorized, never surface them
+///   in a response, log, or error message, and never hand them to a caller-supplied
+///   endpoint.
+///
+/// Prefer `build_s3_client`, which confines them to the object-store client; reach
+/// for this only where a request must be signed by hand.
+#[cfg(feature = "parquet")]
+pub async fn ambient_aws_credentials(
+    region: &str,
+) -> anyhow::Result<aws_sdk_sts::config::Credentials> {
+    ambient_aws_credentials_provider(region).await.get().await
+}
+
 #[cfg(feature = "parquet")]
 pub async fn build_s3_client(s3_resource_ref: &S3Resource) -> error::Result<Arc<dyn ObjectStore>> {
-    let static_creds = s3_resource_ref.access_key.as_ref().is_some_and(|x| x != "")
-        || s3_resource_ref.secret_key.as_ref().is_some_and(|x| x != "");
+    let static_creds = s3_resource_has_static_credentials(s3_resource_ref);
 
     let credentials_provider = if !static_creds {
         Some(ambient_aws_credentials_provider(&s3_resource_ref.region).await)
diff --git a/backend/windmill-queue/src/asset_dispatch.rs b/backend/windmill-queue/src/asset_dispatch.rs
index 29f44b153d..af9ca957b9 100644
--- a/backend/windmill-queue/src/asset_dispatch.rs
+++ b/backend/windmill-queue/src/asset_dispatch.rs
@@ -66,7 +66,7 @@ use windmill_common::error::{self, Result};
 use windmill_common::get_latest_deployed_hash_for_path;
 use windmill_common::jobs::{JobKind, JobPayload, JobTriggerKind};
 use windmill_common::partition::PARTITION_ARG;
-use windmill_common::scripts::ScriptHash;
+use windmill_common::scripts::{ScriptHash, ScriptLang};
 use windmill_common::triggers::TriggerMetadata;
 use windmill_common::users::{get_email_from_permissioned_as, username_to_permissioned_as};
 use windmill_common::worker::to_raw_value;
@@ -245,6 +245,18 @@ async fn try_dispatch(db: &DB, job: &MiniCompletedJob) -> Result<DispatchResult>
     if job.parent_job.is_some() && !is_native_retry_attempt(db, job).await? {
         return Ok(DispatchResult::default());
     }
+    // A dbt run records the relations it builds, so it looks like a producer
+    // here — but dbt does not trigger downstream runs. Its own DAG is dbt's to
+    // order; the only thing a cascade would add is waking Windmill scripts that
+    // read a mart, and nothing outside dbt can declare a `dbt://` write, so
+    // that edge exists in one direction only. Cascading from a project whose
+    // per-run selection can build any subset of itself needs a per-run write set
+    // to be correct, which is a design worth doing deliberately rather than
+    // inferring. Until then dbt materializes and reports; it does not dispatch.
+    if job.script_lang == Some(ScriptLang::Dbt) {
+        return Ok(DispatchResult::default());
+    }
+
     let runnable_path = match job.runnable_path.as_deref() {
         Some(p) if !p.is_empty() => p,
         _ => return Ok(DispatchResult::default()),
@@ -263,6 +275,7 @@ async fn try_dispatch(db: &DB, job: &MiniCompletedJob) -> Result<DispatchResult>
         return Ok(DispatchResult::default());
     };
 
+
     let args = fetch_args(db, &job.workspace_id, job.id).await?;
     if read_skip_arg(args.as_ref()) {
         return Ok(DispatchResult::default());
@@ -753,6 +766,9 @@ async fn push_subscriber(
     .await?
     .prefetch_cached(db)
     .await?;
+    let on_behalf_of = script
+        .on_behalf_of(&producer.workspace_id, db)
+        .await?;
     let hash = ScriptHash(script.hash);
     let tag = script.tag;
     let concurrency_settings = script.runnable_settings.concurrency_settings;
@@ -811,15 +827,17 @@ async fn push_subscriber(
     // producer's. Subscriptions are workspace-wide, so attributing the run
     // to the producer would let anyone who can deploy a `// on` script
     // execute code with the permissions of whoever happens to write the
-    // asset (e.g. an admin's scheduled job). `on_behalf_of_email` (an
-    // explicit service-account opt-in at deploy) takes precedence for the
-    // email; otherwise the deployer's email is resolved from their
-    // username.
-    let permissioned_as = username_to_permissioned_as(&script.created_by);
-    let email = match script.on_behalf_of_email {
-        Some(obo) => obo,
+    // asset (e.g. an admin's scheduled job). An on-behalf-of identity (an
+    // explicit service-account opt-in at deploy) takes precedence; otherwise
+    // the deployer's email is resolved from their username.
+    let (email, permissioned_as) = match on_behalf_of {
+        Some(obo) => (obo.email, obo.permissioned_as),
         None => {
-            get_email_from_permissioned_as(&permissioned_as, &producer.workspace_id, db).await?
+            let permissioned_as = username_to_permissioned_as(&script.created_by);
+            let email =
+                get_email_from_permissioned_as(&permissioned_as, &producer.workspace_id, db)
+                    .await?;
+            (email, permissioned_as)
         }
     };
 
@@ -862,6 +880,7 @@ async fn push_subscriber(
         permissioned_as,
         Some(producer_path),
         None,
+        None,
         Some(producer_path.to_string()),
         None,
         None,
diff --git a/backend/windmill-queue/src/ducklake_maintenance_oss.rs b/backend/windmill-queue/src/ducklake_maintenance_oss.rs
index ab6e035847..8f983c344a 100644
--- a/backend/windmill-queue/src/ducklake_maintenance_oss.rs
+++ b/backend/windmill-queue/src/ducklake_maintenance_oss.rs
@@ -72,7 +72,7 @@ pub async fn sync_ducklake_maintenance_schedules<'c>(
 
 /// Build the job payload for one occurrence of a managed maintenance schedule
 /// (`push_scheduled_job` calls this for reserved-prefix schedule paths).
-/// Returns `(payload, tag, timeout, on_behalf_of_email, created_by)`.
+/// Returns `(payload, tag, timeout, on_behalf_of)`.
 ///
 /// Always `Ok(None)` in the public build: the caller falls through to normal
 /// script resolution, so a pre-existing user schedule under a real
@@ -88,8 +88,7 @@ pub async fn build_maintenance_schedule_payload<'c>(
         JobPayload,
         Option<String>,
         Option<i32>,
-        Option<String>,
-        String,
+        Option<windmill_common::jobs::OnBehalfOf>,
     )>,
 > {
     Ok(None)
diff --git a/backend/windmill-queue/src/jobs.rs b/backend/windmill-queue/src/jobs.rs
index c4f83f4c4b..fd80a741dc 100644
--- a/backend/windmill-queue/src/jobs.rs
+++ b/backend/windmill-queue/src/jobs.rs
@@ -41,7 +41,7 @@ use windmill_common::audit::AuditAuthor;
 use windmill_common::auth::JobPerms;
 #[cfg(feature = "benchmark")]
 use windmill_common::bench::BenchmarkIter;
-use windmill_common::jobs::{JobTriggerKind, EMAIL_ERROR_HANDLER_USER_EMAIL};
+use windmill_common::jobs::{JobTriggerKind, TriggerKindLabel, EMAIL_ERROR_HANDLER_USER_EMAIL};
 use windmill_common::min_version::{
     MIN_VERSION_SUPPORTS_DEBOUNCING, MIN_VERSION_SUPPORTS_DEBOUNCING_V2,
 };
@@ -486,6 +486,7 @@ pub async fn push_init_job<'c>(
         None,
         None,
         None,
+        None,
         false,
         true,
         None,
@@ -545,6 +546,7 @@ pub async fn push_periodic_bash_job<'c>(
         None,
         None,
         None,
+        None,
         false,
         true,
         None,
@@ -1694,6 +1696,7 @@ async fn restart_job_if_perpetual_inner(
             &queued_job.permissioned_as_email,
             queued_job.permissioned_as.clone(),
             Some(&format!("add.completed.job{}", queued_job.id)),
+            None,
             scheduled_for,
             queued_job.schedule_path(),
             None,
@@ -1996,6 +1999,7 @@ pub async fn maybe_enqueue_native_script_retry(
         &job.permissioned_as_email,
         job.permissioned_as.clone(),
         Some(&format!("retry.{}", job.id)),
+        None,
         Some(scheduled_for),
         None,
         Some(root),
@@ -2839,6 +2843,7 @@ pub async fn push_error_handler<'a, 'c, T: Serialize + Send + Sync>(
         Some(&format!("error.handler.{job_id}")),
         None,
         None,
+        None,
         Some(job_id),
         None,
         Some(job_id),
@@ -2927,6 +2932,7 @@ pub async fn push_success_handler<'a, 'c, T: Serialize + Send + Sync>(
         Some(&format!("success.handler.{job_id}")),
         None,
         None,
+        None,
         Some(job_id), // parent_job
         Some(job_id), // root_job
         Some(job_id), // flow_innermost_root_job
@@ -2998,7 +3004,7 @@ pub struct MiniPulledJob {
     pub preprocessed: Option<bool>,
     pub script_entrypoint_override: Option<String>,
     pub trigger: Option<String>,
-    pub trigger_kind: Option<JobTriggerKind>,
+    pub trigger_kind: Option<TriggerKindLabel>,
     pub visible_to_owner: bool,
     pub permissioned_as_end_user_email: Option<String>,
     pub runnable_settings_handle: Option<i64>,
@@ -3074,7 +3080,7 @@ pub struct MiniCompletedJob {
     pub script_lang: Option<ScriptLang>,
     pub permissioned_as_email: String,
     pub flow_step_id: Option<String>,
-    pub trigger_kind: Option<JobTriggerKind>,
+    pub trigger_kind: Option<TriggerKindLabel>,
     pub trigger: Option<String>,
     pub priority: Option<i16>,
     pub concurrent_limit: Option<i32>,
@@ -3101,7 +3107,7 @@ impl From<QueuedJobV2> for MiniCompletedJob {
             script_lang: job.script_lang,
             permissioned_as_email: job.permissioned_as_email,
             flow_step_id: job.flow_step_id,
-            trigger_kind: job.trigger_kind,
+            trigger_kind: job.trigger_kind.map(Into::into),
             trigger: job.trigger,
             priority: job.priority,
             concurrent_limit: job.concurrent_limit,
@@ -3190,12 +3196,12 @@ impl MiniCompletedJob {
 }
 
 fn schedule_path(
-    trigger_kind: &Option<JobTriggerKind>,
+    trigger_kind: &Option<TriggerKindLabel>,
     trigger: &Option<String>,
 ) -> Option<String> {
     if trigger_kind
         .as_ref()
-        .is_some_and(|t| matches!(t, JobTriggerKind::Schedule))
+        .is_some_and(|t| t.is(JobTriggerKind::Schedule))
     {
         trigger.clone()
     } else {
@@ -3273,11 +3279,10 @@ impl MiniPulledJob {
             preprocessed: job.preprocessed.clone(),
             script_entrypoint_override: job.script_entrypoint_override.clone(),
             trigger: job.schedule_path.clone(),
-            trigger_kind: if job.schedule_path.is_some() {
-                Some(JobTriggerKind::Schedule)
-            } else {
-                None
-            },
+            trigger_kind: job
+                .schedule_path
+                .is_some()
+                .then(|| JobTriggerKind::Schedule.into()),
             visible_to_owner: job.visible_to_owner.clone(),
             permissioned_as_end_user_email: None,
         }
@@ -3375,7 +3380,15 @@ impl PulledJob {
                 Some(is_operator),
                 Some(groups),
                 Some(folders),
-            ) => Some(JobPerms { email, username, is_admin, is_operator, groups, folders }),
+            ) => Some(JobPerms {
+                email,
+                username,
+                is_admin,
+                is_operator,
+                groups,
+                folders,
+                end_user_email: self.job.permissioned_as_end_user_email.clone(),
+            }),
             _ => None,
         };
 
@@ -3397,13 +3410,10 @@ impl PulledJob {
 pub async fn create_token(db: &DB, job: &MiniPulledJob, perms: Option<JobPerms>) -> String {
     // skipping test runs
     if job.workspace_id != "" {
-        let label = if job.permissioned_as != format!("u/{}", job.created_by)
-            && job.permissioned_as != job.created_by
-        {
-            format!("ephemeral-script-end-user-{}", job.created_by)
-        } else {
-            "ephemeral-script".to_string()
-        };
+        let label = windmill_common::auth::ephemeral_script_token_label(
+            &job.permissioned_as,
+            &job.created_by,
+        );
         windmill_common::auth::create_token_for_owner(
             db,
             &job.workspace_id,
@@ -3482,7 +3492,7 @@ pub async fn get_mini_pulled_job<'c>(
         preprocessed,
         script_entrypoint_override,
         trigger,
-        trigger_kind as \"trigger_kind: JobTriggerKind\",
+        trigger_kind as \"trigger_kind: TriggerKindLabel\",
         visible_to_owner,
         NULL as permissioned_as_end_user_email
         FROM v2_job_queue INNER JOIN v2_job ON v2_job.id = v2_job_queue.id LEFT JOIN v2_job_status ON v2_job_status.id = v2_job_queue.id WHERE v2_job_queue.id = $1",
@@ -3509,7 +3519,7 @@ pub struct QueuedJobV2 {
     pub script_lang: Option<ScriptLang>,
     pub permissioned_as_email: String,
     pub flow_step_id: Option<String>,
-    pub trigger_kind: Option<JobTriggerKind>,
+    pub trigger_kind: Option<TriggerKindLabel>,
     pub trigger: Option<String>,
     pub priority: Option<i16>,
     pub concurrent_limit: Option<i32>,
@@ -3551,7 +3561,7 @@ pub async fn get_queued_job_v2<'c>(
                 script_lang as "script_lang: ScriptLang",
                 permissioned_as_email,
                 flow_step_id,
-                trigger_kind as "trigger_kind: JobTriggerKind",
+                trigger_kind as "trigger_kind: TriggerKindLabel",
                 trigger,
                 q.priority,
                 concurrent_limit,
@@ -5051,7 +5061,7 @@ pub fn get_mini_completed_job<'a, 'e, A: sqlx::Acquire<'e, Database = Postgres>
             MiniCompletedJob,
             "SELECT
             j.id, j.workspace_id, j.runnable_id AS \"runnable_id: ScriptHash\", q.scheduled_for, q.started_at, j.parent_job, j.flow_innermost_root_job, j.runnable_path, j.kind as \"kind!: JobKind\", j.permissioned_as,
-            j.created_by, j.script_lang AS \"script_lang: ScriptLang\", j.permissioned_as_email, j.flow_step_id, j.trigger_kind AS \"trigger_kind: JobTriggerKind\", j.trigger, j.priority, j.concurrent_limit, j.tag, j.cache_ttl, q.cache_ignore_s3_path, q.runnable_settings_handle
+            j.created_by, j.script_lang AS \"script_lang: ScriptLang\", j.permissioned_as_email, j.flow_step_id, j.trigger_kind AS \"trigger_kind: TriggerKindLabel\", j.trigger, j.priority, j.concurrent_limit, j.tag, j.cache_ttl, q.cache_ignore_s3_path, q.runnable_settings_handle
             FROM v2_job j LEFT JOIN v2_job_queue q ON j.id = q.id
             WHERE j.id = $1 AND j.workspace_id = $2",
             id,
@@ -5276,6 +5286,11 @@ pub async fn push<'c, 'd>(
     email: &str,
     permissioned_as: String,
     token_prefix: Option<&str>,
+    // Identifies the caller in the audit trail — distinct from the `end_user_email` below,
+    // which the job itself reads. The API sources it from `ApiAuthed::username_override`;
+    // a token label reaches audit through here alone, since `user` is the token owner.
+    // Callers that know no caller beyond `user` pass None.
+    audit_end_user: Option<&str>,
     scheduled_for_o: Option<chrono::DateTime<chrono::Utc>>,
     schedule_path: Option<String>,
     parent_job: Option<Uuid>,
@@ -5306,6 +5321,7 @@ pub async fn push<'c, 'd>(
         email,
         permissioned_as,
         token_prefix,
+        audit_end_user,
         scheduled_for_o,
         schedule_path,
         parent_job,
@@ -5340,6 +5356,7 @@ async fn push_inner<'c, 'd>(
     mut email: &str,
     mut permissioned_as: String,
     token_prefix: Option<&str>,
+    audit_end_user: Option<&str>,
     #[allow(unused_mut)] mut scheduled_for_o: Option<chrono::DateTime<chrono::Utc>>,
     schedule_path: Option<String>, //should be removed in favor of the trigger param below
     parent_job: Option<Uuid>,
@@ -6841,20 +6858,27 @@ async fn push_inner<'c, 'd>(
             JobKind::UnassignedSinglestepFlow => "jobs.run.unassigned_singlestepflow",
         };
 
-        let audit_author = if format!("u/{user}") != permissioned_as && user != permissioned_as {
-            AuditAuthor {
-                email: email.to_string(),
-                username: windmill_common::auth::permissioned_as_to_username(&permissioned_as),
-                username_override: Some(user.to_string()),
-                token_prefix: token_prefix.map(|s| s.to_string()),
-            }
-        } else {
-            AuditAuthor {
-                email: email.to_string(),
-                username: user.to_string(),
-                username_override: None,
-                token_prefix: token_prefix.map(|s| s.to_string()),
-            }
+        let runs_on_behalf = format!("u/{user}") != permissioned_as && user != permissioned_as;
+        // `user` is the end user of `permissioned_as` when the job runs as someone else, and
+        // `audit_end_user` takes the one `end_user` slot ahead of it. Record it here so it stays
+        // searchable: `username` holds the run-as identity in that case, not the caller.
+        if runs_on_behalf && audit_end_user.is_some_and(|e| e != user) {
+            hm.insert("created_by", user);
+        }
+        let audit_author = AuditAuthor {
+            email: email.to_string(),
+            username: if runs_on_behalf {
+                windmill_common::auth::permissioned_as_to_username(&permissioned_as)
+            } else {
+                user.to_string()
+            },
+            // `username` is the identity the job runs as; `end_user` identifies the caller
+            // behind it, as it does for an app run. An explicitly passed one therefore wins
+            // over `user`, which only stands in for a caller when the job runs as someone else.
+            username_override: audit_end_user
+                .map(|s| s.to_string())
+                .or_else(|| runs_on_behalf.then(|| user.to_string())),
+            token_prefix: token_prefix.map(|s| s.to_string()),
         };
 
         if let Some(ref stringified_args) = stringified_args {
diff --git a/backend/windmill-queue/src/schedule.rs b/backend/windmill-queue/src/schedule.rs
index 55944b08ca..10f4a2b408 100644
--- a/backend/windmill-queue/src/schedule.rs
+++ b/backend/windmill-queue/src/schedule.rs
@@ -22,6 +22,7 @@ use windmill_common::get_latest_flow_version_id_for_path;
 use windmill_common::jobs::check_tag_available_for_workspace_internal;
 use windmill_common::jobs::JobPayload;
 use windmill_common::jobs::JobTriggerKind;
+use windmill_common::jobs::OnBehalfOf;
 use windmill_common::runnable_settings::ConcurrencySettings;
 use windmill_common::runnable_settings::DebouncingSettings;
 use windmill_common::schedule::schedule_to_user;
@@ -34,19 +35,18 @@ use windmill_common::DB;
 use windmill_common::{
     error::{self, Result},
     schedule::Schedule,
-    users::username_to_permissioned_as,
     utils::{now_from_db, ScheduleType, StripPath},
 };
 
 /// Helper to fetch metadata for a schedule's script or flow
 async fn get_schedule_metadata<'c>(
     tx: &mut sqlx::Transaction<'c, sqlx::Postgres>,
+    db: &DB,
     schedule: &Schedule,
 ) -> Result<(
     Option<String>,     // tag
     Option<i32>,        // timeout
-    Option<String>,     // on_behalf_of_email
-    String,             // created_by
+    Option<OnBehalfOf>, // identity the runnable is deployed to run as
     Option<ScriptHash>, // hash (for scripts)
     Option<i64>,        // flow_version (for flows)
     Option<Retry>,      // retry
@@ -66,20 +66,18 @@ async fn get_schedule_metadata<'c>(
         )
         .await?;
 
-        let FlowVersionInfo { tag, on_behalf_of_email, edited_by, .. } =
-            get_flow_version_info_from_version(
-                &mut **tx,
-                version,
-                &schedule.workspace_id,
-                &schedule.script_path,
-            )
-            .await?;
+        let flow_info = get_flow_version_info_from_version(
+            &mut **tx,
+            version,
+            &schedule.workspace_id,
+            &schedule.script_path,
+        )
+        .await?;
 
         Ok((
-            tag,
+            flow_info.tag.clone(),
             None,
-            on_behalf_of_email,
-            edited_by,
+            flow_info.on_behalf_of(&schedule.workspace_id, db).await?,
             None,
             Some(version),
             parsed_retry,
@@ -99,27 +97,19 @@ async fn get_schedule_metadata<'c>(
             _dedicated_worker,
             _priority,
             timeout,
-            on_behalf_of_email,
-            created_by,
+            on_behalf_of,
             _runnable_settings_handle,
             _labels,
         ) = windmill_common::get_latest_hash_for_path(
             &mut **tx,
+            db,
             &schedule.workspace_id,
             &schedule.script_path,
             false,
         )
         .await?;
 
-        Ok((
-            tag,
-            timeout,
-            on_behalf_of_email,
-            created_by,
-            Some(hash),
-            None,
-            parsed_retry,
-        ))
+        Ok((tag, timeout, on_behalf_of, Some(hash), None, parsed_retry))
     }
 }
 
@@ -246,7 +236,7 @@ pub async fn push_scheduled_job<'c>(
 
     // If schedule handler is defined, wrap the scheduled job in a synthetic flow
     // with the handler as the first step (with stop_after_if to skip if handler returns false)
-    let (payload, tag, timeout, on_behalf_of_email, created_by) = if let Some(maintenance_payload) =
+    let (payload, tag, timeout, on_behalf_of) = if let Some(maintenance_payload) =
         maintenance_payload
     {
         maintenance_payload
@@ -266,8 +256,8 @@ pub async fn push_scheduled_job<'c>(
         );
 
         // Get metadata from the scheduled script/flow for tag, timeout, etc.
-        let (tag, timeout, on_behalf_of_email, created_by, hash, flow_version, retry) =
-            get_schedule_metadata(&mut tx, schedule).await?;
+        let (tag, timeout, on_behalf_of, hash, flow_version, retry) =
+            get_schedule_metadata(&mut tx, db, schedule).await?;
 
         (
             JobPayload::SingleStepFlow {
@@ -300,8 +290,7 @@ pub async fn push_scheduled_job<'c>(
                 tag
             },
             timeout,
-            on_behalf_of_email,
-            created_by,
+            on_behalf_of,
         )
     } else if schedule.is_flow {
         let version = get_latest_flow_version_id_for_path(
@@ -314,15 +303,7 @@ pub async fn push_scheduled_job<'c>(
         .warn_after_seconds_with_sql(1, "get_latest_flow_version_id_for_path".to_string())
         .await?;
 
-        let FlowVersionInfo {
-            version,
-            tag,
-            dedicated_worker,
-            on_behalf_of_email,
-            edited_by,
-            labels,
-            ..
-        } = get_flow_version_info_from_version(
+        let flow_info = get_flow_version_info_from_version(
             &mut *tx,
             version,
             &schedule.workspace_id,
@@ -330,6 +311,8 @@ pub async fn push_scheduled_job<'c>(
         )
         .warn_after_seconds_with_sql(1, "get_flow_version_info_from_version".to_string())
         .await?;
+        let on_behalf_of = flow_info.on_behalf_of(&schedule.workspace_id, db).await?;
+        let FlowVersionInfo { version, tag, dedicated_worker, labels, .. } = flow_info;
 
         (
             JobPayload::Flow {
@@ -341,8 +324,7 @@ pub async fn push_scheduled_job<'c>(
             },
             tag,
             None,
-            on_behalf_of_email,
-            edited_by,
+            on_behalf_of,
         )
     } else {
         let (
@@ -359,12 +341,12 @@ pub async fn push_scheduled_job<'c>(
             dedicated_worker,
             priority,
             timeout,
-            on_behalf_of_email,
-            created_by,
+            on_behalf_of,
             runnable_settings_handle,
             labels,
         ) = windmill_common::get_latest_hash_for_path(
             &mut *tx,
+            db,
             &schedule.workspace_id,
             &schedule.script_path,
             false,
@@ -434,8 +416,7 @@ pub async fn push_scheduled_job<'c>(
                     tag
                 },
                 timeout,
-                on_behalf_of_email,
-                created_by,
+                on_behalf_of.clone(),
             )
         } else {
             (
@@ -463,8 +444,7 @@ pub async fn push_scheduled_job<'c>(
                     tag
                 },
                 timeout,
-                on_behalf_of_email,
-                created_by,
+                on_behalf_of,
             )
         }
     };
@@ -485,8 +465,8 @@ pub async fn push_scheduled_job<'c>(
         );
     };
 
-    let (email, permissioned_as, push_authed, revert_to_windmill_user) = if let Some(email) =
-        on_behalf_of_email.as_ref()
+    let (email, permissioned_as, push_authed, revert_to_windmill_user) = if let Some(obo) =
+        on_behalf_of.as_ref()
     {
         let is_windmill_user =
             sqlx::query_scalar!("SELECT CURRENT_USER = 'windmill_user' as \"is_windmill_user!\"")
@@ -500,8 +480,8 @@ pub async fn push_scheduled_job<'c>(
                 .await?;
         }
         (
-            email.clone(),
-            username_to_permissioned_as(&created_by),
+            obo.email.clone(),
+            obo.permissioned_as.clone(),
             None,
             is_windmill_user,
         )
@@ -561,6 +541,7 @@ pub async fn push_scheduled_job<'c>(
         &email,
         permissioned_as,
         Some(&schedule.path),
+        None,
         Some(next),
         Some(schedule.path.clone()),
         None,
diff --git a/backend/windmill-queue/tests/fixtures/schedule_push.sql b/backend/windmill-queue/tests/fixtures/schedule_push.sql
index 9312d0bbd9..5dcc9e1528 100644
--- a/backend/windmill-queue/tests/fixtures/schedule_push.sql
+++ b/backend/windmill-queue/tests/fixtures/schedule_push.sql
@@ -22,13 +22,13 @@ VALUES (
     'Test script', '', 'f/system/test_script', 100001, 'deno', '', 'script'
 );
 
--- A script with on_behalf_of_email
-INSERT INTO script (workspace_id, created_by, content, schema, summary, description, path, hash, language, lock, kind, on_behalf_of_email)
+-- A script with an on-behalf-of identity
+INSERT INTO script (workspace_id, created_by, content, schema, summary, description, path, hash, language, lock, kind, on_behalf_of)
 VALUES (
     'test-workspace', 'test-user',
     'export async function main() { return "obo"; }',
     '{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{},"required":[],"type":"object"}',
-    'OBO script', '', 'f/system/obo_script', 100002, 'deno', '', 'script', 'obo@windmill.dev'
+    'OBO script', '', 'f/system/obo_script', 100002, 'deno', '', 'script', 'u/obo-user'
 );
 
 -- A script with a tag
@@ -66,13 +66,13 @@ VALUES (
     'test-user'
 );
 
--- A flow with on_behalf_of_email
-INSERT INTO flow (workspace_id, summary, description, path, versions, schema, value, edited_by, on_behalf_of_email)
+-- A flow with an on-behalf-of identity
+INSERT INTO flow (workspace_id, summary, description, path, versions, schema, value, edited_by, on_behalf_of)
 VALUES (
     'test-workspace', 'OBO flow', '', 'f/system/obo_flow', '{200002}',
     '{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{},"required":[],"type":"object"}',
     '{"modules": [{"id": "a", "value": {"path": "f/system/test_script", "type": "script", "input_transforms": {}}}]}',
-    'test-user', 'obo@windmill.dev'
+    'test-user', 'u/obo-user'
 );
 
 INSERT INTO flow_version (id, workspace_id, path, schema, value, created_by)
diff --git a/backend/windmill-queue/tests/native_retry_test.rs b/backend/windmill-queue/tests/native_retry_test.rs
index 6b6c2d65ce..8da40b7cad 100644
--- a/backend/windmill-queue/tests/native_retry_test.rs
+++ b/backend/windmill-queue/tests/native_retry_test.rs
@@ -36,7 +36,7 @@ mod native_retry {
             script_lang: Some(ScriptLang::Deno),
             permissioned_as_email: "test@windmill.dev".to_string(),
             flow_step_id: None,
-            trigger_kind: Some(JobTriggerKind::Schedule),
+            trigger_kind: Some(JobTriggerKind::Schedule.into()),
             trigger: Some(SCHED.to_string()),
             priority: None,
             concurrent_limit: None,
diff --git a/backend/windmill-queue/tests/schedule_push.rs b/backend/windmill-queue/tests/schedule_push.rs
index 3ac4cd2bd9..2069ce06b7 100644
--- a/backend/windmill-queue/tests/schedule_push.rs
+++ b/backend/windmill-queue/tests/schedule_push.rs
@@ -83,7 +83,7 @@ mod schedule_push {
             script_lang: None,
             permissioned_as_email: schedule.email.clone(),
             flow_step_id: None,
-            trigger_kind: Some(JobTriggerKind::Schedule),
+            trigger_kind: Some(JobTriggerKind::Schedule.into()),
             trigger: Some(schedule.path.clone()),
             priority: None,
             concurrent_limit: None,
diff --git a/backend/windmill-store/Cargo.toml b/backend/windmill-store/Cargo.toml
index 1409e30ebf..31cd0fbe0f 100644
--- a/backend/windmill-store/Cargo.toml
+++ b/backend/windmill-store/Cargo.toml
@@ -52,6 +52,7 @@ sql-builder.workspace = true
 async-recursion.workspace = true
 futures.workspace = true
 chrono.workspace = true
+dashmap.workspace = true
 reqwest.workspace = true
 anyhow.workspace = true
 base64.workspace = true
diff --git a/backend/windmill-store/src/resources.rs b/backend/windmill-store/src/resources.rs
index 4ccf364cf8..b2191cf729 100644
--- a/backend/windmill-store/src/resources.rs
+++ b/backend/windmill-store/src/resources.rs
@@ -6,8 +6,11 @@
  * LICENSE-AGPL for a copy of the license.
  */
 
+use dashmap::DashMap;
 use std::collections::HashMap;
 use std::net::IpAddr;
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::sync::LazyLock;
 
 use windmill_api_auth::{
     build_scope_path_predicate, check_scopes, maybe_refresh_folders, require_owner_of_path,
@@ -18,7 +21,10 @@ use windmill_common::workspaces::{check_deploy_rules, RuleCheckResult};
 
 use crate::secret_backend_ext::rename_vault_secret;
 use crate::var_resource_cache::{auth_identity, cache_resource, get_cached_resource};
-use windmill_common::utils::{escape_ilike_pattern, BulkDeleteRequest};
+use windmill_common::utils::{
+    check_proper_path, check_proper_type_name, escape_ilike_pattern, sanitize_db_error,
+    BulkDeleteRequest,
+};
 use windmill_common::webhook::{WebhookMessage, WebhookShared};
 
 use axum::{
@@ -71,6 +77,15 @@ pub fn workspaced_service() -> Router {
         )
         .route("/update/{*path}", post(update_resource))
         .route("/update_value/{*path}", post(update_resource_value))
+        .route(
+            "/history/p/{*path}",
+            get(get_resource_history).delete(clear_resource_history),
+        )
+        .route("/history/v/{version}", get(get_resource_version))
+        .route(
+            "/history/restore/v/{version}",
+            post(restore_resource_version),
+        )
         .route("/delete/{*path}", delete(delete_resource))
         .route("/delete_bulk", delete(delete_resources_bulk))
         .route("/create", post(create_resource))
@@ -1009,6 +1024,79 @@ async fn check_path_conflict<'c>(
     return Ok(());
 }
 
+/// Resource types the platform writes on its own behalf rather than users editing them:
+/// `state` backs `setState` and `cache` backs cached job results, so both are rewritten on
+/// every job run. Workspace export skips them for the same reason the `record_resource_version`
+/// trigger does; that trigger repeats this list in SQL, so the two have to move together.
+pub const INTERNAL_RESOURCE_TYPES: [&str; 2] = ["state", "cache"];
+
+/// Versions retained per resource path. The monitor sweep enforces it eventually; the history
+/// endpoint caps its own read at the same number so a burst of writes between two sweeps cannot
+/// make the drawer fetch an unbounded list.
+pub const MAX_RESOURCE_VERSIONS: i64 = 100;
+
+/// Above any plausible hand-editing cadence, and the rate at which the retained history stops
+/// being useful: at this many writes a minute, MAX_RESOURCE_VERSIONS covers only five minutes.
+/// Counting is per process, so N servers raise the effective threshold to N times this; erring
+/// low is the safe direction for something that only ever logs.
+const RESOURCE_WRITE_ADVISORY_PER_MIN: u32 = 20;
+
+struct ResourceWriteRate {
+    count: u32,
+    minute_bucket: i64,
+}
+
+/// Writes seen per (workspace, path) per minute. Purely advisory, and deliberately so: nothing
+/// is throttled, the count is per process and resets on restart, so it undercounts across
+/// servers. That is affordable for a log line and is what keeps this off the write path proper.
+static RESOURCE_WRITE_RATES: LazyLock<DashMap<(String, String), ResourceWriteRate>> =
+    LazyLock::new(DashMap::new);
+static RESOURCE_WRITES_SEEN: AtomicU64 = AtomicU64::new(0);
+
+/// Notice a caller rewriting one resource in a loop and point them at a store meant for it.
+/// Counts writes rather than versions: an unchanged value records nothing, but it still costs a
+/// row rewrite, an audit entry and a webhook, and is still a caller who wants a different store.
+fn note_resource_write(w_id: &str, path: &str, resource_type: &str) {
+    // `state` and `cache` are rewritten once per job by design. Counting them would fire the
+    // advisory hardest on exactly the traffic it is not about, which is how a warning becomes
+    // noise people filter out.
+    if INTERNAL_RESOURCE_TYPES.contains(&resource_type) {
+        return;
+    }
+    let minute_bucket = chrono::Utc::now().timestamp() / 60;
+    // The entry guard holds a lock on its DashMap shard, and `retain` below takes every shard.
+    // Keeping the guard alive across that call deadlocks the request handler, so this block is
+    // load-bearing: it must end before the eviction, not be flattened into the function body.
+    let reached_cap = {
+        let mut rate = RESOURCE_WRITE_RATES
+            .entry((w_id.to_string(), path.to_string()))
+            .or_insert(ResourceWriteRate { count: 0, minute_bucket });
+        if rate.minute_bucket != minute_bucket {
+            rate.minute_bucket = minute_bucket;
+            rate.count = 0;
+        }
+        rate.count += 1;
+        rate.count == RESOURCE_WRITE_ADVISORY_PER_MIN
+    };
+    // Bounded without a background task: periodically drop what neither the current nor the
+    // previous minute can still need.
+    if RESOURCE_WRITES_SEEN.fetch_add(1, Ordering::Relaxed) % 256 == 0 {
+        RESOURCE_WRITE_RATES.retain(|_, rate| rate.minute_bucket >= minute_bucket - 1);
+    }
+    // Once per minute per path: `==` rather than `>=` so a sustained loop logs at the crossing
+    // and then stays quiet until the bucket rolls over.
+    if reached_cap {
+        tracing::warn!(
+            workspace_id = %w_id,
+            path = %path,
+            "resource written {} times in a minute; each write rewrites the whole value, and a \
+             changed one also records a version. High-frequency writes belong in a state resource, \
+             object storage, or a datatable.",
+            RESOURCE_WRITE_ADVISORY_PER_MIN
+        );
+    }
+}
+
 #[derive(Deserialize)]
 struct CreateResourceQuery {
     update_if_exists: Option<bool>,
@@ -1023,6 +1111,8 @@ async fn create_resource(
     Json(resource): Json<CreateResource>,
 ) -> Result<(StatusCode, String)> {
     check_scopes(&authed, || format!("resources:write:{}", resource.path))?;
+    check_proper_path(&resource.path)?;
+    check_proper_type_name(&resource.resource_type)?;
     if let RuleCheckResult::Blocked(msg) = check_deploy_rules(
         &w_id,
         AuditAuthorable::username(&authed),
@@ -1100,7 +1190,8 @@ async fn create_resource(
             resource.labels.as_deref() as Option<&[String]>
         )
         .execute(&mut *tx)
-        .await?;
+        .await
+        .map_err(sanitize_db_error)?;
     } else {
         // Create-only (the default): DO NOTHING + a row-count guard, so a path that appears between
         // check_path_conflict above and this insert is rejected rather than overwritten. A plain
@@ -1119,7 +1210,8 @@ async fn create_resource(
             resource.labels.as_deref() as Option<&[String]>
         )
         .execute(&mut *tx)
-        .await?;
+        .await
+        .map_err(sanitize_db_error)?;
         if inserted.rows_affected() == 0 {
             return Err(Error::BadRequest(format!(
                 "Resource {} already exists",
@@ -1691,6 +1783,10 @@ async fn update_resource(
     // source path.
     if let Some(npath) = ns.path.as_deref() {
         check_scopes(&authed, || format!("resources:write:{}", npath))?;
+        check_proper_path(npath)?;
+    }
+    if let Some(nrt) = ns.resource_type.as_deref() {
+        check_proper_type_name(nrt)?;
     }
     if let RuleCheckResult::Blocked(msg) = check_deploy_rules(
         &w_id,
@@ -1810,7 +1906,10 @@ async fn update_resource(
     }
 
     let sql = sqlb.sql().map_err(|e| Error::internal_err(e.to_string()))?;
-    let npath_o: Option<String> = sqlx::query_scalar(&sql).fetch_optional(&mut *tx).await?;
+    let npath_o: Option<String> = sqlx::query_scalar(&sql)
+        .fetch_optional(&mut *tx)
+        .await
+        .map_err(sanitize_db_error)?;
 
     let npath = not_found_if_none(npath_o, "Resource", path)?;
 
@@ -1961,44 +2060,79 @@ async fn update_resource_value(
 ) -> Result<String> {
     let path = path.to_path();
     check_scopes(&authed, || format!("resources:write:{}", path))?;
-    if let RuleCheckResult::Blocked(msg) = check_deploy_rules(
+    set_resource_value(
+        &authed,
+        &db,
+        &user_db,
+        &webhook,
         &w_id,
-        AuditAuthorable::username(&authed),
+        path,
+        nv.value,
+        "resources.update",
+    )
+    .await?;
+    Ok(format!("value of resource {} updated", path))
+}
+
+/// Write a resource's value and run everything that has to follow it: a version row, the audit
+/// entry, deployment metadata, the webhook, and dependent CI tests. Shared with version restore
+/// so a restored value is indistinguishable downstream from any other edit.
+async fn set_resource_value(
+    authed: &ApiAuthed,
+    db: &DB,
+    user_db: &UserDB,
+    webhook: &WebhookShared,
+    w_id: &str,
+    path: &str,
+    value: Option<serde_json::Value>,
+    audit_action: &str,
+) -> Result<()> {
+    if let RuleCheckResult::Blocked(msg) = check_deploy_rules(
+        w_id,
+        AuditAuthorable::username(authed),
         &authed.groups,
         authed.is_admin,
-        &db,
+        db,
     )
     .await?
     {
         return Err(Error::PermissionDenied(msg));
     }
-    let mut tx = user_db.begin(&authed).await?;
+    let mut tx = user_db.clone().begin(authed).await?;
 
-    sqlx::query!(
-        "UPDATE resource SET value = $1, edited_at = now() WHERE path = $2 AND workspace_id = $3",
-        nv.value,
+    // `RETURNING resource_type` rather than a second lookup: the advisory below has to know the
+    // type to leave `state` and `cache` alone, and this statement already runs.
+    let updated = sqlx::query_scalar!(
+        "UPDATE resource SET value = $1, edited_at = now() WHERE path = $2 AND workspace_id = $3
+         RETURNING resource_type",
+        value,
         path,
         w_id
     )
-    .execute(&mut *tx)
+    .fetch_optional(&mut *tx)
     .await?;
+    let Some(resource_type) = updated else {
+        return Err(Error::NotFound(format!("Resource {} not found", path)));
+    };
     audit_log(
         &mut *tx,
-        &authed,
-        "resources.update",
+        authed,
+        audit_action,
         ActionKind::Update,
-        &w_id,
+        w_id,
         Some(path),
         None,
     )
     .await?;
     tx.commit().await?;
 
+    note_resource_write(w_id, path, &resource_type);
+
     handle_deployment_metadata(
         &authed.email,
         &authed.username,
-        &db,
-        &w_id,
+        db,
+        w_id,
         DeployedObject::Resource { path: path.to_string(), parent_path: Some(path.to_string()) },
         None,
         true,
@@ -2007,9 +2141,9 @@ async fn update_resource_value(
     .await?;
 
     webhook.send_message(
-        w_id.clone(),
+        w_id.to_string(),
         WebhookMessage::UpdateResource {
-            workspace: w_id.clone(),
+            workspace: w_id.to_string(),
             old_path: path.to_owned(),
             new_path: path.to_owned(),
         },
@@ -2018,12 +2152,13 @@ async fn update_resource_value(
     // Trigger CI tests for items that reference this resource
     {
         let db2 = db.clone();
+        let w_id2 = w_id.to_string();
         let path2 = path.to_string();
         let email2 = authed.email.clone();
         let username2 = authed.username.clone();
         tokio::spawn(async move {
             if let Err(e) = windmill_dep_map::ci_tests::trigger_ci_tests_for_item(
-                &db2, &w_id, &path2, "resource", &email2, &username2,
+                &db2, &w_id2, &path2, "resource", &email2, &username2,
             )
             .await
             {
@@ -2032,7 +2167,299 @@ async fn update_resource_value(
         });
     }
 
-    Ok(format!("value of resource {} updated", path))
+    Ok(())
+}
+
+#[derive(Serialize)]
+struct ResourceVersion {
+    id: i64,
+    created_at: chrono::DateTime<chrono::Utc>,
+    created_by: Option<String>,
+}
+
+#[derive(Serialize)]
+struct ResourceVersionWithValue {
+    id: i64,
+    created_at: chrono::DateTime<chrono::Utc>,
+    created_by: Option<String>,
+    value: Option<serde_json::Value>,
+    /// `$var:`/`$res:` paths in this version that no longer resolve. Restoring is still allowed —
+    /// the reference may be about to be recreated, and refusing would make a version unrestorable
+    /// for a reason outside the resource — but the caller should say so before confirming.
+    missing_references: Vec<String>,
+}
+
+/// Deliberately does not carry the resource's live value. Every write mints a version, so the
+/// newest one already holds it, and `resource_version` rows are immutable — reading the live
+/// value from `resource` instead would mean comparing a mutable row against this list, which at
+/// READ COMMITTED can disagree with it. The drawer reads only versions, and by id, so there is
+/// nothing for a concurrent write to make incoherent.
+#[derive(Serialize)]
+pub struct ResourceHistory {
+    versions: Vec<ResourceVersion>,
+    /// Whether this resource's history can ever fill, so the drawer can say an empty one is
+    /// permanent rather than promising versions from the next edit. Decided here rather than by
+    /// shipping the type out, so INTERNAL_RESOURCE_TYPES is not restated in TypeScript too.
+    /// Compared against nothing, so unlike the value it carries no coherence risk.
+    versioned: bool,
+}
+
+async fn get_resource_history(
+    authed: ApiAuthed,
+    Extension(user_db): Extension<UserDB>,
+    Path((w_id, path)): Path<(String, StripPath)>,
+) -> JsonResult<ResourceHistory> {
+    let path = path.to_path();
+    check_scopes(&authed, || format!("resources:read:{}", path))?;
+    let mut tx = user_db.begin(&authed).await?;
+
+    let versions = sqlx::query_as!(
+        ResourceVersion,
+        "SELECT id, created_at, created_by FROM resource_version
+         WHERE workspace_id = $1 AND path = $2 ORDER BY id DESC LIMIT $3",
+        w_id,
+        path,
+        MAX_RESOURCE_VERSIONS
+    )
+    .fetch_all(&mut *tx)
+    .await?;
+    let resource_type = sqlx::query_scalar!(
+        "SELECT resource_type FROM resource WHERE workspace_id = $1 AND path = $2",
+        w_id,
+        path
+    )
+    .fetch_optional(&mut *tx)
+    .await?;
+    tx.commit().await?;
+
+    Ok(Json(ResourceHistory {
+        versions,
+        versioned: resource_type
+            .map(|t| !INTERNAL_RESOURCE_TYPES.contains(&t.as_str()))
+            .unwrap_or(true),
+    }))
+}
+
+/// Collect the references in `value` that no longer point at anything. Covers the three
+/// path-addressed forms — `$var:` and `$jsonvar:` resolve against `variable`, `$res:` against
+/// `resource`. `$encrypted:` carries its payload inline so there is nothing to look up, and
+/// neither resolution nor this check follows references transitively.
+///
+/// Runs on the caller's RLS-scoped transaction, so a referenced item the caller cannot read is
+/// reported as missing. That errs towards warning rather than staying silent, and the reference
+/// is unusable to them either way.
+async fn missing_references(
+    tx: &mut sqlx::PgConnection,
+    w_id: &str,
+    value: Option<&serde_json::Value>,
+) -> Result<Vec<String>> {
+    const VAR_PREFIXES: [&str; 2] = ["$var:", "$jsonvar:"];
+    const RES_PREFIX: &str = "$res:";
+
+    let mut refs: Vec<String> = vec![];
+    fn collect(v: &serde_json::Value, out: &mut Vec<String>) {
+        match v {
+            // Stated once: adding a form to the consts above must not need a second edit here,
+            // or the new form would be collected but never checked (or the reverse).
+            serde_json::Value::String(s)
+                if VAR_PREFIXES.iter().any(|p| s.starts_with(p)) || s.starts_with(RES_PREFIX) =>
+            {
+                out.push(s.clone())
+            }
+            serde_json::Value::Array(a) => a.iter().for_each(|x| collect(x, out)),
+            serde_json::Value::Object(o) => o.values().for_each(|x| collect(x, out)),
+            _ => {}
+        }
+    }
+    if let Some(v) = value {
+        collect(v, &mut refs);
+    }
+    refs.sort();
+    refs.dedup();
+
+    let mut var_paths: Vec<String> = vec![];
+    let mut res_paths: Vec<String> = vec![];
+    for r in &refs {
+        match VAR_PREFIXES.iter().find_map(|p| r.strip_prefix(p)) {
+            Some(p) => var_paths.push(p.to_string()),
+            None => {
+                if let Some(p) = r.strip_prefix(RES_PREFIX) {
+                    res_paths.push(p.to_string())
+                }
+            }
+        }
+    }
+
+    // Sets, not Vecs: a value carries as many references as its author put in it, and a linear
+    // scan per reference would make the cost of one version fetch quadratic in caller-controlled
+    // input.
+    let existing_vars: std::collections::HashSet<String> = sqlx::query_scalar!(
+        "SELECT path FROM variable WHERE workspace_id = $1 AND path = ANY($2)",
+        w_id,
+        &var_paths[..]
+    )
+    .fetch_all(&mut *tx)
+    .await?
+    .into_iter()
+    .collect();
+    let existing_res: std::collections::HashSet<String> = sqlx::query_scalar!(
+        "SELECT path FROM resource WHERE workspace_id = $1 AND path = ANY($2)",
+        w_id,
+        &res_paths[..]
+    )
+    .fetch_all(&mut *tx)
+    .await?
+    .into_iter()
+    .collect();
+
+    Ok(refs
+        .into_iter()
+        .filter(
+            |r| match VAR_PREFIXES.iter().find_map(|p| r.strip_prefix(p)) {
+                Some(p) => !existing_vars.contains(p),
+                None => match r.strip_prefix(RES_PREFIX) {
+                    Some(p) => !existing_res.contains(p),
+                    None => false,
+                },
+            },
+        )
+        .collect())
+}
+
+async fn get_resource_version(
+    authed: ApiAuthed,
+    Extension(user_db): Extension<UserDB>,
+    Path((w_id, version)): Path<(String, i64)>,
+) -> JsonResult<ResourceVersionWithValue> {
+    let mut tx = user_db.begin(&authed).await?;
+
+    let row = sqlx::query!(
+        "SELECT id, path, created_at, created_by, value FROM resource_version
+         WHERE workspace_id = $1 AND id = $2",
+        w_id,
+        version
+    )
+    .fetch_optional(&mut *tx)
+    .await?;
+    let row = not_found_if_none(row, "ResourceVersion", version.to_string())?;
+    check_scopes(&authed, || format!("resources:read:{}", row.path))?;
+
+    let missing = missing_references(&mut tx, &w_id, row.value.as_ref()).await?;
+    tx.commit().await?;
+
+    Ok(Json(ResourceVersionWithValue {
+        id: row.id,
+        created_at: row.created_at,
+        created_by: row.created_by,
+        value: row.value,
+        missing_references: missing,
+    }))
+}
+
+/// Drop every version of a resource except the one matching its current value.
+///
+/// The remediation for a credential that was stored inline in a resource value (which `wmill`
+/// pushes and `setResource` writes can do, unlike the UI form) and has since been rotated:
+/// without this, rotating leaves the old secret readable in the history by anyone who can read
+/// the resource. All-but-current rather than per-version because such a secret sits in every
+/// version from its introduction to the rotation, so deleting them one at a time would silently
+/// leave copies behind.
+async fn clear_resource_history(
+    authed: ApiAuthed,
+    Extension(db): Extension<DB>,
+    Extension(user_db): Extension<UserDB>,
+    Path((w_id, path)): Path<(String, StripPath)>,
+) -> Result<String> {
+    let path = path.to_path();
+    check_scopes(&authed, || format!("resources:write:{}", path))?;
+    require_owner_of_path(&authed, path)?;
+
+    // Confirm the caller can see the resource under their own RLS before deleting anything with
+    // the unrestricted pool — resource_version grants users SELECT only, so the delete cannot run
+    // through user_db.
+    let mut tx = user_db.begin(&authed).await?;
+    let exists = sqlx::query_scalar!(
+        "SELECT EXISTS(SELECT 1 FROM resource WHERE workspace_id = $1 AND path = $2)",
+        w_id,
+        path
+    )
+    .fetch_one(&mut *tx)
+    .await?;
+    tx.commit().await?;
+    if !exists.unwrap_or(false) {
+        return Err(Error::NotFound(format!("Resource {} not found", path)));
+    }
+
+    let mut tx = db.begin().await?;
+    let deleted = sqlx::query!(
+        "DELETE FROM resource_version rv
+         WHERE rv.workspace_id = $1 AND rv.path = $2
+           AND rv.id != (
+               SELECT max(id) FROM resource_version l
+               WHERE l.workspace_id = rv.workspace_id AND l.path = rv.path
+           )",
+        w_id,
+        path
+    )
+    .execute(&mut *tx)
+    .await?;
+    audit_log(
+        &mut *tx,
+        &authed,
+        "resources.clear_history",
+        ActionKind::Delete,
+        &w_id,
+        Some(path),
+        None,
+    )
+    .await?;
+    tx.commit().await?;
+
+    Ok(format!(
+        "cleared {} past versions of resource {}",
+        deleted.rows_affected(),
+        path
+    ))
+}
+
+async fn restore_resource_version(
+    authed: ApiAuthed,
+    Extension(db): Extension<DB>,
+    Extension(user_db): Extension<UserDB>,
+    Extension(webhook): Extension<WebhookShared>,
+    Path((w_id, version)): Path<(String, i64)>,
+) -> Result<String> {
+    let mut tx = user_db.clone().begin(&authed).await?;
+    let row = sqlx::query!(
+        "SELECT path, value FROM resource_version WHERE workspace_id = $1 AND id = $2",
+        w_id,
+        version
+    )
+    .fetch_optional(&mut *tx)
+    .await?;
+    let row = not_found_if_none(row, "ResourceVersion", version.to_string())?;
+    tx.commit().await?;
+
+    check_scopes(&authed, || format!("resources:write:{}", row.path))?;
+
+    // Writes the old value forward as a new version rather than rewinding, so the history stays
+    // append-only, the restore is itself attributable, and the restore can be undone in turn.
+    set_resource_value(
+        &authed,
+        &db,
+        &user_db,
+        &webhook,
+        &w_id,
+        &row.path,
+        row.value,
+        "resources.restore_version",
+    )
+    .await?;
+
+    Ok(format!(
+        "resource {} restored to version {}",
+        row.path, version
+    ))
 }
 
 #[derive(Serialize)]
@@ -2161,6 +2588,8 @@ async fn create_resource_type(
         return Err(Error::PermissionDenied(msg));
     }
 
+    check_proper_type_name(&resource_type.name)?;
+
     let mut tx = user_db.begin(&authed).await?;
 
     check_rt_path_conflict(&mut tx, &w_id, &resource_type.name).await?;
@@ -2449,7 +2878,10 @@ fn is_private_or_reserved_ip(ip: &IpAddr) -> bool {
             v4.is_loopback()
                 || v4.is_private()
                 || v4.is_link_local()
-                || v4.is_unspecified()
+                // RFC 1122 "this network": the whole /8, not just the
+                // unspecified address `is_unspecified()` matches — stacks that
+                // map 0.x.y.z onto the local host make `0.0.0.1` a bypass.
+                || v4.octets()[0] == 0 // 0.0.0.0/8
                 || v4.is_broadcast()
                 // 100.64.0.0/10 (Carrier-grade NAT / CGNAT)
                 || (v4.octets()[0] == 100 && (v4.octets()[1] & 0xC0) == 64)
@@ -3400,10 +3832,13 @@ mod tests {
         assert!(is_private_or_reserved_ip(
             &"100.64.0.1".parse::<IpAddr>().unwrap()
         ));
-        // Unspecified
+        // "This network" 0.0.0.0/8, not just the unspecified address
         assert!(is_private_or_reserved_ip(
             &"0.0.0.0".parse::<IpAddr>().unwrap()
         ));
+        assert!(is_private_or_reserved_ip(
+            &"0.0.0.1".parse::<IpAddr>().unwrap()
+        ));
         // IPv6 loopback
         assert!(is_private_or_reserved_ip(&"::1".parse::<IpAddr>().unwrap()));
         // IPv6 unique local address (fc00::/7)
diff --git a/backend/windmill-store/src/variables.rs b/backend/windmill-store/src/variables.rs
index 55047ec0c2..8f288dc85e 100644
--- a/backend/windmill-store/src/variables.rs
+++ b/backend/windmill-store/src/variables.rs
@@ -10,14 +10,16 @@ use windmill_api_auth::{
     build_scope_path_predicate, check_scopes, maybe_refresh_folders, require_owner_of_path,
     ApiAuthed,
 };
-use windmill_common::db::DB;
+use windmill_common::db::{Authable, DB};
 use windmill_common::workspaces::{check_deploy_rules, RuleCheckResult};
 
 use crate::secret_backend_ext::{
     delete_secret_from_backend, get_secret_value, is_external_stored_value, is_vault_stored_value,
     rename_vault_secret, store_secret_value,
 };
-use windmill_common::utils::{escape_ilike_pattern, BulkDeleteRequest};
+use windmill_common::utils::{
+    check_proper_path, escape_ilike_pattern, sanitize_db_error, BulkDeleteRequest,
+};
 use windmill_common::webhook::{WebhookMessage, WebhookShared};
 
 use axum::{
@@ -367,10 +369,10 @@ async fn get_variable(
         {
             return Ok(Json(overlay));
         }
-        explain_variable_perm_error(&path, &w_id, &db).await?;
+        explain_variable_perm_error(&path, &w_id, &db, Some(&authed)).await?;
         unreachable!()
     } else {
-        explain_variable_perm_error(&path, &w_id, &db).await?;
+        explain_variable_perm_error(&path, &w_id, &db, Some(&authed)).await?;
         unreachable!()
     };
 
@@ -461,10 +463,27 @@ async fn get_value(
         .map(Json);
 }
 
+/// The grants alone can't explain a denial: a job started on behalf of another
+/// user is authorized as that user, so the error has to name who was actually
+/// asking or it reads as a grant bug.
+fn describe_authed(authed: Option<&(impl Authable + Sync)>) -> String {
+    match authed {
+        Some(authed) => format!(
+            "username: {}, email: {}, groups: {:?}, folders: {:?}",
+            authed.username(),
+            authed.email(),
+            authed.groups(),
+            authed.folders()
+        ),
+        None => "unauthenticated".to_string(),
+    }
+}
+
 async fn explain_variable_perm_error(
     path: &str,
     w_id: &str,
     db: &sqlx::Pool<Postgres>,
+    authed: Option<&(impl Authable + Sync)>,
 ) -> windmill_common::error::Result<()> {
     let extra_perms = sqlx::query_scalar!(
         "SELECT extra_perms from variable WHERE path = $1 AND workspace_id = $2",
@@ -489,13 +508,14 @@ async fn explain_variable_perm_error(
         .fetch_optional(db)
         .await?;
         return Err(Error::NotAuthorized(format!(
-            "Variable exists but you don't have access to it:\nvariable perms: {}\nfolder perms: {}",
-            serde_json::to_string_pretty(&extra_perms).unwrap_or_default(), serde_json::to_string_pretty(&folder_extra_perms).unwrap_or_default()
+            "Variable exists but you don't have access to it:\nvariable perms: {}\nfolder perms: {}\nauthed as: {}",
+            serde_json::to_string_pretty(&extra_perms).unwrap_or_default(), serde_json::to_string_pretty(&folder_extra_perms).unwrap_or_default(), describe_authed(authed)
         )));
     } else {
         return Err(Error::NotAuthorized(format!(
-            "Variable exists but you don't have access to it:\nvariable perms: {}",
-            serde_json::to_string_pretty(&extra_perms).unwrap_or_default()
+            "Variable exists but you don't have access to it:\nvariable perms: {}\nauthed as: {}",
+            serde_json::to_string_pretty(&extra_perms).unwrap_or_default(),
+            describe_authed(authed)
         )));
     }
 }
@@ -575,6 +595,7 @@ async fn create_variable(
     Json(variable): Json<CreateVariable>,
 ) -> Result<(StatusCode, String)> {
     check_scopes(&authed, || format!("variables:write:{}", variable.path))?;
+    check_proper_path(&variable.path)?;
     if let RuleCheckResult::Blocked(msg) = check_deploy_rules(
         &w_id,
         AuditAuthorable::username(&authed),
@@ -641,7 +662,8 @@ async fn create_variable(
         &authed.username
     )
     .execute(&mut *tx)
-    .await?;
+    .await
+    .map_err(sanitize_db_error)?;
 
     if variable.ws_specific.unwrap_or(false) {
         sqlx::query!(
@@ -1077,6 +1099,7 @@ async fn update_variable(
     // source path.
     if let Some(npath) = ns.path.as_deref() {
         check_scopes(&authed, || format!("variables:write:{}", npath))?;
+        check_proper_path(npath)?;
     }
     let authed = maybe_refresh_folders(&path, &w_id, authed, &db).await;
 
@@ -1271,7 +1294,10 @@ async fn update_variable(
         sqlb.set_str("edited_by", &authed.username);
         sqlb.returning("path");
         let sql = sqlb.sql().map_err(|e| Error::internal_err(e.to_string()))?;
-        let npath_o: Option<String> = sqlx::query_scalar(&sql).fetch_optional(&mut *tx).await?;
+        let npath_o: Option<String> = sqlx::query_scalar(&sql)
+            .fetch_optional(&mut *tx)
+            .await
+            .map_err(sanitize_db_error)?;
         not_found_if_none(npath_o, "Variable", path)?
     } else {
         // `has_sql_updates` is guaranteed true whenever `ns.path` is provided
@@ -1498,7 +1524,13 @@ pub async fn get_value_internal<'a>(
     let variable = if let Some(variable) = variable_o {
         variable
     } else {
-        explain_variable_perm_error(path, w_id, &db_with_opt_authed.db()).await?;
+        explain_variable_perm_error(
+            path,
+            w_id,
+            &db_with_opt_authed.db(),
+            db_with_opt_authed.authed(),
+        )
+        .await?;
         unreachable!()
     };
 
diff --git a/backend/windmill-test-utils/src/lib.rs b/backend/windmill-test-utils/src/lib.rs
index c9c019c6e8..060e8af983 100644
--- a/backend/windmill-test-utils/src/lib.rs
+++ b/backend/windmill-test-utils/src/lib.rs
@@ -223,6 +223,7 @@ impl RunJob {
             /* email  */ &email,
             /* permissioned_as */ "u/test-user".to_string(),
             /* token_prefix */ None,
+            /* audit_end_user */ None,
             scheduled_for_o,
             /* schedule_path */ None,
             /* parent_job */ None,
@@ -269,6 +270,7 @@ impl RunJob {
             email,
             format!("u/{}", username),
             /* token_prefix */ None,
+            /* audit_end_user */ None,
             scheduled_for_o,
             /* schedule_path */ None,
             /* parent_job */ None,
diff --git a/backend/windmill-trigger/src/global_handler.rs b/backend/windmill-trigger/src/global_handler.rs
index 00727eac68..6e1c92d588 100644
--- a/backend/windmill-trigger/src/global_handler.rs
+++ b/backend/windmill-trigger/src/global_handler.rs
@@ -37,10 +37,13 @@ async fn get_suspended_trigger(
     path: &str,
 ) -> Result<SuspendedTrigger> {
     // Only trigger kinds backed by a `<kind>_trigger` table support reassignment.
-    // `app` (and webhook/schedule) have no such table, so reject them with a clear
+    // `app`/`ui` (and webhook/schedule) have no such table, so reject them with a clear
     // error instead of failing on a missing-relation database error below.
     match trigger_kind {
-        JobTriggerKind::Webhook | JobTriggerKind::Schedule | JobTriggerKind::App => {
+        JobTriggerKind::Webhook
+        | JobTriggerKind::Schedule
+        | JobTriggerKind::App
+        | JobTriggerKind::Ui => {
             return Err(Error::BadRequest(format!(
                 "{} triggers do not support job reassignment",
                 trigger_kind
diff --git a/backend/windmill-trigger/src/handler.rs b/backend/windmill-trigger/src/handler.rs
index 0c46ff25fd..ad3a6b097a 100644
--- a/backend/windmill-trigger/src/handler.rs
+++ b/backend/windmill-trigger/src/handler.rs
@@ -361,7 +361,17 @@ pub trait TriggerCrud: Send + Sync + 'static {
         .bind(script_path)
         .fetch_one(&mut *tx)
         .await
-        .unwrap_or(0);
+        // Falling back to 0 keeps one unreadable table from failing the whole count
+        // endpoint, but the cause must still reach the logs: a silent 0 is
+        // indistinguishable from "no triggers" in the UI.
+        .unwrap_or_else(|err| {
+            tracing::error!(
+                "failed to count {} triggers of {} {script_path} in {workspace_id}: {err:#}",
+                Self::TABLE_NAME,
+                if is_flow { "flow" } else { "script" }
+            );
+            0
+        });
 
         count
     }
diff --git a/backend/windmill-trigger/src/trigger_helpers.rs b/backend/windmill-trigger/src/trigger_helpers.rs
index e0bfaf3d34..6a37bd0da1 100644
--- a/backend/windmill-trigger/src/trigger_helpers.rs
+++ b/backend/windmill-trigger/src/trigger_helpers.rs
@@ -957,6 +957,7 @@ async fn trigger_script_with_retry_and_error_handler<'c>(
         email,
         permissioned_as,
         authed.token_prefix.as_deref(),
+        authed.username_override.as_deref(),
         None,
         None,
         None,
diff --git a/backend/windmill-types/src/assets.rs b/backend/windmill-types/src/assets.rs
index fb624382c4..463a365b06 100644
--- a/backend/windmill-types/src/assets.rs
+++ b/backend/windmill-types/src/assets.rs
@@ -14,6 +14,18 @@ pub enum AssetKind {
     Ducklake,
     DataTable,
     Volume,
+    /// A warehouse relation a dbt project builds or reads,
+    /// `dbt://<warehouse>/<schema>/<name>`, where `<warehouse>` is the name the
+    /// workspace configures it under.
+    ///
+    /// The SCHEME names the producer — dbt is the only thing that creates one —
+    /// while the PATH stays the physical relation, because that is what two
+    /// projects agree on: a mart one builds is a `source` the next reads, and
+    /// their dbt `unique_id`s differ (`model.a.orders` vs
+    /// `source.b.analytics.orders`) where the relation does not
+    /// (docs/dbt-runtime.md, decision 11). A dbt run does not trigger that
+    /// reader — the shared node is lineage, not a cascade edge.
+    Dbt,
 }
 
 impl AssetKind {
@@ -28,6 +40,7 @@ impl AssetKind {
             AssetKind::Ducklake => Some("ducklake://"),
             AssetKind::DataTable => Some("datatable://"),
             AssetKind::Volume => Some("volume://"),
+            AssetKind::Dbt => Some("dbt://"),
             AssetKind::Variable => None,
         }
     }
diff --git a/backend/windmill-types/src/flows.rs b/backend/windmill-types/src/flows.rs
index 017484caeb..02feeb421a 100644
--- a/backend/windmill-types/src/flows.rs
+++ b/backend/windmill-types/src/flows.rs
@@ -39,9 +39,14 @@ pub struct Flow {
     pub timeout: Option<i32>,
     #[serde(skip_serializing_if = "is_none_or_false")]
     pub visible_to_runner_only: Option<bool>,
+    /// Derived from `on_behalf_of` on the read paths, not selected. Kept in
+    /// the response so clients written against the old shape keep working.
     #[serde(skip_serializing_if = "Option::is_none")]
+    #[sqlx(default)]
     pub on_behalf_of_email: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
+    pub on_behalf_of: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
     pub labels: Option<Vec<String>>,
     /// Labels inherited from the parent folder, computed at read time. Not stored on the flow row.
     #[sqlx(default)]
@@ -127,6 +132,10 @@ pub struct NewFlow {
     pub deployment_message: Option<String>,
     pub visible_to_runner_only: Option<bool>,
     pub on_behalf_of_email: Option<String>,
+    /// Authorization identity to run as, paired with `on_behalf_of_email`. Both move
+    /// together under the same `preserve_on_behalf_of` gate and must name the same user
+    /// or group; `None` has it derived from that email rather than left unset.
+    pub on_behalf_of: Option<String>,
     pub preserve_on_behalf_of: Option<bool>,
     pub ws_error_handler_muted: Option<bool>,
     #[serde(default)]
@@ -164,6 +173,7 @@ pub struct EditFlow {
     pub deployment_message: Option<String>,
     pub visible_to_runner_only: Option<bool>,
     pub on_behalf_of_email: Option<String>,
+    pub on_behalf_of: Option<String>,
     pub preserve_on_behalf_of: Option<bool>,
     pub ws_error_handler_muted: Option<bool>,
     #[serde(default)]
@@ -188,6 +198,7 @@ impl EditFlow {
             deployment_message: self.deployment_message,
             visible_to_runner_only: self.visible_to_runner_only,
             on_behalf_of_email: self.on_behalf_of_email,
+            on_behalf_of: self.on_behalf_of,
             preserve_on_behalf_of: self.preserve_on_behalf_of,
             ws_error_handler_muted: self.ws_error_handler_muted,
             labels: self.labels,
diff --git a/backend/windmill-types/src/jobs.rs b/backend/windmill-types/src/jobs.rs
index 8385e57bd7..42f1285644 100644
--- a/backend/windmill-types/src/jobs.rs
+++ b/backend/windmill-types/src/jobs.rs
@@ -55,11 +55,17 @@ pub enum JobTriggerKind {
     // direct `/jobs/run` cannot set it, so it distinguishes files an app actually
     // produced from files a viewer forged by running a declared runnable directly.
     App,
+    // A run started from the browser (the `/jobs/run*` request carried the session token
+    // minted at login). Nothing writes this yet — it exists so every binary from this release
+    // can decode it, which is what a later release needs before it can start stamping it.
+    // When that happens: attribution, not authority, unlike `App` — a member can have a
+    // session token minted for a script (`/users/refresh_token`), so nothing may gate on it.
+    Ui,
 }
 
-impl std::fmt::Display for JobTriggerKind {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        let kind = match self {
+impl JobTriggerKind {
+    pub const fn as_str(&self) -> &'static str {
+        match self {
             JobTriggerKind::Webhook => "webhook",
             JobTriggerKind::Http => "http",
             JobTriggerKind::Websocket => "websocket",
@@ -80,8 +86,52 @@ impl std::fmt::Display for JobTriggerKind {
             JobTriggerKind::Asset => "asset",
             JobTriggerKind::Freshness => "freshness",
             JobTriggerKind::App => "app",
-        };
-        write!(f, "{}", kind)
+            JobTriggerKind::Ui => "ui",
+        }
+    }
+}
+
+impl std::fmt::Display for JobTriggerKind {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{}", self.as_str())
+    }
+}
+
+/// `v2_job.trigger_kind` as a worker reads it back, kept as the raw label rather than as
+/// [`JobTriggerKind`]. A worker has to keep running jobs stamped with a kind added after it was
+/// built, and decoding into the enum turns an unfamiliar label into a hard error — sqlx on the
+/// pull query, serde on the agent-worker payload — which strands the job instead of running it.
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+#[serde(transparent)]
+pub struct TriggerKindLabel(pub String);
+
+impl TriggerKindLabel {
+    pub fn is(&self, kind: JobTriggerKind) -> bool {
+        self.0 == kind.as_str()
+    }
+
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+impl From<JobTriggerKind> for TriggerKindLabel {
+    fn from(kind: JobTriggerKind) -> Self {
+        Self(kind.as_str().to_string())
+    }
+}
+
+impl sqlx::Type<sqlx::Postgres> for TriggerKindLabel {
+    fn type_info() -> sqlx::postgres::PgTypeInfo {
+        sqlx::postgres::PgTypeInfo::with_name("JOB_TRIGGER_KIND")
+    }
+}
+
+impl<'r> sqlx::Decode<'r, sqlx::Postgres> for TriggerKindLabel {
+    fn decode(value: sqlx::postgres::PgValueRef<'r>) -> Result<Self, sqlx::error::BoxDynError> {
+        Ok(Self(
+            <&str as sqlx::Decode<sqlx::Postgres>>::decode(value)?.to_owned(),
+        ))
     }
 }
 
@@ -252,6 +302,13 @@ pub struct QueuedJob {
     #[serde(default, skip_serializing_if = "Option::is_none")]
     #[sqlx(default)]
     pub is_retry: Option<bool>,
+    // How the run was started. NULL on every job pushed before the API began stamping it, and
+    // on the paths that still don't, so the run page treats it as "unknown" rather than
+    // "manual". `#[sqlx(default)]` lets the queries that don't select it omit the column, and
+    // the label type keeps a kind added after this binary was built readable instead of fatal.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[sqlx(default)]
+    pub trigger_kind: Option<TriggerKindLabel>,
 }
 
 impl QueuedJob {
@@ -328,6 +385,7 @@ impl Default for QueuedJob {
             runnable_settings_handle: None,
             labels: None,
             is_retry: None,
+            trigger_kind: None,
         }
     }
 }
@@ -415,6 +473,13 @@ pub struct CompletedJob {
     #[serde(default, skip_serializing_if = "Option::is_none")]
     #[sqlx(default)]
     pub resolved_automatically: Option<bool>,
+    // How the run was started. NULL on every job pushed before the API began stamping it, and
+    // on the paths that still don't, so the run page treats it as "unknown" rather than
+    // "manual". `#[sqlx(default)]` lets the queries that don't select it omit the column, and
+    // the label type keeps a kind added after this binary was built readable instead of fatal.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[sqlx(default)]
+    pub trigger_kind: Option<TriggerKindLabel>,
 }
 
 impl CompletedJob {
@@ -660,7 +725,7 @@ pub fn generate_dynamic_input_key(workspace_id: &str, path: &str) -> String {
 
 #[cfg(test)]
 mod tests {
-    use super::is_valid_entrypoint_name;
+    use super::{is_valid_entrypoint_name, JobTriggerKind, TriggerKindLabel};
 
     #[test]
     fn valid_entrypoint_names_are_accepted() {
@@ -705,4 +770,22 @@ mod tests {
         // Over-long names are rejected.
         assert!(!is_valid_entrypoint_name(&"a".repeat(256)));
     }
+
+    /// The point of [`TriggerKindLabel`]: a worker built before a trigger kind existed must
+    /// still be able to read — and therefore run — a job stamped with it. Decoding into
+    /// [`JobTriggerKind`] instead makes an unfamiliar label a hard error and strands the job.
+    #[test]
+    fn an_unknown_trigger_kind_label_survives_deserialization() {
+        #[derive(serde::Deserialize)]
+        struct Job {
+            trigger_kind: Option<TriggerKindLabel>,
+        }
+
+        let job: Job = serde_json::from_str(r#"{"trigger_kind":"a_kind_from_the_future"}"#).unwrap();
+        assert_eq!(job.trigger_kind.as_ref().map(|k| k.as_str()), Some("a_kind_from_the_future"));
+        assert!(!job.trigger_kind.unwrap().is(JobTriggerKind::Schedule));
+
+        let job: Job = serde_json::from_str(r#"{"trigger_kind":"schedule"}"#).unwrap();
+        assert!(job.trigger_kind.unwrap().is(JobTriggerKind::Schedule));
+    }
 }
diff --git a/backend/windmill-types/src/scripts.rs b/backend/windmill-types/src/scripts.rs
index 5e5c7f313e..414650e846 100644
--- a/backend/windmill-types/src/scripts.rs
+++ b/backend/windmill-types/src/scripts.rs
@@ -66,6 +66,7 @@ pub enum ScriptLang {
     Java,
     Ruby,
     Rlang,
+    Dbt,
     // for related places search: ADD_NEW_LANG
 }
 
@@ -96,6 +97,7 @@ impl ScriptLang {
             ScriptLang::Java => "java",
             ScriptLang::Ruby => "ruby",
             ScriptLang::Rlang => "rlang",
+            ScriptLang::Dbt => "dbt",
             // for related places search: ADD_NEW_LANG
         }
     }
@@ -134,7 +136,7 @@ impl ScriptLang {
         use ScriptLang::*;
         match self {
             Nativets | Bun | Bunnative | Deno | Go | Php | CSharp | Java => "//",
-            Python3 | Bash | Powershell | Graphql | Ansible | Nu | Ruby | Rlang => "#",
+            Python3 | Bash | Powershell | Graphql | Ansible | Nu | Ruby | Rlang | Dbt => "#",
             Postgresql | Mysql | Bigquery | Snowflake | Mssql | OracleDB | DuckDb => "--",
             Rust => "//!",
             // for related places search: ADD_NEW_LANG
@@ -170,6 +172,7 @@ impl FromStr for ScriptLang {
             "java" => ScriptLang::Java,
             "ruby" => ScriptLang::Ruby,
             "rlang" => ScriptLang::Rlang,
+            "dbt" => ScriptLang::Dbt,
             // for related places search: ADD_NEW_LANG
             language => return Err(anyhow::anyhow!("{} is currently not supported", language)),
         };
@@ -326,7 +329,8 @@ pub const SCRIPT_COLUMNS: &str = concat!(
     "lock, lock_error_logs, language, kind, tag, envs, ",
     "dedicated_worker, ws_error_handler_muted, priority, cache_ttl, cache_ignore_s3_path, ",
     "timeout, delete_after_use, delete_after_secs, restart_unless_cancelled, ",
-    "visible_to_runner_only, auto_kind, codebase, has_preprocessor, on_behalf_of_email, ",
+    "visible_to_runner_only, auto_kind, codebase, has_preprocessor, ",
+    "on_behalf_of, ",
     "assets, modules, labels, concurrency_key, concurrent_limit, ",
     "concurrency_time_window_s, debounce_key, debounce_delay_s, runnable_settings_handle",
 );
@@ -382,9 +386,14 @@ pub struct Script<SR> {
     pub codebase: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub has_preprocessor: Option<bool>,
+    /// Derived from `on_behalf_of` on the read paths, not selected. Kept in the response so
+    /// clients written against the old shape keep working.
     #[serde(skip_serializing_if = "Option::is_none")]
+    #[sqlx(default)]
     pub on_behalf_of_email: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
+    pub on_behalf_of: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
     #[sqlx(json(nullable))]
     pub assets: Option<Vec<AssetWithAltAccessType>>,
     #[serde(skip_serializing_if = "Option::is_none")]
@@ -554,6 +563,10 @@ pub struct NewScript {
     pub codebase: Option<String>,
     pub has_preprocessor: Option<bool>,
     pub on_behalf_of_email: Option<String>,
+    /// Authorization identity to run as, paired with `on_behalf_of_email`. Both move
+    /// together under the same `preserve_on_behalf_of` gate and must name the same user
+    /// or group; `None` has it derived from that email rather than left unset.
+    pub on_behalf_of: Option<String>,
     pub preserve_on_behalf_of: Option<bool>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub assets: Option<Vec<AssetWithAltAccessType>>,
@@ -606,6 +619,7 @@ impl Hash for NewScript {
         self.codebase.hash(state);
         self.has_preprocessor.hash(state);
         self.on_behalf_of_email.hash(state);
+        self.on_behalf_of.hash(state);
         self.preserve_on_behalf_of.hash(state);
         self.assets.hash(state);
         self.labels.hash(state);
diff --git a/backend/windmill-worker/Cargo.toml b/backend/windmill-worker/Cargo.toml
index f4659f7d82..90b15fd1b5 100644
--- a/backend/windmill-worker/Cargo.toml
+++ b/backend/windmill-worker/Cargo.toml
@@ -82,6 +82,7 @@ tokio.workspace = true
 tokio-stream.workspace = true
 serde.workspace = true
 serde_json.workspace = true
+serde_yml.workspace = true
 futures.workspace = true
 async-recursion.workspace = true
 async-trait.workspace = true
diff --git a/backend/windmill-worker/nsjail/run.dbt.config.proto b/backend/windmill-worker/nsjail/run.dbt.config.proto
new file mode 100644
index 0000000000..192a12b3a5
--- /dev/null
+++ b/backend/windmill-worker/nsjail/run.dbt.config.proto
@@ -0,0 +1,138 @@
+name: "dbt run project"
+
+mode: ONCE
+hostname: "dbt"
+log_level: ERROR
+time_limit: {TIMEOUT}
+
+{RLIMIT_AS}
+rlimit_cpu: 1000
+rlimit_fsize: 1000
+rlimit_nofile: 10000
+
+cwd: "{PROJECT_DIR}"
+
+# The warehouse is remote for every adapter but DuckDB, so the network stays.
+clone_newnet: false
+clone_newuser: {CLONE_NEWUSER}
+
+skip_setsid: true
+keep_caps: false
+keep_env: true
+mount_proc: true
+
+mount {
+    src: "/bin"
+    dst: "/bin"
+    is_bind: true
+}
+
+mount {
+    src: "/lib"
+    dst: "/lib"
+    is_bind: true
+}
+
+mount {
+    src: "/lib64"
+    dst: "/lib64"
+    is_bind: true
+    mandatory: false
+}
+
+mount {
+    src: "/usr"
+    dst: "/usr"
+    is_bind: true
+}
+
+mount {
+    src: "/dev/null"
+    dst: "/dev/null"
+    is_bind: true
+    rw: true
+}
+
+mount {
+    src: "/dev/random"
+    dst: "/dev/random"
+    is_bind: true
+}
+
+mount {
+    src: "/dev/urandom"
+    dst: "/dev/urandom"
+    is_bind: true
+}
+
+mount {
+    dst: "/dev/shm"
+    fstype: "tmpfs"
+    rw: true
+    is_bind: false
+}
+
+{TMP_MOUNT_BLOCK}
+
+# The job's own directory: the project, the rendered profile, the artifacts
+# dbt writes and the logs the progress reporter tails all live under it.
+mount {
+    src: "{JOB_DIR}"
+    dst: "{JOB_DIR}"
+    is_bind: true
+    rw: true
+}
+
+# The engine and the interpreter it was built against, read-only: a project
+# must not be able to rewrite the dbt it is run by, or the one the next job
+# on this worker will be.
+mount {
+    src: "{ENGINE_DIR}"
+    dst: "{ENGINE_DIR}"
+    is_bind: true
+}
+
+mount {
+    src: "{PY_INSTALL_DIR}"
+    dst: "{PY_INSTALL_DIR}"
+    is_bind: true
+    mandatory: false
+}
+
+mount {
+    src: "/etc"
+    dst: "/etc"
+    is_bind: true
+}
+
+# Container runtimes bind exactly these 3 files as separate submounts over
+# /etc; nsjail's ro remount of /etc is non-recursive so they stay writable.
+# Load-bearing -- do not remove as redundant with the /etc bind above.
+mount {
+    src: "/etc/resolv.conf"
+    dst: "/etc/resolv.conf"
+    is_bind: true
+    mandatory: false
+}
+
+mount {
+    src: "/etc/hosts"
+    dst: "/etc/hosts"
+    is_bind: true
+    mandatory: false
+}
+
+mount {
+    src: "/etc/ssl/certs"
+    dst: "/etc/ssl/certs"
+    is_bind: true
+    mandatory: false
+}
+
+{SHARED_MOUNT}
+
+# The project's own environment. Set here rather than on the process that
+# execs nsjail: the loader honours `LD_PRELOAD` before the jail exists.
+{ENVARS}
+
+iface_no_lo: true
diff --git a/backend/windmill-worker/nsjail/run.docker.config.proto b/backend/windmill-worker/nsjail/run.docker.config.proto
index 5cc1e4ca03..a8e327927e 100644
--- a/backend/windmill-worker/nsjail/run.docker.config.proto
+++ b/backend/windmill-worker/nsjail/run.docker.config.proto
@@ -46,6 +46,17 @@ gidmap {
 # and avoid it. Generated from the extracted rootfs.
 {ROOTFS_MOUNTS}
 
+# `./result.json` (relative to the image's WorkingDir) bound to a host file outside the
+# image rootfs, so the JSON result the container writes flows back to the job without the
+# worker ever reading a path the image controls.
+#
+# Placed immediately after the rootfs binds and BEFORE every other mount: nsjail resolves
+# a mount destination against its temporary root before pivot_root, so whatever is mounted
+# earlier can steer where this lands. Keeping only the rootfs ahead of it means the image
+# is the single influence on that resolution — and `result_mount_dst` verifies the whole
+# path against the extracted rootfs on the host. Empty when it can't be verified.
+{RESULT_MOUNT}
+
 # Pseudo-filesystems the image expects. /tmp honors the same instance settings as
 # every other nsjail job (nsjail_tmp_backing tmpfs/disk, nsjail_tmpfs_size_mb);
 # /dev gets the standard nodes; /proc comes from mount_proc (the jail's own pid ns).
diff --git a/backend/windmill-worker/src/agent_workers.rs b/backend/windmill-worker/src/agent_workers.rs
index 5320c8ef6c..8dccf691fa 100644
--- a/backend/windmill-worker/src/agent_workers.rs
+++ b/backend/windmill-worker/src/agent_workers.rs
@@ -80,8 +80,6 @@ pub async fn get_datatable_resource_from_agent_http(
 
 /// Record a materialization outcome from an agent worker (no direct DB) via the
 /// API, so `materialized_partition` state lands the same as on a Sql worker.
-// Only called from the duckdb executor, which is itself `#[cfg(feature = "duckdb")]`.
-#[cfg(feature = "duckdb")]
 pub async fn record_materialization_from_agent_http(
     client: &HttpClient,
     w_id: &str,
diff --git a/backend/windmill-worker/src/ai/tools.rs b/backend/windmill-worker/src/ai/tools.rs
index 8adc3bb180..9c15229ba6 100644
--- a/backend/windmill-worker/src/ai/tools.rs
+++ b/backend/windmill-worker/src/ai/tools.rs
@@ -489,6 +489,7 @@ async fn execute_windmill_tool(
         permissioned_as,
         Some(&format!("job-span-{}", ctx.job.id)),
         None,
+        None,
         ctx.job.schedule_path(),
         Some(ctx.job.id),
         ctx.job.root_job.or(Some(ctx.job.id)),
diff --git a/backend/windmill-worker/src/ai_executor.rs b/backend/windmill-worker/src/ai_executor.rs
index ec470fb966..b11ecebc6c 100644
--- a/backend/windmill-worker/src/ai_executor.rs
+++ b/backend/windmill-worker/src/ai_executor.rs
@@ -11,6 +11,7 @@ use crate::worker_flow::{get_previous_job_result, get_transform_context};
 use async_recursion::async_recursion;
 use regex::Regex;
 use serde_json::value::RawValue;
+use sha2::Digest;
 use std::{collections::HashMap, sync::Arc};
 use uuid::Uuid;
 #[cfg(feature = "bedrock")]
@@ -589,6 +590,7 @@ pub async fn handle_ai_agent_job(
                                 Ok(Some(hub_script.schema))
                             } else {
                                 let hash = get_latest_hash_for_path(
+                                    db,
                                     db,
                                     &job.workspace_id,
                                     path.as_str(),
@@ -798,6 +800,24 @@ pub async fn handle_ai_agent_job(
     }
 }
 
+/// OpenAI rejects a `prompt_cache_key` over 64 characters
+/// (`Invalid 'prompt_cache_key': string too long`), and a runnable path alone can pass
+/// that. Fold an over-long key into a digest of itself: same step still yields the same
+/// key across runs, which is the whole property that routes them to one cache.
+fn bounded_prompt_cache_key(raw: &str) -> String {
+    const MAX_LEN: usize = 64;
+    if raw.len() <= MAX_LEN {
+        return raw.to_string();
+    }
+    let suffix = hex::encode(&sha2::Sha256::digest(raw.as_bytes())[..16]);
+    // Keep a readable head so a key stays traceable to its workspace in provider logs.
+    let mut head = MAX_LEN - suffix.len() - 1;
+    while head > 0 && !raw.is_char_boundary(head) {
+        head -= 1;
+    }
+    format!("{}:{}", &raw[..head], suffix)
+}
+
 #[async_recursion]
 pub async fn run_agent(
     // connection
@@ -843,9 +863,10 @@ pub async fn run_agent(
     {
         query_builder = create_chat_completions_query_builder(&credentials);
     }
-    // Both outlive the iteration that discovers them: a request shape or a route the
+    // These outlive the iteration that discovers them: a request shape or a route the
     // endpoint rejected once stays rejected for the whole step.
     let mut include_usage = true;
+    let mut include_prompt_cache_key = true;
 
     // Initialize messages
     let mut messages =
@@ -863,6 +884,17 @@ pub async fn run_agent(
     let effective_flow_step_id: Option<&str> =
         flow_step_id_override.or(job.flow_step_id.as_deref());
 
+    // Keyed on the step, not the run: every run of this step opens with the same system
+    // prompt and tool definitions, and each agent-loop iteration extends the previous
+    // one's prefix. Above ~15 requests/minute one key starts missing again, which is a
+    // reason to split it further, never to make it per-run.
+    let prompt_cache_key = bounded_prompt_cache_key(&format!(
+        "{}:{}:{}",
+        job.workspace_id,
+        job.runnable_path(),
+        effective_flow_step_id.unwrap_or_default()
+    ));
+
     // Fetch flow context for input transforms context, chat and memory
     let mut flow_context = get_flow_context(db, job).await;
 
@@ -1145,7 +1177,7 @@ pub async fn run_agent(
             }
         } else {
             // For all other providers, use the HTTP client approach
-            let build_args = BuildRequestArgs {
+            let mut build_args = BuildRequestArgs {
                 messages: &messages,
                 tools: tool_defs.as_deref(),
                 model: args.provider.get_model(),
@@ -1158,6 +1190,7 @@ pub async fn run_agent(
                 user_message: args.user_message.as_deref().unwrap_or(""),
                 attachments: args.user_attachments.as_deref(),
                 has_websearch,
+                prompt_cache_key: include_prompt_cache_key.then_some(prompt_cache_key.as_str()),
             };
 
             // A worker cannot run the client credentials exchange, so an OAuth resource
@@ -1207,9 +1240,10 @@ pub async fn run_agent(
                 };
 
             // An endpoint can reject the request shape rather than the model:
-            // `stream_options`, which not every OpenAI-compatible provider accepts, and
-            // the route itself, when an Azure resource is outside the Responses API's
-            // model/region matrix. Each is retried once with that part dropped.
+            // `stream_options` and `prompt_cache_key`, which not every OpenAI-compatible
+            // gateway accepts, and the route itself, when an Azure resource is outside
+            // the Responses API's model/region matrix. Each is retried once with that
+            // part dropped.
             // Set where the route is found to be absent, and read once the fallback has
             // answered: a rejection it did not resolve says nothing about the deployment.
             let mut rerouted_by_a_route_rejection = false;
@@ -1257,6 +1291,13 @@ pub async fn run_agent(
                                 || text.contains("include_usage")
                                 || text.contains("Additional properties are not allowed"));
 
+                        // An OpenAI-compatible gateway that validates the body strictly
+                        // names the offending field, whether it calls it an unrecognized
+                        // argument or an unexpected additional property.
+                        let rejects_prompt_cache_key = build_args.prompt_cache_key.is_some()
+                            && status.as_u16() == 400
+                            && text.contains("prompt_cache_key");
+
                         // Only the first call of the step may re-route: an endpoint that
                         // does not serve this API rejects that one already, whereas a
                         // rejection once the conversation is under way is about the
@@ -1271,6 +1312,15 @@ pub async fn run_agent(
                                 "Retrying request without stream_options due to provider incompatibility"
                             );
                             include_usage = false;
+                        } else if rejects_prompt_cache_key {
+                            // Checked before the route fallback: the endpoint serves this
+                            // route, it just refuses one optional field, and re-routing
+                            // the whole step over that would give up far more.
+                            tracing::info!(
+                                "Retrying request without prompt_cache_key due to provider incompatibility"
+                            );
+                            include_prompt_cache_key = false;
+                            build_args.prompt_cache_key = None;
                         } else if route_unserved {
                             tracing::info!(
                                 "Endpoint rejected the request ({}), falling back to chat/completions",
@@ -1663,6 +1713,41 @@ mod tests {
         }
     }
 
+    /// Over 64 characters OpenAI rejects the key outright, which costs a wasted round
+    /// trip per run and silently leaves that step with no prompt caching at all.
+    #[test]
+    fn prompt_cache_key_stays_within_the_provider_bound() {
+        let long = format!("my-workspace:f/{}/agent:step_12", "nested_folder".repeat(8));
+        assert!(long.len() > 64);
+
+        let bounded = bounded_prompt_cache_key(&long);
+
+        assert!(
+            bounded.len() <= 64,
+            "got {} chars: {bounded}",
+            bounded.len()
+        );
+        // Stable for the same step, or every run would land on a different cache.
+        assert_eq!(bounded, bounded_prompt_cache_key(&long));
+        assert_ne!(
+            bounded,
+            bounded_prompt_cache_key(&long.replace("step_12", "step_13"))
+        );
+    }
+
+    #[test]
+    fn prompt_cache_key_passes_short_keys_through_unchanged() {
+        let short = "admins:f/agent/step:a";
+        assert_eq!(bounded_prompt_cache_key(short), short);
+    }
+
+    /// Truncation on a byte index would panic mid-character.
+    #[test]
+    fn prompt_cache_key_truncates_on_a_char_boundary() {
+        let long = format!("workspace:f/{}/agent:step", "é".repeat(80));
+        assert!(bounded_prompt_cache_key(&long).len() <= 64);
+    }
+
     #[test]
     fn overlay_tool_inputs_binds_matching_flowmodule_tool_only() {
         fn js(expr: &str) -> InputTransform {
diff --git a/backend/windmill-worker/src/ansible_executor.rs b/backend/windmill-worker/src/ansible_executor.rs
index d3e71d8fdb..5e151824f0 100644
--- a/backend/windmill-worker/src/ansible_executor.rs
+++ b/backend/windmill-worker/src/ansible_executor.rs
@@ -31,8 +31,9 @@ use crate::{
     bash_executor::BIN_BASH,
     common::{
         build_command_with_isolation, check_executor_binary_exists, get_reserved_variables,
-        read_and_check_result, render_nsjail_rlimit_as, resolve_nsjail_timeout,
-        resolve_nsjail_tmp_mount_block, start_child_process, transform_json, OccupancyMetrics,
+        interpolate_template, read_and_check_result, render_nsjail_rlimit_as,
+        resolve_nsjail_timeout, resolve_nsjail_tmp_mount_block, start_child_process,
+        transform_json, validate_relative_path, OccupancyMetrics,
     },
     handle_child::handle_child,
     is_sandboxing_enabled,
@@ -240,97 +241,6 @@ async fn prepare_socket_root(root: &str, stale_after: std::time::Duration) {
     }
 }
 
-lazy_static::lazy_static! {
-    static ref TEMPLATE_RE: regex::Regex = regex::Regex::new(r"\{\{\s*([A-Za-z_][A-Za-z0-9_]*)\s*\}\}").unwrap();
-}
-
-/// Substitute `{{ arg_name }}` placeholders with values from `args`.
-/// Strings are used raw; numbers/bools are stringified. Other types are rejected.
-fn interpolate_template(
-    template: &str,
-    args: Option<&HashMap<String, Box<RawValue>>>,
-    field_name: &str,
-) -> error::Result<String> {
-    let mut last_err: Option<error::Error> = None;
-    let result = TEMPLATE_RE.replace_all(template, |caps: &regex::Captures| {
-        let name = &caps[1];
-        let raw = args.and_then(|a| a.get(name));
-        let Some(raw) = raw else {
-            last_err = Some(error::Error::BadRequest(format!(
-                "`{}` references `{{{{ {} }}}}` but no such argument was provided",
-                field_name, name
-            )));
-            return String::new();
-        };
-        let json: serde_json::Value = match serde_json::from_str(raw.get()) {
-            Ok(v) => v,
-            Err(e) => {
-                last_err = Some(error::Error::BadRequest(format!(
-                    "`{}` could not parse argument `{}` as JSON: {e}",
-                    field_name, name
-                )));
-                return String::new();
-            }
-        };
-        match json {
-            serde_json::Value::String(s) => s,
-            serde_json::Value::Number(n) => n.to_string(),
-            serde_json::Value::Bool(b) => b.to_string(),
-            serde_json::Value::Null => {
-                last_err = Some(error::Error::BadRequest(format!(
-                    "`{}` references `{{{{ {} }}}}` but the argument is null",
-                    field_name, name
-                )));
-                String::new()
-            }
-            _ => {
-                last_err = Some(error::Error::BadRequest(format!(
-                    "`{}` references `{{{{ {} }}}}` but the argument is not a primitive (string/number/bool)",
-                    field_name, name
-                )));
-                String::new()
-            }
-        }
-    });
-    if let Some(e) = last_err {
-        return Err(e);
-    }
-    Ok(result.into_owned())
-}
-
-/// Reject absolute paths and `..` segments to prevent escaping the cloned repo directory.
-fn validate_relative_path(path: &str, field_name: &str) -> error::Result<()> {
-    let trimmed = path.trim();
-    if trimmed.is_empty() {
-        return Err(error::Error::BadRequest(format!(
-            "`{}` resolved to an empty path",
-            field_name
-        )));
-    }
-    let p = std::path::Path::new(trimmed);
-    for component in p.components() {
-        match component {
-            // RootDir catches leading `/` or `\`; Prefix catches Windows drive
-            // letters and UNC paths. `Path::is_absolute()` alone misses
-            // RootDir-only paths on Windows (e.g. `/etc/passwd`).
-            std::path::Component::RootDir | std::path::Component::Prefix(_) => {
-                return Err(error::Error::BadRequest(format!(
-                    "`{}` must be a relative path inside the cloned repo, got: {}",
-                    field_name, trimmed
-                )));
-            }
-            std::path::Component::ParentDir => {
-                return Err(error::Error::BadRequest(format!(
-                    "`{}` must not contain `..` segments, got: {}",
-                    field_name, trimmed
-                )));
-            }
-            _ => {}
-        }
-    }
-    Ok(())
-}
-
 async fn clone_repo(
     repo: &GitRepo,
     job_dir: &str,
diff --git a/backend/windmill-worker/src/bun_executor.rs b/backend/windmill-worker/src/bun_executor.rs
index 353cc59836..d64499878b 100644
--- a/backend/windmill-worker/src/bun_executor.rs
+++ b/backend/windmill-worker/src/bun_executor.rs
@@ -571,12 +571,8 @@ async fn gen_bunfig(
         NPMRC.read().await.clone()
     };
 
-    if let Some(ref npmrc_content) = npmrc {
-        if !npmrc_content.trim().is_empty() {
-            tracing::debug!("Writing .npmrc for bun from npmrc setting");
-            write_file(job_dir, ".npmrc", npmrc_content)?;
-            return Ok(());
-        }
+    if npmrc.as_ref().is_some_and(|c| !c.trim().is_empty()) {
+        return write_bun_registry_config(job_dir, npmrc, None, None);
     }
 
     let (registry, bunfig_install_scopes) = if let Some(conn) = db {
@@ -606,6 +602,35 @@ async fn gen_bunfig(
             BUNFIG_INSTALL_SCOPES.read().await.clone(),
         )
     };
+    write_bun_registry_config(job_dir, None, registry, bunfig_install_scopes)
+}
+
+/// The files [`write_bun_registry_config`] may create in the directory bun installs from.
+/// Both can hold a registry auth token, so `prepare-deps` deletes them by these names once
+/// the install is over.
+pub(crate) const BUN_NPMRC_FILE: &str = ".npmrc";
+pub(crate) const BUN_CONFIG_FILE: &str = "bunfig.toml";
+
+/// Write the registry configuration `bun install` picks up from its working directory: the
+/// `npmrc` setting verbatim as `.npmrc` when set, otherwise a `bunfig.toml` holding the
+/// registry URL, its auth token and the install scopes.
+///
+/// Shared with the debugger's `prepare-deps`, which resolves the same settings without a
+/// database (see `prepare_deps.rs`), so the two install paths configure bun identically.
+pub(crate) fn write_bun_registry_config(
+    job_dir: &str,
+    npmrc: Option<String>,
+    registry: Option<String>,
+    bunfig_install_scopes: Option<String>,
+) -> Result<()> {
+    if let Some(ref npmrc_content) = npmrc {
+        if !npmrc_content.trim().is_empty() {
+            tracing::debug!("Writing .npmrc for bun from npmrc setting");
+            write_file(job_dir, BUN_NPMRC_FILE, npmrc_content)?;
+            return Ok(());
+        }
+    }
+
     if registry.is_some() || bunfig_install_scopes.is_some() {
         let (url, token_opt) = if let Some(ref s) = registry {
             let url = s.trim();
@@ -635,7 +660,7 @@ registry = {}
                 .unwrap_or("".to_string())
         );
         tracing::debug!("Writing following bunfig.toml: {bunfig_toml}");
-        let _ = write_file(&job_dir, "bunfig.toml", &bunfig_toml)?;
+        let _ = write_file(&job_dir, BUN_CONFIG_FILE, &bunfig_toml)?;
     }
     Ok(())
 }
@@ -2803,86 +2828,97 @@ pub async fn handle_wac_v2_output(
             let push_result: error::Result<()> = async {
                 for (step, (_, child_uuid)) in steps.iter().zip(job_ids.iter()) {
                     // Resolve job payload based on dispatch_type
-                    let (job_payload, child_args, is_external) = match step.dispatch_type.as_str() {
-                        "script" if step.script.starts_with("./") => {
-                            // Module-relative path: resolve from parent script's modules
-                            let module_key = step.script.strip_prefix("./").unwrap();
-                            let module = resolve_parent_module(modules, module_key)?;
-                            let payload = JobPayload::Code(RawCode {
-                                content: module.content,
-                                path: job.runnable_path.clone(),
-                                hash: None,
-                                language: module.language,
-                                lock: module.lock,
-                                cache_ttl: job.cache_ttl,
-                                cache_ignore_s3_path: job.cache_ignore_s3_path,
-                                dedicated_worker: None,
-                                concurrency_settings: ConcurrencySettingsWithCustom::default(),
-                                debouncing_settings: DebouncingSettings::default(),
-                                modules: None,
-                                tag: None,
-                            });
-                            let step_args: HashMap<String, Box<RawValue>> = step
-                                .args
-                                .iter()
-                                .map(|(k, v)| {
-                                    let raw = serde_json::value::to_raw_value(v).unwrap();
-                                    (k.clone(), raw)
-                                })
-                                .collect();
-                            (payload, step_args, true)
-                        }
-                        "script" => {
-                            // Resolve script path to job payload (handles hash, lang, etc.)
-                            let (payload, _, _, _, _, _) = script_path_to_payload(
-                                &step.script,
-                                None, // no authed db for background workers
-                                db.clone(),
-                                &job.workspace_id,
-                                Some(true), // skip preprocessor
-                            )
-                            .await?;
-                            let step_args: HashMap<String, Box<RawValue>> = step
-                                .args
-                                .iter()
-                                .map(|(k, v)| {
-                                    let raw = serde_json::value::to_raw_value(v).unwrap();
-                                    (k.clone(), raw)
-                                })
-                                .collect();
-                            (payload, step_args, true)
-                        }
-                        "flow" => {
-                            let flow_info = get_latest_flow_version_info_for_path(
-                                None,
-                                db,
-                                &job.workspace_id,
-                                &step.script,
-                                true,
-                            )
-                            .await?;
-                            let payload = JobPayload::Flow {
-                                path: step.script.clone(),
-                                dedicated_worker: flow_info.dedicated_worker,
-                                apply_preprocessor: false,
-                                version: flow_info.version,
-                                labels: flow_info.labels.clone(),
-                            };
-                            let step_args: HashMap<String, Box<RawValue>> = step
-                                .args
-                                .iter()
-                                .map(|(k, v)| {
-                                    let raw = serde_json::value::to_raw_value(v).unwrap();
-                                    (k.clone(), raw)
-                                })
-                                .collect();
-                            (payload, step_args, true)
-                        }
-                        _ => {
-                            // "inline" — re-run parent with _executing_key
-                            (job_payload_template.clone(), parent_args.clone(), false)
-                        }
-                    };
+                    let (job_payload, child_args, is_external, on_behalf_of) =
+                        match step.dispatch_type.as_str() {
+                            "script" if step.script.starts_with("./") => {
+                                // Module-relative path: resolve from parent script's modules
+                                let module_key = step.script.strip_prefix("./").unwrap();
+                                let module = resolve_parent_module(modules, module_key)?;
+                                let payload = JobPayload::Code(RawCode {
+                                    content: module.content,
+                                    path: job.runnable_path.clone(),
+                                    hash: None,
+                                    language: module.language,
+                                    lock: module.lock,
+                                    cache_ttl: job.cache_ttl,
+                                    cache_ignore_s3_path: job.cache_ignore_s3_path,
+                                    dedicated_worker: None,
+                                    concurrency_settings: ConcurrencySettingsWithCustom::default(),
+                                    debouncing_settings: DebouncingSettings::default(),
+                                    modules: None,
+                                    tag: None,
+                                });
+                                let step_args: HashMap<String, Box<RawValue>> = step
+                                    .args
+                                    .iter()
+                                    .map(|(k, v)| {
+                                        let raw = serde_json::value::to_raw_value(v).unwrap();
+                                        (k.clone(), raw)
+                                    })
+                                    .collect();
+                                // Inline module code, not a separate runnable: it has no
+                                // identity of its own and runs as the parent.
+                                (payload, step_args, true, None)
+                            }
+                            "script" => {
+                                // Resolve script path to job payload (handles hash, lang, etc.)
+                                let (payload, _, _, _, _, on_behalf_of) = script_path_to_payload(
+                                    &step.script,
+                                    None, // no authed db for background workers
+                                    db.clone(),
+                                    &job.workspace_id,
+                                    Some(true), // skip preprocessor
+                                )
+                                .await?;
+                                let step_args: HashMap<String, Box<RawValue>> = step
+                                    .args
+                                    .iter()
+                                    .map(|(k, v)| {
+                                        let raw = serde_json::value::to_raw_value(v).unwrap();
+                                        (k.clone(), raw)
+                                    })
+                                    .collect();
+                                (payload, step_args, true, on_behalf_of)
+                            }
+                            "flow" => {
+                                let flow_info = get_latest_flow_version_info_for_path(
+                                    None,
+                                    db,
+                                    &job.workspace_id,
+                                    &step.script,
+                                    true,
+                                )
+                                .await?;
+                                let payload = JobPayload::Flow {
+                                    path: step.script.clone(),
+                                    dedicated_worker: flow_info.dedicated_worker,
+                                    apply_preprocessor: false,
+                                    version: flow_info.version,
+                                    labels: flow_info.labels.clone(),
+                                };
+                                let on_behalf_of = flow_info
+                                    .on_behalf_of(&job.workspace_id, db)
+                                    .await?;
+                                let step_args: HashMap<String, Box<RawValue>> = step
+                                    .args
+                                    .iter()
+                                    .map(|(k, v)| {
+                                        let raw = serde_json::value::to_raw_value(v).unwrap();
+                                        (k.clone(), raw)
+                                    })
+                                    .collect();
+                                (payload, step_args, true, on_behalf_of)
+                            }
+                            _ => {
+                                // "inline" — re-run parent with _executing_key
+                                (
+                                    job_payload_template.clone(),
+                                    parent_args.clone(),
+                                    false,
+                                    None,
+                                )
+                            }
+                        };
 
                     let push_args = PushArgs { args: &child_args, extra: None };
 
@@ -2930,6 +2966,21 @@ pub async fn handle_wac_v2_output(
                         }
                     }
 
+                    // A target runnable that opts into on-behalf-of runs under its own
+                    // identity, never the caller's, so a step that reaches it through a
+                    // workflow cannot widen or narrow its permissions. `created_by` still
+                    // credits the caller, matching how the run API pushes these jobs.
+                    let (child_email, child_permissioned_as) = match on_behalf_of.as_ref() {
+                        Some(on_behalf_of) => (
+                            on_behalf_of.email.as_str(),
+                            on_behalf_of.permissioned_as.clone(),
+                        ),
+                        None => (
+                            job.permissioned_as_email.as_str(),
+                            job.permissioned_as.clone(),
+                        ),
+                    };
+
                     let (_, mut tx) = push(
                         db,
                         PushIsolationLevel::IsolatedRoot(db.clone()),
@@ -2937,8 +2988,9 @@ pub async fn handle_wac_v2_output(
                         job_payload,
                         push_args,
                         &job.created_by,
-                        &job.permissioned_as_email,
-                        job.permissioned_as.clone(),
+                        child_email,
+                        child_permissioned_as,
+                        None,
                         None,
                         None,
                         None,
diff --git a/backend/windmill-worker/src/common.rs b/backend/windmill-worker/src/common.rs
index a406f3610c..cd493d969e 100644
--- a/backend/windmill-worker/src/common.rs
+++ b/backend/windmill-worker/src/common.rs
@@ -528,7 +528,7 @@ pub async fn get_reserved_variables(
     };
 
     let tested_runnable = match (&job.trigger_kind, &job.trigger) {
-        (Some(windmill_common::jobs::JobTriggerKind::CiTest), Some(t)) => Some(t.clone()),
+        (Some(k), Some(t)) if k.is(windmill_common::jobs::JobTriggerKind::CiTest) => Some(t.clone()),
         _ => None,
     };
 
@@ -2339,3 +2339,95 @@ mod tests {
         assert!(result.is_err());
     }
 }
+
+lazy_static::lazy_static! {
+    static ref TEMPLATE_RE: regex::Regex =
+        regex::Regex::new(r"\{\{\s*([A-Za-z_][A-Za-z0-9_]*)\s*\}\}").unwrap();
+}
+
+/// Substitute `{{ arg_name }}` placeholders with values from `args`.
+/// Strings are used raw; numbers/bools are stringified. Other types are rejected.
+pub(crate) fn interpolate_template(
+    template: &str,
+    args: Option<&HashMap<String, Box<RawValue>>>,
+    field_name: &str,
+) -> error::Result<String> {
+    let mut last_err: Option<error::Error> = None;
+    let result = TEMPLATE_RE.replace_all(template, |caps: &regex::Captures| {
+        let name = &caps[1];
+        let raw = args.and_then(|a| a.get(name));
+        let Some(raw) = raw else {
+            last_err = Some(error::Error::BadRequest(format!(
+                "`{}` references `{{{{ {} }}}}` but no such argument was provided",
+                field_name, name
+            )));
+            return String::new();
+        };
+        let json: serde_json::Value = match serde_json::from_str(raw.get()) {
+            Ok(v) => v,
+            Err(e) => {
+                last_err = Some(error::Error::BadRequest(format!(
+                    "`{}` could not parse argument `{}` as JSON: {e}",
+                    field_name, name
+                )));
+                return String::new();
+            }
+        };
+        match json {
+            serde_json::Value::String(s) => s,
+            serde_json::Value::Number(n) => n.to_string(),
+            serde_json::Value::Bool(b) => b.to_string(),
+            serde_json::Value::Null => {
+                last_err = Some(error::Error::BadRequest(format!(
+                    "`{}` references `{{{{ {} }}}}` but the argument is null",
+                    field_name, name
+                )));
+                String::new()
+            }
+            _ => {
+                last_err = Some(error::Error::BadRequest(format!(
+                    "`{}` references `{{{{ {} }}}}` but the argument is not a primitive (string/number/bool)",
+                    field_name, name
+                )));
+                String::new()
+            }
+        }
+    });
+    if let Some(e) = last_err {
+        return Err(e);
+    }
+    Ok(result.into_owned())
+}
+
+/// Reject absolute paths and `..` segments to prevent escaping the cloned repo directory.
+pub(crate) fn validate_relative_path(path: &str, field_name: &str) -> error::Result<()> {
+    let trimmed = path.trim();
+    if trimmed.is_empty() {
+        return Err(error::Error::BadRequest(format!(
+            "`{}` resolved to an empty path",
+            field_name
+        )));
+    }
+    let p = std::path::Path::new(trimmed);
+    for component in p.components() {
+        match component {
+            // RootDir catches leading `/` or `\`; Prefix catches Windows drive
+            // letters and UNC paths. `Path::is_absolute()` alone misses
+            // RootDir-only paths on Windows (e.g. `/etc/passwd`).
+            std::path::Component::RootDir | std::path::Component::Prefix(_) => {
+                return Err(error::Error::BadRequest(format!(
+                    "`{}` must be a relative path inside the cloned repo, got: {}",
+                    field_name, trimmed
+                )));
+            }
+            std::path::Component::ParentDir => {
+                return Err(error::Error::BadRequest(format!(
+                    "`{}` must not contain `..` segments, got: {}",
+                    field_name, trimmed
+                )));
+            }
+            _ => {}
+        }
+    }
+    Ok(())
+}
diff --git a/backend/windmill-worker/src/csharp_executor.rs b/backend/windmill-worker/src/csharp_executor.rs
index 944236cf2b..132936a807 100644
--- a/backend/windmill-worker/src/csharp_executor.rs
+++ b/backend/windmill-worker/src/csharp_executor.rs
@@ -27,8 +27,8 @@ use windmill_queue::CanceledBy;
 use crate::{
     common::{
         build_command_with_isolation, check_executor_binary_exists, create_args_and_out_file,
-        get_reserved_variables, read_result, resolve_nsjail_timeout, resolve_nsjail_tmp_mount_block,
-        start_child_process, DEV_CONF_NSJAIL,
+        get_reserved_variables, read_result, resolve_nsjail_timeout,
+        resolve_nsjail_tmp_mount_block, start_child_process, DEV_CONF_NSJAIL,
     },
     get_proxy_envs_for_lang,
     handle_child::handle_child,
diff --git a/backend/windmill-worker/src/dbt_engine.rs b/backend/windmill-worker/src/dbt_engine.rs
new file mode 100644
index 0000000000..2da3481b12
--- /dev/null
+++ b/backend/windmill-worker/src/dbt_engine.rs
@@ -0,0 +1,824 @@
+//! Provisioning the three dbt engines on a worker.
+//!
+//! No engine ships in a Windmill image. `dbt-core-1x` and `dbt-core-2x` are
+//! Apache 2.0 and an operator may pre-stage either (`DBT_BUNDLED_DIR`); the
+//! Fusion engine is **never bundled**. Its license grants only a
+//! non-transferable, non-sublicensable redistribution right and forbids
+//! interposing on Provider-to-End-User communication, which is exactly what
+//! shipping it inside a job runner would do. The mitigation is that the user's
+//! own instance fetches it from dbt Labs on first use, so Windmill never
+//! redistributes it (docs/dbt-runtime.md, decision 1).
+//!
+//! Everything lands in a worker-global cache keyed by engine and version, so
+//! the fetch happens once per worker rather than once per job.
+
+use std::path::{Path, PathBuf};
+use std::process::Stdio;
+
+use tokio::process::Command;
+use uuid::Uuid;
+use windmill_common::error::{self, Error};
+use windmill_common::worker::{write_file, Connection, ROOT_CACHE_NOMOUNT_DIR};
+use windmill_parser_yaml::DbtEngine;
+use windmill_queue::append_logs;
+
+use crate::dbt_executor::digest;
+use crate::dbt_profiles::DbtAdapter;
+use crate::handle_child::{get_mem_peak, run_future_with_polling_update_job_poller, JobCtx};
+
+lazy_static::lazy_static! {
+    pub static ref DBT_CACHE_DIR: String = format!("{}dbt", *ROOT_CACHE_NOMOUNT_DIR);
+    /// Adapters an operator vouches for beyond `PUBLISHED_ADAPTERS`, comma-separated — so a
+    /// brand-new adapter needs an admin's decision, not a Windmill release.
+    static ref DBT_EXTRA_ADAPTERS: Vec<String> = std::env::var("DBT_EXTRA_ADAPTERS")
+        .unwrap_or_default()
+        .split(',')
+        .map(|a| a.trim().to_ascii_lowercase())
+        .filter(|a| !a.is_empty())
+        .collect();
+    /// Where an operator may pre-stage an Apache-2.0 engine in a derived image.
+    /// A persistent image path, unlike the runtime caches, which are a fresh
+    /// volume at start — which is the whole reason it is a separate directory.
+    static ref DBT_BUNDLED_DIR: String =
+        std::env::var("DBT_BUNDLED_DIR").unwrap_or_else(|_| "/usr/local/dbt".to_string());
+    static ref UV_PATH: String =
+        std::env::var("UV_PATH").unwrap_or_else(|_| "/usr/local/bin/uv".to_string());
+    /// Bounds on the dbt-core the 1.x engine resolves. A RANGE, not a pin: the
+    /// adapter decides which core it can take, and several cap below the newest
+    /// (dbt-oracle and dbt-databricks below 1.12), so pinning core independently
+    /// makes those projects unprovisionable. The floor is the CLI this runtime
+    /// invokes -- 1.7 rejects `--target` on `parse`, so resolving down to it
+    /// produces a working venv that then fails on flags, which is worse than
+    /// not resolving at all.
+    ///
+    /// Every static in this group is env-overridable per instance, so an
+    /// operator can move an engine without waiting on a release.
+    static ref DBT_CORE_1X_FLOOR: String =
+        std::env::var("DBT_CORE_1X_FLOOR").unwrap_or_else(|_| "1.8".to_string());
+    static ref DBT_CORE_1X_CEILING: String =
+        std::env::var("DBT_CORE_1X_CEILING").unwrap_or_else(|_| "2.0.0".to_string());
+    /// Reported as the engine version only when the installed `dist-info` cannot
+    /// be read. It pins no install and is not in the cache key -- the resolved
+    /// range is -- so it must not be mistaken for the version that gets used.
+    static ref DBT_CORE_1X_VERSION: String =
+        std::env::var("DBT_CORE_1X_VERSION").unwrap_or_else(|_| "1.12.0".to_string());
+    /// Pinned, not ranged: the Rust engine ships its adapters in the binary, so
+    /// there is no adapter resolution to accommodate.
+    static ref DBT_CORE_2X_VERSION: String =
+        std::env::var("DBT_CORE_2X_VERSION").unwrap_or_else(|_| "2.0.0-alpha.5".to_string());
+    static ref DBT_PYTHON_VERSION: String =
+        std::env::var("DBT_PYTHON_VERSION").unwrap_or_else(|_| "3.12".to_string());
+    /// Where the Fusion engine is fetched from. Never a Windmill-hosted mirror:
+    /// the point of runtime fetch is that the binary comes from dbt Labs.
+    static ref DBT_FUSION_INSTALL_URL: String = std::env::var("DBT_FUSION_INSTALL_URL")
+        .unwrap_or_else(|_| "https://public.cdn.getdbt.com/fs/install/install.sh".to_string());
+}
+
+pub struct ProvisionedEngine {
+    /// Absolute path of the dbt binary to invoke.
+    pub bin: PathBuf,
+    /// The engine's own directory — the ONLY part of the cache a sandboxed job
+    /// may see. Its siblings hold other workspaces' package trees, which are
+    /// scoped by cache key, not by permissions.
+    pub root: PathBuf,
+    pub version: String,
+    pub engine: DbtEngine,
+    /// The adapter version this venv resolved, for dbt-core 1.x where the
+    /// adapter is a separate package that versions independently of core.
+    /// `None` for the Rust engines, which ship their adapters in the binary.
+    pub adapter_version: Option<String>,
+}
+
+/// Ensure the engine is present on this worker and return how to invoke it.
+pub async fn provision_engine(
+    engine: DbtEngine,
+    adapter: DbtAdapter,
+    // What makes the lockfile a lockfile: without it a script silently changes dbt
+    // version when the instance upgrades or lands on a different worker. `None` for
+    // a deploy, which is what writes the pin.
+    pinned_version: Option<&str>,
+    pinned_adapter_version: Option<&str>,
+    job_id: &Uuid,
+    w_id: &str,
+    conn: &Connection,
+    ctx: &mut JobCtx<'_>,
+) -> error::Result<ProvisionedEngine> {
+    let pinned_version = checked_version(pinned_version, "engine_version")?;
+    let pinned_adapter_version = checked_version(pinned_adapter_version, "adapter_version")?;
+    tokio::fs::create_dir_all(&*DBT_CACHE_DIR).await.ok();
+    match engine {
+        DbtEngine::DbtCore1x => {
+            provision_core_1x(
+                adapter,
+                pinned_version,
+                pinned_adapter_version,
+                job_id,
+                w_id,
+                conn,
+                ctx,
+            )
+            .await
+        }
+        DbtEngine::DbtCore2x => provision_core_2x(pinned_version, job_id, w_id, conn, ctx).await,
+        DbtEngine::Fusion => provision_fusion(pinned_version, job_id, w_id, conn, ctx).await,
+    }
+}
+
+/// A version out of the lockfile, which is CALLER DATA: a preview run submits
+/// its own `lock` alongside its content, so nothing about this string has been
+/// through a deploy.
+///
+/// It is interpolated into the engine cache path and into a pip requirement,
+/// and provisioning runs on the host rather than inside the dbt jail — a
+/// `../..` in it would download an archive and extract it anywhere the worker
+/// can write. Accepted only as a plain version token, which every version any
+/// of the three engines publishes already is.
+fn checked_version<'a>(v: Option<&'a str>, field: &str) -> error::Result<Option<&'a str>> {
+    if let Some(v) = v {
+        let plain = v.len() <= 64
+            && v.starts_with(|c: char| c.is_ascii_alphanumeric())
+            && v.chars()
+                .all(|c| c.is_ascii_alphanumeric() || matches!(c, '.' | '-' | '_' | '+'));
+        if !plain {
+            return Err(Error::BadRequest(format!(
+                "the lockfile's `{field}` is not a version: expected a token of letters, digits, \
+                 `.`, `-`, `_` or `+` starting with a letter or digit, got `{v}`"
+            )));
+        }
+    }
+    Ok(v)
+}
+
+/// dbt adapters whose package this worker installs unasked. A PUBLISHED-PACKAGE list, not a
+/// capability one: an adapter absent from it still renders a profile and still runs under an
+/// engine that already carries it. See `ensure_adapter_installable`.
+const PUBLISHED_ADAPTERS: &[&str] = &[
+    "athena", "clickhouse", "databricks", "decodable", "doris", "dremio", "duckdb", "exasol",
+    "extrica", "fabric", "fabricspark", "firebolt", "glue", "greenplum", "hive", "ibmdb2",
+    "impala", "materialize", "mysql", "oracle", "postgres", "redshift", "risingwave", "rockset",
+    "singlestore", "snowflake", "spark", "sqlite", "sqlserver", "starrocks", "synapse", "teradata",
+    "tidb", "trino", "vertica", "yellowbrick",
+];
+
+/// Refuse to install a package nobody vouched for. `dbt-<name>` comes from an adapter name a
+/// SCRIPT AUTHOR chooses, `dbt-` is not a reserved PyPI prefix, and this install runs outside
+/// the nsjail ordinary dependency installation uses — so an unbounded name would run a PEP
+/// 517 backend as the worker. The admin decides what is trusted, via `DBT_EXTRA_ADAPTERS`.
+fn ensure_adapter_installable(adapter: &DbtAdapter) -> error::Result<()> {
+    let name = adapter.name();
+    if adapter.known().is_some()
+        || PUBLISHED_ADAPTERS.contains(&name)
+        || DBT_EXTRA_ADAPTERS.iter().any(|a| a == name)
+    {
+        return Ok(());
+    }
+    Err(Error::BadRequest(format!(
+        "`{name}` is not an adapter this instance installs: the dbt-core 1.x engine would have \
+         to fetch `dbt-{name}` from PyPI, and `dbt-` is not a reserved name there. An admin adds \
+         it to DBT_EXTRA_ADAPTERS, or use an engine that ships its adapters (`engine: fusion`)"
+    )))
+}
+
+/// A uv venv per (dbt version, adapter): the adapter is a separate pip package
+/// and installing every adapter into one venv would make their transitive
+/// dependency sets fight.
+async fn provision_core_1x(
+    adapter: DbtAdapter,
+    pinned_version: Option<&str>,
+    pinned_adapter_version: Option<&str>,
+    job_id: &Uuid,
+    w_id: &str,
+    conn: &Connection,
+    ctx: &mut JobCtx<'_>,
+) -> error::Result<ProvisionedEngine> {
+    ensure_adapter_installable(&adapter)?;
+    if adapter.pip_package().is_empty() {
+        return Err(Error::BadRequest(format!(
+            "the {} adapter has no dbt-core 1.x package: it exists only inside the Fusion \
+             engine. Set `engine: fusion` to use it",
+            adapter.name()
+        )));
+    }
+    // A RANGE, not an `==`. A locked version still pins exactly, because that
+    // one was resolved for this adapter in the first place.
+    let version_spec = match pinned_version {
+        Some(v) => format!("dbt-core=={v}"),
+        None => format!(
+            "dbt-core>={},<{}",
+            DBT_CORE_1X_FLOOR.as_str(),
+            DBT_CORE_1X_CEILING.as_str()
+        ),
+    };
+    let version = pinned_version
+        .map(str::to_string)
+        .unwrap_or_else(|| DBT_CORE_1X_VERSION.clone());
+    // The adapter is in the cache key: pinning core alone would let a rebuilt
+    // cache resolve a newer adapter than the deploy did, which changes runtime
+    // behavior under a lockfile that claims to prevent exactly that.
+    let adapter_spec = match pinned_adapter_version {
+        Some(v) => format!("{}=={v}", adapter.pip_package()),
+        None => adapter.pip_package().to_string(),
+    };
+    let dir = PathBuf::from(&*DBT_CACHE_DIR).join(format!(
+        "core1x-{}-{}",
+        digest(&version_spec),
+        digest(&adapter_spec)
+    ));
+    let bin = dir.join("bin").join("dbt");
+    if bin.exists() {
+        let adapter_version = installed_adapter_version(&dir, adapter).await;
+        return Ok(ProvisionedEngine {
+            root: dir.clone(),
+            bin,
+            // What the resolver actually chose, so the lock pins the version
+            // this adapter can take rather than the one we asked for.
+            version: installed_package_version(&dir, "dbt_core")
+                .await
+                .unwrap_or(version),
+            engine: DbtEngine::DbtCore1x,
+            adapter_version,
+        });
+    }
+
+    append_logs(
+        job_id,
+        w_id,
+        format!(
+            "\nProvisioning {version_spec} with {}...\n",
+            adapter.pip_package()
+        ),
+        conn,
+    )
+    .await;
+    // Build beside the target and rename, so two jobs racing on one worker cannot
+    // observe a half-installed venv through `bin.exists()`. `--relocatable` makes
+    // the rename safe: without it uv bakes the staging path into every shebang and
+    // the moved venv's `dbt` fails with ENOENT.
+    let staging_guard = Scratch::new(staging_path(&dir, job_id));
+    let staging = staging_guard.path().to_path_buf();
+    tokio::fs::remove_dir_all(&staging).await.ok();
+    run_tool(
+        Command::new(UV_PATH.as_str())
+            // The interpreter goes in Windmill's own cache rather than the
+            // worker user's home: a sandboxed job can only see the paths that
+            // are mounted into it, and this is one of them.
+            .env("UV_PYTHON_INSTALL_DIR", crate::PY_INSTALL_DIR.as_str())
+            .args([
+                "venv",
+                "--relocatable",
+                "--python",
+                DBT_PYTHON_VERSION.as_str(),
+            ])
+            .arg(&staging),
+        "uv venv",
+        job_id,
+        w_id,
+        conn,
+        ctx,
+    )
+    .await?;
+    run_tool(
+        Command::new(UV_PATH.as_str())
+            .env("UV_PYTHON_INSTALL_DIR", crate::PY_INSTALL_DIR.as_str())
+            .env("VIRTUAL_ENV", &staging)
+            .args(["pip", "install", &version_spec, &adapter_spec]),
+        "uv pip install",
+        job_id,
+        w_id,
+        conn,
+        ctx,
+    )
+    .await
+    .map_err(|e| {
+        // The common cause is an adapter with no release for this dbt-core
+        // range: dbt-mysql, for one, has not shipped past `~=1.7`. uv reports
+        // that as a resolver dump, which does not say what to do about it.
+        Error::ExecutionErr(format!(
+            "{e}\n\ninstalling the {} adapter: it must have a release compatible with \
+             {version_spec}, which is the dbt-core CLI this engine invokes. If the adapter has \
+             not kept up, use `engine: dbt-core-2x` or `engine: fusion`",
+            adapter.name()
+        ))
+    })?;
+    match tokio::fs::rename(&staging, &dir).await {
+        Ok(()) => staging_guard.keep(),
+        // Lost the race: the winner's venv is equivalent, so use it. The guard
+        // removes ours.
+        Err(_) if bin.exists() => {}
+        Err(e) => return Err(Error::internal_err(format!("installing dbt-core: {e}"))),
+    }
+    let adapter_version = installed_adapter_version(&dir, adapter).await;
+    let version = installed_package_version(&dir, "dbt_core")
+        .await
+        .unwrap_or(version);
+    Ok(
+        ProvisionedEngine {
+            root: dir,
+            bin,
+            version,
+            engine: DbtEngine::DbtCore1x,
+            adapter_version,
+        },
+    )
+}
+
+/// The adapter version a venv actually resolved, read from its dist-info so a
+/// deploy can lock it and later runs can ask for the same one.
+async fn installed_adapter_version(dir: &Path, adapter: DbtAdapter) -> Option<String> {
+    installed_package_version(dir, &adapter.pip_package().replace('-', "_")).await
+}
+
+/// The version of an installed distribution, read from its `.dist-info`.
+async fn installed_package_version(dir: &Path, dist: &str) -> Option<String> {
+    let prefix = format!("{dist}-");
+    let mut entries = tokio::fs::read_dir(dir.join("lib")).await.ok()?;
+    while let Ok(Some(py)) = entries.next_entry().await {
+        let mut pkgs = tokio::fs::read_dir(py.path().join("site-packages"))
+            .await
+            .ok()?;
+        while let Ok(Some(e)) = pkgs.next_entry().await {
+            let name = e.file_name().to_string_lossy().to_string();
+            if let Some(rest) = name.strip_prefix(&prefix) {
+                if let Some(v) = rest.strip_suffix(".dist-info") {
+                    return Some(v.to_string());
+                }
+            }
+        }
+    }
+    None
+}
+
+async fn provision_core_2x(
+    pinned_version: Option<&str>,
+    job_id: &Uuid,
+    w_id: &str,
+    conn: &Connection,
+    ctx: &mut JobCtx<'_>,
+) -> error::Result<ProvisionedEngine> {
+    let version = pinned_version
+        .map(str::to_string)
+        .unwrap_or_else(|| DBT_CORE_2X_VERSION.clone());
+    // No Windmill image ships an engine, so this is the operator's own
+    // pre-stage: `DBT_BUNDLED_DIR` populated in a derived image, for an
+    // air-gapped instance or a fleet that should not fetch per worker. Checked
+    // before the cache because it is read-only and shared, where the cache is a
+    // per-worker volume.
+    let bundled = PathBuf::from(&*DBT_BUNDLED_DIR)
+        .join(format!("core2x-{version}"))
+        .join("dbt-sa-cli");
+    if bundled.exists() {
+        return Ok(ProvisionedEngine {
+            root: bundled.parent().map(Path::to_path_buf).unwrap_or_default(),
+            bin: bundled,
+            version,
+            engine: DbtEngine::DbtCore2x,
+            adapter_version: None,
+        });
+    }
+    let dir = PathBuf::from(&*DBT_CACHE_DIR).join(format!("core2x-{version}"));
+    let bin = dir.join("dbt-sa-cli");
+    if bin.exists() {
+        return Ok(ProvisionedEngine {
+            root: dir.clone(),
+            bin,
+            version,
+            engine: DbtEngine::DbtCore2x,
+            adapter_version: None,
+        });
+    }
+    let target = format!("{}-unknown-linux-gnu", std::env::consts::ARCH);
+    let url = format!(
+        "https://github.com/dbt-labs/dbt-core/releases/download/v{version}/dbt-core-{version}-{target}.tar.gz"
+    );
+    append_logs(
+        job_id,
+        w_id,
+        format!("\nFetching dbt-core {version}...\n"),
+        conn,
+    )
+    .await;
+    fetch_and_extract(&url, &dir, "dbt-sa-cli", job_id, w_id, conn, ctx).await?;
+    Ok(ProvisionedEngine {
+        root: dir,
+        bin,
+        version,
+        engine: DbtEngine::DbtCore2x,
+        adapter_version: None,
+    })
+}
+
+/// Fusion is fetched from dbt Labs at runtime and cached — see the module docs
+/// for why it must never be baked into an image.
+async fn provision_fusion(
+    pinned_version: Option<&str>,
+    job_id: &Uuid,
+    w_id: &str,
+    conn: &Connection,
+    ctx: &mut JobCtx<'_>,
+) -> error::Result<ProvisionedEngine> {
+    // Version-keyed like the other two: one shared `fusion` directory means a
+    // run landing on a clean worker fetches whatever is current rather than
+    // what the deploy locked.
+    let dir = PathBuf::from(&*DBT_CACHE_DIR).join(match pinned_version {
+        Some(v) => format!("fusion-{v}"),
+        None => "fusion".to_string(),
+    });
+    // The installer places the binary directly in the directory `--to` names.
+    let bin = dir.join("dbt");
+    if bin.exists() {
+        return Ok(ProvisionedEngine {
+            root: dir.clone(),
+            bin,
+            version: fusion_version(&dir).await,
+            engine: DbtEngine::Fusion,
+            adapter_version: None,
+        });
+    }
+    append_logs(
+        job_id,
+        w_id,
+        "\nFetching the dbt Fusion engine from dbt Labs (not bundled with Windmill; \
+         subject to the dbt Fusion engine license agreement)...\n"
+            .to_string(),
+        conn,
+    )
+    .await;
+    let script = fetch_under_job(
+        "the Fusion installer",
+        async {
+            let net =
+                |e: reqwest::Error| Error::internal_err(format!("fetching the installer: {e}"));
+            Ok(windmill_common::utils::HTTP_CLIENT
+                .get(&*DBT_FUSION_INSTALL_URL)
+                .send()
+                .await
+                .and_then(|r| r.error_for_status())
+                .map_err(net)?
+                .text()
+                .await
+                .map_err(net)?)
+        },
+        job_id,
+        w_id,
+        conn,
+        ctx,
+    )
+    .await?;
+    // Install into a per-job sibling and rename, like the other two engines:
+    // pointing the installer straight at the shared cache lets a second job
+    // observe `bin/dbt` and execute it while the first is still writing.
+    let staging_guard = Scratch::new(staging_path(&dir, job_id));
+    let staging = staging_guard.path().to_path_buf();
+    tokio::fs::remove_dir_all(&staging).await.ok();
+    let script_guard =
+        Scratch::new(std::env::temp_dir().join(format!("wm-fusion-install-{job_id}.sh")));
+    let tmp = script_guard.path().to_path_buf();
+    write_file(
+        tmp.parent().unwrap().to_str().unwrap(),
+        tmp.file_name().unwrap().to_str().unwrap(),
+        &script,
+    )?;
+    // `--to` and `--version` are the installer's own flags (`install.sh
+    // --help`); it takes no positional arguments and ignores unknown ones, so
+    // an approximation here fails by silently installing the latest release
+    // into the user's $HOME instead of the cache.
+    let mut install = Command::new("sh");
+    install.arg(&tmp).arg("--to").arg(&staging);
+    if let Some(v) = pinned_version {
+        install.args(["--version", v]);
+    } else {
+        install.arg("--update");
+    }
+    run_tool(&mut install, "fusion install", job_id, w_id, conn, ctx).await?;
+    drop(script_guard);
+    if !staging.join("dbt").exists() {
+        return Err(Error::internal_err(
+            "the Fusion installer did not produce a dbt binary".to_string(),
+        ));
+    }
+    if tokio::fs::rename(&staging, &dir).await.is_ok() {
+        staging_guard.keep();
+    } else {
+        if !bin.exists() {
+            return Err(Error::internal_err(
+                "could not install the Fusion engine".to_string(),
+            ));
+        }
+    }
+    Ok(ProvisionedEngine {
+        root: dir.clone(),
+        bin,
+        version: fusion_version(&dir).await,
+        engine: DbtEngine::Fusion,
+        adapter_version: None,
+    })
+}
+
+/// From the binary itself: the installer writes no version file, and a pinned
+/// directory name would only echo back what was asked for rather than what was
+/// installed.
+async fn fusion_version(dir: &Path) -> String {
+    Command::new(dir.join("dbt"))
+        .arg("--version")
+        .output()
+        .await
+        .ok()
+        .filter(|o| o.status.success())
+        .and_then(|o| {
+            String::from_utf8_lossy(&o.stdout)
+                .split_whitespace()
+                .nth(1)
+                .map(|v| v.to_string())
+        })
+        .unwrap_or_else(|| "unknown".to_string())
+}
+
+/// A sibling of `dir` to build in before renaming into place. Appended to the
+/// whole file name rather than via `with_extension`, which would eat everything
+/// after the version's last dot.
+/// A per-job path removed on drop unless the install claimed it.
+///
+/// Provisioning is a sequence of fallible awaits — a download, an installer, an
+/// extraction — and each one can also be cancelled. Cleaning up after the `?`
+/// only covers the paths someone remembered, so a run of failed or cancelled
+/// first-use installs accumulates venvs and tarballs until the worker's disk is
+/// gone. Dropping is the one exit every path takes.
+struct Scratch(Option<PathBuf>);
+
+impl Scratch {
+    fn new(path: PathBuf) -> Self {
+        Scratch(Some(path))
+    }
+
+    fn path(&self) -> &Path {
+        self.0.as_deref().unwrap_or(Path::new(""))
+    }
+
+    /// The install succeeded and moved it: stop owning it.
+    fn keep(mut self) {
+        self.0 = None;
+    }
+}
+
+impl Drop for Scratch {
+    fn drop(&mut self) {
+        let Some(p) = self.0.take() else {
+            return;
+        };
+        let remove = move || {
+            let _ = std::fs::remove_dir_all(&p);
+            let _ = std::fs::remove_file(&p);
+        };
+        // Off the runtime thread: this removes thousands of files and `Drop` runs
+        // inside the job future, so doing it synchronously stalls every other job
+        // on that thread. Detached because a `Drop` cannot await.
+        match tokio::runtime::Handle::try_current() {
+            Ok(handle) => {
+                handle.spawn_blocking(remove);
+            }
+            // No runtime to hand it to (a test, or shutdown): do it here rather
+            // than leave the directory behind.
+            Err(_) => remove(),
+        }
+    }
+}
+
+fn staging_path(dir: &Path, job_id: &Uuid) -> PathBuf {
+    let name = dir.file_name().unwrap_or_default().to_string_lossy();
+    dir.with_file_name(format!("{name}.staging-{job_id}"))
+}
+
+/// Fetch under the job's cancellation and timeout. The shared `HTTP_CLIENT`
+/// sets no request timeout, so a stalled release download would otherwise hold
+/// the worker for as long as the connection stays open.
+async fn fetch_under_job<T, F>(
+    what: &str,
+    fetch: F,
+    job_id: &Uuid,
+    w_id: &str,
+    conn: &Connection,
+    ctx: &mut JobCtx<'_>,
+) -> error::Result<T>
+where
+    F: std::future::Future<Output = error::Result<T>>,
+{
+    run_future_with_polling_update_job_poller(
+        *job_id,
+        ctx.timeout(),
+        conn,
+        ctx.mem_peak,
+        ctx.canceled_by,
+        async move {
+            fetch
+                .await
+                .map_err(|e| Error::internal_err(format!("fetching {what}: {e}")))
+        },
+        ctx.worker_name,
+        w_id,
+        &mut Some(ctx.occupancy_metrics),
+        Box::pin(futures::stream::once(async { 0 })),
+    )
+    .await
+}
+
+async fn fetch_and_extract(
+    url: &str,
+    dir: &Path,
+    expected_bin: &str,
+    job_id: &Uuid,
+    w_id: &str,
+    conn: &Connection,
+    ctx: &mut JobCtx<'_>,
+) -> error::Result<()> {
+    let tarball_guard = Scratch::new(std::env::temp_dir().join(format!("wm-dbt-{job_id}.tar.gz")));
+    let tarball = tarball_guard.path().to_path_buf();
+    // STREAMED to disk, never held whole: an engine archive is ~290 MB, this
+    // runs in the shared worker process rather than the job's subprocess, and
+    // several cold jobs provision at once — buffering would multiply that until
+    // the worker dies, taking every job on it along.
+    fetch_under_job(
+        url,
+        async {
+            use futures::StreamExt;
+            use tokio::io::AsyncWriteExt;
+            let net = |e: reqwest::Error| Error::internal_err(format!("fetching {url}: {e}"));
+            let mut resp = windmill_common::utils::HTTP_CLIENT
+                .get(url)
+                .send()
+                .await
+                .and_then(|r| r.error_for_status())
+                .map_err(net)?
+                .bytes_stream();
+            let mut file = tokio::fs::File::create(&tarball)
+                .await
+                .map_err(|e| Error::internal_err(format!("writing {url}: {e}")))?;
+            while let Some(chunk) = resp.next().await {
+                let chunk = chunk.map_err(net)?;
+                file.write_all(&chunk)
+                    .await
+                    .map_err(|e| Error::internal_err(format!("writing {url}: {e}")))?;
+            }
+            file.flush()
+                .await
+                .map_err(|e| Error::internal_err(format!("writing {url}: {e}")))?;
+            Ok(())
+        },
+        job_id,
+        w_id,
+        conn,
+        ctx,
+    )
+    .await?;
+    let staging_guard = Scratch::new(staging_path(dir, job_id));
+    let staging = staging_guard.path().to_path_buf();
+    tokio::fs::create_dir_all(&staging)
+        .await
+        .map_err(|e| Error::internal_err(format!("creating {staging:?}: {e}")))?;
+    run_tool(
+        Command::new("tar")
+            .arg("xzf")
+            .arg(&tarball)
+            .arg("-C")
+            .arg(&staging)
+            // The release tarballs wrap the binary in a versioned directory.
+            .args(["--strip-components", "1"]),
+        "tar",
+        job_id,
+        w_id,
+        conn,
+        ctx,
+    )
+    .await?;
+    drop(tarball_guard);
+    if !staging.join(expected_bin).exists() {
+        return Err(Error::internal_err(format!(
+            "{url} did not contain the expected `{expected_bin}` binary"
+        )));
+    }
+    if tokio::fs::rename(&staging, dir).await.is_ok() {
+        staging_guard.keep();
+    } else {
+        if !dir.join(expected_bin).exists() {
+            return Err(Error::internal_err(format!("could not install {url}")));
+        }
+    }
+    Ok(())
+}
+
+/// Run a provisioning command to completion. Provisioning happens inside the
+/// job that needs the engine, so it runs under that job's cancellation and
+/// timeout: a cold `uv pip install` or Fusion download is the longest thing a
+/// dbt job does, and a cancel that could not reach it would hold the worker
+/// slot for the rest of the install. Its output is not streamed to the job log
+/// — these are worker-level setup steps with no node to attribute progress to,
+/// and failures surface with the tool's own stderr.
+async fn run_tool(
+    cmd: &mut Command,
+    name: &str,
+    job_id: &Uuid,
+    w_id: &str,
+    conn: &Connection,
+    ctx: &mut JobCtx<'_>,
+) -> error::Result<()> {
+    let child = cmd
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped())
+        // The wait future owns the child, so cancellation dropping that future
+        // is what terminates the install — dropping it alone would not.
+        .kill_on_drop(true)
+        .spawn()
+        .map_err(|e| Error::internal_err(format!("{name} could not be started: {e}")))?;
+    let pid = child.id();
+    let out = run_future_with_polling_update_job_poller(
+        *job_id,
+        ctx.timeout(),
+        conn,
+        ctx.mem_peak,
+        ctx.canceled_by,
+        async move {
+            child
+                .wait_with_output()
+                .await
+                .map_err(|e| Error::internal_err(format!("{name} failed: {e}")))
+        },
+        ctx.worker_name,
+        w_id,
+        &mut Some(ctx.occupancy_metrics),
+        Box::pin(futures::stream::unfold((), move |_| async move {
+            Some((get_mem_peak(pid, false).await, ()))
+        })),
+    )
+    .await?;
+    if !out.status.success() {
+        return Err(Error::internal_err(format!(
+            "{name} failed: {}",
+            String::from_utf8_lossy(&out.stderr)
+        )));
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod core1x_tests {
+    use super::*;
+    use crate::dbt_profiles::KnownAdapter;
+
+    // Several adapters cap dbt-core below what this runtime would ask for
+    // (dbt-mysql ~=1.7, dbt-oracle and dbt-databricks below 1.12) and
+    // dbt-salesforce has no 1.x package at all, so pinning core independently made
+    // those projects fail at provisioning. The install names a ceiling instead.
+    #[test]
+    fn every_adapter_either_names_a_package_or_is_fusion_only() {
+        for a in KnownAdapter::ALL {
+            if matches!(a, KnownAdapter::Salesforce) {
+                continue;
+            }
+            assert!(
+                !a.pip_package().is_empty(),
+                "{} must name a pip package for dbt-core 1.x",
+                a.name()
+            );
+        }
+        // Fusion has it built in, and there is no package to install.
+        assert!(KnownAdapter::Salesforce.pip_package().is_empty());
+        assert_eq!(KnownAdapter::Salesforce.name(), "salesforce");
+    }
+
+    // `dbt-` is not a reserved prefix on PyPI and this install is not sandboxed,
+    // so the name a script author picks decides which package runs its build
+    // backend as the worker.
+    #[test]
+    fn an_unvouched_adapter_is_not_installed() {
+        let known = DbtAdapter::from_dbt_type("postgres").unwrap();
+        assert!(ensure_adapter_installable(&known).is_ok());
+        let published = DbtAdapter::from_dbt_type("trino").unwrap();
+        assert!(ensure_adapter_installable(&published).is_ok());
+        let squatted = DbtAdapter::from_dbt_type("totally-legit-adapter").unwrap();
+        assert!(ensure_adapter_installable(&squatted).is_err());
+    }
+
+    /// A preview submits its own lockfile, so this string reaches a path join
+    /// and a pip requirement straight from the caller, on the host and outside
+    /// the jail.
+    #[test]
+    fn a_lockfile_version_cannot_leave_the_cache_directory() {
+        for v in ["1.12.0", "2.0.0-alpha.5", "2.0.0-preview.202"] {
+            assert_eq!(checked_version(Some(v), "engine_version").unwrap(), Some(v));
+        }
+        for v in [
+            "../../../../etc",
+            "1.0/../..",
+            "..",
+            ".ssh",
+            "-rf",
+            "1.0 --index-url=http://x",
+            "1.0\n",
+        ] {
+            assert!(
+                checked_version(Some(v), "engine_version").is_err(),
+                "`{v}` must be refused before it reaches a path"
+            );
+        }
+        assert!(checked_version(None, "engine_version").unwrap().is_none());
+    }
+}
diff --git a/backend/windmill-worker/src/dbt_executor.rs b/backend/windmill-worker/src/dbt_executor.rs
new file mode 100644
index 0000000000..33ddd6c32e
--- /dev/null
+++ b/backend/windmill-worker/src/dbt_executor.rs
@@ -0,0 +1,5783 @@
+//! Running a dbt project as a Windmill job.
+//!
+//! One `dbt build` per job, not one job per model. That is the shape
+//! astronomer-cosmos arrived at with `ExecutionMode.WATCHER` after per-model
+//! Airflow tasks proved roughly 6x slower on a real project; dbt's own
+//! threading provides the parallelism and Windmill provides the observability
+//! (docs/dbt-runtime.md). Per-model status comes from dbt's JSON event stream
+//! while the run is in flight, and the structured job result comes from
+//! `run_results.json` at the end.
+
+use std::collections::HashMap;
+use std::path::{Path, PathBuf};
+use std::process::Stdio;
+
+use serde::{Deserialize, Serialize};
+use serde_json::value::RawValue;
+use sha2::{Digest, Sha256};
+use tokio::process::Command;
+use uuid::Uuid;
+use windmill_common::client::AuthedClient;
+use windmill_common::error::{self, Error};
+use windmill_common::materialization::{
+    record_materialization, MaterializationStatus, RecordMaterializationRequest,
+};
+use windmill_common::worker::{to_raw_value, write_file, Connection};
+use windmill_parser_yaml::{
+    parse_dbt_descriptor, DbtDescriptor, DbtTestBehavior, DBT_COMMANDS, DBT_COMMAND_ARG,
+    DBT_COMMAND_LABEL, DBT_DEFAULT_WAREHOUSE,
+};
+use windmill_queue::{append_logs, CanceledBy, MiniPulledJob};
+
+use crate::common::{
+    render_nsjail_rlimit_as, resolve_nsjail_timeout, resolve_nsjail_tmp_mount_block,
+};
+use crate::common::{start_child_process, OccupancyMetrics};
+use crate::dbt_engine::{provision_engine, ProvisionedEngine, DBT_CACHE_DIR};
+use crate::dbt_profiles::{
+    ensure_adapter_licensed, render_dbt_profile, render_profile, DbtAdapter, KnownAdapter,
+};
+use crate::handle_child::{
+    get_mem_peak, handle_child, run_future_with_polling_update_job_poller, JobCtx, JobDeadline,
+};
+use crate::worker::write_module_files;
+use crate::{
+    is_sandboxing_enabled, GIT_PATH, NSJAIL_DBT_RLIMIT_AS_MB, NSJAIL_PATH, PATH_ENV, PROXY_ENVS,
+    TZ_ENV,
+};
+
+/// The profile name Windmill renders into `profiles.yml`. dbt takes the profile
+/// to use from `dbt_project.yml`, so the rendered file must answer to whatever
+/// name the project declares — resolved from the project file, with this as the
+/// fallback for the (invalid) case where it declares none.
+const FALLBACK_PROFILE_NAME: &str = "windmill";
+
+/// Written to the script's lockfile at deploy.
+#[derive(Serialize, Deserialize, Debug, Clone, Default)]
+pub struct DbtDependencyLocks {
+    /// The `<schema>/<database>` the profile resolved to at deploy. The
+    /// resource is re-read on every run, so a schema or catalog changed on it
+    /// afterwards moves every relation the project builds — and the stored
+    /// graph, which still names the old ones, has to be re-ingested.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub profile_relation_root: Option<String>,
+    /// dbt-core 1.x only: its adapter is a separate package versioning
+    /// independently of core, so pinning core alone still lets a rebuilt cache
+    /// resolve different runtime behavior.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub adapter_version: Option<String>,
+    /// Digest of the `package-lock.yml` produced at deploy. Package trees are
+    /// worker-local, so a cache miss on another worker must prove it resolved
+    /// the same dependencies before it may run this script version.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub package_lock_digest: Option<String>,
+    pub manifest_digest: String,
+    pub engine: String,
+    pub engine_version: String,
+}
+
+/// Per-node outcome, from `run_results.json`.
+#[derive(Serialize, Debug, Clone)]
+pub struct DbtNodeResult {
+    pub unique_id: String,
+    /// dbt's own status word, verbatim (`success`, `error`, `partial success`,
+    /// `no-op`, …). Kept because it is what the log and dbt's docs say, but it
+    /// is dbt's vocabulary to change — read `outcome` to make a decision.
+    pub status: String,
+    /// The same result in Windmill's terms, which is the stable half of this
+    /// contract: `passed` | `failed` | `warned` | `skipped` | `no_op` |
+    /// `unknown`. A dbt release that renames a status, or adds one, moves
+    /// `status` and leaves this alone.
+    pub outcome: &'static str,
+    pub execution_time: Option<f64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub rows_affected: Option<i64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub relation_name: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub message: Option<String>,
+    /// Test nodes: how many rows violated the assertion.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub failures: Option<i64>,
+}
+
+/// The job result. Partial failure is dbt's normal case, so the result has to
+/// be legible without reading the log: which models succeeded, which failed,
+/// which tests failed and at what severity.
+#[derive(Serialize, Debug)]
+pub struct DbtRunResult {
+    pub engine: String,
+    pub engine_version: String,
+    pub command: String,
+    pub totals: DbtTotals,
+    pub nodes: Vec<DbtNodeResult>,
+    /// The arguments this invocation ran with, as SUBMITTED — a `$var:` stays a
+    /// reference, so no resolved value (and no secret) is published.
+    ///
+    /// Present because a `dbt retry` restores the failed run's arguments inside
+    /// the worker and they are never written back to the retry job: its own
+    /// args are just `{"dbt_command": "retry"}`. Anything that needs to act on
+    /// what the run actually used — the row preview, which is a `dbt show` of
+    /// the same project — cannot get them from the job.
+    #[serde(skip_serializing_if = "std::collections::HashMap::is_empty")]
+    pub invocation_args: std::collections::HashMap<String, Box<RawValue>>,
+}
+
+#[derive(Serialize, Debug, Default)]
+pub struct DbtTotals {
+    pub total: usize,
+    pub success: usize,
+    pub error: usize,
+    pub warn: usize,
+    pub skipped: usize,
+}
+
+#[derive(Deserialize, Debug)]
+struct RunResults {
+    #[serde(default)]
+    results: Vec<RunResultNode>,
+}
+
+#[derive(Deserialize, Debug)]
+struct RunResultNode {
+    unique_id: String,
+    status: String,
+    #[serde(default)]
+    execution_time: Option<f64>,
+    #[serde(default)]
+    adapter_response: serde_json::Value,
+    #[serde(default)]
+    relation_name: Option<String>,
+    #[serde(default)]
+    message: Option<String>,
+    #[serde(default)]
+    failures: Option<i64>,
+}
+
+pub(crate) async fn handle_dbt_job(
+    requirements_o: Option<&String>,
+    job_dir: &str,
+    worker_name: &str,
+    job: &MiniPulledJob,
+    mem_peak: &mut i32,
+    canceled_by: &mut Option<CanceledBy>,
+    conn: &Connection,
+    client: &AuthedClient,
+    inner_content: &str,
+    envs: HashMap<String, String>,
+    occupancy_metrics: &mut OccupancyMetrics,
+    modules: Option<&HashMap<String, windmill_common::scripts::ScriptModule>>,
+) -> error::Result<Box<RawValue>> {
+    let descriptor = parse_dbt_descriptor(inner_content)?;
+    let locks: Option<DbtDependencyLocks> = requirements_o
+        .map(|s| {
+            serde_json::from_str(s)
+                .map_err(|e| Error::internal_err(format!("reading the dbt lockfile: {e}")))
+        })
+        .transpose()?;
+
+    // Through `build_args_map`, like every other executor: dbt cannot resolve a
+    // `$var:` / `$res:` / `$encrypted:` reference, so passing one raw sends the
+    // literal string to `--vars` — a placeholder holding a schema or an `enabled`
+    // flag would then build a different slice of the project than was asked for.
+    let args = flatten_command(
+        crate::common::build_args_map(job, client, conn)
+            .await?
+            .unwrap_or_else(|| job.args.as_ref().map(|a| a.0.clone()).unwrap_or_default()),
+    )?;
+    // As submitted, command block and all: this is what the state saves and the
+    // result publishes, and both describe an invocation of this script, not one
+    // executor's view of it.
+    let raw_args = job.args.as_ref().map(|a| a.0.clone()).unwrap_or_default();
+    let inv = Invocation { args: args.clone(), raw_args, envs: envs.clone(), strict: true };
+    // One wall clock for the whole job. A dbt job is a sequence of
+    // subprocesses — provision, deps, parse, ls, build, then the
+    // `after_all` tests — and each would otherwise resolve the job's full
+    // timeout for itself.
+    let deadline = JobDeadline::start(conn, &job.workspace_id, job.id, job.timeout).await;
+    // Built once and reborrowed into every phase. The five fields travel
+    // together through the whole executor, so passing them apart means each new
+    // phase grows another five parameters and another copy of this literal.
+    let mut ctx = JobCtx { mem_peak, canceled_by, occupancy_metrics, worker_name, deadline };
+    // From EVERY dbt run, not from the progress reporter: that reporter runs only
+    // for engines emitting node events, so hanging the prune off it leaves a
+    // Fusion-only or dbt-core-2x instance accumulating rows nothing deletes.
+    if let Connection::Sql(pool) = conn {
+        let (pool, prune_w_id) = (pool.clone(), job.workspace_id.clone());
+        let prune_path = job.runnable_path.clone().unwrap_or_default();
+        tokio::spawn(async move {
+            windmill_common::dbt_manifest::prune_run_progress(&pool, &prune_w_id).await;
+            if let Err(e) =
+                windmill_common::dbt_manifest::prune_dbt_run_graphs(&pool, &prune_path, &prune_w_id)
+                    .await
+            {
+                tracing::warn!("pruning dbt run graph snapshots: {e:#}");
+            }
+        });
+    }
+    let prepared = prepare_project(
+        &descriptor,
+        inner_content,
+        locks.as_ref(),
+        job_dir,
+        &job.id,
+        &job.workspace_id,
+        job.runnable_path.as_deref().unwrap_or_default(),
+        job.runnable_id.map(|h| h.0),
+        conn,
+        client,
+        &mut ctx,
+        &envs,
+        modules,
+    )
+    .await;
+    // A preparation failure leaves the saved run alone: nothing up to here — the
+    // bundle, `dbt deps`, the engine, the profile — touches a relation, so the
+    // previous run's failures still describe the warehouse. Only an interrupted
+    // BUILD invalidates that, which the save at the end of the job decides.
+    let mut prepared = prepared?;
+
+    // A `vars` override drives `enabled`, alias, schema, database and
+    // materialization, so the run's models are not the deployed graph's: it
+    // snapshots under its own job id. Re-asked below for a retry, which submits
+    // only `dbt_command` until the failed run's arguments are restored.
+    prepared.graph_refresh.add_caller_args(&descriptor, &args)?;
+
+    let command = match arg_str(&args, "dbt_command")? {
+        // An allowlist, not a passthrough: the value becomes the dbt subcommand,
+        // and running a script needs weaker permission than editing it — so an
+        // unchecked arg would let a runner invoke `clean` or `seed` on the
+        // descriptor's warehouse.
+        Some(c) if DBT_COMMANDS.contains(&c.as_str()) => c,
+        Some(c) => {
+            return Err(Error::BadRequest(format!(
+                "`dbt_command` must be one of {}, got `{c}`",
+                DBT_COMMANDS.join(", ")
+            )))
+        }
+        None => windmill_parser_yaml::default_dbt_command(&descriptor).to_string(),
+    };
+    // A parse is the whole job: it resolves the project into a manifest, stores
+    // the graph and stops. Handled before everything below because none of it
+    // applies — nothing is built, so there is no test phase, no materialization,
+    // no retry state and no ownership to publish.
+    if command == "parse" {
+        return run_parse_only(
+            &prepared,
+            &descriptor,
+            // Tolerant of the `{{ }}` placeholders only a run can fill, exactly
+            // as the deploy's own parse is: refreshing an editor buffer must not
+            // require filling the run form in first, and the graph it produces is
+            // the one the deploy would store.
+            &Invocation { strict: false, ..inv },
+            &mut ctx,
+            job,
+            conn,
+        )
+        .await;
+    }
+
+    // `dbt retry` resumes from the previous run's `run_results.json`, which is what
+    // makes one-job-per-invocation defensible. Each attempt gets a fresh job dir, so
+    // that state is restored along with the ARGUMENTS it ran with: dbt reuses the
+    // failed invocation's selection and vars, so every phase must agree with them.
+    let mut restored_results_digest: Option<String> = None;
+    let inv = if command == "retry" {
+        // Read BEFORE the restore replaces the arguments. A retry must name the run
+        // it resumes: only the latest failure of this script is kept, so an unnamed
+        // one would mean "whatever failed last" and quietly resume a different run
+        // than the caller was looking at.
+        let expected = arg_str(&inv.args, "dbt_retry_job")?.filter(|s| !s.trim().is_empty());
+        let Some(expected) = expected else {
+            return Err(Error::BadRequest(
+                "a `retry` needs `dbt_retry_job`, the id of the run to resume. Open that run and \
+                 use `Resume this run`, or pass its id: only the latest failure of this script is \
+                 kept, so a retry names which one it means"
+                    .to_string(),
+            ));
+        };
+        // Parsed, not compared as text: the saved run is a `uuid`, and an id
+        // that differs only in case or in braces names the same run.
+        let expected = Uuid::parse_str(expected.trim()).map_err(|_| {
+            Error::BadRequest(format!(
+                "`dbt_retry_job` must be the id of the run to resume, got `{expected}`"
+            ))
+        })?;
+        let restored = restore_run_state(
+            &prepared,
+            &job.workspace_id,
+            &job.permissioned_as,
+            &inv,
+            expected,
+            conn,
+        )
+        .await?;
+        restored_results_digest = Some(restored.results_digest.clone());
+        // Restored args are the ones SUBMITTED, so the references they carry are
+        // resolved again now — against this caller's access, not the original's.
+        let inv = Invocation {
+            args: flatten_command(
+                crate::common::transform_json(client, &job.workspace_id, &restored.args, job, conn)
+                    .await?
+                    .unwrap_or_else(|| restored.args.clone()),
+            )?,
+            raw_args: restored.args,
+            ..inv
+        };
+        // Compared only now that they are resolved: a `$var:` whose value moved
+        // selects a different node set, so the saved failures no longer describe
+        // what a retry would build. Refused rather than resumed, since which
+        // graph it would use depends on which worker it lands on.
+        if let Some(saved) = restored.args_digest.as_deref() {
+            if saved != inv.resolved_args_digest() {
+                return Err(Error::BadRequest(
+                    "the values this run's arguments resolve to have changed since the run \
+                     being retried, so its failures no longer describe what a retry would \
+                     build; run the script normally instead"
+                        .to_string(),
+                ));
+            }
+        }
+        // The restored arguments decide this retry's graph, and RESOLVED ones: a
+        // saved `select` spelled `$res:` is a string until resolved, so reading the
+        // raw form refuses the retry as "must be a list of strings" for a reference
+        // that resolves to the very list the failed run built with.
+        prepared
+            .graph_refresh
+            .add_caller_args(&descriptor, &inv.args)?;
+        if restored.needs_parse {
+            // After the resolution above, so the manifest describes the project
+            // the build is about to retry.
+            run_dbt_parse(
+                &prepared,
+                &descriptor,
+                &inv,
+                &mut ctx,
+                &job.id,
+                &job.workspace_id,
+                conn,
+            )
+            .await?;
+        }
+        inv
+    } else {
+        inv
+    };
+
+    // Ingested BEFORE the build, from a `dbt parse` with this run's vars, so the
+    // models shown are the ones about to be built. Rows are keyed by path, version
+    // AND job so no two runs collide; the path-keyed `asset` usage belongs to one
+    // version, which `claim_graph_publication` arbitrates (docs/dbt-runtime.md).
+    if prepared.graph_refresh.needed() && !windmill_parser_yaml::dbt::is_read_only_command(&command)
+    {
+        // A parse and an ingest write no relation either, so a failure in either
+        // leaves the saved run as accurate as the preparation exits above do.
+        if command != "retry" {
+            run_dbt_parse(
+                &prepared,
+                &descriptor,
+                &inv,
+                &mut ctx,
+                &job.id,
+                &job.workspace_id,
+                conn,
+            )
+            .await?;
+        }
+        // For a retry the restored manifest already describes the invocation
+        // being resumed, so only the ingest runs — with that invocation's
+        // arguments, which the selection resolver needs to interpolate.
+        ingest_from_run(&prepared, &descriptor, &inv, &mut ctx, job, conn).await?;
+    }
+
+    // A read-only command prints rows to stdout, so it is captured rather than
+    // streamed, and nothing below applies: nothing was built, so there is no graph
+    // to publish, no materialization, no test phase and nothing to retry.
+    if windmill_parser_yaml::dbt::is_read_only_command(&command) {
+        return run_show(
+            &prepared,
+            &descriptor,
+            &inv,
+            &mut ctx,
+            &job.id,
+            &job.workspace_id,
+            conn,
+        )
+        .await;
+    }
+
+    let mut run = run_dbt(
+        &prepared,
+        &command,
+        &descriptor,
+        &inv,
+        job,
+        conn,
+        &mut ctx,
+        true,
+    )
+    .await;
+
+    // `after_all` is two invocations, models then tests, and each REWRITES
+    // `run_results.json` — so the model results are read before the test phase
+    // overwrites them, or the job reports tests alone and nothing settles the
+    // models' materializations.
+    let mut results = read_run_results(&prepared.project_dir).await;
+
+    // In-job node retry: rebuilding only the failed and skipped nodes, while the
+    // previous attempt's `run_results.json` is still in the job directory. Never on
+    // an agent worker, which cannot read `v2_job_queue` — the wait below would be
+    // uninterruptible, so a cancelled job would hold its slot and then start dbt.
+    let node_retry = descriptor
+        .retry_failed_nodes
+        .filter(|_| matches!(conn, Connection::Sql(_)));
+    let mut retries_left = node_retry.map(|p| p.attempts()).unwrap_or(0);
+    if let Some(policy) = node_retry.filter(|_| run.is_err()) {
+        retry_failed_nodes(
+            policy,
+            &prepared,
+            &descriptor,
+            &inv,
+            job,
+            conn,
+            &mut ctx,
+            &mut run,
+            &mut results,
+            &mut retries_left,
+        )
+        .await;
+    }
+    // A `retry` whose saved results were tests alone IS the test phase: dbt reran
+    // exactly those tests, so running the suite after it would execute every test
+    // a second time and report each one twice. `test_behavior: after_all` is how
+    // `run_results.json` comes to hold tests alone.
+    let retry_was_the_test_phase = command == "retry"
+        && !results.is_empty()
+        && results
+            .iter()
+            .all(|n| n.unique_id.starts_with("test.") || n.unique_id.starts_with("unit_test."));
+    // `retry` counts as the model phase too: a run that failed midway and was
+    // retried to success would otherwise return green having never tested.
+    if run.is_ok()
+        && matches!(descriptor.test_behavior, DbtTestBehavior::AfterAll)
+        && matches!(command.as_str(), "build" | "retry")
+        && !retry_was_the_test_phase
+    {
+        run = run_dbt(
+            &prepared,
+            "test",
+            &descriptor,
+            &inv,
+            job,
+            conn,
+            &mut ctx,
+            // The tests must be scoped exactly like the models were: testing
+            // the whole project would assert against models this script never
+            // builds, the same failure the ingest-side scoping fixes.
+            true,
+        )
+        .await;
+        // Merged, not appended: the model phase and the test phase can name the
+        // same node, and a duplicate would double its totals and collide as a key
+        // in the result table.
+        merge_results(&mut results, read_run_results(&prepared.project_dir).await);
+        // The same policy applies to a failing test. `dbt retry` redoes test
+        // nodes, and the descriptor promises to retry the ones that failed —
+        // retrying the model phase alone would exempt the failure mode
+        // `test_behavior: after_all` exists to produce.
+        if let Some(policy) = node_retry.filter(|_| run.is_err()) {
+            retry_failed_nodes(
+                policy,
+                &prepared,
+                &descriptor,
+                &inv,
+                job,
+                conn,
+                &mut ctx,
+                &mut run,
+                &mut results,
+                &mut retries_left,
+            )
+            .await;
+        }
+    }
+
+    // Best-effort: losing the state costs a retry, not the run that just
+    // finished. Logged rather than dropped — without it the only symptom is
+    // `dbt retry` reporting nothing to resume, which reads as a bug in retry.
+    if let Err(e) = save_run_state(
+        &prepared,
+        &job.workspace_id,
+        &job.permissioned_as,
+        job.visible_to_owner,
+        &job.id,
+        &inv,
+        restored_results_digest.as_deref(),
+        conn,
+    )
+    .await
+    {
+        tracing::warn!("dbt: could not save retry state for job {}: {e:#}", job.id);
+    }
+    let reconciled = reconcile_materializations(&prepared, &results, job, conn, client).await;
+    terminalize_running_relations(job, &reconciled, conn).await;
+
+    let result = build_result(&prepared, &command, results, &inv);
+    match run {
+        Ok(()) => Ok(to_raw_value(&result)),
+        Err(e) => {
+            // dbt's exit code already honors each test's own `severity`: a
+            // failing `warn` test leaves the run successful. Overriding that
+            // would make the same project behave differently on Windmill than
+            // it does locally, which is the promise this feature is built on.
+            append_logs(
+                &job.id,
+                &job.workspace_id,
+                format!("\n{}\n", render_failures(&result)),
+                conn,
+            )
+            .await;
+            Err(Error::ExecutionErr(format!(
+                "{e}\n\n{}",
+                serde_json::to_string_pretty(&result).unwrap_or_default()
+            )))
+        }
+    }
+}
+
+/// Deploy-time lock: materialise the script's project and parse it, so its
+/// models land in the asset graph before it has ever run.
+///
+/// This is the one place where dbt does not fit the shape every other language
+/// uses. `parse_assets_for_lang` is a pure function of the script content, and
+/// dbt's assets are not derivable from the descriptor — they need the project
+/// on disk and a dbt invocation. So the dependency job, which already runs on a
+/// worker with the engine available, does the parse and writes the `asset` rows
+/// itself; `parse_assets_for_lang` returns `None` for dbt and leaves them
+/// alone. That also makes redeploy the graph-refresh mechanism, with no
+/// separate concept (docs/dbt-runtime.md, decision 12).
+#[allow(clippy::too_many_arguments)]
+pub(crate) async fn dbt_dep(
+    content: &str,
+    // The project this dependency job is deploying: a dependency job has no
+    // generic module-writing step, so the executor materialises them.
+    modules: Option<&HashMap<String, windmill_common::scripts::ScriptModule>>,
+    job_id: &Uuid,
+    mem_peak: &mut i32,
+    canceled_by: &mut Option<CanceledBy>,
+    job_dir: &str,
+    db: &sqlx::Pool<sqlx::Postgres>,
+    worker_name: &str,
+    w_id: &str,
+    script_path: &str,
+    occupancy_metrics: &mut OccupancyMetrics,
+    token: &str,
+    base_internal_url: &str,
+) -> error::Result<String> {
+    let descriptor = parse_dbt_descriptor(content)?;
+    // A DEPLOY writes a whole node set of its own, `raw_code` included, so it
+    // has to reclaim as well: hung off runs alone, a project redeployed on every
+    // push by CI and run nightly kept one full graph per push until the next
+    // run, and one deployed but never run kept them for good.
+    {
+        let (pool, prune_w_id) = (db.clone(), w_id.to_string());
+        let prune_path = script_path.to_string();
+        tokio::spawn(async move {
+            if let Err(e) =
+                windmill_common::dbt_manifest::prune_dbt_run_graphs(&pool, &prune_path, &prune_w_id)
+                    .await
+            {
+                tracing::warn!("pruning dbt graphs at deploy: {e:#}");
+            }
+        });
+    }
+    // The script's own `envs`, exactly as a run gets them. A project can drive a
+    // model's schema, alias or `enabled` from `env_var()`, so parsing with an
+    // empty environment would record one relation at deploy and build another
+    // at run time — with no per-run refresh to correct it.
+    let envs = script_envs(db, job_id, w_id).await;
+    let conn = Connection::Sql(db.clone());
+    let client = AuthedClient::new(
+        base_internal_url.to_string(),
+        w_id.to_string(),
+        token.to_string(),
+        None,
+    );
+    // A dependency job carries no per-job timeout of its own, but its phases
+    // still share one wall clock rather than each getting the instance-wide
+    // one.
+    let deadline = JobDeadline::start(&conn, w_id, *job_id, None).await;
+    let mut ctx = JobCtx { mem_peak, canceled_by, occupancy_metrics, worker_name, deadline };
+    let prepared = prepare_project(
+        &descriptor,
+        content,
+        None,
+        job_dir,
+        job_id,
+        w_id,
+        script_path,
+        deploying_script_hash(db, job_id).await,
+        &conn,
+        &client,
+        &mut ctx,
+        &envs,
+        modules,
+    )
+    .await?;
+
+    // A deploy has no job arguments, so it tolerates the `{{ }}` placeholders
+    // only a run can fill (see `Invocation::strict`). Its environment is the
+    // script's, matching what the run will parse with.
+    let inv = Invocation { envs: envs.clone(), strict: false, ..Default::default() };
+    run_dbt_parse(&prepared, &descriptor, &inv, &mut ctx, job_id, w_id, &conn).await?;
+
+    let selected =
+        resolve_selection(&prepared, &descriptor, &inv, &mut ctx, job_id, w_id, &conn).await?;
+    let manifest = read_manifest(&prepared.project_dir).await?;
+    let manifest_digest = digest(
+        &tokio::fs::read_to_string(
+            prepared
+                .project_dir
+                .join(ARTIFACTS_DIR)
+                .join("manifest.json"),
+        )
+        .await
+        .unwrap_or_default(),
+    );
+
+    // Two deploys of one path can run concurrently — nothing serializes
+    // dependency jobs. The GRAPH is keyed by version so both may write theirs;
+    // the path-keyed asset usages are claimed by the newest.
+    let publisher = match deploying_script_hash(db, job_id).await {
+        Some(hash) => GraphPublisher::Version(hash),
+        None => GraphPublisher::Unversioned,
+    };
+    let superseded = if let Some(warehouse) = prepared.warehouse.as_deref() {
+        let ingested = windmill_common::dbt_manifest::ingest_manifest(
+            &manifest,
+            warehouse,
+            prepared.default_database.as_deref(),
+            selected.as_ref(),
+        );
+        let published = persist_ingest(
+            db,
+            w_id,
+            script_path,
+            &ingested,
+            &prepared.relation_root(),
+            publisher,
+            None,
+            true,
+        )
+        .await?;
+        if published {
+            append_logs(
+                job_id,
+                w_id,
+                format!(
+                    "\nIngested {} dbt nodes and {} edges into the asset graph\n",
+                    ingested.nodes.len(),
+                    ingested.edges.len()
+                ),
+                &conn,
+            )
+            .await;
+        }
+        !published
+    } else {
+        // No warehouse identity, so nothing can be ingested — but this version's
+        // rows must still go, or a descriptor moved to its own profiles.yml keeps
+        // claiming relations it no longer describes.
+        let mut tx = db.begin().await?;
+        // Clearing is a publication too: an older job that no longer describes the
+        // script must not wipe a newer deploy's graph.
+        let published = claim_graph_publication(&mut tx, w_id, script_path, publisher).await?;
+        if published {
+            // This VERSION's rows, never the path's: what is given up is the
+            // path-keyed usage cleared below, while an older version's graph is
+            // what its own finished runs still render.
+            if let GraphPublisher::Version(hash) = publisher {
+                windmill_common::dbt_manifest::clear_dbt_manifest_version(
+                    &mut tx,
+                    w_id,
+                    script_path,
+                    hash,
+                )
+                .await?;
+            }
+            windmill_common::assets::replace_static_asset_usage(&mut tx, w_id, script_path, &[])
+                .await?;
+            tx.commit().await?;
+            append_logs(
+                job_id,
+                w_id,
+                "\nNo asset-graph ingest: the descriptor names no `profile.warehouse` beside \
+                 its own `profile.profiles_yml`, so there is no warehouse identity to key \
+                 `dbt://` assets on. Any previously ingested nodes for this script have been \
+                 cleared.\n"
+                    .to_string(),
+                &conn,
+            )
+            .await;
+        }
+        !published
+    };
+    if superseded {
+        append_logs(
+            job_id,
+            w_id,
+            "\nA newer version of this script was deployed while this job ran, so the asset \
+             graph was left describing that one.\n"
+                .to_string(),
+            &conn,
+        )
+        .await;
+    }
+
+    serde_json::to_string_pretty(&DbtDependencyLocks {
+        manifest_digest,
+        profile_relation_root: Some(prepared.relation_root()),
+        engine: prepared.engine.engine.as_str().to_string(),
+        engine_version: prepared.engine.version.clone(),
+        adapter_version: prepared.engine.adapter_version.clone(),
+        package_lock_digest: prepared.package_lock_digest.clone(),
+    })
+    .map_err(|e| Error::internal_err(format!("serializing the dbt lockfile: {e}")))
+}
+
+/// The `envs` of the script this dependency job is deploying, in the same shape
+/// a run receives them. Empty when the version cannot be resolved — a raw
+/// dependency job has no script row.
+async fn script_envs(
+    db: &sqlx::Pool<sqlx::Postgres>,
+    job_id: &Uuid,
+    w_id: &str,
+) -> HashMap<String, String> {
+    let Some(hash) = deploying_script_hash(db, job_id).await else {
+        return HashMap::new();
+    };
+    let envs = sqlx::query_scalar!(
+        "SELECT envs FROM script WHERE workspace_id = $1 AND hash = $2",
+        w_id,
+        hash
+    )
+    .fetch_optional(db)
+    .await
+    .ok()
+    .flatten()
+    .flatten();
+    crate::worker::build_envs(envs.as_ref()).unwrap_or_default()
+}
+
+/// The script version this dependency job is deploying. `None` for a raw
+/// dependency job (the CLI's lock generation), which has no script row.
+async fn deploying_script_hash(db: &sqlx::Pool<sqlx::Postgres>, job_id: &Uuid) -> Option<i64> {
+    sqlx::query_scalar!("SELECT runnable_id FROM v2_job WHERE id = $1", job_id)
+        .fetch_optional(db)
+        .await
+        .ok()
+        .flatten()
+        .flatten()
+}
+
+/// Why a run re-ingests its graph instead of trusting the deployed version's —
+/// and, since the reasons differ in WHOSE graph the result is, what becomes of
+/// it.
+///
+/// A model set this RUN decides — a caller's override, or a descriptor dynamic by
+/// construction — is stored under the job id so the run page shows what it built,
+/// leaving the script's ownership alone: those schemas and aliases would otherwise
+/// stand as the script's until the next deploy.
+///
+/// A moved PROFILE is the one that republishes, because every later run of this
+/// version resolves there too. Publishing is also what ENDS a drift: the check
+/// reads back the published root, so a run that saw a move and did not republish
+/// leaves the next one seeing the same move.
+#[derive(Clone, Copy, Default)]
+pub struct GraphRefresh {
+    /// This run's models are not the deployed descriptor's: a `{{ }}`
+    /// placeholder in `vars` or a `$var:` in `env` (re-resolved every run), or
+    /// an invocation that overrode `vars`. Vars steer `enabled`, alias, schema,
+    /// database and materialization, so the deployed graph names another run's
+    /// relations.
+    per_run_models: bool,
+    /// The profile resolves somewhere other than where the published usages
+    /// point. The relations moved for the VERSION, not for one invocation.
+    profile_drift: bool,
+}
+
+impl GraphRefresh {
+    /// Whether this run parses and ingests a graph of its own at all.
+    fn needed(&self) -> bool {
+        self.per_run_models || self.profile_drift
+    }
+
+    /// The job to key this graph under, or `None` to write the version's own.
+    ///
+    /// Only a DRIFT alone writes the version's: the move is permanent, and
+    /// storing it per run would leave every later run — which no longer detects
+    /// a drift, because this one published the new root — reading the pre-move
+    /// rows. A run whose models are its own goes under the job id, in both
+    /// directions: written as the version's, a narrowing selection would drop
+    /// every model this invocation left out, and a widening one would add models
+    /// that version never had.
+    fn snapshot_job(&self, job_id: uuid::Uuid) -> Option<uuid::Uuid> {
+        self.per_run_models.then_some(job_id)
+    }
+
+    /// Whether this ingest also becomes what the script owns.
+    ///
+    /// Exactly when it wrote the VERSION's graph and the caller scoped nothing.
+    /// The workspace graph takes an asset's relations from the `asset` rows and
+    /// its models, SQL, tests and `ref()` lineage from that version's
+    /// `dbt_node`/`dbt_edge`, so publishing relations the version's graph does
+    /// not name leaves those assets with no model behind them — a placeholder
+    /// that moves an alias would empty the current graph of everything dbt
+    /// contributes to it.
+    ///
+    /// So a run that stored a snapshot of its own publishes nothing, which
+    /// leaves two cases settled elsewhere and deliberately: an override's
+    /// relations are a one-off and are meant not to stand as the script's, and a
+    /// dynamic descriptor at a moved profile keeps its ownership at the deploy's
+    /// relations until a redeploy — every run of it still shows its own models,
+    /// and it re-parses regardless, so the undetected-forever drift costs it
+    /// nothing it was not already paying.
+    ///
+    /// The exact complement of `snapshot_job`, which is what lets the agent
+    /// worker's payload carry one `per_run` bit and no second flag: decouple the
+    /// two and that wire format stops describing this decision.
+    fn publishes_ownership(&self) -> bool {
+        !self.per_run_models
+    }
+
+    /// Fold in what this invocation's own arguments say about its model set.
+    fn add_caller_args(
+        &mut self,
+        descriptor: &DbtDescriptor,
+        args: &HashMap<String, Box<RawValue>>,
+    ) -> error::Result<()> {
+        if has_vars_override(args) {
+            self.per_run_models = true;
+        }
+        // A caller's selection is not necessarily a SUBSET of the deployed one:
+        // deployed `select: ["tag:nightly"]`, overridden with `["*"]`, builds models
+        // the deployed graph never had — and those are the ones whose progress, SQL
+        // and lineage the run page would otherwise have nothing to draw.
+        if selection_is_overridden(descriptor, args)? {
+            self.per_run_models = true;
+        }
+        Ok(())
+    }
+}
+
+pub struct PreparedProject {
+    pub project_dir: PathBuf,
+    pub profiles_dir: PathBuf,
+    pub engine: ProvisionedEngine,
+    /// Why this run's graph is its own rather than the deployed version's, if
+    /// it is.
+    pub graph_refresh: GraphRefresh,
+    /// Digest of the project's own files: the identity of the code that runs.
+    /// It keys the package cache (a `local:` dependency's content appears in no
+    /// manifest) and gates retry state, so a project edited between attempts
+    /// cannot resume the old one.
+    pub project_digest: String,
+    /// Resolution produced by `dbt deps` at deploy. The package cache is local
+    /// to one worker; this makes a cache miss on another worker fail closed if
+    /// an unlocked range or mutable Git revision has moved meanwhile.
+    pub package_lock_digest: Option<String>,
+    /// The workspace warehouse's NAME, the `<warehouse>` component of every
+    /// `dbt://` asset this project produces. `None` when the project brings its
+    /// own `profiles.yml` and names no warehouse, in which case there is no
+    /// stable warehouse identity to key assets on.
+    pub warehouse: Option<String>,
+    /// The descriptor's `profile.target`, passed as `--target` so it applies to
+    /// a project-owned `profiles.yml` as well as a rendered one.
+    pub target: Option<String>,
+    /// The profile target's database. Nodes that override it qualify their
+    /// `dbt://` schema segment so two databases cannot collapse onto one node.
+    pub default_database: Option<String>,
+    /// The profile target's schema, for the drift check against the lockfile.
+    pub default_schema: Option<String>,
+    pub script_path: String,
+    pub env: Vec<(String, String)>,
+    /// The descriptor body, kept so an ingest can re-read its `# on` / `# mute`
+    /// annotations without threading the content through every caller.
+    pub descriptor_content: String,
+    /// The descriptor's `env`, resolved, in a stable order. Feeds run identity;
+    /// `env` itself is not usable there because it carries per-job values.
+    pub descriptor_env: std::collections::BTreeMap<String, String>,
+    /// The invocation's own environment (the script's `envs`), in a stable
+    /// order. Every phase gets it, `dbt deps` included: `packages.yml` can
+    /// resolve a private package URL through `env_var()`, and a phase that saw
+    /// a different environment from the one the cache key was built on would
+    /// populate that key with the wrong tree.
+    pub invocation_env: Vec<(String, String)>,
+    /// Digest of the above. Keys the package cache alongside the descriptor's
+    /// environment; digested because the values are resolved secrets.
+    pub invocation_env_digest: u64,
+    /// Written nsjail profile for this job, when the worker sandboxes jobs.
+    /// `None` means the phases run unsandboxed, exactly as before.
+    pub sandbox_config: Option<SandboxProfile>,
+    /// One-way digest of the rendered profile — the resolved connection, not
+    /// just the names it exposes. A resource repointed from one warehouse to
+    /// another that happens to use the same database and schema names is
+    /// invisible to `relation_root`, and a retry would then execute the saved
+    /// failures against a warehouse where the successful nodes do not exist.
+    pub profile_digest: String,
+}
+
+impl PreparedProject {
+    /// Where this run's relations live: the resolved schema and database. Drift
+    /// here since the deploy means the stored graph names relations that no
+    /// longer exist.
+    fn relation_root(&self) -> String {
+        format!(
+            "{}|{}",
+            self.default_schema.as_deref().unwrap_or(""),
+            self.default_database.as_deref().unwrap_or(""),
+        )
+    }
+
+    /// The environment `dbt_project.yml`'s own `env_var()` calls render
+    /// against: the two the run gives dbt, in the order the child receives
+    /// them. `HOME` is left out on purpose — it is Windmill's, not the
+    /// project's, and it differs on every attempt.
+    fn template_env(&self) -> HashMap<String, String> {
+        self.descriptor_env
+            .iter()
+            .map(|(k, v)| (k.clone(), v.clone()))
+            .chain(self.invocation_env.iter().cloned())
+            .collect()
+    }
+
+    /// A digest of the DESCRIPTOR's resolved environment, for `run_identity`.
+    /// Digested rather than listed: the values are resolved secrets.
+    ///
+    /// Only the descriptor's own entries. `env` additionally carries `HOME`,
+    /// set to this job's directory, which differs on every attempt — hashing it
+    /// would make a retry reject its own predecessor every time.
+    fn env_digest(&self) -> String {
+        stable_digest(
+            self.descriptor_env
+                .iter()
+                .flat_map(|(k, v)| [k.as_str(), v.as_str()]),
+        )
+    }
+
+    /// Everything that decides which relations a run produces, which is what a
+    /// retry has to match before it may resume a saved `run_results.json`: same
+    /// project files, same warehouse and target, same engine. Identity only,
+    /// never credentials — the profile is digested, and the digest is one-way.
+    ///
+    /// Anything omitted here is something a redeploy could change while a stale
+    /// `run_results.json` stays eligible, so `dbt retry` would resume one
+    /// project's failures inside another. The descriptor's resolved environment
+    /// is in it because `env_var()` can drive a model's schema, database, alias
+    /// or `enabled`.
+    fn run_identity(&self) -> String {
+        // The descriptor whole, not field by field, or the next field added to it
+        // is silently left out. And the RESOLVED engine and adapter versions: an
+        // unchanged project redeployed after a release resolves a newer dbt, whose
+        // retry would otherwise feed one version's `run_results.json` to another.
+        format!(
+            "{}|{}|{}|{}|{}|{}|{}|{}|{}",
+            self.project_digest,
+            self.package_lock_digest.as_deref().unwrap_or(""),
+            self.engine.engine.as_str(),
+            self.engine.version,
+            self.engine.adapter_version.as_deref().unwrap_or(""),
+            digest(&self.descriptor_content),
+            self.env_digest(),
+            self.relation_root(),
+            self.profile_digest,
+        )
+    }
+}
+
+#[allow(clippy::too_many_arguments)]
+pub(crate) async fn prepare_project(
+    descriptor: &DbtDescriptor,
+    descriptor_content: &str,
+    locks: Option<&DbtDependencyLocks>,
+    job_dir: &str,
+    job_id: &Uuid,
+    w_id: &str,
+    // Keys the per-script retry-state cache. Passed in rather than patched onto
+    // the result afterwards: an empty value silently shares one state directory
+    // across every dbt script in the workspace, so a retry resumes another
+    // project's run_results.json.
+    script_path: &str,
+    // The version this job runs, which is the one whose stored graph the drift
+    // check below must read. `None` for a preview, which has no stored graph.
+    script_hash: Option<i64>,
+    conn: &Connection,
+    client: &AuthedClient,
+    ctx: &mut JobCtx<'_>,
+    // The invocation's own environment (script-level `envs`). Needed here
+    // because under a sandbox it must travel in the jail profile rather than
+    // on the process that execs nsjail.
+    invocation_env: &HashMap<String, String>,
+    // The script's files: the dbt project itself.
+    modules: Option<&HashMap<String, windmill_common::scripts::ScriptModule>>,
+) -> error::Result<PreparedProject> {
+    // The project IS this script's files. Nothing is fetched: the bundle is the
+    // project. A dependency job has no generic module-writing step, so it does
+    // the writing here; a run rewrites the same bytes, which costs nothing next
+    // to the dbt invocations that follow.
+    if let Some(modules) = modules {
+        write_module_files(job_dir, modules, None).await?;
+    }
+    let project_dir = PathBuf::from(job_dir);
+    if !project_dir.join("dbt_project.yml").exists() {
+        return Err(Error::BadRequest(
+            "this dbt script carries no project: `dbt_project.yml` was not found. Copy a dbt \
+             project into its `<script>__dbt/` folder and push it (`wmill sync push`)"
+                .to_string(),
+        ));
+    }
+    // Vars drive `enabled`, alias, schema, database and materialization, so a
+    // placeholder var or a `$var:` env value (re-resolved every run) makes the
+    // deploy-time graph a guess and each run re-ingests its own manifest.
+    let has_placeholder = |v: &str| v.contains("{{");
+    let graph_refresh = GraphRefresh {
+        per_run_models: descriptor
+            .vars
+            .values()
+            .flat_map(windmill_parser_yaml::dbt::string_leaves)
+            .any(has_placeholder)
+            || descriptor.env.values().any(|v| v.starts_with("$var:")),
+        ..Default::default()
+    };
+
+    let resolved_env = resolve_env(descriptor, client).await?;
+    reject_reserved_env(
+        resolved_env.iter().map(|(k, _)| k),
+        "the descriptor's `env`",
+    )?;
+    reject_reserved_env(invocation_env.keys(), "the script's environment variables")?;
+    // `PreparedProject::template_env`, before there is one.
+    let template_env: HashMap<String, String> = resolved_env
+        .iter()
+        .cloned()
+        .chain(invocation_env.iter().map(|(k, v)| (k.clone(), v.clone())))
+        .collect();
+
+    let (profiles_dir, warehouse, adapter, default_database, default_schema, profile_digest) =
+        write_profiles(descriptor, &project_dir, job_dir, client, &template_env).await?;
+    // The lockfile's version, when it pinned one for this same engine — a
+    // descriptor edited to another engine invalidates the pin.
+    let pinned_version = locks
+        .filter(|l| l.engine == descriptor.engine().as_str())
+        .map(|l| l.engine_version.as_str())
+        .filter(|v| !v.is_empty());
+    let engine = provision_engine(
+        descriptor.engine(),
+        adapter,
+        pinned_version,
+        locks
+            .filter(|l| l.engine == descriptor.engine().as_str())
+            .and_then(|l| l.adapter_version.as_deref())
+            .filter(|v| !v.is_empty()),
+        job_id,
+        w_id,
+        conn,
+        &mut *ctx,
+    )
+    .await?;
+
+    let descriptor_env: std::collections::BTreeMap<String, String> =
+        resolved_env.iter().cloned().collect();
+    let mut env = resolved_env;
+    // Both engines write their profile-independent state under the project;
+    // pinning it inside the job dir keeps a job from touching a shared $HOME.
+    env.push(("HOME".to_string(), job_dir.to_string()));
+
+    // The engines are provisioned per (version, adapter) under one cache root,
+    // and mounting that root rather than the resolved engine directory keeps
+    // the profile identical for every job on this worker.
+    let sandbox_config: Option<SandboxProfile> = if is_sandboxing_enabled() {
+        let nsjail_timeout = resolve_nsjail_timeout(conn, w_id, *job_id, ctx.timeout()).await;
+        // A SIBLING of the job directory: that directory is mounted read-write
+        // into the jail, and every phase re-reads this file.
+        let sandbox_dir = PathBuf::from(format!("{job_dir}.dbt-sandbox"));
+        tokio::fs::create_dir_all(&sandbox_dir).await.map_err(|e| {
+            Error::internal_err(format!("could not create the dbt sandbox dir: {e}"))
+        })?;
+        write_file(
+            &sandbox_dir.to_string_lossy(),
+            SANDBOX_PROFILE_NAME,
+            &NSJAIL_CONFIG_RUN_DBT_CONTENT
+                .replace(
+                    "{RLIMIT_AS}",
+                    &render_nsjail_rlimit_as(NSJAIL_DBT_RLIMIT_AS_MB.as_deref(), 4096),
+                )
+                .replace("{JOB_DIR}", &escape_textproto(job_dir))
+                .replace(
+                    "{PROJECT_DIR}",
+                    &escape_textproto(&project_dir.to_string_lossy()),
+                )
+                // The engine's own directory, NOT the cache root: its siblings
+                // are other workspaces' package trees, kept apart by cache key
+                // rather than by permissions.
+                .replace(
+                    "{ENGINE_DIR}",
+                    &escape_textproto(&engine.root.to_string_lossy()),
+                )
+                .replace(
+                    "{PY_INSTALL_DIR}",
+                    &escape_textproto(&crate::PY_INSTALL_DIR),
+                )
+                .replace("{CLONE_NEWUSER}", &(!*crate::DISABLE_NUSER).to_string())
+                // Both environments the child needs: the descriptor's and the
+                // invocation's. Neither may sit on the launcher.
+                .replace(
+                    "{ENVARS}",
+                    &jail_envars(
+                        env.iter()
+                            .map(|(k, v)| (k.clone(), v.clone()))
+                            .chain(invocation_env.iter().map(|(k, v)| (k.clone(), v.clone())))
+                            .collect::<Vec<_>>()
+                            .as_slice(),
+                    ),
+                )
+                .replace("{SHARED_MOUNT}", "")
+                .replace(
+                    "{TMP_MOUNT_BLOCK}",
+                    &resolve_nsjail_tmp_mount_block(job_dir).await,
+                )
+                .replace("{TIMEOUT}", &nsjail_timeout),
+        )
+        // Fail the job rather than fall back: a `None` here means every
+        // project-controlled phase would run unsandboxed on a worker configured
+        // to isolate them, and a project can make this write fail on purpose by
+        // filling the job filesystem first.
+        .map_err(|e| {
+            Error::internal_err(format!("could not write the dbt sandbox profile: {e}"))
+        })?;
+        Some(SandboxProfile(sandbox_dir.join(SANDBOX_PROFILE_NAME)))
+    } else {
+        None
+    };
+
+    let project_digest = project_digest(modules);
+
+    // Sorted so the digest depends on the values rather than on map ordering.
+    let sorted_invocation_env = {
+        let mut v: Vec<(String, String)> = invocation_env
+            .iter()
+            .map(|(k, val)| (k.clone(), val.clone()))
+            .collect();
+        v.sort();
+        v
+    };
+    let mut prepared = PreparedProject {
+        project_digest,
+        package_lock_digest: locks.and_then(|l| l.package_lock_digest.clone()),
+        invocation_env: sorted_invocation_env.clone(),
+        invocation_env_digest: {
+            use std::hash::{Hash, Hasher};
+            let mut h = std::collections::hash_map::DefaultHasher::new();
+            for (k, v) in &sorted_invocation_env {
+                k.hash(&mut h);
+                v.hash(&mut h);
+            }
+            h.finish()
+        },
+        sandbox_config,
+        profile_digest,
+        project_dir,
+        profiles_dir,
+        engine,
+        graph_refresh,
+        warehouse,
+        target: descriptor.profile.target.clone(),
+        descriptor_content: descriptor_content.to_string(),
+        descriptor_env,
+
+        default_database,
+        default_schema,
+        script_path: script_path.to_string(),
+        env,
+    };
+    // A moved profile relocates every relation, so the stored graph names ones that
+    // no longer exist. Compared against the root recorded beside THIS VERSION's
+    // graph: not the deploy lock, which A→B→A matches while the graph sits at B,
+    // and not the newest ingest of any job, which a matching run never writes.
+    match conn {
+        Connection::Sql(db) => {
+            if let Some(stored) = sqlx::query_scalar!(
+                "SELECT relation_root_at_last_ingest FROM dbt_graph_snapshot
+                  WHERE workspace_id = $1 AND script_path = $2 AND script_hash = $3
+                    AND job_id = '00000000-0000-0000-0000-000000000000'",
+                w_id,
+                script_path,
+                script_hash,
+            )
+            .fetch_optional(db)
+            .await?
+            .flatten()
+            {
+                if stored != prepared.relation_root() {
+                    prepared.graph_refresh.profile_drift = true;
+                }
+            }
+        }
+        // An agent cannot READ the stored root, but publishing settles what the
+        // comparison asks: it re-ingests what it parsed. Under its own job id,
+        // since it cannot tell a moved profile from an unmoved one and must not
+        // overwrite the version's graph on a guess.
+        Connection::Http(_) => prepared.graph_refresh.per_run_models = true,
+    }
+    prepared.package_lock_digest =
+        install_packages(&prepared, locks.is_some(), &mut *ctx, job_id, w_id, conn).await?;
+    Ok(prepared)
+}
+/// Identity of the project's own files: what the run reproduces, and what a
+/// retry must match to be allowed to resume.
+///
+/// Sorted, so it depends on the files rather than on map ordering: a digest
+/// that moved between two runs of one project would evict the package cache
+/// every time and reject every retry. Every caller must pass the bundle; an
+/// empty one collapses every project in the workspace onto one digest, which
+/// silently lets a retry resume a DIFFERENT project's `run_results.json`.
+fn project_digest(
+    modules: Option<&HashMap<String, windmill_common::scripts::ScriptModule>>,
+) -> String {
+    let mut names: Vec<&String> = modules.map(|m| m.keys().collect()).unwrap_or_default();
+    names.sort();
+    let mut h = Sha256::new();
+    for name in names {
+        h.update(name.as_bytes());
+        h.update([0u8]);
+        if let Some(m) = modules.and_then(|m| m.get(name)) {
+            h.update(m.content.as_bytes());
+        }
+        h.update([0u8]);
+    }
+    format!("{:x}", h.finalize())[..32].to_string()
+}
+
+/// Resolve `$var:<path>` values in the descriptor's `env`. This is the only way
+/// a project using its own `profiles.yml` can get a secret into
+/// `{{ env_var() }}` without writing it into versioned script content.
+async fn resolve_env(
+    descriptor: &DbtDescriptor,
+    client: &AuthedClient,
+) -> error::Result<Vec<(String, String)>> {
+    let mut out = Vec::with_capacity(descriptor.env.len());
+    for (k, v) in &descriptor.env {
+        let value = match v.strip_prefix("$var:") {
+            Some(path) => client.get_variable_value(path.trim()).await.map_err(|e| {
+                Error::NotFound(format!("variable {path} not found for `env.{k}`: {e:#}"))
+            })?,
+            None => v.clone(),
+        };
+        out.push((k.clone(), value));
+    }
+    Ok(out)
+}
+
+async fn package_lock_digest(project_dir: &Path) -> error::Result<Option<String>> {
+    match tokio::fs::read_to_string(project_dir.join("package-lock.yml")).await {
+        Ok(lock) => Ok(Some(digest(&lock))),
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(None),
+        Err(e) => Err(Error::internal_err(format!(
+            "reading the dbt package lock: {e}"
+        ))),
+    }
+}
+
+fn package_cache_key(base: &str, lock_digest: &str) -> String {
+    digest(&format!("{base}\nresolved-lock\n{lock_digest}"))
+}
+
+/// Resolve or restore `dbt_packages/`, proving the tree matches the dependency
+/// resolution recorded when this script version was deployed.
+///
+/// dbt re-resolves ranges and mutable git revisions on every `dbt deps`; the deploy
+/// is the only place that happens here, so runs of one version cannot disagree about
+/// what they installed. A project that wants a newer version deploys again — nothing
+/// expires a tree by age, which would re-resolve mid-run and then be refused below
+/// for differing from the pin.
+async fn install_packages(
+    p: &PreparedProject,
+    require_pinned_resolution: bool,
+    ctx: &mut JobCtx<'_>,
+    job_id: &Uuid,
+    w_id: &str,
+    conn: &Connection,
+) -> error::Result<Option<String>> {
+    // A hit skips `dbt deps`, so the key covers what determines the tree: declared
+    // packages, a committed lock, and a `local:` dependency's content (no manifest
+    // holds it; the project digest stands in). Workspace too — `dbt deps` fetches
+    // private git packages, and a shared tree would run one workspace's for another.
+    let mut key = format!(
+        "{w_id}\n{}\n{}\n{:x}\n",
+        p.project_digest,
+        p.env_digest(),
+        p.invocation_env_digest,
+    );
+    let mut declares_packages = false;
+    for f in ["packages.yml", "dependencies.yml", "package-lock.yml"] {
+        let path = p.project_dir.join(f);
+        if !path.exists() {
+            continue;
+        }
+        declares_packages |= f != "package-lock.yml";
+        key.push_str(f);
+        key.push('\n');
+        key.push_str(&tokio::fs::read_to_string(&path).await.unwrap_or_default());
+    }
+    if !declares_packages {
+        return Ok(None);
+    }
+    // A committed `package-lock.yml` keys the lookup but is not the answer: dbt
+    // rewrites it when the `sha1_hash` it recorded for `packages.yml` stops
+    // matching, so holding the deploy to it would refuse the first deploy after a
+    // package is added, with no way out. The deploy records what dbt resolved.
+    let project_lock_digest = package_lock_digest(&p.project_dir).await?;
+    let expected_lock_digest = p
+        .package_lock_digest
+        .as_deref()
+        .or(project_lock_digest.as_deref());
+    if require_pinned_resolution && expected_lock_digest.is_none() {
+        return Err(Error::BadRequest(
+            "this script's lock predates deployment-pinned dbt dependencies; redeploy the project"
+                .to_string(),
+        ));
+    }
+    // Where `dbt deps` actually writes. `packages-install-path` is a project
+    // setting, and assuming the default means a project that moved it gets no
+    // cache at all: the publish finds nothing to copy and every job resolves
+    // its dependencies over the network again.
+    let target = p
+        .project_dir
+        .join(packages_install_path(&p.project_dir, &p.template_env()).await?);
+    let cached = expected_lock_digest.map(|lock| {
+        PathBuf::from(&*DBT_CACHE_DIR)
+            .join("packages")
+            .join(package_cache_key(&key, lock))
+    });
+    if let Some(cached) = cached.as_ref().filter(|cached| cached.exists()) {
+        let restored = copy_dir_watched(
+            cached,
+            &target,
+            "restoring cached dbt_packages",
+            ctx,
+            job_id,
+            w_id,
+            conn,
+        )
+        .await;
+        // A tree that went missing between `exists()` and the copy is a cache MISS,
+        // not a failed job: `dbt deps` resolves it again. Falling through costs a
+        // fetch; failing costs the run.
+        if restored.is_ok() {
+            append_logs(
+                job_id,
+                w_id,
+                "\nReusing cached dbt_packages\n".to_string(),
+                conn,
+            )
+            .await;
+            return Ok(expected_lock_digest.map(str::to_string));
+        }
+        tokio::fs::remove_dir_all(&target).await.ok();
+        append_logs(
+            job_id,
+            w_id,
+            "\nCached dbt_packages went away mid-restore; resolving them again\n".to_string(),
+            conn,
+        )
+        .await;
+    }
+    run_prep_command(
+        p,
+        dbt_command(p, &["deps"]),
+        "dbt deps",
+        ctx,
+        job_id,
+        w_id,
+        conn,
+    )
+    .await?;
+    let resolved_lock_digest = package_lock_digest(&p.project_dir).await?.ok_or_else(|| {
+        Error::ExecutionErr(
+            "`dbt deps` completed without producing package-lock.yml; Windmill cannot pin this \
+             dependency resolution across workers"
+                .to_string(),
+        )
+    })?;
+    // Against the PIN alone. Only a run has a resolution to be held to; the deploy
+    // is where one is established, so it accepts what dbt resolved and records it.
+    if let Some(pinned) = p.package_lock_digest.as_deref() {
+        if pinned != resolved_lock_digest {
+            return Err(Error::BadRequest(
+                "this project's dbt dependencies resolve differently here from the resolution \
+                 recorded when this script version was deployed; redeploy to accept the new one"
+                    .to_string(),
+            ));
+        }
+    }
+    if target.exists() {
+        let cached = PathBuf::from(&*DBT_CACHE_DIR)
+            .join("packages")
+            .join(package_cache_key(&key, &resolved_lock_digest));
+        publish_to_cache(&target, &cached, ctx, job_id, w_id, conn).await;
+    }
+    Ok(Some(resolved_lock_digest))
+}
+
+/// Copy `from` into a sibling of `cached`, then move it into place.
+///
+/// The rename is the point. The copy creates its destination and then fills it,
+/// so a concurrent job on the same host — worker processes share
+/// `DBT_CACHE_DIR` — would see `cached` exist and restore a half-written
+/// package tree. Worse, a copy interrupted by cancellation or disk pressure
+/// would leave that tree in place for every later job, so a transient failure
+/// becomes permanent. Staging keeps it under a name nothing looks up.
+/// Same pattern as the engine provisioning; best-effort, since losing the race
+/// only means the next job repopulates.
+async fn publish_to_cache(
+    from: &Path,
+    cached: &Path,
+    ctx: &mut JobCtx<'_>,
+    job_id: &Uuid,
+    w_id: &str,
+    conn: &Connection,
+) {
+    let Some(parent) = cached.parent() else {
+        return;
+    };
+    if tokio::fs::create_dir_all(parent).await.is_err() {
+        return;
+    }
+    let name = cached.file_name().unwrap_or_default().to_string_lossy();
+    let staging = cached.with_file_name(format!("{name}.staging-{job_id}"));
+    tokio::fs::remove_dir_all(&staging).await.ok();
+    if copy_dir_watched(
+        from,
+        &staging,
+        "caching dbt_packages",
+        ctx,
+        job_id,
+        w_id,
+        conn,
+    )
+    .await
+    .is_err()
+        || strip_git_remotes(&staging).await.is_err()
+        || tokio::fs::rename(&staging, cached).await.is_err()
+    {
+        tokio::fs::remove_dir_all(&staging).await.ok();
+    }
+}
+
+/// Drop the origin remotes from a `dbt_packages` tree on its way into the cache.
+///
+/// `dbt deps` clones `git:` packages and leaves each one's `.git` behind, with
+/// the URL it was given in `.git/config` — and for token auth that URL *is* the
+/// credential, since `packages.yml` renders it from `env_var()`. The cache is
+/// worker-global and outlives the job, so copying the tree verbatim would leave
+/// a live token readable by every later job on the host. Restores never fetch,
+/// so no remote is needed.
+async fn strip_git_remotes(dir: &Path) -> std::io::Result<()> {
+    let mut entries = tokio::fs::read_dir(dir).await?;
+    while let Some(e) = entries.next_entry().await? {
+        strip_git_remote(&e.path()).await?;
+    }
+    Ok(())
+}
+
+async fn strip_git_remote(dir: &Path) -> std::io::Result<()> {
+    let config = dir.join(".git").join("config");
+    if !config.exists() {
+        return Ok(());
+    }
+    let content = tokio::fs::read_to_string(&config).await?;
+    let mut out = String::with_capacity(content.len());
+    let mut in_remote = false;
+    for line in content.lines() {
+        let trimmed = line.trim_start();
+        if trimmed.starts_with('[') {
+            in_remote = trimmed.starts_with("[remote ");
+        }
+        if !in_remote {
+            out.push_str(line);
+            out.push('\n');
+        }
+    }
+    tokio::fs::write(&config, out).await
+}
+
+/// Write `profiles.yml`, either rendered from a Windmill resource or taken from
+/// the project itself. Both paths are supported (decision 8): the workspace
+/// warehouse is the ergonomic one, the project's own file is what makes an
+/// existing repo run unchanged.
+async fn write_profiles(
+    descriptor: &DbtDescriptor,
+    project_dir: &Path,
+    job_dir: &str,
+    client: &AuthedClient,
+    template_env: &HashMap<String, String>,
+) -> error::Result<(
+    PathBuf,
+    Option<String>,
+    DbtAdapter,
+    Option<String>,
+    Option<String>,
+    String,
+)> {
+    // The workspace's warehouse, always: a descriptor names one by NAME or takes
+    // `main`, and cannot name a resource at all. The NAME is what asset identity
+    // keys on, so every project on one warehouse shares its nodes while the
+    // credential stays a workspace setting only an admin writes.
+    let warehouse = descriptor
+        .profile
+        .warehouse
+        .as_deref()
+        .unwrap_or(DBT_DEFAULT_WAREHOUSE);
+
+    let declared = descriptor
+        .profile
+        .adapter
+        .as_deref()
+        .map(DbtAdapter::from_dbt_type)
+        .transpose()?;
+
+    if let Some(own) = descriptor.profile.profiles_yml.as_deref() {
+        crate::common::validate_relative_path(own, "profile.profiles_yml")?;
+        let path = project_dir.join(own);
+        let dir = path
+            .parent()
+            .ok_or_else(|| Error::BadRequest("profile.profiles_yml has no parent".to_string()))?
+            .to_path_buf();
+        // Read from the project's own file even when the descriptor declares a type:
+        // the file is what dbt connects with. Licensing is why it cannot be a hint —
+        // the Rust engines carry every adapter, so a descriptor claiming `postgres`
+        // over a `sqlserver` target would pass the CE check and connect anyway. A
+        // templated `type` is refused outright rather than taken from the
+        // descriptor, for the same reason: the claim cannot be checked against
+        // what dbt will render.
+        let target = adapter_from_profiles_yml(
+            &path,
+            &project_profile_name(project_dir, template_env).await,
+            descriptor.profile.target.as_deref(),
+        )
+        .await?;
+        let actual = target.adapter;
+        if let Some(declared) = declared.filter(|d| *d != actual).as_ref() {
+            return Err(Error::BadRequest(format!(
+                "`profile.type: {}` disagrees with `{}`, whose target uses `{}`. dbt connects \
+                 with the file, so remove `profile.type` or correct it",
+                declared.name(),
+                own,
+                actual.name(),
+            )));
+        }
+        let adapter = actual;
+        ensure_adapter_licensed(&adapter)?;
+        // The target's own database and schema, read from the file dbt connects
+        // with. A relation that sits in them is then spelled plainly, exactly as
+        // a workspace-warehouse project spells it, and one that overrides them
+        // qualifies. Where the file leaves them implicit they stay `None` and
+        // every relation qualifies, since assuming two share a database is what
+        // would collapse distinct relations onto a single node.
+        let profile_digest = digest(&tokio::fs::read_to_string(&path).await.unwrap_or_default());
+        // Identity only when the descriptor NAMES a warehouse: defaulting to
+        // `main` would key a self-hosted profile's assets onto the workspace
+        // warehouse it never connected to.
+        //
+        // The name is still resolved, because a name that matches no configured
+        // warehouse is not identity, it is a typo that would strand this
+        // project's models on a node nothing else reaches.
+        let identity = match descriptor.profile.warehouse.as_deref() {
+            Some(named) => {
+                windmill_common::workspaces::validate_dbt_warehouse_name(named)?;
+                // Only that it EXISTS: this project connects through its own
+                // file, so the connection behind the name is never opened and
+                // pulling it here would decrypt a credential for a string
+                // comparison.
+                client.dbt_warehouse_exists(named).await.map_err(|e| {
+                    Error::BadRequest(format!(
+                        "`profile.warehouse: {named}` is where this project's assets belong, so \
+                         it must name a warehouse this workspace configures: {e}"
+                    ))
+                })?;
+                Some(named.to_string())
+            }
+            None => None,
+        };
+        return Ok((
+            dir,
+            identity,
+            adapter,
+            target.database,
+            target.schema,
+            profile_digest,
+        ));
+    }
+
+    use windmill_common::workspaces::DBT_PROFILE_RESOURCE_TYPE;
+
+    let resolved = resolve_warehouse(warehouse, client).await?;
+    let workspace_target = resolved.target;
+    let value = resolved.value;
+    // From the resource's TYPE, not its shape: both kinds are objects with a `type`
+    // (Windmill's bigquery resource is a service-account JSON), so the value cannot
+    // say which it is.
+    let is_dbt_profile = resolved.resource_type == DBT_PROFILE_RESOURCE_TYPE;
+    // The block is written for the adapter it names, so a descriptor claiming another
+    // is a mistake worth naming rather than a profile rendered under the wrong type.
+    let stated = is_dbt_profile
+        .then(|| DbtAdapter::stated_by_dbt_profile(&value))
+        .transpose()?;
+    if let (Some(declared), Some(stated)) = (declared.as_ref(), stated.as_ref()) {
+        if declared != stated {
+            return Err(Error::BadRequest(format!(
+                "`profile.type: {}` disagrees with the `{warehouse}` warehouse, whose resource \
+                 states `{}`. Remove `profile.type` or correct it",
+                declared.name(),
+                stated.name(),
+            )));
+        }
+    }
+    let adapter = declared
+        .or(stated)
+        // The resource TYPE: decision 9's authority, which the warehouse now carries.
+        // Inference reads connection details and covers a workspace's own type.
+        .or_else(|| KnownAdapter::from_resource_type(&resolved.resource_type).map(DbtAdapter::from))
+        .or_else(|| KnownAdapter::infer_from_resource(&value).map(DbtAdapter::from))
+        .ok_or_else(|| {
+            Error::BadRequest(format!(
+                "could not tell which dbt adapter the `{warehouse}` warehouse needs; \
+                 set `profile.type` in the descriptor"
+            ))
+        })?;
+    ensure_adapter_licensed(&adapter)?;
+    let profile_name = project_profile_name(project_dir, template_env).await;
+    // The workspace's warehouse may name the target too, so a project that carries
+    // no connection still gets `{{ target }}` right.
+    let target = descriptor
+        .profile
+        .target
+        .as_deref()
+        .or(workspace_target.as_deref())
+        .unwrap_or("default");
+    let dir = PathBuf::from(job_dir).join("dbt_profiles");
+    tokio::fs::create_dir_all(&dir)
+        .await
+        .map_err(|e| Error::internal_err(format!("creating the profiles dir: {e}")))?;
+    let rendered = if is_dbt_profile {
+        let block = value.as_object().ok_or_else(|| {
+            Error::BadRequest(
+                "a `dbt_profile` resource is a `profiles.yml` output block, so its value must be \
+                 an object"
+                    .to_string(),
+            )
+        })?;
+        render_dbt_profile(
+            &adapter,
+            block,
+            &profile_name,
+            target,
+            descriptor.threads,
+            descriptor.profile.schema.as_deref(),
+            &dir,
+        )?
+    } else {
+        render_profile(
+            &adapter,
+            &value,
+            &profile_name,
+            target,
+            descriptor.threads,
+            descriptor.profile.schema.as_deref(),
+            &dir,
+        )?
+    };
+    write_file(dir.to_str().unwrap(), "profiles.yml", &rendered.yaml)?;
+    if let Some(pem) = rendered.root_certificate_pem.as_deref() {
+        write_file(
+            dir.to_str().unwrap(),
+            crate::dbt_profiles::ROOT_CERT_FILENAME,
+            pem,
+        )?;
+    }
+    let profile_digest = profile_identity_digest(
+        &rendered.yaml,
+        &dir,
+        rendered.root_certificate_pem.as_deref(),
+        &client.token,
+    );
+    Ok((
+        dir,
+        Some(warehouse.to_string()),
+        adapter,
+        rendered.database,
+        rendered.schema,
+        profile_digest,
+    ))
+}
+
+/// Where a workspace warehouse name points: its resource path and, if the
+/// workspace names one, its target.
+async fn resolve_warehouse(
+    warehouse: &str,
+    client: &AuthedClient,
+) -> error::Result<windmill_common::workspaces::DbtWarehouseConnection> {
+    // The descriptor supplies this name, so it is checked HERE too, not only
+    // where settings are written: it reaches the route as a URL path segment,
+    // and `../../resources/get_value/...` would resolve to another route.
+    windmill_common::workspaces::validate_dbt_warehouse_name(warehouse)?;
+    // Through the API even when this worker holds the database, because the
+    // route is where a resource is interpolated against the job — `$WM_TOKEN`
+    // and its kin resolve there and nowhere the worker can reach.
+    client
+        .get_dbt_warehouse(warehouse)
+        .await
+        .map_err(|e| Error::BadRequest(format!("resolving the dbt warehouse `{warehouse}`: {e}")))
+}
+
+/// Identifies the connection a rendered profile describes, for run identity.
+///
+/// Two things in the rendered text belong to the ATTEMPT rather than the
+/// connection, and hashing either as-is makes a retry reject its own
+/// predecessor — it compares identities and finds a different one every time:
+///
+/// * the per-job profiles dir, spelled out when a private CA is configured
+///   (`sslrootcert`). The certificate is part of the connection, so it is
+///   hashed in place of its path.
+/// * the job's own token, where the warehouse resource interpolates `$WM_TOKEN`
+///   (a warehouse reached through an OIDC or on-behalf flow does). Every
+///   attempt is a new job with a new token.
+fn profile_identity_digest(
+    yaml: &str,
+    profiles_dir: &Path,
+    root_cert_pem: Option<&str>,
+    job_token: &str,
+) -> String {
+    let normalized = yaml.replace(profiles_dir.to_str().unwrap_or_default(), "$PROFILES_DIR");
+    let normalized = if job_token.is_empty() {
+        normalized
+    } else {
+        normalized.replace(job_token, "$WM_TOKEN")
+    };
+    digest(&format!(
+        "{}\n{}",
+        normalized,
+        root_cert_pem.unwrap_or_default()
+    ))
+}
+
+async fn adapter_from_profiles_yml(
+    path: &Path,
+    profile_name: &str,
+    target: Option<&str>,
+) -> error::Result<ProfileTarget> {
+    let content = tokio::fs::read_to_string(path)
+        .await
+        .map_err(|e| Error::BadRequest(format!("could not read {}: {e}", path.display())))?;
+    let v: serde_yml::Value = serde_yml::from_str(&content)
+        .map_err(|e| Error::BadRequest(format!("could not parse {}: {e}", path.display())))?;
+    // The profile the project names and the target actually in use, not the
+    // first `type:` in the file: a `profiles.yml` may define several profiles
+    // and several targets, and provisioning the wrong adapter installs the
+    // wrong package and license-checks the wrong warehouse.
+    let outputs = v
+        .get(profile_name)
+        .and_then(|p| p.get("outputs"))
+        .ok_or_else(|| {
+            Error::BadRequest(format!(
+                "{} declares no profile named `{profile_name}` (the name in dbt_project.yml)",
+                path.display()
+            ))
+        })?;
+    let target = target
+        .or_else(|| {
+            v.get(profile_name)
+                .and_then(|p| p.get("target"))
+                .and_then(|t| t.as_str())
+        })
+        .ok_or_else(|| {
+            Error::BadRequest(format!(
+                "{} names no default target for `{profile_name}`; set `profile.target`",
+                path.display()
+            ))
+        })?;
+    // dbt renders the profile through Jinja before reading it; Windmill does not,
+    // so a templated `target:` — `{{ env_var('DBT_TARGET', 'prod') }}`, which is
+    // how a repo carries one profile across environments — is a name no output
+    // has. Where the profile defines exactly one output there is nothing to
+    // choose and it is taken; otherwise the descriptor has to say which.
+    let templated_target = target.contains("{{");
+    let out = if templated_target {
+        let only = outputs
+            .as_mapping()
+            .filter(|m| m.len() == 1)
+            .and_then(|m| m.values().next());
+        only.ok_or_else(|| {
+            Error::BadRequest(format!(
+                "{} selects its target with a template (`{target}`), which dbt renders and \
+                 Windmill does not, and defines several outputs. Set `profile.target` in the \
+                 descriptor to say which one this script runs",
+                path.display()
+            ))
+        })?
+    } else {
+        outputs.get(target).ok_or_else(|| {
+            Error::BadRequest(format!(
+                "{} has no `{target}` target under `{profile_name}`",
+                path.display()
+            ))
+        })?
+    };
+    let declared_type = out
+        .get("type")
+        .and_then(|t| t.as_str())
+        .filter(|t| !t.contains("{{"));
+    let adapter = match declared_type {
+        Some(t) => DbtAdapter::from_dbt_type(t)?,
+        // REFUSED, not guessed. dbt renders the template and Windmill does not,
+        // so the descriptor's word is the only thing left — and it is worth
+        // nothing here: `profile.type: postgres` over a target resolving to
+        // `sqlserver` would pass the CE check while dbt runs the licensed
+        // adapter it bundles. A `target` may be templated (it only picks an
+        // output); the `type` inside that output may not.
+        None => {
+            return Err(Error::BadRequest(format!(
+                "{} does not state its adapter as a literal `type` — templated, or absent. \
+                 Windmill cannot resolve it, and the adapter decides both the engine and the \
+                 licence, so spell it literally in the target",
+                path.display()
+            )))
+        }
+    };
+    // The target's own database and schema, read with the same keys the renderer
+    // writes. A project that owns its profile then spells its `dbt://` paths
+    // identically to one on a workspace warehouse, which is what lets the two
+    // meet on the same node when they are on the same relation.
+    let (database_key, schema_key) = adapter.target_identity_keys();
+    let read = |k: &str| {
+        out.get(k)
+            .and_then(|v| v.as_str())
+            .map(|v| v.to_string())
+            .filter(|v| !v.is_empty() && !v.contains("{{"))
+    };
+    Ok(ProfileTarget { adapter, database: read(database_key), schema: read(schema_key) })
+}
+
+/// What a project-owned `profiles.yml` target says, for the two things Windmill
+/// needs from a file it did not write: which adapter to provision, and how to
+/// spell the relations it will produce.
+#[derive(Debug)]
+struct ProfileTarget {
+    adapter: DbtAdapter,
+    database: Option<String>,
+    schema: Option<String>,
+}
+
+lazy_static::lazy_static! {
+    /// `{{ env_var('NAME') }}` / `{{ env_var("NAME", "default") }}`.
+    static ref ENV_VAR_CALL: regex::Regex = regex::Regex::new(
+        r#"\{\{\s*env_var\(\s*['"]([^'"]+)['"]\s*(?:,\s*['"]([^'"]*)['"]\s*)?\)\s*\}\}"#
+    )
+    .unwrap();
+}
+
+/// dbt renders `env_var()` in `dbt_project.yml` as well, so a setting Windmill
+/// reads out of that file has to be rendered against the environment the run
+/// hands dbt. Left as written, Windmill acts on the template and dbt acts on the
+/// value, and the two never name the same profile or the same directory.
+///
+/// Only `env_var` is rendered — the one Jinja call dbt documents for this file.
+/// An expression that resolves to nothing is left verbatim so dbt reports it.
+fn render_env_vars(value: &str, env: &HashMap<String, String>) -> String {
+    ENV_VAR_CALL
+        .replace_all(value, |caps: &regex::Captures| {
+            env.get(&caps[1])
+                .cloned()
+                .or_else(|| caps.get(2).map(|d| d.as_str().to_string()))
+                .unwrap_or_else(|| caps[0].to_string())
+        })
+        .into_owned()
+}
+
+/// dbt takes the profile to use from `dbt_project.yml`, so a rendered
+/// `profiles.yml` has to answer to that name rather than one of our choosing.
+async fn project_profile_name(project_dir: &Path, env: &HashMap<String, String>) -> String {
+    let Ok(content) = tokio::fs::read_to_string(project_dir.join("dbt_project.yml")).await else {
+        return FALLBACK_PROFILE_NAME.to_string();
+    };
+    serde_yml::from_str::<serde_yml::Value>(&content)
+        .ok()
+        .and_then(|v| {
+            v.get("profile")
+                .and_then(|p| p.as_str())
+                .map(|s| render_env_vars(s, env))
+        })
+        .unwrap_or_else(|| FALLBACK_PROFILE_NAME.to_string())
+}
+
+/// Where the project has `dbt deps` install its packages, defaulting to dbt's
+/// own `dbt_packages`.
+///
+/// REFUSED rather than replaced when it escapes the project: dbt reads
+/// `dbt_project.yml` itself, so substituting a safe path here would only move
+/// Windmill's cache — dbt would still install to the escaping one, writing
+/// outside the job directory and leaving the cache watching a directory nothing
+/// fills.
+async fn packages_install_path(
+    project_dir: &Path,
+    env: &HashMap<String, String>,
+) -> error::Result<String> {
+    const DEFAULT: &str = "dbt_packages";
+    let Ok(content) = tokio::fs::read_to_string(project_dir.join("dbt_project.yml")).await else {
+        return Ok(DEFAULT.to_string());
+    };
+    let declared = serde_yml::from_str::<serde_yml::Value>(&content)
+        .ok()
+        .and_then(|v| {
+            v.get("packages-install-path")
+                .and_then(|p| p.as_str())
+                .map(|s| {
+                    render_env_vars(s, env)
+                        .trim()
+                        .trim_start_matches("./")
+                        .to_string()
+                })
+        })
+        .filter(|s| !s.is_empty());
+    let Some(declared) = declared else {
+        return Ok(DEFAULT.to_string());
+    };
+    if !Path::new(&declared)
+        .components()
+        .all(|c| matches!(c, std::path::Component::Normal(_)))
+    {
+        return Err(Error::BadRequest(format!(
+            "`packages-install-path: {declared}` in dbt_project.yml points outside the \
+             project; it must be a path within it, such as `dbt_packages`"
+        )));
+    }
+    Ok(declared)
+}
+
+/// The nsjail profile a sandboxed dbt phase runs under.
+const NSJAIL_CONFIG_RUN_DBT_CONTENT: &str = include_str!("../nsjail/run.dbt.config.proto");
+
+/// Build the command for a dbt phase, inside the job's sandbox when the worker
+/// has one configured.
+///
+/// Every phase is project-controlled — `dbt deps` fetches packages the project
+/// names, `parse` and `build` render project macros, and a DuckDB profile
+/// reads and writes local files — so they are the project's code, not
+/// Windmill's, and the same isolation every other executor applies has to
+/// apply here.
+///
+/// The invocation's environment must NOT reach the launcher under a sandbox:
+/// what this returns is the process that execs nsjail, and those values come
+/// from caller-controlled script metadata — an `LD_PRELOAD` naming a library
+/// from the project bundle would be loaded by the dynamic linker as the worker,
+/// before isolation exists. The jail profile carries them to the child instead
+/// (see `sandbox_config`).
+pub(crate) fn dbt_command(p: &PreparedProject, args: &[&str]) -> Command {
+    let mut cmd = match p.sandbox_config.as_ref().map(|c| c.path()) {
+        Some(config) => {
+            let mut nsjail = Command::new(NSJAIL_PATH.as_str());
+            nsjail
+                .arg("--config")
+                .arg(config)
+                .arg("--")
+                .arg(&p.engine.bin);
+            nsjail
+        }
+        None => Command::new(&p.engine.bin),
+    };
+    // The rendered profile is written with this target as its only output, but
+    // a project-owned `profiles.yml` has its own default — silently building
+    // `dev` when the descriptor asked for `prod` writes to the wrong warehouse.
+    if let Some(target) = p.target.as_deref() {
+        cmd.args(["--target", target]);
+    }
+    cmd.current_dir(&p.project_dir)
+        .env_clear()
+        .envs(PROXY_ENVS.clone())
+        .env("PATH", PATH_ENV.as_str())
+        .env("TZ", TZ_ENV.as_str())
+        .env("GIT_PATH", GIT_PATH.as_str());
+    // Both environments belong to the child. Under a sandbox they reach it through
+    // the jail profile instead: set here, they would reach the dynamic loader that
+    // execs nsjail itself, so an `LD_PRELOAD` from the project would run as the
+    // worker, before any isolation exists.
+    if p.sandbox_config.is_none() {
+        cmd.envs(p.env.iter().map(|(k, v)| (k.as_str(), v.as_str())));
+        cmd.envs(
+            p.invocation_env
+                .iter()
+                .map(|(k, v)| (k.as_str(), v.as_str())),
+        );
+    }
+    cmd.args(args)
+        .arg("--profiles-dir")
+        .arg(&p.profiles_dir)
+        // Every artifact this runtime reads is found by path, so the location is
+        // Windmill's to decide and not the project's `target-path`. An env var
+        // because `dbt deps` rejects `--target-path`, and set last so neither
+        // environment above can displace it.
+        .env("DBT_TARGET_PATH", ARTIFACTS_DIR);
+    cmd
+}
+
+/// The project's environment, as jail directives rather than launcher
+/// environment. `keep_env` passes nsjail's own environment through, so these
+/// are added on top of the Windmill-controlled ones the launcher carries.
+fn jail_envars(env: &[(String, String)]) -> String {
+    env.iter()
+        .map(|(k, v)| format!("envar: \"{}={}\"", escape_textproto(k), escape_textproto(v)))
+        .collect::<Vec<_>>()
+        .join("\n")
+}
+
+const SANDBOX_PROFILE_NAME: &str = "dbt.nsjail.config.proto";
+
+/// The written nsjail profile, kept OUTSIDE every path the jailed child can
+/// reach and removed when the job ends.
+///
+/// It cannot live in the job directory: the jail mounts that read-write, and
+/// each phase launches a fresh `nsjail --config` against this file — so a
+/// project able to write files during `build` (a DuckDB one can, through
+/// `shellfs`) could rewrite the profile and have the `after_all` test phase
+/// start with mounts of its choosing. A sibling of the job directory is not
+/// mounted at all, so the child never sees it.
+pub struct SandboxProfile(PathBuf);
+
+impl SandboxProfile {
+    fn path(&self) -> &Path {
+        &self.0
+    }
+}
+
+impl Drop for SandboxProfile {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(self.0.parent().unwrap_or(&self.0));
+    }
+}
+
+/// Escape a value for a protobuf text-format string literal.
+///
+/// Every path and environment value interpolated into the jail profile is
+/// caller-influenced — a repository directory is named by whoever wrote the
+/// repo — and a bare `"` or newline would close the string and let the rest be
+/// read as further directives, including host bind mounts.
+fn escape_textproto(s: &str) -> String {
+    let mut out = String::with_capacity(s.len());
+    for c in s.chars() {
+        match c {
+            '\\' => out.push_str("\\\\"),
+            '"' => out.push_str("\\\""),
+            '\n' => out.push_str("\\n"),
+            '\r' => out.push_str("\\r"),
+            '\t' => out.push_str("\\t"),
+            c if (c as u32) < 0x20 || c as u32 == 0x7f => {
+                out.push_str(&format!("\\x{:02x}", c as u32))
+            }
+            c => out.push(c),
+        }
+    }
+    out
+}
+
+/// Environment this runtime owns. A project setting one of these would redirect
+/// where dbt writes the artifacts Windmill reads by path — the graph, the
+/// per-node results, the retry state — so a run could succeed while Windmill
+/// records nothing. Refused rather than silently stripped, so the descriptor's
+/// author is told.
+const RESERVED_ENV_KEYS: &[&str] = &["DBT_TARGET_PATH", "DBT_PROFILES_DIR", "DBT_PROJECT_DIR"];
+
+fn reject_reserved_env<'a>(
+    env: impl IntoIterator<Item = &'a String>,
+    source: &str,
+) -> error::Result<()> {
+    for k in env {
+        if RESERVED_ENV_KEYS.iter().any(|r| r.eq_ignore_ascii_case(k)) {
+            return Err(Error::BadRequest(format!(
+                "`{k}` is set by Windmill and cannot be overridden from {source}: it decides \
+                 where dbt writes the artifacts this runtime reads"
+            )));
+        }
+    }
+    Ok(())
+}
+
+/// Fixed artifact directory, relative to the project root: `dbt_project.yml`
+/// may point `target-path` anywhere, and this runtime reads every artifact by
+/// path. Relative rather than absolute so it stays inside whatever sandbox the
+/// project runs in.
+pub const ARTIFACTS_DIR: &str = "wm_target";
+
+/// Take one attempt from the job's budget, returning its 1-based number, or
+/// `None` when nothing is left.
+///
+/// Claiming and counting are one operation because they are the retry loop's
+/// only bound: separating them is how the budget stops being spent and the loop
+/// reissues `dbt retry` until the job's deadline instead of `attempts` times.
+/// Claimed before the guards that can decline an attempt, which is harmless —
+/// each of those breaks out rather than looping again.
+fn claim_attempt(remaining: &mut u32, total: u32) -> Option<u32> {
+    if *remaining == 0 {
+        return None;
+    }
+    let attempt = total - *remaining + 1;
+    *remaining -= 1;
+    Some(attempt)
+}
+
+/// The descriptor's `retry_failed_nodes` policy, applied to whichever phase just
+/// failed. `dbt retry` rebuilds only the failed and skipped nodes, so a
+/// transient warehouse error costs those rather than the whole project.
+///
+/// Called after the model phase and again after the `after_all` test phase: a
+/// failing test is a failed node too. `remaining` is the budget for the WHOLE
+/// job, not per phase — each attempt is a real dbt invocation holding a worker
+/// slot, so a model phase that spent them all leaves none for the tests.
+#[allow(clippy::too_many_arguments)]
+async fn retry_failed_nodes(
+    policy: windmill_parser_yaml::dbt::DbtNodeRetry,
+    prepared: &PreparedProject,
+    descriptor: &DbtDescriptor,
+    inv: &Invocation,
+    job: &MiniPulledJob,
+    conn: &Connection,
+    ctx: &mut JobCtx<'_>,
+    run: &mut error::Result<()>,
+    results: &mut Vec<DbtNodeResult>,
+    remaining: &mut u32,
+) {
+    let total = policy.attempts();
+    while let Some(attempt) = claim_attempt(remaining, total) {
+        // A cancelled or timed-out job must not start another warehouse
+        // write: its failure is not the transient kind this retries, and
+        // the slot is supposed to be going away. The wait itself re-checks,
+        // since a cancel most likely arrives during it.
+        if !current_results_are_retryable(prepared).await {
+            break;
+        }
+        if !sleep_before_retry(policy.delay_seconds, &job.id, conn, ctx.deadline).await {
+            break;
+        }
+        append_logs(
+            &job.id,
+            &job.workspace_id,
+            format!("\nRetrying the nodes that failed (attempt {attempt} of {total})\n"),
+            conn,
+        )
+        .await;
+        *run = run_dbt(
+            prepared, "retry", descriptor, inv, job, conn, &mut *ctx,
+            // `dbt retry` reuses the previous invocation's selection; adding
+            // one would narrow what it resumes.
+            false,
+        )
+        .await;
+        // A retry's `run_results.json` describes only the nodes it redid, so
+        // it OVERLAYS the previous attempt's rather than replacing it. The
+        // job's result has to be every node this job touched.
+        merge_results(results, read_run_results(&prepared.project_dir).await);
+        if run.is_ok() {
+            break;
+        }
+    }
+}
+
+#[allow(clippy::too_many_arguments)]
+async fn run_dbt(
+    p: &PreparedProject,
+    command: &str,
+    descriptor: &DbtDescriptor,
+    inv: &Invocation,
+    job: &MiniPulledJob,
+    conn: &Connection,
+    ctx: &mut JobCtx<'_>,
+    with_selection: bool,
+) -> error::Result<()> {
+    let mut cmd = dbt_command(p, &[command]);
+    // The console stays human-readable and goes straight to the job log; the
+    // machine-readable copy goes to a file the progress reporter tails, so
+    // neither purpose degrades the other.
+    let log_dir = p.project_dir.join("logs");
+    cmd.arg("--log-path")
+        .arg(&log_dir)
+        .args(["--log-format-file", "json"])
+        .args(["--log-level-file", p.engine.engine.progress_log_level()]);
+
+    if with_selection && command != "retry" {
+        add_selection(&mut cmd, descriptor, inv)?;
+    }
+    // The model phase of `after_all` — and every phase of `none` — builds
+    // everything the selection names EXCEPT tests. `dbt run` would be the
+    // obvious command but covers models only, silently skipping seeds and
+    // snapshots the descriptor selected.
+    if command == "build" && !matches!(descriptor.test_behavior, DbtTestBehavior::Build) {
+        cmd.args([
+            "--exclude-resource-type",
+            "test",
+            "--exclude-resource-type",
+            "unit_test",
+        ]);
+    }
+    if command != "retry" {
+        add_vars(&mut cmd, descriptor, inv)?;
+        if let Some(t) = descriptor.threads {
+            cmd.args(["--threads", &t.to_string()]);
+        }
+        let full_refresh = arg_bool(&inv.args, "full_refresh")?.unwrap_or(descriptor.full_refresh);
+        if full_refresh && command != "test" {
+            cmd.arg("--full-refresh");
+        }
+    }
+
+    tokio::fs::remove_file(log_dir.join("dbt.log")).await.ok();
+    // `handle_child` reads the job log off these pipes. Without them the child
+    // inherits the worker's stdio and handle_child waits on streams that never
+    // arrive, so the job hangs instead of running.
+    cmd.stdout(Stdio::piped()).stderr(Stdio::piped());
+    let child = start_child_process(cmd, p.engine.bin.to_string_lossy().as_ref(), false).await?;
+    let progress = spawn_progress_reporter(p, job, conn, log_dir.join("dbt.log"));
+    let res = handle_child(
+        &job.id,
+        conn,
+        ctx.mem_peak,
+        ctx.canceled_by,
+        child,
+        false,
+        ctx.worker_name,
+        &job.workspace_id,
+        &format!("dbt {command}"),
+        // What is left of the job's wall clock: `dbt build` follows the whole
+        // preparation sequence, and the `after_all` tests follow it.
+        ctx.timeout(),
+        false,
+        &mut Some(&mut *ctx.occupancy_metrics),
+        None,
+        None,
+    )
+    .await;
+    if let Some(h) = progress {
+        h.abort();
+    }
+    res.map(|_| ())
+}
+
+/// Tail dbt's JSON event file and record each node's status as it finishes, so
+/// the asset graph shows the run advancing rather than a single opaque job.
+///
+/// Only `dbt-core-1x` emits these events today: dbt-core 2.0.0-alpha.5 accepts
+/// `--log-format-file json` but still writes a text log, so its runs surface
+/// per-model state from `run_results.json` when the invocation ends. The
+/// reporter is a no-op there rather than a second, format-sniffing code path.
+fn spawn_progress_reporter(
+    p: &PreparedProject,
+    job: &MiniPulledJob,
+    conn: &Connection,
+    log_file: PathBuf,
+) -> Option<tokio::task::JoinHandle<()>> {
+    let Connection::Sql(db) = conn else {
+        // Agent workers reach the DB only through the API, and tailing a log to
+        // POST every event would spend a request per node. Their per-model state
+        // is settled from `run_results.json` when the run ends instead: recorded
+        // in full, but arriving at the end rather than live.
+        return None;
+    };
+    if !p.engine.engine.emits_node_events() {
+        // Nothing to read: those engines write a text file log, so tailing it
+        // would burn a task per run for no events.
+        return None;
+    }
+    let (db, w_id, job_id) = (db.clone(), job.workspace_id.clone(), job.id);
+    let warehouse = p.warehouse.clone()?;
+    let default_database = p.default_database.clone();
+    Some(tokio::spawn(async move {
+        use tokio::io::{AsyncReadExt, AsyncSeekExt};
+        let mut offset = 0u64;
+        let mut tail = LogTail::default();
+        loop {
+            tokio::time::sleep(std::time::Duration::from_millis(500)).await;
+            let Ok(mut f) = tokio::fs::File::open(&log_file).await else {
+                continue;
+            };
+            // dbt truncates/rotates its log; a shrunk file means the offsets
+            // from the previous incarnation are meaningless, and keeping them
+            // would silence the tailer for the rest of the run.
+            let len = f.metadata().await.map(|m| m.len()).unwrap_or(0);
+            if len < offset {
+                offset = 0;
+                tail = LogTail::default();
+            }
+            if len == offset {
+                continue;
+            }
+            // Seek rather than re-read: a long run's log grows without bound
+            // and reading it whole every tick is quadratic in its size.
+            if f.seek(std::io::SeekFrom::Start(offset)).await.is_err() {
+                continue;
+            }
+            // BOUNDED, and heap-allocated: this reader runs in the worker
+            // process, outside the jailed child's memory limit, so reading a
+            // whole tail a macro can make arbitrarily large would take down
+            // every job on the worker. What is left waits for the next tick.
+            let mut buf = Vec::new();
+            if (&mut f)
+                .take(LOG_TICK_MAX_BYTES)
+                .read_to_end(&mut buf)
+                .await
+                .is_err()
+            {
+                continue;
+            }
+            offset += buf.len() as u64;
+            let chunk = tail.push(&String::from_utf8_lossy(&buf));
+            for line in chunk.lines() {
+                let Some(ev) = parse_node_event(line, &warehouse, default_database.as_deref())
+                else {
+                    continue;
+                };
+                windmill_common::dbt_manifest::record_run_progress(
+                    &db,
+                    &w_id,
+                    &job_id,
+                    &ev.asset_path,
+                    ev.status,
+                    ev.row_count,
+                    ev.error.as_deref(),
+                )
+                .await;
+                let _ = record_materialization(
+                    &db,
+                    &w_id,
+                    ev.asset_kind,
+                    &ev.asset_path,
+                    &ev.partition,
+                    ev.status,
+                    None,
+                    ev.row_count,
+                    ev.job_id.or(Some(job_id)),
+                    ev.error.as_deref(),
+                )
+                .await;
+            }
+        }
+    }))
+}
+
+/// How much of dbt's log one tick of the tailer takes, and how long one event
+/// may be. Both bound what the WORKER process holds: the reader lives there,
+/// not in the jailed child, and a macro can print anything into a log line.
+const LOG_TICK_MAX_BYTES: u64 = 1 << 20;
+const LOG_LINE_MAX_BYTES: usize = 256 * 1024;
+
+/// Complete lines out of a log read in chunks.
+///
+/// A tick can land mid-write, leaving a trailing partial line; it is held over
+/// rather than dropping the event it belongs to — unless it grows past
+/// `LOG_LINE_MAX_BYTES`, which no node event does, and then it is discarded
+/// through its next newline so the events after it still arrive.
+#[derive(Default)]
+struct LogTail {
+    carry: String,
+    /// Inside an over-long line: everything up to its end is dropped.
+    skipping: bool,
+}
+
+impl LogTail {
+    fn push(&mut self, chunk: &str) -> String {
+        if self.skipping {
+            match chunk.find('\n') {
+                Some(i) => {
+                    self.skipping = false;
+                    self.carry.push_str(&chunk[i + 1..]);
+                }
+                None => return String::new(),
+            }
+        } else {
+            // Appended BEFORE looking for the last newline: a line spanning
+            // three reads would otherwise have its middle fragment replace the
+            // first, and the reassembled line would be invalid JSON.
+            self.carry.push_str(chunk);
+        }
+        let complete_upto = self.carry.rfind('\n').map(|i| i + 1).unwrap_or(0);
+        let complete = self.carry[..complete_upto].to_string();
+        self.carry.drain(..complete_upto);
+        if self.carry.len() > LOG_LINE_MAX_BYTES {
+            self.carry.clear();
+            self.skipping = true;
+        }
+        complete
+    }
+}
+
+/// One `node_info`-carrying dbt log event turned into the materialization
+/// record the asset graph reads. `None` for events that are not per-node, and
+/// for nodes with no physical relation (tests, ephemeral models).
+fn parse_node_event(
+    line: &str,
+    warehouse: &str,
+    default_database: Option<&str>,
+) -> Option<RecordMaterializationRequest> {
+    let line = line.trim();
+    if !line.starts_with('{') {
+        return None;
+    }
+    let v: serde_json::Value = serde_json::from_str(line).ok()?;
+    let info = v.get("data")?.get("node_info")?;
+    let rel = info.get("node_relation")?;
+    let schema = rel.get("schema")?.as_str()?;
+    let alias = rel.get("alias")?.as_str()?;
+    let database = rel.get("database").and_then(|d| d.as_str());
+    if rel
+        .get("relation_name")
+        .and_then(|r| r.as_str())
+        .unwrap_or("")
+        .is_empty()
+    {
+        return None;
+    }
+    let status = match classify_status(info.get("node_status")?.as_str()?) {
+        DbtNodeOutcome::Started => MaterializationStatus::Running,
+        DbtNodeOutcome::Passed => MaterializationStatus::Materialized,
+        DbtNodeOutcome::Failed => MaterializationStatus::Failed,
+        // `warn` is a passing test at reduced severity, and a node that never
+        // built says nothing about the relation's state; none is a
+        // materialization.
+        DbtNodeOutcome::Warn
+        | DbtNodeOutcome::Skipped
+        | DbtNodeOutcome::NoOp
+        | DbtNodeOutcome::Unknown => return None,
+    };
+    // `None` when the derived key would not fit `asset.path`; the node keeps its
+    // manifest row and this run records no materialization for it, rather than
+    // one swallowed `value too long` per node per run.
+    let path = windmill_common::dbt_manifest::table_asset_path(
+        warehouse,
+        database,
+        schema,
+        alias,
+        default_database,
+    )?;
+    Some(RecordMaterializationRequest {
+        asset_kind: windmill_common::assets::AssetKind::Dbt,
+        asset_path: path,
+        partition: windmill_common::materialization::UNPARTITIONED.to_string(),
+        status,
+        snapshot_id: None,
+        row_count: None,
+        job_id: None,
+        error: v
+            .get("info")
+            .and_then(|i| i.get("msg"))
+            .and_then(|m| m.as_str())
+            .filter(|_| status == MaterializationStatus::Failed)
+            .map(|s| s.to_string()),
+        schema: None,
+    })
+}
+
+/// Settle each model's materialization record from `run_results.json` once the
+/// invocation ends.
+///
+/// This is what the live event tailer cannot do: the events carry no row count,
+/// and the Rust engines do not emit them at all (dbt-core 2.0.0-alpha.5 accepts
+/// `--log-format-file json` but still writes a text log). So the same records
+/// the tailer has been updating are re-stated here from the authoritative
+/// artifact, which both fills in `row_count` and gives those engines per-model
+/// state — just at the end of the run rather than during it.
+///
+/// Returns the relations it settled, and the ones the run reported but left
+/// untouched (`no-op`, `warn`, `skipped`). The two need opposite treatment
+/// afterwards, which is why they come back apart.
+async fn reconcile_materializations(
+    p: &PreparedProject,
+    results: &[DbtNodeResult],
+    job: &MiniPulledJob,
+    conn: &Connection,
+    client: &AuthedClient,
+) -> Reconciled {
+    let mut out = Reconciled::default();
+    // One batch for an agent worker's per-model state; empty on a Sql worker,
+    // which writes each row directly.
+    let mut progress: Vec<windmill_common::dbt_manifest::DbtRunProgressRequest> = vec![];
+    let Some(warehouse) = p.warehouse.as_deref() else {
+        return out;
+    };
+    for r in results {
+        let Some(path) = asset_path_of_relation(
+            r.relation_name.as_deref(),
+            warehouse,
+            p.default_database.as_deref(),
+        ) else {
+            continue;
+        };
+        let status = match classify_status(&r.status) {
+            DbtNodeOutcome::Passed => MaterializationStatus::Materialized,
+            DbtNodeOutcome::Failed => MaterializationStatus::Failed,
+            // Tests and nodes that built nothing say nothing about a relation's
+            // state — but the tailer may already have written `running` for one,
+            // so they are reported for the caller to clear rather than settle.
+            _ => {
+                out.untouched.push(path);
+                continue;
+            }
+        };
+        out.settled.push(path.clone());
+        let error = (status == MaterializationStatus::Failed)
+            .then(|| r.message.as_deref())
+            .flatten();
+        // An agent worker has no direct DB, so its outcomes go through the API —
+        // otherwise a successful agent run leaves every model with no recorded
+        // status or row count.
+        let recorded = match conn {
+            Connection::Sql(db) => {
+                windmill_common::dbt_manifest::record_run_progress(
+                    db,
+                    &job.workspace_id,
+                    &job.id,
+                    &path,
+                    status,
+                    r.rows_affected,
+                    error,
+                )
+                .await;
+                record_materialization(
+                    db,
+                    &job.workspace_id,
+                    windmill_common::assets::AssetKind::Dbt,
+                    &path,
+                    windmill_common::materialization::UNPARTITIONED,
+                    status,
+                    None,
+                    r.rows_affected,
+                    Some(job.id),
+                    error,
+                )
+                .await
+                .map_err(|e| e.to_string())
+            }
+            Connection::Http(http) => {
+                // Progress too, not only the materialization: the live reporter
+                // needs a database and does not run here, so these settled
+                // outcomes are the only per-model state an agent's run page ever
+                // gets. COLLECTED, not sent: one round trip per model would run
+                // after dbt has already finished, and a large project has
+                // hundreds. Posted once below.
+                progress.push(windmill_common::dbt_manifest::DbtRunProgressRequest {
+                    asset_path: path.clone(),
+                    status,
+                    row_count: r.rows_affected,
+                    error: error.map(|e| e.to_string()),
+                });
+                crate::agent_workers::record_materialization_from_agent_http(
+                    http,
+                    &job.workspace_id,
+                    &RecordMaterializationRequest {
+                        asset_kind: windmill_common::assets::AssetKind::Dbt,
+                        asset_path: path.clone(),
+                        partition: windmill_common::materialization::UNPARTITIONED.to_string(),
+                        status,
+                        snapshot_id: None,
+                        row_count: r.rows_affected,
+                        job_id: Some(job.id),
+                        error: error.map(|e| e.to_string()),
+                        schema: None,
+                    },
+                )
+                .await
+                .map_err(|e| e.to_string())
+            }
+        };
+        if let Err(e) = recorded {
+            tracing::warn!("recording the materialization of {path} failed: {e}");
+        }
+    }
+    if !progress.is_empty() {
+        if let Err(e) = client.record_dbt_run_progress(&progress).await {
+            // A display, not the run: the models are built either way.
+            tracing::warn!(
+                "recording dbt run progress for {} nodes: {e:#}",
+                progress.len()
+            );
+        }
+    }
+    out
+}
+
+/// What `reconcile_materializations` did, split by what has to happen next.
+#[derive(Default)]
+struct Reconciled {
+    /// Given a terminal status by this run.
+    settled: Vec<String>,
+    /// Reported by this run but not built — `no-op`, `warn`, `skipped`.
+    untouched: Vec<String>,
+}
+
+/// Leave no relation of this job's on `running`.
+///
+/// The live tailer writes `running` when a model starts, and two things can
+/// leave it there. A node that ends `no-op`, `warn` or `skipped` built nothing,
+/// so there is no outcome to record — its row is DELETED, which is what the
+/// finished run's own result says about it too (`relationOutcome` colours it
+/// nothing), so the live view and the settled view agree. And a cancellation or
+/// a timeout means dbt never wrote `run_results.json` for the node in flight, so
+/// it is reported nowhere — that one is FAILED, because the run ended without
+/// finishing it.
+///
+/// A killed worker reaches none of this and leaves its rows `running` in both
+/// tables until the retention sweep takes them; recovering those belongs to
+/// whatever reclaims the job, not here.
+///
+/// Only the SQL path can strand a row: `spawn_progress_reporter` returns `None`
+/// for an agent worker and for the engines that emit no node events, so nothing
+/// there writes `running` in the first place.
+async fn terminalize_running_relations(
+    job: &MiniPulledJob,
+    reconciled: &Reconciled,
+    conn: &Connection,
+) {
+    let Connection::Sql(db) = conn else {
+        return;
+    };
+    if let Err(e) = sqlx::query!(
+        "DELETE FROM materialized_partition
+          WHERE workspace_id = $1 AND job_id = $2 AND status = 'running'
+            AND asset_path = ANY($3)",
+        job.workspace_id,
+        job.id,
+        &reconciled.untouched
+    )
+    .execute(db)
+    .await
+    {
+        tracing::warn!("clearing the models {} left untouched: {e}", job.id);
+    }
+    let accounted: Vec<String> = reconciled
+        .settled
+        .iter()
+        .chain(reconciled.untouched.iter())
+        .cloned()
+        .collect();
+    if let Err(e) = sqlx::query!(
+        "UPDATE materialized_partition
+            SET status = 'failed',
+                error = COALESCE(error, 'the run ended before this model finished')
+          WHERE workspace_id = $1 AND job_id = $2 AND status = 'running'
+            AND NOT (asset_path = ANY($3))",
+        job.workspace_id,
+        job.id,
+        &accounted
+    )
+    .execute(db)
+    .await
+    {
+        tracing::warn!("settling the models left running by {}: {e}", job.id);
+    }
+    // The run page reads `dbt_run_progress`, so both closing writes have to land
+    // there too. Without them a cancelled or killed run — which leaves no
+    // `run_results.json`, so the page falls back to this poll — shows every
+    // in-flight model still spinning for as long as the row is retained.
+    if let Err(e) = sqlx::query!(
+        "DELETE FROM dbt_run_progress
+          WHERE workspace_id = $1 AND job_id = $2 AND status = 'running'
+            AND asset_path = ANY($3)",
+        job.workspace_id,
+        job.id,
+        &reconciled.untouched
+    )
+    .execute(db)
+    .await
+    {
+        tracing::warn!("clearing the progress rows {} left untouched: {e}", job.id);
+    }
+    if let Err(e) = sqlx::query!(
+        "UPDATE dbt_run_progress
+            SET status = 'failed',
+                error = COALESCE(error, 'the run ended before this model finished')
+          WHERE workspace_id = $1 AND job_id = $2 AND status = 'running'
+            AND NOT (asset_path = ANY($3))",
+        job.workspace_id,
+        job.id,
+        &accounted
+    )
+    .execute(db)
+    .await
+    {
+        tracing::warn!("settling the progress rows left running by {}: {e}", job.id);
+    }
+}
+
+/// `"db"."schema"."name"` from dbt into the `dbt://` path of the relation,
+/// through the same derivation the manifest ingest and the live events use.
+fn asset_path_of_relation(
+    relation_name: Option<&str>,
+    warehouse: &str,
+    default_database: Option<&str>,
+) -> Option<String> {
+    let parts = split_relation(relation_name?);
+    let (database, schema, name) = match parts.as_slice() {
+        [db, schema, name] => (Some(db.as_str()), schema.as_str(), name.as_str()),
+        [schema, name] => (None, schema.as_str(), name.as_str()),
+        _ => return None,
+    };
+    windmill_common::dbt_manifest::table_asset_path(
+        warehouse,
+        database,
+        schema,
+        name,
+        default_database,
+    )
+}
+
+/// Split `"db"."schema"."name"` on the separators BETWEEN identifiers only.
+///
+/// A period inside a quoted identifier is part of the name — `"analytics.v2"`
+/// is one schema, not two — and splitting on every period discards the relation
+/// entirely, so the model silently records no status at all.
+fn split_relation(rel: &str) -> Vec<String> {
+    let mut parts = Vec::new();
+    let mut current = String::new();
+    let mut quote: Option<char> = None;
+    let mut chars = rel.chars().peekable();
+    while let Some(c) = chars.next() {
+        match quote {
+            Some(q) => {
+                let close = if q == '[' { ']' } else { q };
+                if c == close {
+                    // Doubled is how these dialects escape their delimiter: one
+                    // literal character, not the end of the identifier. Dropping
+                    // it renames the relation, so the run records progress
+                    // against a key no node has.
+                    if chars.peek() == Some(&close) {
+                        chars.next();
+                        current.push(close);
+                    } else {
+                        quote = None;
+                    }
+                } else {
+                    current.push(c);
+                }
+            }
+            None if c == '"' || c == '`' || c == '[' => quote = Some(c),
+            None if c == '.' => parts.push(std::mem::take(&mut current)),
+            None => current.push(c),
+        }
+    }
+    parts.push(current);
+    parts.into_iter().map(|p| p.trim().to_string()).collect()
+}
+
+/// Ceiling on a preview's captured output, enforced as `run_capturing` reads.
+/// `--limit` bounds how many rows dbt returns, not how big they are — a single
+/// column can hold a megabyte — so the row clamp is not a memory bound on its
+/// own. This also bounds what a preview can store in `v2_job_completed.result`.
+const SHOW_MAX_OUTPUT_BYTES: usize = 8 * 1024 * 1024;
+
+/// Ceiling on `dbt ls`, whose output is one line per selected node. Generous
+/// against the largest real projects, and there only so a runaway cannot be
+/// unbounded.
+const LS_MAX_OUTPUT_BYTES: usize = 8 * 1024 * 1024;
+
+/// The `--limit` a `show` runs with, from the run's argument.
+///
+/// Clamped, not merely defaulted: the rows are read out of dbt's stdout, so this
+/// argument decides how much a caller can make the worker hold — and running a
+/// script needs only run permission. `SHOW_MAX_OUTPUT_BYTES` is the backstop for
+/// rows that are individually large; this keeps an ordinary preview from
+/// reaching it. Zero and negatives fall back to the default rather than reaching
+/// dbt, where `--limit 0` means something else.
+/// Whether a `show` selector can name at most one node, syntactically.
+///
+/// dbt splits a selector on WHITESPACE into a union and applies commas within
+/// each member, so the `,resource_type:model` intersection `run_show` appends
+/// binds to the last member only. More than one member therefore leaves the
+/// others unconstrained — and a seed among them is dispatched through dbt's
+/// seed runner, which writes its relation from the one command this runtime
+/// calls read-only.
+///
+/// Graph operators and wildcards are refused for the plainer reason: they
+/// resolve to a set, and `show` previews one relation.
+fn show_selects_one_node(model: &str) -> bool {
+    model.split_whitespace().count() == 1 && !model.contains(['+', '*', '@'])
+}
+
+fn show_limit(requested: Option<i64>) -> i64 {
+    let max = windmill_parser_yaml::dbt::DBT_SHOW_MAX_LIMIT as i64;
+    requested
+        .filter(|l| *l > 0)
+        .map(|l| l.min(max))
+        .unwrap_or(windmill_parser_yaml::dbt::DBT_SHOW_DEFAULT_LIMIT as i64)
+}
+
+/// `dbt show`: SELECT from the selected node and return its rows. dbt prints one
+/// document per selected node and the result is a single preview, so a selection
+/// naming several returns the first — which is what the argument's description
+/// tells the caller.
+///
+/// Captured rather than streamed, for the same reason `dbt ls` is: the job-log
+/// writer is what `NO_LOGS_AT_ALL` discards, and these rows ARE the result, not
+/// commentary about it.
+async fn run_show(
+    p: &PreparedProject,
+    descriptor: &DbtDescriptor,
+    inv: &Invocation,
+    ctx: &mut JobCtx<'_>,
+    job_id: &Uuid,
+    w_id: &str,
+    conn: &Connection,
+) -> error::Result<Box<RawValue>> {
+    // ONE node, named by the run. Not `add_selection`: the descriptor's selectors
+    // narrow a BUILD, and applying them here would preview whatever they happen
+    // to resolve to first. dbt's own failure for an empty selection carries no
+    // message at all, so the refusal has to be this one.
+    let Some(model) = arg_str(&inv.args, "model")? else {
+        return Err(Error::BadRequest(
+            "`show` previews one model's rows, so it needs `model` to name one — `stg_orders`, \
+             or any dbt selector that resolves to a single MODEL (a seed, test or \
+             snapshot is not previewable)"
+                .to_string(),
+        ));
+    };
+    let model = model.trim();
+    // ONE union member, because the intersection below binds to the LAST one:
+    // dbt splits a selector on whitespace into a union and applies commas within
+    // each member, so `my_seed safe_model,resource_type:model` still selects the
+    // seed — and dbt dispatches a selected SEED through its seed runner, which
+    // LOADS it. That writes a relation through a path recording no
+    // materialization, no graph and no retry state, from the one command this
+    // runtime advertises as read-only. Graph operators are refused for the same
+    // reason they are refused above: they resolve to a set, and `show` previews
+    // one relation.
+    if !show_selects_one_node(model) {
+        return Err(Error::BadRequest(format!(
+            "`show` previews ONE model's rows, so `model` must name exactly one — got \
+             `{model}`. A selector naming several (spaces), or a graph operator (`+`, \
+             `@`) or wildcard (`*`), resolves to a set: run `build` with it instead"
+        )));
+    }
+    let mut cmd = dbt_command(p, &["show"]);
+    add_vars(&mut cmd, descriptor, inv)?;
+    // Intersected with `resource_type:model`, because `show` is only read-only
+    // for models: dbt dispatches a selected SEED through its seed runner and
+    // loads it, which would write a relation through a path that records no
+    // materialization and no graph. A comma is dbt's own intersection, the same
+    // one `package:` already uses here, so a seed simply selects nothing. Sound
+    // only because the check above left exactly one union member for it to bind.
+    cmd.args(["--select", &format!("{model},resource_type:model")]);
+    let limit = show_limit(arg_i64(&inv.args, "limit")?);
+    cmd.args(["--output", "json", "--limit", &limit.to_string()]);
+    let stdout = run_capturing(
+        cmd,
+        "dbt show",
+        ctx,
+        job_id,
+        w_id,
+        conn,
+        SHOW_MAX_OUTPUT_BYTES,
+    )
+    .await?;
+    // dbt frames the rows as `{"node": …, "show": [ … ]}`, pretty-printed, with a
+    // banner before and a deprecation summary after — so neither "the line starting
+    // with `{`" nor "first `{` to the end" parses. A streaming deserializer stops at
+    // the first complete document and ignores the rest.
+    let mut from = 0;
+    while let Some(rel) = stdout[from..].find('{') {
+        let at = from + rel;
+        let mut docs =
+            serde_json::Deserializer::from_str(&stdout[at..]).into_iter::<serde_json::Value>();
+        if let Some(Ok(v)) = docs.next() {
+            if v.get("show").is_some() {
+                return Ok(to_raw_value(&v));
+            }
+        }
+        from = at + 1;
+    }
+    Err(Error::ExecutionErr(format!(
+        "dbt show returned no rows to parse. Output was:\n{}",
+        stdout.chars().take(2000).collect::<String>()
+    )))
+}
+
+async fn read_run_results(project_dir: &Path) -> Vec<DbtNodeResult> {
+    let Ok(content) =
+        tokio::fs::read_to_string(project_dir.join(ARTIFACTS_DIR).join("run_results.json")).await
+    else {
+        return vec![];
+    };
+    let Ok(rr) = serde_json::from_str::<RunResults>(&content) else {
+        return vec![];
+    };
+    rr.results
+        .into_iter()
+        .map(|r| DbtNodeResult {
+            unique_id: r.unique_id,
+            outcome: classify_status(&r.status).as_result_word(),
+            status: r.status,
+            execution_time: r.execution_time,
+            rows_affected: r
+                .adapter_response
+                .get("rows_affected")
+                .and_then(|v| v.as_i64())
+                // Adapters report -1 for statements with no row count.
+                .filter(|v| *v >= 0),
+            relation_name: r.relation_name,
+            message: r.message,
+            failures: r.failures,
+        })
+        .collect()
+}
+
+fn build_result(
+    p: &PreparedProject,
+    command: &str,
+    nodes: Vec<DbtNodeResult>,
+    inv: &Invocation,
+) -> DbtRunResult {
+    let mut totals = DbtTotals { total: nodes.len(), ..Default::default() };
+    for n in &nodes {
+        match classify_status(&n.status) {
+            DbtNodeOutcome::Passed => totals.success += 1,
+            DbtNodeOutcome::Warn => totals.warn += 1,
+            DbtNodeOutcome::Skipped | DbtNodeOutcome::NoOp => totals.skipped += 1,
+            _ => totals.error += 1,
+        }
+    }
+    DbtRunResult {
+        engine: p.engine.engine.as_str().to_string(),
+        engine_version: p.engine.version.clone(),
+        command: command.to_string(),
+        totals,
+        nodes,
+        invocation_args: inv.raw_args.clone(),
+    }
+}
+
+fn render_failures(r: &DbtRunResult) -> String {
+    let failed: Vec<&DbtNodeResult> = r
+        .nodes
+        .iter()
+        .filter(|n| {
+            matches!(
+                classify_status(&n.status),
+                DbtNodeOutcome::Failed | DbtNodeOutcome::Warn | DbtNodeOutcome::Unknown
+            )
+        })
+        .collect();
+    if failed.is_empty() {
+        return "dbt failed before any node ran".to_string();
+    }
+    let mut out = format!("{} dbt node(s) did not succeed:\n", failed.len());
+    for n in failed {
+        out.push_str(&format!(
+            "  {} [{}]{}{}\n",
+            n.unique_id,
+            n.status,
+            n.failures
+                .map(|f| format!(" {f} failing row(s)"))
+                .unwrap_or_default(),
+            n.message
+                .as_deref()
+                .map(|m| format!(": {m}"))
+                .unwrap_or_default(),
+        ));
+    }
+    out
+}
+
+/// What a `parse` returns. Deliberately not a `DbtRunResult`: nothing ran, so
+/// there are no per-node outcomes to report and a result shaped like a build's
+/// would invite a caller to read totals that describe nothing.
+#[derive(Serialize, Debug)]
+pub struct DbtParseResult {
+    pub engine: String,
+    pub engine_version: String,
+    pub command: &'static str,
+    /// The workspace warehouse the relations are keyed on. Absent for a project
+    /// that brings its own `profiles.yml` and names none, which is exactly the
+    /// case that stores no graph.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub warehouse: Option<String>,
+    pub nodes: usize,
+    pub edges: usize,
+    /// Nodes by dbt `resource_type` (`model`, `source`, `test`, `seed`,
+    /// `snapshot`, …). A map rather than a field each, so a resource type dbt
+    /// adds later is reported instead of silently dropped.
+    pub by_resource_type: std::collections::BTreeMap<String, usize>,
+    /// The job to read this graph back through, with
+    /// `GET /jobs/dbt_graph/{id}`. Its own, always — a version-less parse is
+    /// reachable no other way, and a versioned one resolves to its snapshot or
+    /// falls back to the version's graph, which is what it agreed with.
+    ///
+    /// Present once the write was ACCEPTED, which is the half a caller can act
+    /// on; absent when there was nothing to store (no warehouse identity to key
+    /// relations on) or nothing to store it against (a deleted script).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub graph_job: Option<Uuid>,
+}
+
+/// `dbt parse` over this job's project, stored as a graph and nothing else.
+///
+/// Three provenances end up here, and they differ only in what the graph is
+/// keyed to:
+///
+/// * a PREVIEW job — the editor refreshing its buffer — keys it to the job
+///   alone, with no version. Those rows are readable only back through that job
+///   id, never through the path, so a caller who needs no more than `jobs:run`
+///   cannot restate what a deployed project's graph says.
+/// * a job that names a deployed VERSION stores an ordinary per-run snapshot of
+///   it, suppressed when it matches what the deploy stored.
+/// * an agent worker posts either to the API, which decides the same way from
+///   the job it verified.
+///
+/// None of them publishes the path-keyed `asset` usages: a parse is a question
+/// about a project, and answering it must not move what the script owns.
+async fn run_parse_only(
+    p: &PreparedProject,
+    descriptor: &DbtDescriptor,
+    inv: &Invocation,
+    ctx: &mut JobCtx<'_>,
+    job: &MiniPulledJob,
+    conn: &Connection,
+) -> error::Result<Box<RawValue>> {
+    run_dbt_parse(p, descriptor, inv, ctx, &job.id, &job.workspace_id, conn).await?;
+    let manifest = read_manifest(&p.project_dir).await?;
+    let selected =
+        resolve_selection(p, descriptor, inv, ctx, &job.id, &job.workspace_id, conn).await?;
+    let mut result = DbtParseResult {
+        engine: p.engine.engine.as_str().to_string(),
+        engine_version: p.engine.version.clone(),
+        command: "parse",
+        warehouse: p.warehouse.clone(),
+        nodes: 0,
+        edges: 0,
+        by_resource_type: Default::default(),
+        graph_job: None,
+    };
+    // Counted before the guard, because the node and edge SETS come from the
+    // manifest and the selection while the warehouse only keys them — so a project
+    // with no warehouse identity still reports what dbt found. The placeholder
+    // reaches no row: the guard below returns before anything is written.
+    let ingested = windmill_common::dbt_manifest::ingest_manifest(
+        &manifest,
+        p.warehouse.as_deref().unwrap_or("unkeyed"),
+        p.default_database.as_deref(),
+        selected.as_ref(),
+    );
+    result.nodes = ingested.nodes.len();
+    result.edges = ingested.edges.len();
+    for n in &ingested.nodes {
+        *result
+            .by_resource_type
+            .entry(n.resource_type.clone())
+            .or_default() += 1;
+    }
+    // No warehouse identity means no `dbt://` key to store the relations under, so
+    // the parse reports what it found and stores nothing.
+    let (Some(_), Some(script_path)) = (p.warehouse.as_deref(), job.runnable_path.as_deref())
+    else {
+        return Ok(to_raw_value(&result));
+    };
+    match conn {
+        Connection::Sql(db) => match job.runnable_id.map(|h| h.0) {
+            Some(script_hash) => {
+                let stored = persist_ingest(
+                    db,
+                    &job.workspace_id,
+                    script_path,
+                    &ingested,
+                    &p.relation_root(),
+                    GraphPublisher::Version(script_hash),
+                    Some(job.id),
+                    // A parse answers for the arguments IT was given, so it can
+                    // no more stand as what the script owns than an overriding
+                    // run can. Ownership stays the deploy's.
+                    false,
+                )
+                .await?;
+                result.graph_job = stored.then_some(job.id);
+            }
+            None => {
+                let mut tx = db.begin().await?;
+                windmill_common::dbt_manifest::replace_dbt_editor_graph(
+                    &mut tx,
+                    &job.workspace_id,
+                    script_path,
+                    job.id,
+                    &job.permissioned_as,
+                    &ingested,
+                    &p.relation_root(),
+                )
+                .await?;
+                tx.commit().await?;
+                result.graph_job = Some(job.id);
+            }
+        },
+        Connection::Http(client) => {
+            client
+                .post::<_, serde_json::Value>(
+                    &format!("/api/agent_workers/dbt_graph/{}", job.workspace_id),
+                    None,
+                    // `per_run`, because a parse never writes the version's own
+                    // graph: it is a question about one invocation's project.
+                    &serde_json::json!({
+                        "job_id": job.id,
+                        "per_run": true,
+                        "relation_root": p.relation_root(),
+                        "manifest": ingested,
+                    }),
+                )
+                .await
+                .map_err(|e| {
+                    Error::internal_err(format!("publishing dbt graph from an agent worker: {e:#}"))
+                })?;
+            result.graph_job = Some(job.id);
+        }
+    }
+    Ok(to_raw_value(&result))
+}
+
+/// Refresh the stored graph from the manifest this run produced.
+async fn ingest_from_run(
+    p: &PreparedProject,
+    descriptor: &DbtDescriptor,
+    inv: &Invocation,
+    ctx: &mut JobCtx<'_>,
+    job: &MiniPulledJob,
+    conn: &Connection,
+) -> error::Result<()> {
+    // No warehouse identity means there is no graph that could go stale.
+    let Some(warehouse) = p.warehouse.as_deref() else {
+        return Ok(());
+    };
+    let Some(script_path) = job.runnable_path.as_deref() else {
+        return Ok(());
+    };
+    let manifest = read_manifest(&p.project_dir).await?;
+    // The run's own arguments: resolving the selection with empty vars could
+    // filter this run's manifest by a different node set than it built.
+    let selected =
+        resolve_selection(p, descriptor, inv, ctx, &job.id, &job.workspace_id, conn).await?;
+    let ingested = windmill_common::dbt_manifest::ingest_manifest(
+        &manifest,
+        warehouse,
+        p.default_database.as_deref(),
+        selected.as_ref(),
+    );
+    // Only a run whose models are its own snapshots per run. A static
+    // descriptor at a moved profile re-ingests the VERSION's graph, since the
+    // move outlives the run; one that neither drifted nor overrode anything
+    // re-ingests the same graph its deploy wrote and stores nothing.
+    let snapshot_job = p.graph_refresh.snapshot_job(job.id);
+    match conn {
+        Connection::Sql(db) => {
+            persist_ingest(
+                db,
+                &job.workspace_id,
+                script_path,
+                &ingested,
+                &p.relation_root(),
+                job.runnable_id
+                    .map(|h| GraphPublisher::Version(h.0))
+                    .unwrap_or(GraphPublisher::Unversioned),
+                snapshot_job,
+                p.graph_refresh.publishes_ownership(),
+            )
+            .await?;
+        }
+        // An agent worker reaches these tables only through the API. Publishing
+        // is the whole of what it needs: a worker that can replace the graph
+        // never has to establish that the stored one still describes its
+        // profile, because it stores what it just parsed.
+        Connection::Http(client) => {
+            client
+                .post::<_, serde_json::Value>(
+                    &format!("/api/agent_workers/dbt_graph/{}", job.workspace_id),
+                    None,
+                    // Only the job id: the server reads the path and version
+                    // from the job it verified, so this cannot name another
+                    // script's graph.
+                    &serde_json::json!({
+                        "job_id": job.id,
+                        "per_run": snapshot_job.is_some(),
+                        "relation_root": p.relation_root(),
+                        "manifest": ingested,
+                    }),
+                )
+                .await
+                .map_err(|e| {
+                    Error::internal_err(format!("publishing dbt graph from an agent worker: {e:#}"))
+                })?;
+        }
+    }
+    // Synchronously, not through the notify poller: the ingest just rewrote this
+    // script's `asset` rows and the poll is seconds away, so anything in this
+    // process reading the producer map meanwhile would see the pre-refresh copy.
+    // The `notify_event` the transaction emitted still reaches every other process.
+    windmill_queue::asset_dispatch::ASSET_PRODUCER_WRITES_CACHE.remove(&job.workspace_id);
+    Ok(())
+}
+
+/// Who is publishing a graph, which decides whether it may.
+#[derive(Clone, Copy)]
+enum GraphPublisher {
+    /// The script version this job belongs to, whether it is deploying that
+    /// version or running it. Publishes while the version is still the newest
+    /// for the path: a slow deploy — or a long run — of an older version
+    /// finishing later would otherwise describe code no longer deployed.
+    Version(i64),
+    /// No version behind the job: a preview, or a raw dependency job whose
+    /// `script_path` is chosen by a caller who needs only `jobs:run`. Never
+    /// publishes, so a run-only principal cannot rewrite another script's
+    /// graph.
+    Unversioned,
+}
+
+/// Replace this script's graph, unless a newer version of it has been deployed.
+///
+/// Write one ingest: the sidecar rows and the `asset` usages the manifest
+/// implies. No subscriptions — a `dbt://` one could never fire.
+///
+/// Returns whether this job was still the one entitled to the path-keyed half —
+/// false once a newer version has superseded it, or once the version is gone.
+async fn persist_ingest(
+    db: &sqlx::Pool<sqlx::Postgres>,
+    w_id: &str,
+    script_path: &str,
+    ingested: &windmill_common::dbt_manifest::IngestedManifest,
+    relation_root: &str,
+    publisher: GraphPublisher,
+    // Set for a RUN whose model set depends on its own arguments: that graph is
+    // a snapshot of this run and must not overwrite what another run of the same
+    // version saw. A deploy passes `None` and writes the version's own graph, as
+    // does a run that found the profile moved — that move is the version's.
+    run_snapshot: Option<uuid::Uuid>,
+    // Whether this ingest also becomes what the SCRIPT owns: the path-keyed
+    // `asset` usages, and the relation root the drift check reads back. False
+    // for a graph the caller's own arguments scoped (`GraphRefresh`).
+    publish_ownership: bool,
+) -> error::Result<bool> {
+    let GraphPublisher::Version(script_hash) = publisher else {
+        // No version to attribute the graph to — an inline or preview run, which
+        // deploys nothing and must not touch what a deploy wrote.
+        return Ok(false);
+    };
+    let mut tx = db.begin().await?;
+    // Deletion only soft-updates `script`, so re-inserting would republish model
+    // SQL a user deleted. NOT `archived`: every redeploy archives the parent, and
+    // treating that as deletion would deny v1 the graph its own runs render. An
+    // explicit archive still waits on `FOR UPDATE` and clears afterwards.
+    let deleted = sqlx::query_scalar!(
+        "SELECT deleted FROM script WHERE workspace_id = $1 AND hash = $2 FOR UPDATE",
+        w_id,
+        script_hash,
+    )
+    .fetch_optional(&mut *tx)
+    .await?
+    .unwrap_or(true);
+    if deleted {
+        return Ok(false);
+    }
+    // Written without regard to NEWER versions: the rows are keyed by this one, so
+    // an older deploy finishing late overwrites nothing and its own runs still
+    // render.
+    windmill_common::dbt_manifest::replace_dbt_manifest(
+        &mut tx,
+        w_id,
+        script_path,
+        script_hash,
+        run_snapshot,
+        ingested,
+        relation_root,
+    )
+    .await?;
+    // Beside the graph just written, not the ownership below: this is the root the
+    // STORED VERSION GRAPH describes. Hung off publication, a version that cannot
+    // claim the path records nothing and compares against a stale root forever.
+    // Only the DEPLOYED row: a run's own snapshot left its root as it was.
+    if run_snapshot.is_none() {
+        sqlx::query!(
+            "UPDATE dbt_graph_snapshot SET relation_root_at_last_ingest = $4
+          WHERE workspace_id = $1 AND script_path = $2 AND script_hash = $3
+            AND job_id = '00000000-0000-0000-0000-000000000000'",
+            w_id,
+            script_path,
+            script_hash,
+            relation_root,
+        )
+        .execute(&mut *tx)
+        .await?;
+    }
+    // What follows is keyed by PATH, so it belongs to the newest version alone: an
+    // older deploy, or a run whose `vars`/`select` describe one invocation, stops
+    // here. Publishing either as ownership would leave the workspace graph wrong
+    // until the next deploy, since a static descriptor never ingests again.
+    if !publish_ownership {
+        tx.commit().await?;
+        return Ok(true);
+    }
+    if !claim_graph_publication(&mut tx, w_id, script_path, publisher).await? {
+        tx.commit().await?;
+        return Ok(false);
+    }
+    windmill_common::assets::replace_static_asset_usage(
+        &mut tx,
+        w_id,
+        script_path,
+        &ingested.assets,
+    )
+    .await?;
+    // A `dbt://` subscription can never fire, so none are derived from the
+    // manifest. The delete stays to clear what earlier versions wrote, which would
+    // otherwise keep drawing cascade arrows that wake nothing.
+    sqlx::query!(
+        "DELETE FROM script_trigger
+          WHERE workspace_id = $1 AND runnable_kind = 'script' AND runnable_path = $2
+            AND trigger_kind = 'asset' AND trigger_ref LIKE 'dbt://%'",
+        w_id,
+        script_path,
+    )
+    .execute(&mut *tx)
+    .await?;
+    tx.commit().await?;
+    Ok(true)
+}
+
+/// Serialize publishers for one script path and confirm this job's version is
+/// still the newest. Both happen inside the caller's transaction, so a newer
+/// publisher either commits before this check sees it, or waits behind it and
+/// overwrites afterwards — which is the correct order either way.
+///
+/// Only the PATH-keyed writes need this. The graph itself is keyed by version,
+/// so two deploys of one path write disjoint rows and neither can lose.
+async fn claim_graph_publication(
+    tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
+    w_id: &str,
+    script_path: &str,
+    publisher: GraphPublisher,
+) -> error::Result<bool> {
+    let mine = match publisher {
+        GraphPublisher::Unversioned => return Ok(false),
+        GraphPublisher::Version(hash) => hash,
+    };
+    sqlx::query!(
+        "SELECT pg_advisory_xact_lock(hashtext($1))",
+        format!("dbt_graph:{w_id}:{script_path}")
+    )
+    .execute(&mut **tx)
+    .await?;
+    // Not `get_latest_script_hash`: its `lock IS NOT NULL` predicate names the
+    // PREVIOUS version while this one is being deployed, so every deploy would
+    // look superseded.
+    let latest = sqlx::query_scalar!(
+        "SELECT hash FROM script WHERE workspace_id = $1 AND path = $2 \
+           AND deleted = false AND archived = false \
+         ORDER BY created_at DESC LIMIT 1",
+        w_id,
+        script_path
+    )
+    .fetch_optional(&mut **tx)
+    .await?;
+    // No live version left means the script was archived or deleted while this
+    // job ran, and the deploy path has already cleared its graph. Publishing now
+    // would put the asset, provenance and subscription rows back with nothing
+    // left to remove them, so a missing row is a refusal, not a free pass.
+    Ok(latest.is_some_and(|latest| latest == mine))
+}
+
+/// The node set the descriptor's selection resolves to, or `None` when it
+/// selects everything.
+///
+/// Resolved by asking dbt (`dbt ls`) rather than by interpreting the selector
+/// string: the grammar is dbt's, it is large, and reimplementing it is a
+/// standing source of divergence — the mistake Cosmos's manifest path had to
+/// make and keeps paying for.
+async fn resolve_selection(
+    p: &PreparedProject,
+    descriptor: &DbtDescriptor,
+    inv: &Invocation,
+    ctx: &mut JobCtx<'_>,
+    job_id: &Uuid,
+    w_id: &str,
+    conn: &Connection,
+) -> error::Result<Option<std::collections::HashSet<String>>> {
+    if !has_selection(descriptor, inv)? {
+        return Ok(None);
+    }
+    let mut cmd = dbt_command(p, &["ls"]);
+    // A project whose models call `var()` without a default fails to parse
+    // without these, so the selection resolver needs them exactly as the run
+    // does. Placeholders that only a run can fill are dropped rather than
+    // failing the deploy.
+    add_vars(&mut cmd, descriptor, inv)?;
+    // Spelled out rather than `all`, which dbt-core 2.x rejects — and `unit_test`
+    // is its own type, so omitting it resolves a unit-test selection to the empty
+    // set. All three engines accept every value here.
+    for t in ["model", "source", "seed", "snapshot", "test", "unit_test"] {
+        cmd.args(["--resource-type", t]);
+    }
+    cmd.args(["--output", "json", "--quiet"]);
+    add_selection(&mut cmd, descriptor, inv)?;
+    // Captured directly, not through `handle_child`: its `pipe_stdout` path goes
+    // through the job-log writer, which `NO_LOGS_AT_ALL` discards — the selection
+    // would resolve to the empty set and the ingest would wipe the script's assets
+    // while dbt went on building the descriptor's models.
+    let stdout = run_capturing(cmd, "dbt ls", ctx, job_id, w_id, conn, LS_MAX_OUTPUT_BYTES).await?;
+    let mut set = std::collections::HashSet::new();
+    for line in stdout.lines() {
+        let line = line.trim();
+        if !line.starts_with('{') {
+            continue;
+        }
+        if let Ok(v) = serde_json::from_str::<serde_json::Value>(line) {
+            if let Some(id) = v.get("unique_id").and_then(|x| x.as_str()) {
+                set.insert(id.to_string());
+            }
+        }
+    }
+    if set.is_empty() {
+        // A selection that matches nothing would be ingested as "this script
+        // owns no relations", wiping its graph and cascade edges — the same
+        // outcome a failed capture produces, and indistinguishable from it.
+        // Refuse rather than silently un-wire the script.
+        return Err(Error::ExecutionErr(
+            "the descriptor's `select`/`exclude` matched no dbt nodes; fix the selection rather \
+             than deploying a script that owns nothing"
+                .to_string(),
+        ));
+    }
+    Ok(Some(set))
+}
+
+/// A failed command's stderr is quoted back to the user, so it is bounded — and
+/// what is kept is the TAIL, because dbt prints its error summary last.
+const CAPTURE_MAX_STDERR_BYTES: usize = 64 * 1024;
+
+/// Run a command for its stdout under the job's cancellation and timeout.
+/// The same poller `handle_child` uses drives them, so a cancel or a deadline
+/// drops the wait future — which owns the child, and `kill_on_drop` then
+/// terminates it. Dropping a wait future does NOT by itself kill a process, so
+/// without that flag the child would outlive the job.
+///
+/// Reads the pipes incrementally against `max_stdout_bytes` rather than
+/// `wait_with_output`, which would buffer whatever the child chose to write
+/// before any ceiling could apply: the point of the ceiling is that the worker
+/// never holds more than it, so it has to be enforced while reading. Both pipes
+/// are drained concurrently because a child that fills the one nobody reads
+/// blocks forever.
+async fn run_capturing(
+    mut cmd: Command,
+    name: &str,
+    ctx: &mut JobCtx<'_>,
+    job_id: &Uuid,
+    w_id: &str,
+    conn: &Connection,
+    max_stdout_bytes: usize,
+) -> error::Result<String> {
+    use tokio::io::AsyncReadExt;
+
+    let mut child = cmd
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped())
+        .kill_on_drop(true)
+        .spawn()
+        .map_err(|e| Error::internal_err(format!("{name} could not be started: {e}")))?;
+    let pid = child.id();
+    let mut stdout_pipe = child
+        .stdout
+        .take()
+        .ok_or_else(|| Error::internal_err(format!("{name} has no stdout")))?;
+    let mut stderr_pipe = child
+        .stderr
+        .take()
+        .ok_or_else(|| Error::internal_err(format!("{name} has no stderr")))?;
+
+    let out = run_future_with_polling_update_job_poller(
+        *job_id,
+        ctx.timeout(),
+        conn,
+        ctx.mem_peak,
+        ctx.canceled_by,
+        async move {
+            let mut stdout: Vec<u8> = Vec::new();
+            let mut stderr: Vec<u8> = Vec::new();
+            // On the heap, not the stack: these live across the `select!`, so an
+            // array would be baked into this future's state, and the future is
+            // then moved into the job poller and boxed several layers deep. Two
+            // 16 KB arrays there overflow the worker thread's stack.
+            let mut out_buf = vec![0u8; 16 * 1024];
+            let mut err_buf = vec![0u8; 16 * 1024];
+            let (mut out_open, mut err_open) = (true, true);
+            while out_open || err_open {
+                tokio::select! {
+                    r = stdout_pipe.read(&mut out_buf[..]), if out_open => match r {
+                        Ok(0) => out_open = false,
+                        Ok(n) => {
+                            if stdout.len() + n > max_stdout_bytes {
+                                // Killed here rather than left to `kill_on_drop`
+                                // so the child is gone before the error unwinds,
+                                // not merely once this future is dropped.
+                                let _ = child.kill().await;
+                                return Err(Error::ExecutionErr(format!(
+                                    "{name} produced more than {} MB of output. Narrow the \
+                                     selection, or query the relation from a SQL script.",
+                                    max_stdout_bytes / 1024 / 1024
+                                )));
+                            }
+                            stdout.extend_from_slice(&out_buf[..n]);
+                        }
+                        Err(e) => return Err(Error::internal_err(format!("{name} failed: {e}"))),
+                    },
+                    r = stderr_pipe.read(&mut err_buf[..]), if err_open => match r {
+                        Ok(0) => err_open = false,
+                        Ok(n) => {
+                            stderr.extend_from_slice(&err_buf[..n]);
+                            if stderr.len() > CAPTURE_MAX_STDERR_BYTES {
+                                let excess = stderr.len() - CAPTURE_MAX_STDERR_BYTES;
+                                stderr.drain(..excess);
+                            }
+                        }
+                        Err(_) => err_open = false,
+                    },
+                }
+            }
+            let status = child
+                .wait()
+                .await
+                .map_err(|e| Error::internal_err(format!("{name} failed: {e}")))?;
+            Ok((status, stdout, stderr))
+        },
+        ctx.worker_name,
+        w_id,
+        &mut Some(ctx.occupancy_metrics),
+        Box::pin(futures::stream::unfold((), move |_| async move {
+            Some((get_mem_peak(pid, false).await, ()))
+        })),
+    )
+    .await?;
+    let (status, stdout, stderr) = out;
+    if !status.success() {
+        return Err(Error::ExecutionErr(format!(
+            "{name} failed: {}",
+            String::from_utf8_lossy(&stderr)
+        )));
+    }
+    Ok(String::from_utf8_lossy(&stdout).to_string())
+}
+
+/// Run a preparation command through the same child handler the build uses, so
+/// cancellation and the job timeout apply to it too.
+async fn run_prep_command(
+    p: &PreparedProject,
+    mut cmd: Command,
+    name: &str,
+    ctx: &mut JobCtx<'_>,
+    job_id: &Uuid,
+    w_id: &str,
+    conn: &Connection,
+) -> error::Result<()> {
+    cmd.stdout(Stdio::piped()).stderr(Stdio::piped());
+    let child = start_child_process(cmd, p.engine.bin.to_string_lossy().as_ref(), false).await?;
+    handle_child(
+        job_id,
+        conn,
+        ctx.mem_peak,
+        ctx.canceled_by,
+        child,
+        false,
+        ctx.worker_name,
+        w_id,
+        name,
+        ctx.timeout(),
+        false,
+        &mut Some(ctx.occupancy_metrics),
+        None,
+        None,
+    )
+    .await
+    .map(|_| ())
+}
+
+/// `dbt parse`, which writes the manifest without touching the
+/// warehouse. Both the deploy and a per-run graph refresh need the manifest
+/// before anything else happens.
+async fn run_dbt_parse(
+    p: &PreparedProject,
+    descriptor: &DbtDescriptor,
+    inv: &Invocation,
+    ctx: &mut JobCtx<'_>,
+    job_id: &Uuid,
+    w_id: &str,
+    conn: &Connection,
+) -> error::Result<()> {
+    let mut cmd = dbt_command(p, &["parse"]);
+    add_vars(&mut cmd, descriptor, inv)?;
+    run_prep_command(p, cmd, "dbt parse", ctx, job_id, w_id, conn).await
+}
+
+pub(crate) async fn read_manifest(
+    project_dir: &Path,
+) -> error::Result<windmill_common::dbt_manifest::Manifest> {
+    let path = project_dir.join(ARTIFACTS_DIR).join("manifest.json");
+    let content = tokio::fs::read_to_string(&path)
+        .await
+        .map_err(|e| Error::internal_err(format!("dbt produced no manifest.json: {e}")))?;
+    serde_json::from_str(&content)
+        .map_err(|e| Error::internal_err(format!("could not parse manifest.json: {e}")))
+}
+
+/// `dbt retry` reads `run_results.json` from the previous invocation, and
+/// Windmill gives each attempt a fresh job dir — so this is where the last one
+/// is kept. It is a fast path over `dbt_run_state`, which any worker of the
+/// group can read; only an agent worker, which cannot reach that table, is
+/// limited to what its own disk holds.
+///
+/// Keyed by principal as well, matching `dbt_run_state`. An agent worker never
+/// reads that table, so this cache is the whole boundary there: without it one
+/// principal's saved `select` and `vars` are restorable by the next.
+fn state_dir(w_id: &str, script_path: &str, permissioned_as: &str) -> PathBuf {
+    PathBuf::from(&*DBT_CACHE_DIR)
+        .join("state")
+        .join(digest(&format!("{w_id}/{script_path}/{permissioned_as}")))
+}
+
+/// Forget any saved retry state for this principal and script.
+///
+/// Called where an invocation ran the BUILD and left nothing resumable —
+/// cancelled, timed out, dead before dbt wrote `run_results.json` — because the
+/// warehouse is then no longer what the previous run's failures describe, and a
+/// `dbt retry` would rebuild against a state that moved under it. Also where the
+/// run is hidden from the script's owners, which keeps no state at all. A
+/// failure BEFORE the build touches no relation and leaves the saved run alone.
+async fn invalidate_run_state(
+    w_id: &str,
+    script_path: &str,
+    permissioned_as: &str,
+    conn: &Connection,
+) {
+    if script_path.is_empty() {
+        return;
+    }
+    if let Connection::Sql(db) = conn {
+        let _ = sqlx::query!(
+            "DELETE FROM dbt_run_state
+              WHERE workspace_id = $1 AND script_path = $2 AND permissioned_as = $3",
+            w_id,
+            script_path,
+            permissioned_as,
+        )
+        .execute(db)
+        .await
+        .inspect_err(|e| {
+            tracing::warn!("dbt: could not clear retry state for {script_path}: {e:#}")
+        });
+    }
+    let dir = state_dir(w_id, script_path, permissioned_as);
+    if let Err(e) = tokio::fs::remove_file(dir.join(CURRENT_GENERATION)).await {
+        if e.kind() != std::io::ErrorKind::NotFound {
+            tracing::warn!("dbt: could not drop local retry state for {script_path}: {e:#}");
+        }
+    }
+    // The generations too, not only the pointer. `prune_old_generations` otherwise
+    // runs at the tail of a successful SAVE, so a script whose last run went green
+    // stranded the failed run's directory, each holding a `manifest.json` that
+    // grows with the project. Keeps only what a retry may already be copying.
+    prune_old_generations(&dir, "").await;
+}
+
+async fn save_run_state(
+    p: &PreparedProject,
+    w_id: &str,
+    // Part of the state's key: a retry replaces the caller's arguments with
+    // these, so another principal must not be able to restore them.
+    permissioned_as: &str,
+    // A HIDDEN run keeps no state: the key is the principal, which every caller of
+    // an `on_behalf_of` script shares, and a retry publishes the arguments it
+    // restored — so that retry would be the one way to see a run they cannot read.
+    // A visible run discloses nothing they could not already read.
+    visible_to_owner: bool,
+    // Names this run's generation directory, so two runs of one script stage into
+    // their own and cannot publish a mixture of each other's artifacts.
+    job_id: &Uuid,
+    inv: &Invocation,
+    // Digest of the `run_results.json` a retry restored, when this run is one.
+    restored_results_digest: Option<&str>,
+    conn: &Connection,
+) -> error::Result<()> {
+    if p.script_path.is_empty() {
+        return Ok(());
+    }
+    // The previous run's state goes with it: this invocation happened, so those
+    // failures are no longer what last ran here.
+    if !visible_to_owner {
+        invalidate_run_state(w_id, &p.script_path, permissioned_as, conn).await;
+        return Ok(());
+    }
+    let identity = format!(
+        "{}|{}{ARGS_DIGEST_TAG}{}",
+        p.run_identity(),
+        inv.env_digest(),
+        inv.resolved_args_digest()
+    );
+    // As SUBMITTED, not resolved: `build_args_map` turns `$var:` and `$res:` into
+    // plaintext and this row outlives the job, so persisting the resolved value
+    // would leave a secret in the database and let a retry replay it after the
+    // grant was revoked. The restore resolves again, under whoever retries.
+    let args: HashMap<String, String> = inv
+        .raw_args
+        .iter()
+        .map(|(k, v)| (k.clone(), v.get().to_string()))
+        .collect();
+    // The durable copy, so a retry works from any worker of the group. Only
+    // `run_results.json`: the manifest is a pure function of what `identity`
+    // already pins, so the resuming worker re-derives it with a `dbt parse`.
+    let results =
+        tokio::fs::read_to_string(p.project_dir.join(ARTIFACTS_DIR).join("run_results.json"))
+            .await
+            .ok();
+    // No `run_results.json` means nothing resumable happened — cancelled, timed
+    // out, dead before dbt wrote one. The previous run's state must not stay
+    // authoritative, or `dbt retry` resumes ITS failed nodes, which are not what
+    // last ran here. Both copies go, so neither answers for the other.
+    let Some(results) = results else {
+        invalidate_run_state(w_id, &p.script_path, permissioned_as, conn).await;
+        return Ok(());
+    };
+    // A retry that ended before dbt rewrote the file leaves what the restore put
+    // there. Republishing dates the PREVIOUS attempt's failures to this job, so the
+    // next retry rebuilds nodes this one already redid — appending to an
+    // incremental model twice. As above: nothing resumable happened here.
+    if restored_results_digest == Some(digest(&results).as_str()) {
+        invalidate_run_state(w_id, &p.script_path, permissioned_as, conn).await;
+        return Ok(());
+    }
+    let mut durable_err = None;
+    if let Connection::Sql(db) = conn {
+        {
+            // Only while a live dbt version stays at this path — the test
+            // `clear_dbt_run_state_if_path_retired` retires state by, plus the
+            // language, since a rename leaves the old path archived rather than
+            // deleted and a path can come back as another language. A job already
+            // running finishes after those move or clear the row: writing then
+            // strands a failure where the script no longer is.
+            durable_err = sqlx::query!(
+                "INSERT INTO dbt_run_state (workspace_id, script_path, permissioned_as, identity, args, run_results, job_id, retryable, updated_at)
+                 SELECT $1::varchar, $2::varchar, $7::varchar, $3::text, $4::jsonb, $5::text, $6::uuid, $8::boolean, now()
+                  WHERE EXISTS (SELECT 1 FROM script
+                                 WHERE workspace_id = $1 AND path = $2
+                                   AND deleted = false AND archived = false
+                                   AND language = 'dbt')
+                 ON CONFLICT (workspace_id, script_path, permissioned_as) DO UPDATE SET
+                   identity = EXCLUDED.identity, args = EXCLUDED.args,
+                   run_results = EXCLUDED.run_results, job_id = EXCLUDED.job_id,
+                   retryable = EXCLUDED.retryable, updated_at = now()",
+                w_id,
+                &p.script_path,
+                identity,
+                serde_json::to_value(&args).unwrap_or_default(),
+                results,
+                job_id,
+                permissioned_as,
+                // Read back by the API to decide whether anything may offer a
+                // resume; the restore re-checks the results themselves, which is
+                // what tells a retry the run succeeded rather than that no state
+                // exists.
+                has_retryable_node(&results),
+            )
+            .execute(db)
+            .await
+            .err();
+        }
+    }
+    // A failed durable write leaves this generation unpublished locally too:
+    // `restore` takes a local one only when the row names it, so publishing what no
+    // row records would have this worker reject its own newest state. The previous
+    // run's goes with it, since resuming it would rebuild the wrong nodes.
+    if let Some(e) = durable_err {
+        invalidate_run_state(w_id, &p.script_path, permissioned_as, conn).await;
+        return Err(e.into());
+    }
+    let dir = state_dir(w_id, &p.script_path, permissioned_as);
+    let generation = format!("gen-{job_id}");
+    // Giving up leaves the PREVIOUS generation's pointer in place, which is
+    // harmless where a durable row exists — `restore` falls back to it. An agent
+    // worker has no row, so that pointer is all a retry reads, and it would answer
+    // for a run that is not the last one to have happened here.
+    let abandon_local = || async {
+        if matches!(conn, Connection::Http(_)) {
+            invalidate_run_state(w_id, &p.script_path, permissioned_as, conn).await;
+        }
+        Ok(())
+    };
+    let staging = dir.join(&generation);
+    tokio::fs::remove_dir_all(&staging).await.ok();
+    if tokio::fs::create_dir_all(&staging).await.is_err() {
+        return abandon_local().await;
+    }
+    for f in ["run_results.json", "manifest.json"] {
+        if tokio::fs::copy(p.project_dir.join(ARTIFACTS_DIR).join(f), staging.join(f))
+            .await
+            .is_err()
+        {
+            tokio::fs::remove_dir_all(&staging).await.ok();
+            return abandon_local().await;
+        }
+    }
+    // What produced it, environment included: a moved ref, a repointed profile or
+    // a changed script variable makes the saved results describe relations a retry
+    // would not produce. The arguments come back too, since `dbt retry` reuses the
+    // original invocation's selection and vars rather than this job's.
+    let state = SavedRunState { identity, args };
+    if tokio::fs::write(
+        staging.join("state.json"),
+        serde_json::to_vec(&state).unwrap_or_default(),
+    )
+    .await
+    .is_err()
+    {
+        tokio::fs::remove_dir_all(&staging).await.ok();
+        return abandon_local().await;
+    }
+    // Publishing is one rename over the pointer file. A reader either sees the
+    // previous generation's name or this one's, never a directory being
+    // rebuilt under it.
+    let pointer_staging = dir.join(format!(".{generation}.pointer"));
+    if tokio::fs::write(&pointer_staging, generation.as_bytes())
+        .await
+        .is_err()
+        || tokio::fs::rename(&pointer_staging, dir.join(CURRENT_GENERATION))
+            .await
+            .is_err()
+    {
+        tokio::fs::remove_file(&pointer_staging).await.ok();
+        tokio::fs::remove_dir_all(&staging).await.ok();
+        return abandon_local().await;
+    }
+    prune_old_generations(&dir, &generation).await;
+    Ok(())
+}
+
+/// Names the generation directory a retry reads. Replaced by rename, so it is
+/// always one name or the other.
+const CURRENT_GENERATION: &str = "current";
+
+/// How long a superseded generation stays readable. A retry that has already
+/// read the pointer is still copying out of that directory, so it cannot be
+/// removed the moment the next run publishes.
+const GENERATION_GRACE_SECS: u64 = 3600;
+
+/// How many superseded generations may sit inside the grace period at once.
+/// Each holds a manifest and a results copy, and the grace is a whole hour: a
+/// burst of runs would otherwise accumulate that many copies, and nothing after
+/// the burst comes back to remove them.
+const GENERATION_KEEP: usize = 4;
+
+async fn prune_old_generations(dir: &Path, keep: &str) {
+    let Ok(mut entries) = tokio::fs::read_dir(dir).await else {
+        return;
+    };
+    let now = std::time::SystemTime::now();
+    let mut young: Vec<(std::time::SystemTime, PathBuf)> = Vec::new();
+    while let Ok(Some(e)) = entries.next_entry().await {
+        let name = e.file_name().to_string_lossy().to_string();
+        if !name.starts_with("gen-") || name == keep {
+            continue;
+        }
+        let modified = e.metadata().await.ok().and_then(|m| m.modified().ok());
+        let stale = modified
+            .and_then(|t| now.duration_since(t).ok())
+            .is_some_and(|age| age.as_secs() > GENERATION_GRACE_SECS);
+        if stale {
+            tokio::fs::remove_dir_all(e.path()).await.ok();
+        } else if let Some(t) = modified {
+            young.push((t, e.path()));
+        }
+    }
+    // Oldest first, so what goes is what a retry is least likely to still be
+    // copying out of.
+    young.sort_by_key(|(t, _)| *t);
+    let excess = young.len().saturating_sub(GENERATION_KEEP);
+    for (_, path) in young.into_iter().take(excess) {
+        tokio::fs::remove_dir_all(path).await.ok();
+    }
+}
+
+/// Everything a dbt invocation is parameterized by. One struct because every
+/// command in a run — `parse`, `ls`, `build` — must see the SAME arguments and
+/// environment: a difference between any two of them means the graph describes
+/// something other than what was built, silently.
+#[derive(Clone, Default)]
+pub struct Invocation {
+    pub args: HashMap<String, Box<RawValue>>,
+    /// The args as SUBMITTED, before `$var:` / `$res:` / `$encrypted:` were
+    /// resolved. This is what run state persists: saving `args` would write the
+    /// resolved plaintext into `dbt_run_state` and the worker's `state.json`,
+    /// and a later `retry` would replay another caller's secret — after the
+    /// grant was revoked or the value rotated. The reference outlives the run;
+    /// what it pointed at must not.
+    pub raw_args: HashMap<String, Box<RawValue>>,
+    pub envs: HashMap<String, String>,
+    /// A run must fail on a `{{ }}` placeholder it cannot fill; a deploy, which
+    /// has no arguments at all, tolerates them. Declared rather than inferred
+    /// from the argument count: a run submitted with `{}` is still a run, and
+    /// treating it as a deploy would blank its placeholders and build against
+    /// an unintended schema or alias.
+    pub strict: bool,
+}
+
+impl Invocation {
+    /// Digest of the RESOLVED arguments, for retry identity.
+    ///
+    /// The saved arguments are the ones submitted, so a `$var:` in them is
+    /// re-resolved on retry — and a value that changed since the failed run
+    /// selects a different set of nodes, or an `enabled`/`schema`/`alias` that
+    /// moves the relations. Without this in the identity that retry is accepted,
+    /// and which graph it uses then depends on WHERE it lands: a worker holding
+    /// the local snapshot replays the saved manifest, while a database restore
+    /// reparses with the new value. Placement must not decide that.
+    ///
+    /// Values are the user's, and can be secrets, so they are hashed.
+    fn resolved_args_digest(&self) -> String {
+        let mut sorted: Vec<(&String, &Box<RawValue>)> = self.args.iter().collect();
+        sorted.sort_by(|a, b| a.0.cmp(b.0));
+        stable_digest(sorted.iter().flat_map(|(k, v)| [k.as_str(), v.get()]))
+    }
+
+    /// Digest of the script-level environment, for retry identity. Values are
+    /// secrets, so they are hashed rather than stored.
+    fn env_digest(&self) -> String {
+        let mut sorted: Vec<(&String, &String)> = self.envs.iter().collect();
+        sorted.sort();
+        stable_digest(sorted.iter().flat_map(|(k, v)| [k.as_str(), v.as_str()]))
+    }
+}
+
+/// A digest that survives a toolchain upgrade.
+///
+/// These values are written into `dbt_run_state.identity` and compared by a
+/// later worker, possibly built with a different Rust release —
+/// `DefaultHasher`'s output is explicitly not stable across those, so a bump
+/// would refuse every saved failure as a different project. Each part is
+/// length-prefixed so no split of the same bytes can collide.
+fn stable_digest<'a>(parts: impl Iterator<Item = &'a str>) -> String {
+    use sha2::{Digest, Sha256};
+    let mut h = Sha256::new();
+    for p in parts {
+        h.update((p.len() as u64).to_be_bytes());
+        h.update(p.as_bytes());
+    }
+    format!("{:x}", h.finalize())
+}
+
+/// Whether the invocation overrides the descriptor's `vars`, which decides
+/// whether its graph is its own rather than the deployed one.
+fn has_vars_override(args: &HashMap<String, Box<RawValue>>) -> bool {
+    args.get("vars")
+        .is_some_and(|r| !matches!(r.get().trim(), "" | "null" | "{}"))
+}
+
+/// The saved identity, split at the point resolution happens.
+///
+/// The project, warehouse, engine and env can be checked before anything is
+/// restored. The resolved-arguments digest cannot: the retry REQUEST carries
+/// only `dbt_command`, and the arguments to compare are the saved ones after
+/// this caller has re-resolved them — which happens later, in `handle_dbt_job`.
+/// Comparing the whole string up front would refuse every retry.
+fn split_identity(identity: &str) -> (&str, Option<&str>) {
+    // Tagged, not positional. The previous format was `<identity>|<env>`, so
+    // taking "everything after the last `|`" reads a pre-upgrade row's env
+    // digest as an arguments digest, leaves `<identity>` as the prefix, and
+    // rejects every saved failure on the instance as a different project.
+    match identity.rsplit_once(ARGS_DIGEST_TAG) {
+        Some((prefix, args)) => (prefix, Some(args)),
+        None => (identity, None),
+    }
+}
+
+/// Separates the resolved-arguments digest from the rest of a saved identity.
+/// A row written before it existed simply does not contain this.
+const ARGS_DIGEST_TAG: &str = "|args=";
+
+/// What an invocation was, so a later `dbt retry` can prove it is resuming the
+/// same thing rather than replaying failures somewhere else.
+#[derive(Serialize, Deserialize, Debug, Default)]
+struct SavedRunState {
+    /// Project digest, warehouse and engine — everything that decides which
+    /// relations the restored `run_results.json` describes.
+    identity: String,
+    /// The invocation's job arguments, as raw JSON per key. `dbt retry` reuses
+    /// the original selection and vars, so refreshing the graph for it needs
+    /// these rather than the retry request's.
+    args: HashMap<String, String>,
+}
+
+/// The durable half of the restore: the worker-local generation is gone (or this
+/// is another worker of the group), so the state comes from the database.
+///
+/// `run_results.json` is all that is stored. `dbt retry` also reads
+/// `manifest.json`, which is far larger and grows with the project, so it has to
+/// be re-derived with a `dbt parse` — sound because `identity` pins the project
+/// digest, the warehouse and the engine, which is everything the manifest is a
+/// function of. That parse is the caller's, on resolved arguments.
+async fn restore_from_db(
+    p: &PreparedProject,
+    w_id: &str,
+    permissioned_as: &str,
+    inv: &Invocation,
+    // The run the caller named. Re-checked here rather than trusted from the
+    // caller's earlier read: another invocation can replace the row in between,
+    // and the row this restore actually reads must still be that run.
+    expected_job: Uuid,
+    conn: &Connection,
+    no_state: Error,
+) -> error::Result<RestoredRun> {
+    let Connection::Sql(db) = conn else {
+        // An agent worker reaches the database only through the API, and this
+        // state is not exposed there.
+        return Err(no_state);
+    };
+    // The principal IS the boundary, and deliberately: a retry resumes what last
+    // ran as this identity, not what this caller ran. Adding a caller check needs an
+    // identity the worker does not have — `created_by` is a display name a token
+    // label supplies — and resuming grants nothing a caller entitled to run the
+    // script lacks. What it does add, the resumed arguments echoed in the result,
+    // and the one sharing shape where that crosses a line, are in docs/dbt-runtime.md.
+    let Some(row) = sqlx::query!(
+        "SELECT identity, args, run_results, job_id FROM dbt_run_state
+         WHERE workspace_id = $1 AND script_path = $2 AND permissioned_as = $3",
+        w_id,
+        &p.script_path,
+        permissioned_as
+    )
+    .fetch_optional(db)
+    .await?
+    else {
+        return Err(no_state);
+    };
+    if row.job_id != Some(expected_job) {
+        return Err(wrong_run(
+            expected_job,
+            row.job_id.map(|j| j.to_string()).as_deref(),
+            "for this script",
+        ));
+    }
+    let (saved_prefix, saved_args_digest) = split_identity(&row.identity);
+    if saved_prefix != format!("{}|{}", p.run_identity(), inv.env_digest()) {
+        return Err(different_project());
+    }
+    let saved_args_digest = saved_args_digest.map(str::to_string);
+    if !has_retryable_node(&row.run_results) {
+        return Err(nothing_to_retry());
+    }
+    let target = p.project_dir.join(ARTIFACTS_DIR);
+    tokio::fs::create_dir_all(&target).await.ok();
+    tokio::fs::write(target.join("run_results.json"), &row.run_results)
+        .await
+        .map_err(|e| Error::internal_err(format!("restoring run_results.json: {e}")))?;
+    // No manifest came with the row, so one has to be re-derived — but not here:
+    // these arguments are as SUBMITTED, and a `$var:` in them shapes the graph
+    // only once resolved. The caller resolves, then parses.
+    Ok(RestoredRun {
+        args: restored_args(row.args),
+        needs_parse: true,
+        args_digest: saved_args_digest,
+        results_digest: digest(&row.run_results),
+    })
+}
+
+/// Job arguments as stored, each value a raw JSON string.
+fn restored_args(args: serde_json::Value) -> HashMap<String, Box<RawValue>> {
+    serde_json::from_value::<HashMap<String, String>>(args)
+        .unwrap_or_default()
+        .into_iter()
+        .filter_map(|(k, v)| Some((k, RawValue::from_string(v).ok()?)))
+        .collect()
+}
+
+fn different_project() -> Error {
+    Error::BadRequest(
+        "the last dbt run was of a different project, warehouse or engine, so its failures do \
+         not describe this one; run the script normally instead"
+            .to_string(),
+    )
+}
+
+/// A retry named a run other than the one whose failure is held. Both ids are
+/// spelled out: only one failure is kept per script per principal, so a later run
+/// replaces it, and without the held id "that is not the one" reads as a bug.
+fn wrong_run(asked: Uuid, held: Option<&str>, held_where: &str) -> Error {
+    Error::BadRequest(match held {
+        Some(held) => format!(
+            "you asked to resume run {asked}, but the failure saved {held_where} is run {held}; \
+             only the most recent one is kept. Open {held} to retry that one, or run the script \
+             normally"
+        ),
+        None => format!(
+            "you asked to resume run {asked}, but no failure is saved {held_where}; run the \
+             script normally to rebuild"
+        ),
+    })
+}
+
+fn nothing_to_retry() -> Error {
+    Error::BadRequest(
+        "the last dbt run succeeded, so there is nothing to retry: `dbt retry` resumes the \
+         previous run's failed and skipped nodes. Run the script normally to rebuild"
+            .to_string(),
+    )
+}
+
+/// The previous invocation, restored.
+pub struct RestoredRun {
+    /// ITS arguments, as submitted, which is what the graph refresh for a retry
+    /// must use — still unresolved, so the caller resolves before using them.
+    pub args: HashMap<String, Box<RawValue>>,
+    /// Whether a `dbt parse` still owes a `manifest.json`. The local snapshot
+    /// carries one — unless it was pruned mid-restore; the database row never
+    /// does.
+    pub needs_parse: bool,
+    /// The resolved-arguments digest the saved run had, checked once the caller
+    /// has re-resolved those arguments.
+    pub args_digest: Option<String>,
+    /// Digest of the `run_results.json` this restore put in the job directory.
+    /// A retry that ends before dbt rewrites that file — cancelled, timed out —
+    /// leaves it there unchanged, and saving it would republish the PREVIOUS
+    /// attempt's failures as the newest state, so the retry after this one would
+    /// redo nodes this one already rebuilt.
+    pub results_digest: String,
+}
+
+/// Which worker-local generation a restore may use, if any.
+///
+/// The pointer is a fast path over the database row and is accepted only when it
+/// names the run that row does. An agent has no row — so for it the pointer is
+/// all there is, and its own name is the only thing that can answer "is this the
+/// run you asked to resume", which is why the check below is not the caller's.
+fn chosen_generation(
+    local: Option<String>,
+    conn: &Connection,
+    latest_job: Option<Uuid>,
+    expected_job: Uuid,
+) -> error::Result<Option<String>> {
+    let generation = match (local, conn, latest_job) {
+        (Some(g), Connection::Http(_), _) => Some(g),
+        (Some(g), _, Some(id)) if g.trim() == format!("gen-{id}") => Some(g),
+        _ => None,
+    };
+    if let Some(g) = generation.as_ref() {
+        if g.trim() != format!("gen-{expected_job}") {
+            return Err(wrong_run(
+                expected_job,
+                Some(g.trim().trim_start_matches("gen-")),
+                "on this worker",
+            ));
+        }
+    }
+    Ok(generation)
+}
+
+/// Restore the previous invocation. The `dbt parse` a database restore needs is
+/// left to the caller so it runs on RESOLVED arguments: a `$var:` reference
+/// shapes the graph only once it has a value, and parsing with the reference
+/// verbatim would hand the build a manifest of a different project than the one
+/// it goes on to build.
+async fn restore_run_state(
+    p: &PreparedProject,
+    w_id: &str,
+    permissioned_as: &str,
+    inv: &Invocation,
+    // The run the caller means to resume, which a retry always names.
+    expected_job: Uuid,
+    conn: &Connection,
+) -> error::Result<RestoredRun> {
+    if p.script_path.is_empty() {
+        // A preview has no path to key state on, and an empty key is the one
+        // that used to be shared by every dbt script in the workspace.
+        return Err(Error::BadRequest(
+            "`dbt_command: retry` needs a deployed script; a preview run has no state to \
+             resume from"
+                .to_string(),
+        ));
+    }
+    let dir = state_dir(w_id, &p.script_path, permissioned_as);
+    // Resolved ONCE, with everything read out of the generation it names.
+    // Generations are immutable, so arguments, manifest and results describe one
+    // invocation; resolving per file could pair one run's arguments with another's
+    // results.
+    let no_state = || {
+        Error::BadRequest(
+            "no previous dbt run to retry from. `dbt retry` resumes from the \
+             `run_results.json` the failed run left behind; run the script normally to rebuild"
+                .to_string(),
+        )
+    };
+    // The row is the authoritative latest state, written by whichever worker ran
+    // last, while `current` names only what THIS one saw — preferring local would
+    // let a retry on an idle worker resume an older invocation. The local snapshot
+    // is a fast path only when it names that same run: it already holds a manifest.
+    let saved_state = match conn {
+        Connection::Sql(db) => {
+            sqlx::query_scalar!(
+                "SELECT job_id FROM dbt_run_state
+              WHERE workspace_id = $1 AND script_path = $2 AND permissioned_as = $3",
+                w_id,
+                &p.script_path,
+                permissioned_as
+            )
+            .fetch_optional(db)
+            .await?
+        }
+        // An agent worker cannot read it; its local copy is all there is.
+        Connection::Http(_) => None,
+    };
+    let latest_job = saved_state.flatten();
+    if let Some(saved) = latest_job {
+        if expected_job != saved {
+            return Err(wrong_run(
+                expected_job,
+                Some(&saved.to_string()),
+                "for this script",
+            ));
+        }
+    }
+    // Authoritative including when it says nothing: no row means the last
+    // invocation left nothing resumable, and a local generation that outlived it
+    // would resurrect a run the newer one replaced. An agent worker has no such
+    // authority to consult, so its local copy stands.
+    let local = tokio::fs::read_to_string(dir.join(CURRENT_GENERATION))
+        .await
+        .ok();
+    let generation = chosen_generation(local, conn, latest_job, expected_job)?;
+    let Some(generation) = generation else {
+        return restore_from_db(
+            p,
+            w_id,
+            permissioned_as,
+            inv,
+            expected_job,
+            conn,
+            no_state(),
+        )
+        .await;
+    };
+    let snapshot = dir.join(generation.trim());
+    // The local generation is a fast path over the row for this same run, so one
+    // pruned out from under this restore falls back to the row rather than
+    // reporting nothing to resume. An agent worker has no row and gets that
+    // report, which is then true.
+    let Ok(saved_results) = tokio::fs::read_to_string(snapshot.join("run_results.json")).await
+    else {
+        return restore_from_db(
+            p,
+            w_id,
+            permissioned_as,
+            inv,
+            expected_job,
+            conn,
+            no_state(),
+        )
+        .await;
+    };
+    // dbt builds a retry's graph from the error, fail and skipped nodes alone, so
+    // retrying an all-green run selects nothing and builds nothing. Refused
+    // rather than reported as a successful run of nothing.
+    if !has_retryable_node(&saved_results) {
+        return Err(nothing_to_retry());
+    }
+    let Some(saved) = tokio::fs::read_to_string(snapshot.join("state.json"))
+        .await
+        .ok()
+        .and_then(|s| serde_json::from_str::<SavedRunState>(&s).ok())
+    else {
+        return restore_from_db(
+            p,
+            w_id,
+            permissioned_as,
+            inv,
+            expected_job,
+            conn,
+            no_state(),
+        )
+        .await;
+    };
+    let (saved_prefix, saved_args_digest) = split_identity(&saved.identity);
+    if saved_prefix != format!("{}|{}", p.run_identity(), inv.env_digest()) {
+        return Err(different_project());
+    }
+    let saved_args_digest = saved_args_digest.map(str::to_string);
+    let target = p.project_dir.join(ARTIFACTS_DIR);
+    tokio::fs::create_dir_all(&target).await.ok();
+    // From the bytes already read, not by copying the file again: a burst of saves
+    // can prune this generation mid-restore, and a `dbt retry` whose
+    // `run_results.json` went missing rebuilds nothing and reports success. The
+    // manifest has no such copy, so a failure there falls back to a `dbt parse`.
+    tokio::fs::write(target.join("run_results.json"), &saved_results)
+        .await
+        .map_err(|e| {
+            Error::internal_err(format!("could not restore the previous run's results: {e}"))
+        })?;
+    let needs_parse = tokio::fs::copy(snapshot.join("manifest.json"), target.join("manifest.json"))
+        .await
+        .is_err();
+    // The generation was chosen from a row read before the file work above. A run
+    // finishing in that window publishes a newer one, and resuming the superseded
+    // generation redoes nodes it has already rebuilt — appending to an incremental
+    // model twice. Re-read and refuse rather than resume what is no longer the last
+    // failure here.
+    if let Connection::Sql(db) = conn {
+        let still = sqlx::query_scalar!(
+            "SELECT job_id FROM dbt_run_state
+              WHERE workspace_id = $1 AND script_path = $2 AND permissioned_as = $3",
+            w_id,
+            &p.script_path,
+            permissioned_as
+        )
+        .fetch_optional(db)
+        .await?
+        .flatten();
+        if still != latest_job {
+            return Err(Error::BadRequest(
+                "another run of this script finished while this retry was starting, so its saved \
+                 failures are no longer the last ones; retry again to resume those"
+                    .to_string(),
+            ));
+        }
+    }
+    Ok(RestoredRun {
+        args: saved
+            .args
+            .into_iter()
+            .filter_map(|(k, v)| Some((k, RawValue::from_string(v).ok()?)))
+            .collect(),
+        needs_parse,
+        args_digest: saved_args_digest,
+        results_digest: digest(&saved_results),
+    })
+}
+
+/// Wait between retries, giving up if the job is cancelled or runs out of time.
+///
+/// Returns whether the retry should still happen. A plain sleep would hold the
+/// worker slot for the whole delay after a cancel and then start another dbt
+/// process on the far side of it.
+///
+/// The cancellation is READ FROM THE DATABASE each second rather than from
+/// `canceled_by`: that is only written by the job poller, which runs alongside a
+/// child process and so is not running here. Re-reading it would report the
+/// state as of the failed attempt and miss every cancel issued during the wait,
+/// which is the whole window this exists to cover.
+async fn sleep_before_retry(
+    delay_seconds: u64,
+    job_id: &Uuid,
+    conn: &Connection,
+    deadline: JobDeadline,
+) -> bool {
+    let mut left = delay_seconds;
+    loop {
+        if deadline.is_expired() || job_is_canceled(job_id, conn).await {
+            return false;
+        }
+        if left == 0 {
+            return true;
+        }
+        let step = left.min(1);
+        tokio::time::sleep(std::time::Duration::from_secs(step)).await;
+        left -= step;
+    }
+}
+
+/// Whether the job has been cancelled, as of now.
+///
+/// Only reachable with a database: the automatic retry that calls this is
+/// refused on an agent worker precisely because it could not answer here.
+async fn job_is_canceled(job_id: &Uuid, conn: &Connection) -> bool {
+    let Connection::Sql(db) = conn else {
+        return false;
+    };
+    sqlx::query_scalar!(
+        "SELECT canceled_by IS NOT NULL AS \"canceled!\" FROM v2_job_queue WHERE id = $1",
+        job_id
+    )
+    .fetch_optional(db)
+    .await
+    .map(|v| v == Some(true))
+    .unwrap_or(false)
+}
+
+/// Whether the artifacts in the job directory still name something to retry.
+async fn current_results_are_retryable(p: &PreparedProject) -> bool {
+    match tokio::fs::read_to_string(p.project_dir.join(ARTIFACTS_DIR).join("run_results.json"))
+        .await
+    {
+        Ok(s) => has_retryable_node(&s),
+        Err(_) => false,
+    }
+}
+
+/// Overlay a retry's results onto the attempt they resumed.
+///
+/// dbt writes only the nodes it redid, so replacing the accumulated results
+/// would drop every node that succeeded before the retry — the job would then
+/// report a handful of nodes and settle materializations for no others.
+fn merge_results(into: &mut Vec<DbtNodeResult>, from: Vec<DbtNodeResult>) {
+    for node in from {
+        match into.iter_mut().find(|n| n.unique_id == node.unique_id) {
+            Some(existing) => *existing = node,
+            None => into.push(node),
+        }
+    }
+}
+
+/// What a dbt node's status means, in the three terms this runtime acts on.
+///
+/// Every site classifies through here: dbt-core 1.x echoes the author's casing
+/// where 2.x uppercases, so comparing statuses inline gives each site its own
+/// answer for the same node.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum DbtNodeOutcome {
+    Started,
+    Passed,
+    Failed,
+    /// `warn`: a test failed under a severity that does not fail the run. The
+    /// relation is untouched, but the node is worth showing.
+    Warn,
+    /// `skipped`: dbt did not run the node, usually because an upstream one
+    /// failed. Says nothing about the relation, and `dbt retry` redoes it.
+    Skipped,
+    /// `no-op`: the node ran and had nothing to do (an empty microbatch, a model
+    /// with no rows to build). Tallied with `skipped` — nothing was built — but
+    /// NOT retryable: dbt's own retry set is error / fail / skipped.
+    NoOp,
+    /// A status this dbt version spells some way we do not know. Counted as an
+    /// error rather than silently passing, but never used to settle a relation.
+    Unknown,
+}
+
+impl DbtNodeOutcome {
+    /// The word this outcome is published as in a job's result. Stable by
+    /// contract: a dbt release may rename its own status, and this must not
+    /// move with it.
+    fn as_result_word(&self) -> &'static str {
+        match self {
+            // A finished node is never `Started`; it is spelled here so the
+            // match stays exhaustive rather than falling into `unknown`.
+            DbtNodeOutcome::Started => "started",
+            DbtNodeOutcome::Passed => "passed",
+            DbtNodeOutcome::Failed => "failed",
+            DbtNodeOutcome::Warn => "warned",
+            DbtNodeOutcome::Skipped => "skipped",
+            DbtNodeOutcome::NoOp => "no_op",
+            DbtNodeOutcome::Unknown => "unknown",
+        }
+    }
+}
+
+fn classify_status(status: &str) -> DbtNodeOutcome {
+    match status.trim().to_ascii_lowercase().as_str() {
+        "started" => DbtNodeOutcome::Started,
+        "success" | "pass" => DbtNodeOutcome::Passed,
+        // `partial success` builds the relation and then fails its tests: the
+        // node is a failure, and the relation it wrote is real but suspect.
+        "error" | "fail" | "runtime error" | "partial success" => DbtNodeOutcome::Failed,
+        "warn" => DbtNodeOutcome::Warn,
+        "skipped" => DbtNodeOutcome::Skipped,
+        "no-op" => DbtNodeOutcome::NoOp,
+        _ => DbtNodeOutcome::Unknown,
+    }
+}
+
+/// Whether a saved `run_results.json` holds anything `dbt retry` would redo.
+///
+/// The rule is dbt's own: `error`, `fail` and `skipped`. A `partial success`
+/// counts too — dbt spells that for a node that built but whose tests failed,
+/// and its retry redoes the node.
+///
+/// Tests count too, and they are the common case: with
+/// `test_behavior: after_all` a failing test is the whole of
+/// `run_results.json`, so requiring a relation-writing node would refuse the
+/// retry exactly when it is wanted.
+fn has_retryable_node(run_results: &str) -> bool {
+    serde_json::from_str::<RunResults>(run_results)
+        .map(|r| {
+            r.results.iter().any(|n| {
+                matches!(
+                    classify_status(&n.status),
+                    DbtNodeOutcome::Failed | DbtNodeOutcome::Skipped
+                )
+            })
+        })
+        // Unreadable results are not "nothing to retry": let dbt decide rather
+        // than refusing a retry the user may well need.
+        .unwrap_or(true)
+}
+
+/// Append `--vars` if the descriptor (or the run) declares any.
+fn add_vars(cmd: &mut Command, descriptor: &DbtDescriptor, inv: &Invocation) -> error::Result<()> {
+    let vars = resolved_vars(descriptor, &inv.args, inv.strict)?;
+    if !vars.is_empty() {
+        cmd.args(["--vars", &serde_json::to_string(&vars).unwrap_or_default()]);
+    }
+    Ok(())
+}
+
+/// `strict` is the difference between the two callers. A run MUST fail on a
+/// placeholder it cannot fill — silently substituting an empty string would let
+/// the job build the wrong slice and report success. A deploy has no arguments
+/// at all, so the same placeholder is expected there; the var still has to be
+/// *defined* or a project calling `var("run_date")` without its own default
+/// cannot be parsed, but its value is irrelevant to the graph.
+fn resolved_vars(
+    descriptor: &DbtDescriptor,
+    args: &HashMap<String, Box<RawValue>>,
+    strict: bool,
+) -> error::Result<serde_json::Map<String, serde_json::Value>> {
+    let mut out = serde_json::Map::new();
+    for (k, v) in &descriptor.vars {
+        out.insert(
+            k.clone(),
+            interpolate_value(v, args, &format!("vars.{k}"), strict)?,
+        );
+    }
+    // The run argument overrides; it never carries the descriptor's own values
+    // back (its signature default is empty), so this cannot clobber what was
+    // just interpolated above.
+    if let Some(raw) = args.get("vars").filter(|r| r.get().trim() != "null") {
+        // A wrong-typed override is refused rather than ignored: argument-schema
+        // validation is opt-in, so silently running the descriptor's own vars
+        // could build against a different schema or alias than the caller asked
+        // for — the same reason `select`/`exclude` reject theirs.
+        match serde_json::from_str(raw.get()) {
+            Ok(serde_json::Value::Object(m)) => out.extend(m),
+            _ => {
+                return Err(Error::BadRequest(
+                    "`vars` must be an object mapping dbt var names to values".to_string(),
+                ))
+            }
+        }
+    }
+    Ok(out)
+}
+
+/// Substitute `{{ arg }}` in every string leaf, leaving numbers, booleans and
+/// structure exactly as the descriptor spelled them.
+fn interpolate_value(
+    v: &serde_json::Value,
+    args: &HashMap<String, Box<RawValue>>,
+    field: &str,
+    strict: bool,
+) -> error::Result<serde_json::Value> {
+    Ok(match v {
+        serde_json::Value::String(s) => {
+            match crate::common::interpolate_template(s, Some(args), field) {
+                // A var whose ENTIRE value is one placeholder takes the
+                // argument's own type: `"{{ strict }}"` given `false` must reach
+                // dbt as a boolean, since "false" is truthy in Jinja. Embedded in
+                // text it stays a string, which is what interpolation means.
+                Ok(v) => match sole_placeholder(s).and_then(|name| args.get(name)) {
+                    Some(raw) => {
+                        serde_json::from_str(raw.get()).unwrap_or(serde_json::Value::String(v))
+                    }
+                    None => serde_json::Value::String(v),
+                },
+                Err(e) if strict => return Err(e),
+                Err(_) => serde_json::Value::String(String::new()),
+            }
+        }
+        serde_json::Value::Array(a) => serde_json::Value::Array(
+            a.iter()
+                .map(|x| interpolate_value(x, args, field, strict))
+                .collect::<error::Result<_>>()?,
+        ),
+        serde_json::Value::Object(o) => serde_json::Value::Object(
+            o.iter()
+                .map(|(k, x)| Ok((k.clone(), interpolate_value(x, args, field, strict)?)))
+                .collect::<error::Result<_>>()?,
+        ),
+        other => other.clone(),
+    })
+}
+
+/// The argument name when a value is exactly one `{{ placeholder }}` and
+/// nothing else.
+fn sole_placeholder(s: &str) -> Option<&str> {
+    let inner = s.trim().strip_prefix("{{")?.strip_suffix("}}")?.trim();
+    (!inner.is_empty()
+        && !inner.contains("{{")
+        && inner.chars().all(|c| c.is_ascii_alphanumeric() || c == '_'))
+    .then_some(inner)
+}
+
+/// One job argument, absent when unset or JSON `null` — a schema-less run sends
+/// the key with a null rather than omitting it, and both mean "not given".
+///
+/// A wrong TYPE is an error rather than an absence: argument-schema validation
+/// is opt-in, so `dbt_command: 1` read as unset would run the default command
+/// and `full_refresh: "false"` would still full-refresh, the caller silently
+/// getting something other than what they asked for.
+fn arg<T: serde::de::DeserializeOwned>(
+    args: &HashMap<String, Box<RawValue>>,
+    k: &str,
+    expected: &str,
+) -> error::Result<Option<T>> {
+    let Some(raw) = args.get(k).filter(|r| r.get().trim() != "null") else {
+        return Ok(None);
+    };
+    serde_json::from_str::<T>(raw.get())
+        .map(Some)
+        .map_err(|e| Error::BadRequest(format!("`{k}` must be {expected}: {e}")))
+}
+
+/// The run's arguments with the command block spread over them, its variant
+/// `label` under `dbt_command`.
+///
+/// A run submits one `command` argument whose `oneOf` variant IS the command, so
+/// an override belongs to the command that takes it. Every reader below wants a
+/// single map, and the block is spread here rather than at each of them so the
+/// two shapes never both reach one. `raw_args` keeps the submitted shape: it is
+/// what the state saves and the result publishes.
+///
+/// A block that is present must NAME a command: dropping a malformed one would
+/// leave no command at all, which reads as "the descriptor's default" — so
+/// `{"command": "show"}` would build the project the caller meant to preview.
+/// Argument-schema validation is opt-in, so this is the only check a direct
+/// request passes through.
+fn flatten_command(
+    mut args: HashMap<String, Box<RawValue>>,
+) -> error::Result<HashMap<String, Box<RawValue>>> {
+    let Some(block) = args.remove(DBT_COMMAND_ARG) else {
+        return Ok(args);
+    };
+    // `null` is how a schema-less run sends "not given", like every other
+    // argument, and means the descriptor's own command.
+    if block.get().trim() == "null" {
+        return Ok(args);
+    }
+    let malformed = || {
+        Error::BadRequest(format!(
+            "`{DBT_COMMAND_ARG}` must be an object naming what to run, e.g. \
+             `{{\"{DBT_COMMAND_LABEL}\": \"{}\"}}` — one of {}",
+            DBT_COMMANDS[0],
+            DBT_COMMANDS.join(", ")
+        ))
+    };
+    let mut fields = serde_json::from_str::<HashMap<String, Box<RawValue>>>(block.get())
+        .map_err(|_| malformed())?;
+    if arg_str(&fields, DBT_COMMAND_LABEL)?.is_none() {
+        return Err(malformed());
+    }
+    let label = fields.remove(DBT_COMMAND_LABEL);
+    for (k, v) in fields {
+        // A placeholder of the same name would otherwise be overwritten by the
+        // block — they are reserved for exactly that reason.
+        args.insert(k, v);
+    }
+    // LAST, and from the variant's label alone: a block carrying a `dbt_command`
+    // of its own would otherwise land on the same key, and which command ran
+    // would be map iteration order — the malformed check above, arrived at from
+    // the other side.
+    if let Some(label) = label {
+        args.insert("dbt_command".to_string(), label);
+    }
+    Ok(args)
+}
+
+/// Empty reads as absent: it is what an untouched text field sends.
+fn arg_str(args: &HashMap<String, Box<RawValue>>, k: &str) -> error::Result<Option<String>> {
+    Ok(arg::<String>(args, k, "a string")?.filter(|s| !s.is_empty()))
+}
+
+fn arg_bool(args: &HashMap<String, Box<RawValue>>, k: &str) -> error::Result<Option<bool>> {
+    arg(args, k, "a boolean")
+}
+
+fn arg_i64(args: &HashMap<String, Box<RawValue>>, k: &str) -> error::Result<Option<i64>> {
+    arg(args, k, "a whole number")
+}
+
+/// The selectors a given invocation runs with: the descriptor's, unless the
+/// run overrode them. Shared by the build and by the resolver that decides
+/// which nodes the run claims, which must agree — a resolver reading the
+/// descriptor while dbt builds an override filters the graph by a set the run
+/// never built.
+///
+/// Selectors are dbt's grammar and are passed verbatim — reimplementing it is a
+/// standing source of divergence (docs/dbt-runtime.md).
+fn add_selection(
+    cmd: &mut Command,
+    descriptor: &DbtDescriptor,
+    inv: &Invocation,
+) -> error::Result<()> {
+    for s in effective_select(descriptor, inv)? {
+        cmd.args(["--select", &s]);
+    }
+    for s in effective_exclude(descriptor, inv)? {
+        cmd.args(["--exclude", &s]);
+    }
+    if let Some(sel) = effective_selector(descriptor, inv)? {
+        cmd.args(["--selector", sel]);
+    }
+    Ok(())
+}
+
+/// Whether this invocation chose its own `select`/`exclude`.
+///
+/// DIFFERENT from the descriptor's, not merely present: `parse_dbt_sig` gives
+/// both fields the descriptor's own value as their default and the generated
+/// run form posts a default back for every field the caller left untouched, so
+/// every run from the UI, a schedule, a webhook or a flow step carries them.
+/// Reading that echo as a choice is wrong in two ways at once — it drops the
+/// descriptor's `--selector` from those runs (building the whole project), and
+/// it marks their graph caller-scoped so a moved profile never republishes and
+/// never settles. Both decisions ask this one question.
+///
+/// A run that wants the whole project despite a descriptor selector names a
+/// selection that differs — `["*"]`.
+fn selection_is_overridden(
+    descriptor: &DbtDescriptor,
+    args: &HashMap<String, Box<RawValue>>,
+) -> error::Result<bool> {
+    let differs = |key: &str, from: &Vec<String>| -> error::Result<bool> {
+        Ok(arg_list(args, key)?.is_some_and(|v| &v != from))
+    };
+    Ok(differs("select", &descriptor.select)? || differs("exclude", &descriptor.exclude)?)
+}
+
+/// The descriptor's named selector, unless this run named its own selection.
+///
+/// dbt resolves `--selector` INSTEAD of `--select`, so passing both makes the
+/// descriptor win: a preview asked for one model would return the descriptor's
+/// nodes, and a run asked for a subset would build something else. A run naming
+/// its own selection therefore replaces the descriptor's selector entirely.
+fn effective_selector<'a>(
+    descriptor: &'a DbtDescriptor,
+    inv: &Invocation,
+) -> error::Result<Option<&'a str>> {
+    if selection_is_overridden(descriptor, &inv.args)? {
+        return Ok(None);
+    }
+    Ok(descriptor.selector.as_deref())
+}
+
+fn effective_select(descriptor: &DbtDescriptor, inv: &Invocation) -> error::Result<Vec<String>> {
+    Ok(arg_list(&inv.args, "select")?.unwrap_or_else(|| descriptor.select.clone()))
+}
+
+fn effective_exclude(descriptor: &DbtDescriptor, inv: &Invocation) -> error::Result<Vec<String>> {
+    Ok(arg_list(&inv.args, "exclude")?.unwrap_or_else(|| descriptor.exclude.clone()))
+}
+
+/// Whether an invocation selects a subset at all, from whichever of the
+/// descriptor's fields and the run's arguments end up in force.
+fn has_selection(descriptor: &DbtDescriptor, inv: &Invocation) -> error::Result<bool> {
+    Ok(!effective_select(descriptor, inv)?.is_empty()
+        || !effective_exclude(descriptor, inv)?.is_empty()
+        || effective_selector(descriptor, inv)?.is_some())
+}
+
+/// An explicitly supplied list, including an empty one — `[]` is how a run asks
+/// for the whole project where the descriptor named a selection, so it must not
+/// read as "absent" and fall back to that selection.
+///
+/// A malformed one is an error rather than an absence: argument-schema
+/// validation is opt-in, so treating `"stg_orders"` as unset would silently run
+/// the descriptor's broader selection instead of the one the caller asked for.
+fn arg_list(args: &HashMap<String, Box<RawValue>>, k: &str) -> error::Result<Option<Vec<String>>> {
+    let Some(raw) = args.get(k) else {
+        return Ok(None);
+    };
+    if raw.get().trim() == "null" {
+        return Ok(None);
+    }
+    serde_json::from_str::<Vec<String>>(raw.get())
+        .map(Some)
+        .map_err(|e| Error::BadRequest(format!("`{k}` must be a list of strings: {e}")))
+}
+
+pub(crate) fn digest(s: &str) -> String {
+    let mut h = Sha256::new();
+    h.update(s.as_bytes());
+    format!("{:x}", h.finalize())[..32].to_string()
+}
+
+/// Copy a package tree, bounded by the job.
+///
+/// The tree is the project's, so its size is not ours to assume: run it under
+/// the poller like every other phase, or a cancelled or timed-out job keeps its
+/// worker slot until `cp` finishes on its own.
+async fn copy_dir_watched(
+    from: &Path,
+    to: &Path,
+    label: &str,
+    ctx: &mut JobCtx<'_>,
+    job_id: &Uuid,
+    w_id: &str,
+    conn: &Connection,
+) -> error::Result<()> {
+    tokio::fs::create_dir_all(to)
+        .await
+        .map_err(|e| Error::internal_err(format!("creating {to:?}: {e}")))?;
+    let mut cmd = Command::new("cp");
+    cmd.arg("-a").arg(format!("{}/.", from.display())).arg(to);
+    cmd.stdout(Stdio::piped()).stderr(Stdio::piped());
+    let child = start_child_process(cmd, "cp", false).await?;
+    handle_child(
+        job_id,
+        conn,
+        ctx.mem_peak,
+        ctx.canceled_by,
+        child,
+        false,
+        ctx.worker_name,
+        w_id,
+        label,
+        ctx.timeout(),
+        false,
+        &mut Some(ctx.occupancy_metrics),
+        None,
+        None,
+    )
+    .await
+    .map(|_| ())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn node_events_become_materialization_records() {
+        let started = r#"{"data":{"node_info":{"node_status":"started","materialized":"table",
+            "node_relation":{"alias":"Customers","schema":"Analytics",
+            "relation_name":"\"wh\".\"Analytics\".\"Customers\""}}},
+            "info":{"name":"LogStartLine","msg":"start"}}"#;
+        let ev = parse_node_event(started, "f/prod/wh", Some("wh")).unwrap();
+        assert_eq!(ev.status, MaterializationStatus::Running);
+        // Same canonicalization as the manifest ingest, or a run would record
+        // progress against a key no graph node has.
+        assert_eq!(ev.asset_path, "f/prod/wh/analytics/customers");
+
+        let failed = r#"{"data":{"node_info":{"node_status":"error",
+            "node_relation":{"alias":"c","schema":"a","relation_name":"\"w\".\"a\".\"c\""}}},
+            "info":{"name":"LogModelResult","msg":"boom"}}"#;
+        let ev = parse_node_event(failed, "f/prod/wh", Some("wh")).unwrap();
+        assert_eq!(ev.status, MaterializationStatus::Failed);
+        assert_eq!(ev.error.as_deref(), Some("boom"));
+    }
+
+    // `[]` against a descriptor that names a selection is how a run asks for the
+    // whole project. Reading it as "absent" would fall back to the descriptor's
+    // and build a different model set than the run asked for.
+    #[test]
+    fn an_empty_override_widens_a_descriptor_selection() {
+        let descriptor =
+            DbtDescriptor { select: vec!["tag:nightly".to_string()], ..Default::default() };
+        let cleared = Invocation {
+            args: [(
+                "select".to_string(),
+                serde_json::value::RawValue::from_string("[]".to_string()).unwrap(),
+            )]
+            .into_iter()
+            .collect(),
+            ..Default::default()
+        };
+        assert!(has_selection(&descriptor, &Invocation::default()).unwrap());
+        assert!(!has_selection(&descriptor, &cleared).unwrap());
+        // A wrong-typed override is refused rather than read as absent, which
+        // would silently run the descriptor's broader selection.
+        let malformed = Invocation {
+            args: [(
+                "select".to_string(),
+                serde_json::value::RawValue::from_string("\"stg_orders\"".to_string()).unwrap(),
+            )]
+            .into_iter()
+            .collect(),
+            ..Default::default()
+        };
+        assert!(has_selection(&descriptor, &malformed).is_err());
+    }
+
+    // Compared in two halves because resolution happens between them: the prefix
+    // is checkable up front, the digest only once the caller has re-resolved the
+    // saved arguments. Comparing the whole string up front refuses every retry,
+    // whose request carries only `dbt_command`.
+    #[test]
+    fn the_identity_splits_at_the_resolved_arguments() {
+        let (prefix, args) = split_identity("proj|wh|engine|deadbeef|args=c0ffee");
+        assert_eq!(prefix, "proj|wh|engine|deadbeef");
+        assert_eq!(args, Some("c0ffee"));
+        // Profile targets and other identity inputs are user-controlled. A
+        // literal `args=` inside one must stay in the identity prefix.
+        let (prefix, args) = split_identity("proj|target=blue|args=warehouse|deadbeef|args=c0ffee");
+        assert_eq!(prefix, "proj|target=blue|args=warehouse|deadbeef");
+        assert_eq!(args, Some("c0ffee"));
+        // A PRE-UPGRADE row, which ends in the env digest and has plenty of
+        // `|` in it. Splitting on the last one would take that digest for an
+        // arguments digest and make every saved failure unretryable.
+        let (prefix, args) = split_identity("proj|wh|engine|deadbeef");
+        assert_eq!(prefix, "proj|wh|engine|deadbeef");
+        assert_eq!(args, None);
+    }
+
+    #[test]
+    // dbt resolves `--selector` INSTEAD of `--select`, so a descriptor selector
+    // left on alongside an explicit selection makes the descriptor win: a preview
+    // of one model returns another's rows.
+    fn a_runs_own_selection_replaces_the_descriptor_selector() {
+        let descriptor =
+            DbtDescriptor { selector: Some("nightly".to_string()), ..Default::default() };
+        let selects = |v: &str| Invocation {
+            args: [(
+                "select".to_string(),
+                serde_json::value::RawValue::from_string(v.to_string()).unwrap(),
+            )]
+            .into_iter()
+            .collect(),
+            ..Default::default()
+        };
+        assert_eq!(
+            effective_selector(&descriptor, &Invocation::default()).unwrap(),
+            Some("nightly")
+        );
+        assert_eq!(
+            effective_selector(&descriptor, &selects(r#"["stg_orders"]"#)).unwrap(),
+            None
+        );
+        // The generated form posts the descriptor's own `[]` back for a field nobody
+        // touched, so that is not an override: reading it as one drops the selector
+        // from every UI, schedule and webhook run and builds the whole project.
+        // `["*"]` is how a run asks for that on purpose.
+        assert_eq!(
+            effective_selector(&descriptor, &selects("[]")).unwrap(),
+            Some("nightly")
+        );
+        assert!(has_selection(&descriptor, &selects("[]")).unwrap());
+        assert_eq!(
+            effective_selector(&descriptor, &selects(r#"["*"]"#)).unwrap(),
+            None
+        );
+    }
+
+    // A retry runs in a new job directory, and a profile with a private CA
+    // names that directory in `sslrootcert`. Hashing the rendered text as-is
+    // would make every such retry look like a different warehouse and reject
+    // its own predecessor's state.
+    #[test]
+    fn profile_identity_ignores_the_job_dir_but_not_the_connection() {
+        let yaml = |dir: &str, host: &str| {
+            format!("host: \"{host}\"\nsslrootcert: \"{dir}/server-ca.pem\"\n")
+        };
+        let first = profile_identity_digest(
+            &yaml("/tmp/windmill/w/job-1/profiles", "wh.internal"),
+            Path::new("/tmp/windmill/w/job-1/profiles"),
+            Some("PEM"),
+            "",
+        );
+        let retry = profile_identity_digest(
+            &yaml("/tmp/windmill/w/job-2/profiles", "wh.internal"),
+            Path::new("/tmp/windmill/w/job-2/profiles"),
+            Some("PEM"),
+            "",
+        );
+        assert_eq!(first, retry);
+
+        let repointed = profile_identity_digest(
+            &yaml("/tmp/windmill/w/job-2/profiles", "other.internal"),
+            Path::new("/tmp/windmill/w/job-2/profiles"),
+            Some("PEM"),
+            "",
+        );
+        let recerted = profile_identity_digest(
+            &yaml("/tmp/windmill/w/job-2/profiles", "wh.internal"),
+            Path::new("/tmp/windmill/w/job-2/profiles"),
+            Some("OTHER PEM"),
+            "",
+        );
+        assert_ne!(first, repointed);
+        assert_ne!(first, recerted);
+    }
+
+    // The warehouse's resource may interpolate `$WM_TOKEN`, so the rendered
+    // profile carries the ATTEMPT's token. A retry is a new job with a new one,
+    // and without normalizing it the saved run is never recognized as its own.
+    #[test]
+    fn profile_identity_ignores_the_attempts_token() {
+        let yaml = |tok: &str| format!("host: \"wh\"\npassword: \"{tok}\"\n");
+        let dir = Path::new("/tmp/windmill/w/job-1/profiles");
+        assert_eq!(
+            profile_identity_digest(&yaml("tok-first"), dir, None, "tok-first"),
+            profile_identity_digest(&yaml("tok-retry"), dir, None, "tok-retry")
+        );
+        // A password that is NOT the job's token is the connection, and changing
+        // it must still read as a different warehouse.
+        assert_ne!(
+            profile_identity_digest(&yaml("static-a"), dir, None, "tok-first"),
+            profile_identity_digest(&yaml("static-b"), dir, None, "tok-retry")
+        );
+    }
+
+    // The jail profile is protobuf text format, and the project path and the
+    // descriptor's environment land inside string literals. An unescaped quote or
+    // newline closes the literal and lets the rest be read as further directives —
+    // extra host bind mounts, for one.
+    #[test]
+    fn jail_values_cannot_close_their_string_and_add_directives() {
+        let hostile = "proj\"\nmount {\n src: \"/\"\n dst: \"/host\"\n}\n#";
+        let escaped = escape_textproto(hostile);
+        assert!(!escaped.contains('\n'), "{escaped}");
+        // Every quote that survives is escaped, so none of them terminates the
+        // literal.
+        let mut chars = escaped.chars().peekable();
+        let mut prev = None;
+        while let Some(c) = chars.next() {
+            if c == '"' {
+                assert_eq!(prev, Some('\\'), "unescaped quote in {escaped}");
+            }
+            // A doubled backslash is a literal one, so it does not escape what
+            // follows it.
+            prev = if c == '\\' && prev == Some('\\') {
+                None
+            } else {
+                Some(c)
+            };
+        }
+
+        let envars = jail_envars(&[("LD_PRELOAD".to_string(), hostile.to_string())]);
+        assert_eq!(envars.lines().count(), 1, "{envars}");
+        assert!(envars.starts_with("envar: \"LD_PRELOAD="), "{envars}");
+    }
+
+    // THREE sites derive a `dbt://` key: the manifest ingest, the live events and
+    // the end-of-run settlement. One deriving it differently records progress
+    // against a path no node has — the run still succeeds and the graph never
+    // moves. Nothing else catches that.
+    #[test]
+    fn all_three_key_derivations_agree() {
+        use windmill_common::dbt_manifest::{ingest_manifest, Manifest};
+        let manifest: Manifest = serde_json::from_str(
+            r#"{"nodes":{"model.p.customers":{
+                 "resource_type":"model","name":"customers","alias":"Customers",
+                 "schema":"Analytics","database":"Archive",
+                 "relation_name":"\"Archive\".\"Analytics\".\"Customers\""}}}"#,
+        )
+        .unwrap();
+        let ingested = ingest_manifest(&manifest, "f/prod/wh", Some("wh"), None);
+        let from_manifest = ingested.nodes[0].asset_path.clone().unwrap();
+
+        let relation = "\"Archive\".\"Analytics\".\"Customers\"";
+        let from_results = asset_path_of_relation(Some(relation), "f/prod/wh", Some("wh")).unwrap();
+        let live = r#"{"data":{"node_info":{"node_status":"success",
+            "node_relation":{"alias":"Customers","schema":"Analytics","database":"Archive",
+            "relation_name":"\"Archive\".\"Analytics\".\"Customers\""}}},
+            "info":{"name":"LogModelResult","msg":"ok"}}"#;
+        let from_events = parse_node_event(live, "f/prod/wh", Some("wh"))
+            .unwrap()
+            .asset_path;
+
+        // The model overrode its database, so all three must qualify.
+        assert_eq!(from_manifest, "f/prod/wh/archive.analytics/customers");
+        assert_eq!(from_results, from_manifest);
+        assert_eq!(from_events, from_manifest);
+
+        // And in the target's own database, all three drop it.
+        let plain = "\"wh\".\"Analytics\".\"Customers\"";
+        assert_eq!(
+            asset_path_of_relation(Some(plain), "f/prod/wh", Some("wh")).unwrap(),
+            "f/prod/wh/analytics/customers"
+        );
+        // A test node has no relation of its own.
+        assert_eq!(asset_path_of_relation(None, "f/prod/wh", Some("wh")), None);
+
+        // A period INSIDE a quoted identifier is part of the name. Splitting on
+        // every period yields four parts and discards the relation, so the model
+        // records no status at all — invisible except as a graph that never
+        // moves.
+        assert_eq!(
+            asset_path_of_relation(
+                Some("\"wh\".\"analytics.v2\".\"orders\""),
+                "f/prod/wh",
+                Some("wh")
+            ),
+            Some("f/prod/wh/analytics.v2/orders".to_string())
+        );
+        // A doubled delimiter is that delimiter, literally: the manifest keeps
+        // the real spelling, so dropping the pair here records the run's
+        // progress against a key no node has.
+        assert_eq!(
+            split_relation("\"wh\".\"schema\".\"a\"\"b\""),
+            vec!["wh", "schema", "a\"b"]
+        );
+        assert_eq!(
+            split_relation("[db].[my]]schema].[t]"),
+            vec!["db", "my]schema", "t"]
+        );
+    }
+
+    // dbt vars are typed and Jinja treats the string "false" as truthy, so a var
+    // that IS a placeholder carries the argument's own type through, while one
+    // embedded in text stays the string it interpolates to.
+    #[test]
+    fn placeholder_vars_keep_the_arguments_type() {
+        use windmill_parser_yaml::parse_dbt_descriptor;
+        let d = parse_dbt_descriptor(
+            "vars:\n  strict: \"{{ strict }}\"\n  n: \"{{ n }}\"\n  label: \"run-{{ name }}\"\n",
+        )
+        .unwrap();
+        let args: HashMap<String, Box<RawValue>> =
+            [("strict", "false"), ("n", "7"), ("name", "\"nightly\"")]
+                .into_iter()
+                .map(|(k, v)| (k.to_string(), RawValue::from_string(v.to_string()).unwrap()))
+                .collect();
+        let vars = resolved_vars(&d, &args, true).unwrap();
+        assert_eq!(vars["strict"], serde_json::json!(false));
+        assert_eq!(vars["n"], serde_json::json!(7));
+        assert_eq!(vars["label"], serde_json::json!("run-nightly"));
+    }
+
+    // The digest gates the retry state and keys the package cache, so a value
+    // that depends on map ordering would evict and reject on every run, and one
+    // that ignores content would let an edited project resume the previous
+    // attempt's failures against models it no longer builds.
+    #[test]
+    fn the_project_digest_is_content_addressed_and_order_free() {
+        use windmill_common::scripts::{ScriptLang, ScriptModule};
+        let m = |pairs: &[(&str, &str)]| {
+            pairs
+                .iter()
+                .map(|(k, v)| {
+                    (
+                        k.to_string(),
+                        ScriptModule {
+                            content: v.to_string(),
+                            language: ScriptLang::Dbt,
+                            lock: None,
+                        },
+                    )
+                })
+                .collect::<HashMap<_, _>>()
+        };
+        let a = m(&[("models/a.sql", "select 1"), ("dbt_project.yml", "name: p")]);
+        let b = m(&[("dbt_project.yml", "name: p"), ("models/a.sql", "select 1")]);
+        assert_eq!(project_digest(Some(&a)), project_digest(Some(&b)));
+        let edited = m(&[("models/a.sql", "select 2"), ("dbt_project.yml", "name: p")]);
+        assert_ne!(project_digest(Some(&a)), project_digest(Some(&edited)));
+        // A file renamed with the same body is a different project too: the
+        // separators keep `ab|c` from digesting the same as `a|bc`.
+        let renamed = m(&[("models/b.sql", "select 1"), ("dbt_project.yml", "name: p")]);
+        assert_ne!(project_digest(Some(&a)), project_digest(Some(&renamed)));
+    }
+
+    // A project that owns its `profiles.yml` has to spell its relations the way
+    // a workspace-warehouse project does, or the same physical table becomes two
+    // nodes — `main/analytics/orders` for one and `main/prod.analytics/orders`
+    // for the other — and the lineage they exist to share never connects.
+    #[tokio::test]
+    async fn a_project_owned_profile_reports_its_target_database() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("profiles.yml");
+        std::fs::write(
+            &path,
+            "jaffle:\n  target: prod\n  outputs:\n    prod:\n      type: snowflake\n\
+             \x20     database: prod\n      schema: analytics\n",
+        )
+        .unwrap();
+        let t = adapter_from_profiles_yml(&path, "jaffle", None)
+            .await
+            .unwrap();
+        assert_eq!(t.adapter, DbtAdapter::from(KnownAdapter::Snowflake));
+        assert_eq!(t.database.as_deref(), Some("prod"));
+        assert_eq!(t.schema.as_deref(), Some("analytics"));
+        // Spelled plainly, exactly as a rendered profile on the same relation.
+        assert_eq!(
+            windmill_common::dbt_manifest::table_asset_path(
+                "main",
+                Some("prod"),
+                "analytics",
+                "orders",
+                t.database.as_deref(),
+            )
+            .as_deref(),
+            Some("main/analytics/orders")
+        );
+    }
+
+    // dbt renders `profiles.yml` through Jinja; Windmill reads it raw. A repo that
+    // carries one profile across environments selects its target with `env_var`,
+    // and refusing that would refuse the unmodified-project path this exists for.
+    #[tokio::test]
+    async fn a_templated_target_takes_the_only_output() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("profiles.yml");
+        std::fs::write(
+            &path,
+            "jaffle:\n  target: \"{{ env_var('DBT_TARGET', 'prod') }}\"\n  outputs:\n\
+             \x20   prod:\n      type: snowflake\n      database: prod\n      schema: analytics\n",
+        )
+        .unwrap();
+        let t = adapter_from_profiles_yml(&path, "jaffle", None)
+            .await
+            .unwrap();
+        assert_eq!(t.adapter, DbtAdapter::from(KnownAdapter::Snowflake));
+        assert_eq!(t.database.as_deref(), Some("prod"));
+    }
+
+    // With several outputs the template names none of them, so the descriptor
+    // has to choose rather than Windmill guessing which environment to run.
+    #[tokio::test]
+    async fn a_templated_target_with_several_outputs_asks_for_one() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("profiles.yml");
+        std::fs::write(
+            &path,
+            "jaffle:\n  target: \"{{ env_var('DBT_TARGET') }}\"\n  outputs:\n\
+             \x20   prod:\n      type: snowflake\n    dev:\n      type: snowflake\n",
+        )
+        .unwrap();
+        let e = adapter_from_profiles_yml(&path, "jaffle", None)
+            .await
+            .unwrap_err()
+            .to_string();
+        assert!(e.contains("profile.target"), "{e}");
+    }
+
+    // A target that leaves its database to dbt's own defaults says nothing, and
+    // guessing one would collapse relations that are genuinely apart.
+    #[tokio::test]
+    async fn an_implicit_database_stays_unknown() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("profiles.yml");
+        std::fs::write(
+            &path,
+            "jaffle:\n  target: dev\n  outputs:\n    dev:\n      type: postgres\n\
+             \x20     dbname: \"{{ env_var('DB') }}\"\n",
+        )
+        .unwrap();
+        let t = adapter_from_profiles_yml(&path, "jaffle", None)
+            .await
+            .unwrap();
+        assert_eq!(t.database, None);
+    }
+
+    #[tokio::test]
+    async fn package_cache_identity_includes_the_resolved_lock() {
+        let dir = tempfile::tempdir().unwrap();
+        std::fs::write(
+            dir.path().join("package-lock.yml"),
+            "packages:\n  - package: dbt-labs/dbt_utils\n    version: 1.3.0\n",
+        )
+        .unwrap();
+        let first = package_lock_digest(dir.path()).await.unwrap().unwrap();
+        std::fs::write(
+            dir.path().join("package-lock.yml"),
+            "packages:\n  - package: dbt-labs/dbt_utils\n    version: 1.4.0\n",
+        )
+        .unwrap();
+        let second = package_lock_digest(dir.path()).await.unwrap().unwrap();
+
+        assert_ne!(first, second);
+        assert_ne!(
+            package_cache_key("same project and environment", &first),
+            package_cache_key("same project and environment", &second)
+        );
+    }
+
+    // The path is project-controlled and both cache copies are rooted at it, so
+    // an absolute or `..`-bearing value would read and write outside the job.
+    #[tokio::test]
+    async fn a_projects_packages_path_cannot_escape_the_project() {
+        let dir = tempfile::tempdir().unwrap();
+        let root = dir.path();
+        let write = |yml: &str| std::fs::write(root.join("dbt_project.yml"), yml).unwrap();
+        let none = HashMap::new();
+
+        write("name: p\n");
+        assert_eq!(
+            packages_install_path(root, &none).await.unwrap(),
+            "dbt_packages"
+        );
+        write("name: p\npackages-install-path: ./vendor\n");
+        assert_eq!(packages_install_path(root, &none).await.unwrap(), "vendor");
+        // Unset and empty are the default; an escaping one is refused rather
+        // than replaced, since dbt reads the file itself and would honour it.
+        write("name: p\npackages-install-path: \"\"\n");
+        assert_eq!(
+            packages_install_path(root, &none).await.unwrap(),
+            "dbt_packages"
+        );
+        for escape in ["/etc", "../../etc", "a/../../b"] {
+            write(&format!("name: p\npackages-install-path: \"{escape}\"\n"));
+            assert!(
+                packages_install_path(root, &none).await.is_err(),
+                "{escape} must not be honoured"
+            );
+        }
+        // An escaping value the ENVIRONMENT supplies is refused just the same:
+        // rendering happens before the check, not after it.
+        write("name: p\npackages-install-path: \"{{ env_var('D') }}\"\n");
+        let escaping = HashMap::from([("D".to_string(), "../out".to_string())]);
+        assert!(packages_install_path(root, &escaping).await.is_err());
+    }
+
+    // dbt renders `env_var()` in `dbt_project.yml`, so the profile it looks up
+    // and the directory `dbt deps` fills are the RENDERED ones. Reading the
+    // template instead leaves a project that runs everywhere else unable to find
+    // its profile, and its package cache watching a directory nothing fills.
+    #[tokio::test]
+    async fn a_projects_settings_are_rendered_with_the_runs_environment() {
+        let dir = tempfile::tempdir().unwrap();
+        let root = dir.path();
+        std::fs::write(
+            root.join("dbt_project.yml"),
+            "name: p\nprofile: \"{{ env_var('DBT_PROFILE', 'analytics') }}\"\n\
+             packages-install-path: \"{{ env_var('PKGS', 'vendor') }}\"\n",
+        )
+        .unwrap();
+
+        let none = HashMap::new();
+        assert_eq!(project_profile_name(root, &none).await, "analytics");
+        assert_eq!(packages_install_path(root, &none).await.unwrap(), "vendor");
+
+        let set = HashMap::from([
+            ("DBT_PROFILE".to_string(), "prod".to_string()),
+            ("PKGS".to_string(), "deps".to_string()),
+        ]);
+        assert_eq!(project_profile_name(root, &set).await, "prod");
+        assert_eq!(packages_install_path(root, &set).await.unwrap(), "deps");
+
+        // Neither set nor defaulted: left verbatim, so dbt reports it rather
+        // than Windmill inventing a name.
+        std::fs::write(
+            root.join("dbt_project.yml"),
+            "name: p\nprofile: \"{{ env_var('DBT_PROFILE') }}\"\n",
+        )
+        .unwrap();
+        assert_eq!(
+            project_profile_name(root, &none).await,
+            "{{ env_var('DBT_PROFILE') }}"
+        );
+    }
+
+    // A retry rewrites `run_results.json` with only the nodes it redid, so the
+    // job's own result has to be the union: replacing would drop every node that
+    // succeeded before it, and nothing would settle their materializations.
+    #[test]
+    fn a_retrys_results_overlay_the_attempt_they_resumed() {
+        let node = |id: &str, status: &str| DbtNodeResult {
+            outcome: classify_status(status).as_result_word(),
+            unique_id: id.to_string(),
+            status: status.to_string(),
+            execution_time: None,
+            rows_affected: None,
+            relation_name: None,
+            message: None,
+            failures: None,
+        };
+        let mut acc = vec![
+            node("model.p.a", "success"),
+            node("model.p.b", "error"),
+            node("model.p.c", "skipped"),
+        ];
+        merge_results(
+            &mut acc,
+            vec![node("model.p.b", "success"), node("model.p.c", "success")],
+        );
+        assert_eq!(acc.len(), 3, "the untouched node must survive the retry");
+        let by = |id: &str| acc.iter().find(|n| n.unique_id == id).unwrap();
+        assert_eq!(by("model.p.a").status, "success");
+        assert_eq!(by("model.p.b").status, "success");
+        assert_eq!(by("model.p.c").status, "success");
+        // A node the retry introduces is kept rather than dropped.
+        merge_results(&mut acc, vec![node("test.p.d", "fail")]);
+        assert_eq!(acc.len(), 4);
+    }
+
+    // `--limit` decides how much of dbt's stdout the worker buffers, and any
+    // caller who may run the script may set it.
+    #[test]
+    fn only_a_single_node_may_be_shown() {
+        // What the run page sends: one model, package-qualified.
+        assert!(show_selects_one_node("stg_orders,package:slow_shop"));
+        assert!(show_selects_one_node("stg_orders"));
+        // A union: the intersection would bind to `safe_model` alone, leaving
+        // `my_seed` selected — and a selected seed is LOADED, not shown.
+        assert!(!show_selects_one_node("my_seed safe_model"));
+        assert!(!show_selects_one_node(
+            "my_seed  safe_model,resource_type:model"
+        ));
+        // Resolve to a set rather than to one relation.
+        assert!(!show_selects_one_node("stg_orders+"));
+        assert!(!show_selects_one_node("+stg_orders"));
+        assert!(!show_selects_one_node("stg_*"));
+        assert!(!show_selects_one_node("@stg_orders"));
+    }
+
+    #[test]
+    fn a_show_limit_is_clamped_to_the_ceiling() {
+        let max = windmill_parser_yaml::dbt::DBT_SHOW_MAX_LIMIT as i64;
+        let default = windmill_parser_yaml::dbt::DBT_SHOW_DEFAULT_LIMIT as i64;
+        assert_eq!(show_limit(Some(i64::MAX)), max, "an enormous ask is capped");
+        assert_eq!(show_limit(Some(max + 1)), max);
+        assert_eq!(show_limit(Some(5)), 5, "a modest ask is honoured");
+        assert_eq!(show_limit(None), default);
+        // `--limit 0` means something else to dbt, and a negative is nonsense.
+        assert_eq!(show_limit(Some(0)), default);
+        assert_eq!(show_limit(Some(-1)), default);
+    }
+
+    // The loop this feeds is bounded by nothing else: stop spending the budget
+    // and a failing job reissues `dbt retry` until its deadline.
+    #[test]
+    fn an_attempt_is_claimed_from_the_budget_exactly_once() {
+        let mut remaining = 3;
+        let mut claimed = vec![];
+        // Bounded by this `for`, never by `claim_attempt`: a regression that
+        // stops spending the budget has to fail an assertion here, and must not
+        // be able to allocate until the machine dies. `from_fn(..).collect()`
+        // would do the latter.
+        for _ in 0..10 {
+            match claim_attempt(&mut remaining, 3) {
+                Some(n) => claimed.push(n),
+                None => break,
+            }
+        }
+        assert_eq!(claimed, vec![1, 2, 3], "numbered in order, one per attempt");
+        assert_eq!(remaining, 0);
+        assert_eq!(
+            claim_attempt(&mut remaining, 3),
+            None,
+            "a spent budget grants no more"
+        );
+        let mut none = 0;
+        assert_eq!(claim_attempt(&mut none, 0), None);
+    }
+
+    // A second `dbt test` after a tests-only retry runs every test twice and
+    // reports each one twice — duplicate ids in the result table, doubled totals.
+    #[test]
+    fn merging_two_phases_keeps_one_row_per_node() {
+        let n = |id: &str, status: &str| DbtNodeResult {
+            outcome: classify_status(status).as_result_word(),
+            unique_id: id.to_string(),
+            status: status.to_string(),
+            execution_time: None,
+            rows_affected: None,
+            relation_name: None,
+            message: None,
+            failures: None,
+        };
+        let mut results = vec![n("model.p.m", "success"), n("test.p.t", "fail")];
+        // The test phase re-reports the same test, now passing.
+        merge_results(&mut results, vec![n("test.p.t", "pass")]);
+        assert_eq!(results.len(), 2, "a node re-reported must not duplicate");
+        assert_eq!(
+            results
+                .iter()
+                .find(|r| r.unique_id == "test.p.t")
+                .unwrap()
+                .status,
+            "pass",
+            "the later phase's outcome wins"
+        );
+    }
+
+    // `partial success` is a node that built and then failed its tests. Read as
+    // "says nothing about the relation", it left the model on `Running` — the
+    // tailer writes that when the node starts and nothing after it moves the
+    // record, so a finished job showed a model still building.
+    #[test]
+    fn partial_success_settles_the_relation_as_failed() {
+        assert_eq!(classify_status("partial success"), DbtNodeOutcome::Failed);
+        // The engines disagree on casing: 1.x echoes the author's, 2.x
+        // uppercases. Every classifier folds, or they disagree with each other.
+        for spelling in ["PARTIAL SUCCESS", " Partial Success ", "ERROR", "Pass"] {
+            assert_ne!(
+                classify_status(spelling),
+                DbtNodeOutcome::Unknown,
+                "{spelling} must classify"
+            );
+        }
+        assert_eq!(classify_status("success"), DbtNodeOutcome::Passed);
+        assert_eq!(classify_status("started"), DbtNodeOutcome::Started);
+        assert_eq!(classify_status("warn"), DbtNodeOutcome::Warn);
+        assert_eq!(classify_status("skipped"), DbtNodeOutcome::Skipped);
+        // `no-op` is not `skipped`: nothing was built either way, but dbt's
+        // retry set is error / fail / skipped, so a retry must not redo it.
+        assert_eq!(classify_status("no-op"), DbtNodeOutcome::NoOp);
+    }
+
+    #[test]
+    fn a_retry_needs_something_to_retry() {
+        let results = |statuses: &[&str]| {
+            format!(
+                r#"{{"results":[{}]}}"#,
+                statuses
+                    .iter()
+                    .map(|s| format!(r#"{{"unique_id":"model.p.m","status":"{s}"}}"#))
+                    .collect::<Vec<_>>()
+                    .join(",")
+            )
+        };
+        assert!(!has_retryable_node(&results(&["success"])));
+        assert!(!has_retryable_node(&results(&["success", "pass"])));
+        assert!(!has_retryable_node(r#"{"results":[]}"#));
+        for retryable in ["error", "fail", "skipped", "partial success"] {
+            assert!(
+                has_retryable_node(&results(&["success", retryable])),
+                "{retryable} must be retryable"
+            );
+        }
+        // Failed TESTS alone are retryable: `test_behavior: after_all` is exactly
+        // how `run_results.json` comes to describe tests alone.
+        let tests_only = r#"{"results":[
+            {"unique_id":"test.p.not_null_orders_id.ab","status":"fail"},
+            {"unique_id":"test.p.unique_orders_id.cd","status":"error"}]}"#;
+        assert!(has_retryable_node(tests_only));
+        // A passing test-only run still has nothing to retry.
+        let tests_passed = r#"{"results":[
+            {"unique_id":"test.p.not_null_orders_id.ab","status":"pass"}]}"#;
+        assert!(!has_retryable_node(tests_passed));
+        // Unreadable results let dbt decide rather than refusing a retry the
+        // user may well need.
+        assert!(has_retryable_node("not json"));
+    }
+
+    /// An interrupted BUILD leaves the warehouse in a state the previous run's
+    /// failures no longer describe, so that state has to go — including its local
+    /// generation, which a retry landing back on this worker reads first.
+    #[tokio::test]
+    async fn invalidating_run_state_drops_the_local_generation() {
+        let dir = state_dir("ws", "f/a/one", "u/alice");
+        tokio::fs::create_dir_all(&dir).await.unwrap();
+        tokio::fs::write(dir.join(CURRENT_GENERATION), b"gen-old")
+            .await
+            .unwrap();
+
+        let http = Connection::Http(windmill_common::worker::HttpClient {
+            client: reqwest_middleware::ClientBuilder::new(reqwest::Client::new()).build(),
+            base_internal_url: String::new(),
+        });
+        invalidate_run_state("ws", "f/a/one", "u/alice", &http).await;
+
+        assert!(
+            !dir.join(CURRENT_GENERATION).exists(),
+            "the pointer a retry reads must be gone"
+        );
+    }
+
+    /// The tailer runs in the WORKER process, outside the jailed child's memory
+    /// limit, and a dbt macro decides how long a log line is. An unbounded line
+    /// must be dropped rather than held, and the events after it must still
+    /// arrive — a tailer that stops reporting is a run with a blank graph.
+    #[test]
+    fn an_oversized_log_line_is_dropped_without_stopping_the_tailer() {
+        let mut tail = LogTail::default();
+        let event = |name: &str| format!(r#"{{"info":{{"name":"{name}"}}}}"#);
+
+        // A line split across reads is reassembled, not dropped.
+        assert_eq!(tail.push("{\"a\":1"), "");
+        assert_eq!(tail.push(",\"b\":2}\n"), "{\"a\":1,\"b\":2}\n");
+
+        // One that never ends is discarded, in bounded memory, ...
+        let huge = "x".repeat(LOG_LINE_MAX_BYTES / 2 + 1);
+        assert_eq!(tail.push(&huge), "");
+        assert_eq!(tail.push(&huge), "");
+        assert!(tail.carry.is_empty(), "the over-long line is not held");
+        assert_eq!(tail.push(&huge), "", "still inside that line");
+
+        // ... through its end, after which the next events come through.
+        let resumed = tail.push(&format!("tail-of-the-huge-line\n{}\n", event("ok")));
+        assert_eq!(resumed, format!("{}\n", event("ok")));
+        assert_eq!(
+            tail.push(&format!("{}\n", event("next"))),
+            format!("{}\n", event("next"))
+        );
+    }
+
+    /// A command block that names nothing must not read as "no command given":
+    /// that is the descriptor's default, so a mistyped `show` would BUILD the
+    /// project — the one direction a read-only command must never fail in.
+    /// Argument-schema validation is opt-in, so this is the only check between a
+    /// direct request and the engine.
+    #[test]
+    fn a_command_block_that_names_no_command_is_refused() {
+        let args = |json: &str| {
+            serde_json::from_str::<HashMap<String, Box<RawValue>>>(json).expect("test payload")
+        };
+        for payload in [
+            r#"{"command": "show"}"#,
+            r#"{"command": {}}"#,
+            r#"{"command": {"select": ["a"]}}"#,
+            r#"{"command": {"label": null}}"#,
+            r#"{"command": {"label": ""}}"#,
+            r#"{"command": []}"#,
+        ] {
+            let err = flatten_command(args(payload))
+                .expect_err("a block naming no command must not fall back to the default");
+            assert!(
+                err.to_string().contains("naming what to run"),
+                "{payload}: {err}"
+            );
+        }
+        // Absent and `null` both mean "the descriptor's own command", which is
+        // what an empty run submits.
+        for payload in ["{}", r#"{"command": null}"#] {
+            let out = flatten_command(args(payload)).expect(payload);
+            assert!(!out.contains_key("dbt_command"), "{payload}");
+        }
+        // A named one spreads, its label under the name every reader uses.
+        let out = flatten_command(args(r#"{"command": {"label": "show", "limit": 3}}"#)).unwrap();
+        assert_eq!(
+            arg_str(&out, "dbt_command").unwrap().as_deref(),
+            Some("show")
+        );
+        assert_eq!(arg_i64(&out, "limit").unwrap(), Some(3));
+        assert!(!out.contains_key(DBT_COMMAND_ARG));
+        // The variant's label decides, not map iteration order: a block carrying a
+        // `dbt_command` of its own lands on the same key.
+        let both = flatten_command(args(
+            r#"{"command": {"label": "show", "dbt_command": "build"}}"#,
+        ))
+        .unwrap();
+        assert_eq!(
+            arg_str(&both, "dbt_command").unwrap().as_deref(),
+            Some("show")
+        );
+    }
+
+    /// An agent reaches no database, so the row that answers "is this the run you
+    /// asked to resume" is not there — only the generation the worker itself
+    /// wrote. Unchecked, a retry naming one failed run resumes whichever failed
+    /// last on that worker, which is what the run page's two retry actions would
+    /// otherwise do from any older run.
+    #[test]
+    fn an_agent_refuses_a_generation_the_caller_did_not_name() {
+        let http = Connection::Http(windmill_common::worker::HttpClient {
+            client: reqwest_middleware::ClientBuilder::new(reqwest::Client::new()).build(),
+            base_internal_url: String::new(),
+        });
+        let saved = uuid::Uuid::new_v4();
+        let asked_for = uuid::Uuid::new_v4();
+        let local = || Some(format!("gen-{saved}"));
+
+        let err = chosen_generation(local(), &http, None, asked_for)
+            .expect_err("a generation the caller did not name must not be resumed");
+        assert!(
+            err.to_string().contains(&saved.to_string())
+                && err.to_string().contains(&asked_for.to_string()),
+            "the refusal names both the run asked for and the one held, got: {err}"
+        );
+
+        assert_eq!(
+            chosen_generation(local(), &http, None, saved).unwrap(),
+            local(),
+            "the run it does hold still resumes"
+        );
+    }
+
+    /// Why a run re-ingests decides what becomes of the result. Drift is the one
+    /// that MUST publish: the check reads back the published root, so a drifted
+    /// run that only snapshots leaves the next run detecting the same move, and
+    /// the asset rows naming the schema the project no longer builds into.
+    #[test]
+    fn what_a_refresh_publishes_depends_on_why_it_happened() {
+        let job = uuid::Uuid::new_v4();
+        let arg = |k: &str, v: &str| {
+            HashMap::from([(k.to_string(), RawValue::from_string(v.to_string()).unwrap())])
+        };
+        let descriptor = DbtDescriptor::default();
+
+        // A moved profile relocates the VERSION's relations: its own graph, and
+        // the ownership that answers the next drift check.
+        let drift = GraphRefresh { profile_drift: true, ..Default::default() };
+        assert!(drift.needed());
+        assert_eq!(drift.snapshot_job(job), None);
+        assert!(drift.publishes_ownership());
+
+        // A dynamic descriptor: this run's graph, under its own job id — and
+        // nothing published, because the `asset` rows and the version's nodes
+        // must describe one picture, and the version's are the deploy's.
+        let dynamic = GraphRefresh { per_run_models: true, ..Default::default() };
+        assert_eq!(dynamic.snapshot_job(job), Some(job));
+        assert!(!dynamic.publishes_ownership());
+
+        // A `vars` override: this run's graph, and only this run's.
+        let mut overridden = GraphRefresh::default();
+        overridden
+            .add_caller_args(&descriptor, &arg("vars", r#"{"day":"2026-07-29"}"#))
+            .unwrap();
+        assert!(overridden.needed());
+        assert_eq!(overridden.snapshot_job(job), Some(job));
+        assert!(!overridden.publishes_ownership());
+
+        // A caller's selection is not necessarily a subset of the deployed one —
+        // `["*"]` against `tag:nightly` builds models the deployed graph never had,
+        // which the run page would have nothing to draw. Under its own job id, so it
+        // neither becomes what the script owns nor replaces the version's graph.
+        let mut narrowed = GraphRefresh::default();
+        narrowed
+            .add_caller_args(&descriptor, &arg("select", r#"["stg_orders"]"#))
+            .unwrap();
+        assert!(narrowed.needed());
+        assert_eq!(narrowed.snapshot_job(job), Some(job));
+        assert!(!narrowed.publishes_ownership());
+
+        // The form posts the descriptor's own `select` back for every UI, schedule
+        // and webhook run. Reading that echo as a narrowing marks all of them
+        // caller-scoped, leaving a moved profile no run that could republish: it
+        // re-detects the same drift, and pays a `dbt parse` for it, forever.
+        let echoed =
+            DbtDescriptor { select: vec!["tag:nightly".to_string()], ..Default::default() };
+        let mut untouched = GraphRefresh { profile_drift: true, ..Default::default() };
+        untouched
+            .add_caller_args(&echoed, &arg("select", r#"["tag:nightly"]"#))
+            .unwrap();
+        assert!(untouched.publishes_ownership());
+        assert_eq!(untouched.snapshot_job(job), None);
+    }
+
+    // `dbt retry` restores the previous run's target/ from this directory, so two
+    // dbt scripts must not share one — a retry would resume another project's
+    // `run_results.json`, which an empty script_path is exactly how it happened.
+    #[test]
+    fn retry_state_is_per_script_and_principal() {
+        assert_ne!(
+            state_dir("ws", "f/a/one", "u"),
+            state_dir("ws", "f/a/two", "u")
+        );
+        assert_ne!(
+            state_dir("ws1", "f/a/one", "u"),
+            state_dir("ws2", "f/a/one", "u")
+        );
+        assert_eq!(
+            state_dir("ws", "f/a/one", "u"),
+            state_dir("ws", "f/a/one", "u")
+        );
+        // A retry replaces the caller's arguments with the saved ones, and an
+        // agent worker has no database row to fall back on: this separation is
+        // the only thing keeping one principal's `select`/`vars` from another.
+        assert_ne!(
+            state_dir("ws", "f/a/one", "u/alice"),
+            state_dir("ws", "f/a/one", "u/bob")
+        );
+    }
+
+    #[test]
+    fn events_without_a_relation_are_not_materializations() {
+        // A test node has no relation of its own.
+        let t = r#"{"data":{"node_info":{"node_status":"pass",
+            "node_relation":{"alias":"unique_c","schema":"a_audit","relation_name":""}}},
+            "info":{"name":"LogTestResult","msg":"ok"}}"#;
+        assert!(parse_node_event(t, "f/prod/wh", Some("wh")).is_none());
+        assert!(parse_node_event("Running with dbt=1.12.0", "f/prod/wh", Some("wh")).is_none());
+        // `skipped` says nothing about the relation's state.
+        let s = r#"{"data":{"node_info":{"node_status":"skipped",
+            "node_relation":{"alias":"c","schema":"a","relation_name":"\"w\".\"a\".\"c\""}}},
+            "info":{"name":"LogModelResult","msg":"skip"}}"#;
+        assert!(parse_node_event(s, "f/prod/wh", Some("wh")).is_none());
+    }
+}
diff --git a/backend/windmill-worker/src/dbt_profiles.rs b/backend/windmill-worker/src/dbt_profiles.rs
new file mode 100644
index 0000000000..3d96f84676
--- /dev/null
+++ b/backend/windmill-worker/src/dbt_profiles.rs
@@ -0,0 +1,1402 @@
+//! Rendering a `profiles.yml` from a Windmill warehouse resource, and the
+//! adapter package each warehouse needs.
+//!
+//! Only the fields dbt actually reads are emitted; anything the resource
+//! carries for other runtimes is ignored rather than guessed at. Credentials
+//! are written into the job dir, which is torn down with the job.
+
+use serde_json::Value;
+use windmill_common::error::{self, Error};
+
+/// Written beside `profiles.yml`, and named absolutely in `sslrootcert`: dbt
+/// runs with the project as its working directory and hands the path to the
+/// driver unchanged.
+pub const ROOT_CERT_FILENAME: &str = "server-ca.pem";
+
+/// The per-adapter facts, so each adapter states them together and a new one
+/// cannot inherit another's by omission. `PG` is the base every arm spreads
+/// from: most adapters differ from Postgres only in their name and package.
+struct AdapterSpec {
+    /// As a user would write it, for error messages.
+    name: &'static str,
+    /// dbt's own `type:` key in `profiles.yml`.
+    dbt_type: &'static str,
+    /// The dbt-core 1.x pip package; empty when the adapter is Fusion-only.
+    pip_package: &'static str,
+    default_port: i64,
+    database_key: &'static str,
+    requires_enterprise: bool,
+    /// Overrides `dbt_type` in the licensing error, where the product's own
+    /// spelling reads better than dbt's driver name.
+    display_name: Option<&'static str>,
+}
+
+impl AdapterSpec {
+    const PG: AdapterSpec = AdapterSpec {
+        name: "postgres",
+        dbt_type: "postgres",
+        pip_package: "dbt-postgres",
+        default_port: 5432,
+        database_key: "dbname",
+        requires_enterprise: false,
+        display_name: None,
+    };
+}
+
+/// The adapters Windmill has facts about (decision 9): a field mapping, a pip package, the
+/// license gate. NOT the adapters dbt projects may use — `DbtAdapter` carries those by name.
+/// The picker offers what reaches one (`WAREHOUSE_RESOURCE_TYPES` in
+/// `frontend/.../workspaceSettings/DbtSettings.svelte`), so a mapping change belongs there.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum KnownAdapter {
+    Postgres,
+    Redshift,
+    Mysql,
+    Duckdb,
+    Clickhouse,
+    Snowflake,
+    Bigquery,
+    Databricks,
+    Salesforce,
+    Mssql,
+    OracleDB,
+}
+
+impl KnownAdapter {
+    /// dbt's OWN `type:` spelling — a separate vocabulary from the resource types
+    /// below, deliberately. `fabric` is why: Windmill's `fabric` RESOURCE is a SQL
+    /// Server one, while dbt's `fabric` ADAPTER is its own `dbt-fabric`. Absent
+    /// here, it falls through to the open path and gets what it asked for.
+    pub fn from_dbt_type(t: &str) -> Option<Self> {
+        match t {
+            "postgres" | "postgresql" => Some(KnownAdapter::Postgres),
+            "redshift" => Some(KnownAdapter::Redshift),
+            "mysql" => Some(KnownAdapter::Mysql),
+            "duckdb" => Some(KnownAdapter::Duckdb),
+            "clickhouse" => Some(KnownAdapter::Clickhouse),
+            "snowflake" => Some(KnownAdapter::Snowflake),
+            "bigquery" => Some(KnownAdapter::Bigquery),
+            "databricks" => Some(KnownAdapter::Databricks),
+            "salesforce" => Some(KnownAdapter::Salesforce),
+            "sqlserver" | "mssql" => Some(KnownAdapter::Mssql),
+            "oracle" => Some(KnownAdapter::OracleDB),
+            _ => None,
+        }
+    }
+
+    pub fn from_resource_type(rt: &str) -> Option<Self> {
+        match rt {
+            "postgresql" | "postgres" => Some(KnownAdapter::Postgres),
+            "redshift" => Some(KnownAdapter::Redshift),
+            "mysql" => Some(KnownAdapter::Mysql),
+            "duckdb" => Some(KnownAdapter::Duckdb),
+            "clickhouse" => Some(KnownAdapter::Clickhouse),
+            "snowflake" | "snowflake_oauth" => Some(KnownAdapter::Snowflake),
+            "bigquery" | "gcp_service_account" => Some(KnownAdapter::Bigquery),
+            "databricks" => Some(KnownAdapter::Databricks),
+            "salesforce" => Some(KnownAdapter::Salesforce),
+            "ms_sql_server" | "mssql" | "sqlserver" | "fabric" => Some(KnownAdapter::Mssql),
+            "oracledb" | "oracle" => Some(KnownAdapter::OracleDB),
+            _ => None,
+        }
+    }
+
+    /// Everything that differs per adapter, in one place.
+    ///
+    /// Adding a warehouse is one arm here, and the match is exhaustive so the
+    /// compiler demands it. Spread across a method each, two of them carried a
+    /// `_ =>` default, so a new adapter silently inherited port 5432 and
+    /// `dbname` instead of failing to build.
+    fn spec(&self) -> &'static AdapterSpec {
+        match self {
+            KnownAdapter::Postgres => &AdapterSpec::PG,
+            KnownAdapter::Redshift => &AdapterSpec {
+                name: "redshift",
+                dbt_type: "redshift",
+                pip_package: "dbt-redshift",
+                default_port: 5439,
+                ..AdapterSpec::PG
+            },
+            KnownAdapter::Mysql => &AdapterSpec {
+                name: "mysql",
+                dbt_type: "mysql",
+                pip_package: "dbt-mysql",
+                default_port: 3306,
+                database_key: "schema",
+                ..AdapterSpec::PG
+            },
+            KnownAdapter::Duckdb => &AdapterSpec {
+                name: "duckdb",
+                dbt_type: "duckdb",
+                pip_package: "dbt-duckdb",
+                ..AdapterSpec::PG
+            },
+            KnownAdapter::Clickhouse => &AdapterSpec {
+                name: "clickhouse",
+                dbt_type: "clickhouse",
+                pip_package: "dbt-clickhouse",
+                ..AdapterSpec::PG
+            },
+            KnownAdapter::Snowflake => &AdapterSpec {
+                name: "snowflake",
+                dbt_type: "snowflake",
+                pip_package: "dbt-snowflake",
+                ..AdapterSpec::PG
+            },
+            KnownAdapter::Bigquery => &AdapterSpec {
+                name: "bigquery",
+                dbt_type: "bigquery",
+                pip_package: "dbt-bigquery",
+                ..AdapterSpec::PG
+            },
+            KnownAdapter::Databricks => &AdapterSpec {
+                name: "databricks",
+                dbt_type: "databricks",
+                pip_package: "dbt-databricks",
+                ..AdapterSpec::PG
+            },
+            // No dbt-core 1.x package exists for it; Fusion has it built in, and
+            // `provision_core_1x` refuses it by name rather than asking uv to
+            // install `""`. Pinned by
+            // `every_adapter_either_names_a_package_or_is_fusion_only`.
+            KnownAdapter::Salesforce => &AdapterSpec {
+                name: "salesforce",
+                dbt_type: "salesforce",
+                pip_package: "",
+                ..AdapterSpec::PG
+            },
+            KnownAdapter::Mssql => &AdapterSpec {
+                name: "mssql",
+                dbt_type: "sqlserver",
+                pip_package: "dbt-sqlserver",
+                requires_enterprise: true,
+                display_name: Some("Microsoft SQL server"),
+                ..AdapterSpec::PG
+            },
+            KnownAdapter::OracleDB => &AdapterSpec {
+                name: "oracle",
+                dbt_type: "oracle",
+                pip_package: "dbt-oracle",
+                requires_enterprise: true,
+                display_name: Some("Oracle DB"),
+                ..AdapterSpec::PG
+            },
+        }
+    }
+
+    /// Every adapter, for the tests that must cover all of them. The one list
+    /// there is: a second would be the thing that goes stale. Test-only, so a
+    /// release build does not carry a table nothing reads.
+    #[cfg(test)]
+    pub const ALL: &'static [KnownAdapter] = &[
+        KnownAdapter::Postgres,
+        KnownAdapter::Redshift,
+        KnownAdapter::Mysql,
+        KnownAdapter::Duckdb,
+        KnownAdapter::Clickhouse,
+        KnownAdapter::Snowflake,
+        KnownAdapter::Bigquery,
+        KnownAdapter::Databricks,
+        KnownAdapter::Salesforce,
+        KnownAdapter::Mssql,
+        KnownAdapter::OracleDB,
+    ];
+
+    /// Which dbt driver a resource needs, from the fields it carries — a
+    /// fallback for when the descriptor omits `profile.type`. It picks the
+    /// adapter only; asset identity is always the workspace warehouse's name,
+    /// never anything read here.
+    ///
+    /// Deliberately conservative about the host/port shapes. Windmill's
+    /// `ms_sql_server` and `oracledb` resources carry the same `host` +
+    /// `dbname`/`database` fields Postgres does, so a shape check cannot tell
+    /// them apart — and guessing Postgres for a SQL Server resource would
+    /// connect dbt-postgres to port 1433 instead of producing the licensing
+    /// error this design exists to give. So a bare host/database resource is
+    /// only Postgres when it carries something Postgres-specific, and is
+    /// otherwise `None`, which asks the user for `profile.type`.
+    pub fn infer_from_resource(v: &Value) -> Option<Self> {
+        let has = |k: &str| v.get(k).is_some_and(|x| !x.is_null());
+        if has("account_identifier") || has("warehouse") {
+            Some(KnownAdapter::Snowflake)
+        } else if has("http_path") {
+            Some(KnownAdapter::Databricks)
+        } else if has("project_id") && has("client_email") {
+            Some(KnownAdapter::Bigquery)
+        } else if has("dbname") && has("host") && (has("sslmode") || has("root_certificate_pem")) {
+            Some(KnownAdapter::Postgres)
+        } else {
+            None
+        }
+    }
+
+    /// dbt's own `type:` key in `profiles.yml`.
+    pub fn dbt_type(&self) -> &'static str {
+        self.spec().dbt_type
+    }
+
+    /// The adapter's name as a user would write it, for error messages.
+    pub fn name(&self) -> &'static str {
+        self.spec().name
+    }
+
+    /// The pip package providing this adapter for the dbt-core 1.x engine,
+    /// whose venv is provisioned on first use. The Rust engines ship their
+    /// adapters in the binary and never consult this. Empty means no such
+    /// package exists.
+    pub fn pip_package(&self) -> &'static str {
+        self.spec().pip_package
+    }
+
+    /// Only meaningful for the host/port adapters rendered from a resource.
+    fn default_port(&self) -> i64 {
+        self.spec().default_port
+    }
+
+    /// dbt spells the database differently per adapter.
+    fn database_key(&self) -> &'static str {
+        self.spec().database_key
+    }
+
+    /// The keys a target block spells its database and schema with, mirroring
+    /// what `render_profile` emits below.
+    ///
+    /// Read back when the PROJECT owns its `profiles.yml`. Windmill did not
+    /// write that file, but it still needs the target's database to spell
+    /// `dbt://` paths the way a rendered profile does: without it every relation
+    /// qualifies as `<db>.<schema>` while a workspace-warehouse project spells
+    /// the same table plainly, and the two never share a node.
+    pub fn target_identity_keys(&self) -> (&'static str, &'static str) {
+        match self {
+            KnownAdapter::Bigquery => ("project", "dataset"),
+            KnownAdapter::Databricks => ("catalog", "schema"),
+            // `database_key` is what Windmill's own resource spells it, and only
+            // the adapters `render_profile` translates have one. The rest reach
+            // dbt through a block they wrote themselves, which spells it the way
+            // dbt does.
+            KnownAdapter::Postgres | KnownAdapter::Redshift | KnownAdapter::Mysql => {
+                (self.database_key(), "schema")
+            }
+            _ => ("database", "schema"),
+        }
+    }
+
+    /// Whether this adapter needs an enterprise license.
+    ///
+    /// The boundary is not invented for dbt: it mirrors the two native script
+    /// languages that are still enterprise-gated. Every other warehouse dbt can
+    /// reach has a CE `ScriptLang`, so gating its dbt adapter would be stricter
+    /// than running the same query natively.
+    pub fn requires_enterprise(&self) -> bool {
+        self.spec().requires_enterprise
+    }
+
+    /// The name used in the licensing error, matching how the native languages
+    /// name themselves.
+    fn display_name(&self) -> &'static str {
+        let spec = self.spec();
+        spec.display_name.unwrap_or(spec.dbt_type)
+    }
+}
+
+/// The adapter a profile connects with: dbt's own `type:`, plus whatever Windmill knows.
+/// Open by construction — a `dbt_profile` carries a block Windmill never has to understand,
+/// so an unknown adapter is still rendered, licensed and identified. INSTALLING one is a
+/// separate question, gated by `ensure_adapter_installable`.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct DbtAdapter {
+    known: Option<KnownAdapter>,
+    /// dbt's own `type:` spelling, lowercased. Also the pip package's suffix.
+    name: String,
+}
+
+impl DbtAdapter {
+    /// An adapter as dbt spells it, known or not. The name reaches a pip requirement
+    /// and a venv path, so it is confined to what an adapter name can be rather than
+    /// escaped at each use: a leading `-` is a pip flag, a `/` or `..` a path segment.
+    pub fn from_dbt_type(t: &str) -> error::Result<Self> {
+        let name = t.trim().to_ascii_lowercase();
+        let shaped = name.len() <= 40
+            && name.starts_with(|c: char| c.is_ascii_alphanumeric())
+            && name
+                .chars()
+                .all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '-');
+        if !shaped {
+            return Err(Error::BadRequest(format!(
+                "`{t}` is not a dbt adapter name: dbt spells one with letters, digits, `_` and \
+                 `-`, as in `postgres` or `trino`"
+            )));
+        }
+        // Normalised to the adapter's own dbt spelling when one resolves, so two
+        // names for one adapter are one value: `PartialEq` covers `name` too, and
+        // `profile.type: mssql` over a `sqlserver` target would otherwise be
+        // rejected by a message naming the same adapter on both sides.
+        let known = KnownAdapter::from_dbt_type(&name);
+        let name = known.map_or(name, |k| k.dbt_type().to_string());
+        Ok(Self { known, name })
+    }
+
+    /// The adapter a `dbt_profile` states, from the `type` of the block its value is.
+    /// Called only for that resource TYPE, never sniffed: Windmill's bigquery resource
+    /// is a service-account JSON and says `type: service_account`.
+    pub fn stated_by_dbt_profile(v: &Value) -> error::Result<Self> {
+        let stated = v.get("type").and_then(|t| t.as_str()).ok_or_else(|| {
+            Error::BadRequest(
+                "a `dbt_profile` resource names its adapter in `type`, as a `profiles.yml` output \
+                 does; this one has none"
+                    .to_string(),
+            )
+        })?;
+        Self::from_dbt_type(stated)
+    }
+
+    /// The adapter's facts, when it is one Windmill has any.
+    pub fn known(&self) -> Option<KnownAdapter> {
+        self.known
+    }
+
+    /// dbt's own `type:` key in `profiles.yml`.
+    pub fn dbt_type(&self) -> &str {
+        self.known.map_or(self.name.as_str(), |k| k.dbt_type())
+    }
+
+    /// The adapter's name as a user would write it, for error messages.
+    pub fn name(&self) -> &str {
+        self.known.map_or(self.name.as_str(), |k| k.name())
+    }
+
+    /// The pip package providing this adapter for the dbt-core 1.x engine.
+    /// Empty means no such package exists and only Fusion has it.
+    pub fn pip_package(&self) -> String {
+        match self.known {
+            Some(k) => k.pip_package().to_string(),
+            None => format!("dbt-{}", self.name),
+        }
+    }
+
+    /// The keys a target block spells its database and schema with.
+    /// An unknown adapter is read with dbt's ordinary pair.
+    pub fn target_identity_keys(&self) -> (&'static str, &'static str) {
+        self.known
+            .map_or(("database", "schema"), |k| k.target_identity_keys())
+    }
+
+    /// Whether this adapter needs an enterprise license. Never for an unknown
+    /// one: the gate mirrors the two native warehouse languages, and an adapter
+    /// with no Windmill runtime behind it is not one of them.
+    pub fn requires_enterprise(&self) -> bool {
+        self.known.is_some_and(|k| k.requires_enterprise())
+    }
+
+    fn display_name(&self) -> &str {
+        self.known.map_or(self.name.as_str(), |k| k.display_name())
+    }
+}
+
+impl From<KnownAdapter> for DbtAdapter {
+    fn from(known: KnownAdapter) -> Self {
+        Self { known: Some(known), name: known.dbt_type().to_string() }
+    }
+}
+
+/// Whether this build may use the enterprise-only adapters.
+///
+/// Two conditions, both required. `LICENSE_KEY_VALID` alone is not enough: the
+/// OSS variant of `ee_oss` initializes it to `true`, so reading it on a CE
+/// build would wave everything through. The `cfg` establishes it is an
+/// enterprise build; the atomic then reports whether that build's key actually
+/// verified.
+fn enterprise_licensed() -> bool {
+    #[cfg(feature = "enterprise")]
+    {
+        windmill_common::ee_oss::LICENSE_KEY_VALID.load(std::sync::atomic::Ordering::Relaxed)
+    }
+    #[cfg(not(feature = "enterprise"))]
+    {
+        false
+    }
+}
+
+/// Reject an enterprise-only adapter on an unlicensed build.
+///
+/// Unlike the native languages, this cannot be a compile-time gate: there is
+/// one dbt executor and the adapter is only known once the profile resolves. So
+/// it is checked at both deploy and run — and it says so plainly, rather than
+/// letting the run fail later with a connection error the user cannot act on.
+pub fn ensure_adapter_licensed(adapter: &DbtAdapter) -> error::Result<()> {
+    if adapter.requires_enterprise() && !enterprise_licensed() {
+        return Err(Error::BadRequest(format!(
+            "{} is only available with an enterprise license",
+            adapter.display_name()
+        )));
+    }
+    Ok(())
+}
+
+fn s(v: &Value, k: &str) -> Option<String> {
+    v.get(k)
+        .and_then(|x| x.as_str())
+        .map(|x| x.to_string())
+        .filter(|x| !x.is_empty())
+}
+
+/// A resource's port, which may arrive as a JSON number or as a string —
+/// resources are user-supplied JSON and nothing coerces the field. Reading only
+/// `as_i64` sent `"5433"` to the adapter default, which connects to whatever
+/// listens there and reports nothing; a value that is present but not a port is
+/// refused rather than replaced.
+fn port_of(resource: &Value, default: i64) -> error::Result<i64> {
+    let bad = |v: &Value| {
+        Error::BadRequest(format!(
+            "resource `port` must be a number, got `{v}`; correct the resource"
+        ))
+    };
+    match resource.get("port") {
+        None | Some(Value::Null) => Ok(default),
+        Some(Value::Number(n)) => n.as_i64().ok_or_else(|| bad(&Value::Number(n.clone()))),
+        Some(Value::String(s)) if s.trim().is_empty() => Ok(default),
+        Some(Value::String(s)) => s
+            .trim()
+            .parse::<i64>()
+            .map_err(|_| bad(&Value::String(s.clone()))),
+        Some(other) => Err(bad(other)),
+    }
+}
+
+/// The rendered `profiles.yml` body plus the `(schema, database)` the target
+/// resolves to. The caller needs those two to spell the `dbt://` asset paths
+/// of models that do not override them.
+#[derive(Debug)]
+pub struct RenderedProfile {
+    pub yaml: String,
+    pub schema: Option<String>,
+    pub database: Option<String>,
+    /// A private CA the caller must write next to `profiles.yml`, under the
+    /// file name `sslrootcert` already points at. Returned rather than written
+    /// here so this stays a pure renderer.
+    pub root_certificate_pem: Option<String>,
+}
+
+/// Render a single-target `profiles.yml` for `profile_name`/`target`.
+///
+/// `threads` is the descriptor's, defaulted by dbt when absent. `schema` comes
+/// from the descriptor when set, else from the resource, else from dbt's own
+/// per-adapter default — dbt errors out clearly when it ends up missing, which
+/// is a better failure than a Windmill-invented default.
+pub fn render_profile(
+    adapter: &DbtAdapter,
+    resource: &Value,
+    profile_name: &str,
+    target: &str,
+    threads: Option<u32>,
+    schema_override: Option<&str>,
+    // Where `profiles.yml` (and any root certificate) is written. dbt runs with
+    // the PROJECT as its working directory and hands `sslrootcert` to the
+    // driver unchanged, so a path relative to the profiles dir would be
+    // resolved against the project and never found.
+    profiles_dir: &std::path::Path,
+) -> error::Result<RenderedProfile> {
+    // Past here the resource is one of Windmill's own connection types, which
+    // becomes a target only through a field mapping below — so an adapter
+    // Windmill has no facts about cannot be rendered from one at all.
+    let adapter = adapter.known().ok_or_else(|| {
+        Error::BadRequest(format!(
+            "no Windmill resource translates into a `{}` target; point the warehouse at a \
+             `dbt_profile` resource, whose value is the profiles.yml block itself",
+            adapter.dbt_type()
+        ))
+    })?;
+
+    let mut out: Vec<(String, ProfileValue)> = vec![("type".into(), quoted(adapter.dbt_type()))];
+    let mut schema = schema_override.map(|x| x.to_string());
+    let database;
+
+    match adapter {
+        // Redshift and MySQL take the same host/port/user/password/database
+        // shape as Postgres in both dbt and Windmill's resource types, so one
+        // arm renders all three; only the default port and the database key
+        // differ.
+        KnownAdapter::Postgres | KnownAdapter::Redshift | KnownAdapter::Mysql => {
+            let host = s(resource, "host").ok_or_else(|| {
+                Error::BadRequest(format!("{} resource has no `host`", adapter.dbt_type()))
+            })?;
+            let dbname = s(resource, "dbname")
+                .or_else(|| s(resource, "database"))
+                .or_else(|| s(resource, "service_name"))
+                .ok_or_else(|| {
+                    Error::BadRequest(format!(
+                        "{} resource has no `dbname`/`database`",
+                        adapter.dbt_type()
+                    ))
+                })?;
+            out.push(("host".into(), quoted(&host)));
+            out.push((
+                "port".into(),
+                // dbt validates `port` against a JSON schema that demands an
+                // integer; a quoted scalar is rejected outright.
+                ProfileValue::Number(port_of(resource, adapter.default_port())?),
+            ));
+            out.push((adapter.database_key().into(), quoted(&dbname)));
+            database = Some(dbname.clone());
+            if let Some(u) = s(resource, "user") {
+                out.push(("user".into(), quoted(&u)));
+            }
+            if let Some(p) = s(resource, "password") {
+                out.push(("password".into(), quoted(&p)));
+            }
+            if let Some(m) = s(resource, "sslmode") {
+                out.push(("sslmode".into(), quoted(&m)));
+            }
+            // Under `verify-ca`/`verify-full` a resource's private CA is the
+            // only way the connection can succeed; without it libpq looks for a
+            // default certificate that is not there, and the same field is what
+            // identifies the resource as Postgres in the first place.
+            if s(resource, "root_certificate_pem").is_some() {
+                out.push((
+                    "sslrootcert".into(),
+                    quoted(&profiles_dir.join(ROOT_CERT_FILENAME).to_string_lossy()),
+                ));
+            }
+            schema = match adapter {
+                // Already emitted as the database key; reported back so the
+                // caller can spell `dbt://` paths with it.
+                KnownAdapter::Mysql => Some(dbname.clone()),
+                _ => schema
+                    .or_else(|| s(resource, "schema"))
+                    .or(Some("public".into())),
+            };
+        }
+        // Their Windmill resources do not carry what dbt needs — an `oracledb`
+        // resource has no host/service, dbt-sqlserver needs an ODBC `driver` the
+        // images lack — so a rendered profile could not connect. They are reached
+        // through a target written for them instead.
+        KnownAdapter::Duckdb
+        | KnownAdapter::Clickhouse
+        | KnownAdapter::Salesforce
+        | KnownAdapter::Mssql
+        | KnownAdapter::OracleDB => {
+            return Err(Error::BadRequest(format!(
+                "a `{}` resource carries nothing dbt can connect with; point the warehouse at a \
+                 `dbt_profile` resource, whose value is the profiles.yml block itself, or \
+                 `profile.profiles_yml` at the project's own profiles.yml",
+                adapter.dbt_type()
+            )));
+        }
+        KnownAdapter::Snowflake => {
+            let account = s(resource, "account_identifier")
+                .or_else(|| s(resource, "account"))
+                .ok_or_else(|| {
+                    Error::BadRequest("snowflake resource has no `account_identifier`".to_string())
+                })?;
+            out.push(("account".into(), quoted(&account)));
+            if let Some(u) = s(resource, "username").or_else(|| s(resource, "user")) {
+                out.push(("user".into(), quoted(&u)));
+            }
+            // Key-pair is Windmill's own snowflake resource shape; the
+            // `snowflake_oauth` type carries a token instead, which dbt only
+            // accepts alongside `authenticator: oauth` — without both, the
+            // profile renders with no credential at all and cannot connect.
+            if let Some(t) = s(resource, "token").or_else(|| s(resource, "access_token")) {
+                out.push(("authenticator".into(), quoted("oauth")));
+                out.push(("token".into(), quoted(&t)));
+            } else if let Some(k) = s(resource, "private_key") {
+                out.push(("private_key".into(), quoted(&k)));
+                if let Some(pp) = s(resource, "private_key_passphrase") {
+                    out.push(("private_key_passphrase".into(), quoted(&pp)));
+                }
+            } else if let Some(p) = s(resource, "password") {
+                out.push(("password".into(), quoted(&p)));
+            }
+            for k in ["warehouse", "role"] {
+                if let Some(v) = s(resource, k) {
+                    out.push((k.into(), quoted(&v)));
+                }
+            }
+            database = s(resource, "database");
+            if let Some(d) = database.clone() {
+                out.push(("database".into(), quoted(&d)));
+            }
+            schema = schema.or_else(|| s(resource, "schema"));
+        }
+        KnownAdapter::Bigquery => {
+            // Windmill's bigquery resource is the raw service-account JSON, so
+            // hand dbt the same document via `method: service-account-json`
+            // rather than re-deriving individual fields.
+            out.push(("method".into(), quoted("service-account-json")));
+            let project = s(resource, "project_id").ok_or_else(|| {
+                Error::BadRequest("bigquery resource has no `project_id`".to_string())
+            })?;
+            out.push(("project".into(), quoted(&project)));
+            database = Some(project);
+            // A service-account JSON has no dataset, so unless the resource was
+            // extended with one the descriptor must supply it — dbt rejects a
+            // BigQuery target without `dataset`, and failing here names the
+            // missing field instead.
+            schema = schema
+                .or_else(|| s(resource, "dataset"))
+                .or_else(|| s(resource, "schema"));
+            if schema.is_none() {
+                return Err(Error::BadRequest(
+                    "a BigQuery target needs a dataset; set `profile.schema` in the descriptor"
+                        .to_string(),
+                ));
+            }
+        }
+        KnownAdapter::Databricks => {
+            // Windmill's databricks resource spells the workspace `workspace_url`, and
+            // spells it as a full URL; dbt wants a bare hostname under `host`.
+            let host = s(resource, "host")
+                .or_else(|| s(resource, "workspace_url").map(|u| bare_host(&u)))
+                .ok_or_else(|| {
+                    Error::BadRequest(
+                        "databricks resource has no `workspace_url`/`host`".to_string(),
+                    )
+                })?;
+            out.push(("host".into(), quoted(&host)));
+            for (k, rk) in [("http_path", "http_path"), ("token", "token")] {
+                let v = s(resource, rk).ok_or_else(|| {
+                    Error::BadRequest(format!("databricks resource has no `{rk}`"))
+                })?;
+                out.push((k.into(), quoted(&v)));
+            }
+            database = s(resource, "catalog");
+            if let Some(c) = database.clone() {
+                out.push(("catalog".into(), quoted(&c)));
+            }
+            schema = schema.or_else(|| s(resource, "schema"));
+        }
+    }
+
+    // dbt-mysql has no database/schema distinction: its `schema` key IS the
+    // database, already emitted above. Pushing the generic one too would put
+    // two `schema` keys in one target — an invalid profile, or one silently
+    // pointing at the wrong database.
+    if adapter != KnownAdapter::Mysql {
+        if let Some(sc) = schema.clone() {
+            // dbt-bigquery spells it `dataset`; every other adapter says
+            // `schema`. Emitting `schema` there produces a profile dbt rejects.
+            let key = match adapter {
+                KnownAdapter::Bigquery => "dataset",
+                _ => "schema",
+            };
+            out.push((key.into(), quoted(&sc)));
+        }
+    }
+    if let Some(t) = threads {
+        out.push(("threads".into(), ProfileValue::Number(t as i64)));
+    }
+
+    // Quoted, keys included. `profile_name` comes from the project's own
+    // `dbt_project.yml` and `target` from the descriptor, so both are the
+    // author's text: a name like `prod # x` silently truncates the mapping, and
+    // a newline in one opens a sibling key of the caller's choosing.
+    let (qp, qt) = (yaml_scalar(profile_name), yaml_scalar(target));
+    let mut yaml = format!("{qp}:\n  target: {qt}\n  outputs:\n    {qt}:\n");
+    for (k, v) in &out {
+        yaml.push_str(&format!("      {k}: {}\n", v.render()));
+    }
+    // The service-account document is a nested mapping, not a scalar.
+    if adapter == KnownAdapter::Bigquery {
+        yaml.push_str("      keyfile_json:\n");
+        let obj = resource
+            .as_object()
+            .ok_or_else(|| Error::BadRequest("bigquery resource is not an object".to_string()))?;
+        for (k, v) in obj {
+            if let Some(v) = v.as_str() {
+                yaml.push_str(&format!("        {}: {}\n", yaml_scalar(k), yaml_scalar(v)));
+            }
+        }
+    }
+
+    Ok(RenderedProfile {
+        yaml,
+        schema,
+        database,
+        root_certificate_pem: matches!(adapter, KnownAdapter::Postgres)
+            .then(|| s(resource, "root_certificate_pem"))
+            .flatten(),
+    })
+}
+
+/// Render a `dbt_profile`: its value IS one entry of `profiles.yml`'s `outputs` map, so it
+/// is emitted as it stands — nothing lifted out or renamed, which is the point of the type.
+/// Only what dbt cannot take literally is handled: the adapter's `type`, a certificate that
+/// is a PEM body rather than a path, and the two keys a descriptor may override.
+pub fn render_dbt_profile(
+    adapter: &DbtAdapter,
+    block: &serde_json::Map<String, Value>,
+    profile_name: &str,
+    target: &str,
+    threads: Option<u32>,
+    schema_override: Option<&str>,
+    profiles_dir: &std::path::Path,
+) -> error::Result<RenderedProfile> {
+    let (database_key, schema_key) = adapter.target_identity_keys();
+    let root_certificate_pem = block
+        .get("root_certificate_pem")
+        .and_then(|v| v.as_str())
+        .filter(|v| !v.is_empty())
+        .map(|v| v.to_string());
+
+    let (qp, qt) = (yaml_scalar(profile_name), yaml_scalar(target));
+    let mut yaml = format!("{qp}:\n  target: {qt}\n  outputs:\n    {qt}:\n");
+    // Keys quoted throughout this block, the block's own and Windmill's alike: a
+    // target whose `"host"` is quoted and whose `schema` is not reads as a bug.
+    yaml.push_str(&format!(
+        "      \"type\": {}\n",
+        yaml_scalar(adapter.dbt_type())
+    ));
+    for (k, v) in block {
+        // A null is an optional field the resource form left unset, and dbt
+        // validates several keys against a schema that rejects one.
+        if k == "type" || k == "root_certificate_pem" || v.is_null() {
+            continue;
+        }
+        // Only when Windmill writes one of its own, which would otherwise be a second
+        // `sslrootcert`. A path with no PEM beside it is the block's own trust source —
+        // a CA baked into the image or mounted on the worker — and dropping it changes
+        // what the connection verifies against.
+        if k == "sslrootcert" && root_certificate_pem.is_some() {
+            continue;
+        }
+        if (k == schema_key && schema_override.is_some()) || (k == "threads" && threads.is_some()) {
+            continue;
+        }
+        emit_entry(&mut yaml, 6, k, v);
+    }
+    if root_certificate_pem.is_some() {
+        yaml.push_str(&format!(
+            "      \"sslrootcert\": {}\n",
+            yaml_scalar(&profiles_dir.join(ROOT_CERT_FILENAME).to_string_lossy())
+        ));
+    }
+    if let Some(sc) = schema_override {
+        yaml.push_str(&format!(
+            "      {}: {}\n",
+            yaml_scalar(schema_key),
+            yaml_scalar(sc)
+        ));
+    }
+    if let Some(t) = threads {
+        yaml.push_str(&format!("      \"threads\": {t}\n"));
+    }
+
+    let str_key = |k: &str| block.get(k).and_then(|v| v.as_str()).map(|v| v.to_string());
+    Ok(RenderedProfile {
+        yaml,
+        schema: schema_override
+            .map(|x| x.to_string())
+            .or_else(|| str_key(schema_key)),
+        database: str_key(database_key),
+        root_certificate_pem,
+    })
+}
+
+/// Emit one target key, nesting as deep as the value goes — an adapter's credential can be
+/// a mapping (bigquery's `keyfile_json`) or a list. Keys are quoted like values: one nothing
+/// here enumerates is as free-form as a password.
+fn emit_entry(out: &mut String, indent: usize, key: &str, v: &Value) {
+    out.push_str(&format!("{}{}:", " ".repeat(indent), yaml_scalar(key)));
+    emit_value(out, indent, v);
+}
+
+/// The value half, after `key:`. An empty collection is emitted INLINE: a block with no
+/// children reads back as `null`, so `extensions: []` would reach the adapter as a missing
+/// value rather than the empty list dbt was handed.
+fn emit_value(out: &mut String, indent: usize, v: &Value) {
+    match v {
+        Value::Object(m) => {
+            // A null is an optional field the resource form left unset, and dbt validates
+            // several keys against a schema that rejects one.
+            let kept: Vec<_> = m.iter().filter(|(_, v)| !v.is_null()).collect();
+            if kept.is_empty() {
+                out.push_str(" {}\n");
+                return;
+            }
+            out.push('\n');
+            for (k, v) in kept {
+                emit_entry(out, indent + 2, k, v);
+            }
+        }
+        Value::Array(items) => {
+            if items.is_empty() {
+                out.push_str(" []\n");
+                return;
+            }
+            out.push('\n');
+            let pad = " ".repeat(indent + 2);
+            for item in items {
+                out.push_str(&pad);
+                out.push('-');
+                emit_value(out, indent + 2, item);
+            }
+        }
+        _ => out.push_str(&format!(" {}\n", yaml_value(v))),
+    }
+}
+
+/// A scalar as dbt reads it: quoted when it is text, bare when it is not.
+/// `port`, `threads` and the boolean toggles adapters carry are validated
+/// against a JSON schema that rejects the quoted form.
+fn yaml_value(v: &Value) -> String {
+    match v {
+        Value::String(s) => yaml_scalar(s),
+        Value::Bool(b) => b.to_string(),
+        Value::Number(n) => n.to_string(),
+        other => yaml_scalar(&other.to_string()),
+    }
+}
+
+/// One rendered `profiles.yml` value. Strings are always quoted so credential
+/// content cannot inject profile keys; numbers must NOT be, because dbt
+/// validates `port` and `threads` against a JSON schema that demands integers
+/// and rejects the quoted form outright.
+enum ProfileValue {
+    Str(String),
+    Number(i64),
+}
+
+impl ProfileValue {
+    fn render(&self) -> String {
+        match self {
+            ProfileValue::Str(s) => yaml_scalar(s),
+            ProfileValue::Number(n) => n.to_string(),
+        }
+    }
+}
+
+fn quoted(v: &str) -> ProfileValue {
+    ProfileValue::Str(v.to_string())
+}
+
+/// A workspace URL as dbt wants it: the hostname alone. Windmill's databricks
+/// resource carries the full deployment URL, while dbt-databricks builds its own
+/// URL from `host`, so a scheme left in place produces `https://https://…`.
+fn bare_host(url: &str) -> String {
+    url.trim()
+        .trim_start_matches("https://")
+        .trim_start_matches("http://")
+        .trim_end_matches('/')
+        .to_string()
+}
+
+/// Emit a YAML scalar that survives any credential content. Always
+/// double-quoted with the two characters that can terminate or escape inside a
+/// double-quoted scalar escaped, so a password containing `#`, `:`, a newline
+/// or a quote cannot break out of its value and inject profile keys.
+fn yaml_scalar(v: &str) -> String {
+    let escaped = v
+        .replace('\\', "\\\\")
+        .replace('"', "\\\"")
+        .replace('\n', "\\n")
+        .replace('\r', "\\r");
+    format!("\"{escaped}\"")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    #[test]
+    fn renders_postgres_target() {
+        let r = json!({"host": "db.internal", "port": 5433, "user": "u", "password": "p",
+                       "dbname": "warehouse", "sslmode": "require"});
+        let p = render_profile(
+            &KnownAdapter::Postgres.into(),
+            &r,
+            "wm",
+            "prod",
+            Some(8),
+            None,
+            std::path::Path::new("/tmp/p"),
+        )
+        .unwrap();
+        // Quoted: the profile name and target are the author's text, so they are
+        // rendered as scalars rather than as bare keys.
+        assert!(
+            p.yaml.contains("\"wm\":\n  target: \"prod\"\n"),
+            "{}",
+            p.yaml
+        );
+        assert!(p.yaml.contains("      type: \"postgres\"\n"));
+        // dbt's profile schema types these as integers, so they must not be
+        // quoted like the credential scalars around them.
+        assert!(p.yaml.contains("      port: 5433\n"));
+        assert!(p.yaml.contains("      threads: 8\n"));
+        assert_eq!(p.database.as_deref(), Some("warehouse"));
+        assert_eq!(p.schema.as_deref(), Some("public"));
+    }
+
+    #[test]
+    fn redshift_falls_back_to_its_own_port() {
+        // Redshift is rendered from the same host/port shape as Postgres but
+        // does not answer on Postgres's port.
+        let r = json!({"host": "cluster.redshift.amazonaws.com", "user": "u",
+                       "password": "p", "dbname": "warehouse"});
+        let p = render_profile(
+            &KnownAdapter::Redshift.into(),
+            &r,
+            "wm",
+            "prod",
+            None,
+            None,
+            std::path::Path::new("/tmp/p"),
+        )
+        .unwrap();
+        assert!(p.yaml.contains("      port: 5439\n"), "{}", p.yaml);
+    }
+
+    // The point of `dbt_profile`: an adapter with no field mapping still
+    // connects, because its value is a block dbt wrote and reaches dbt as it is.
+    #[test]
+    fn dbt_profile_renders_its_block_verbatim() {
+        let r = json!({"type": "clickhouse", "host": "ch.internal", "port": 8123,
+                       "secure": true, "user": "u", "password": "p", "schema": "analytics"});
+        let p = render_dbt_profile(
+            &KnownAdapter::Clickhouse.into(),
+            r.as_object().unwrap(),
+            "wm",
+            "prod",
+            None,
+            None,
+            std::path::Path::new("/tmp/p"),
+        )
+        .unwrap();
+        assert!(
+            p.yaml.contains("      \"type\": \"clickhouse\"\n"),
+            "{}",
+            p.yaml
+        );
+        assert!(
+            p.yaml.contains("      \"host\": \"ch.internal\"\n"),
+            "{}",
+            p.yaml
+        );
+        // dbt types these in its own schema and rejects the quoted form.
+        assert!(p.yaml.contains("      \"port\": 8123\n"), "{}", p.yaml);
+        assert!(p.yaml.contains("      \"secure\": true\n"), "{}", p.yaml);
+        // The identity a `dbt://` path is spelled with, read back from the block.
+        assert_eq!(p.schema.as_deref(), Some("analytics"));
+    }
+
+    // Two `schema` keys in one target is a profile dbt rejects, or one silently
+    // pointing at the schema the descriptor meant to override.
+    #[test]
+    fn dbt_profile_schema_override_replaces_the_block_key() {
+        let r = json!({"type": "clickhouse", "host": "h", "schema": "raw"});
+        let p = render_dbt_profile(
+            &KnownAdapter::Clickhouse.into(),
+            r.as_object().unwrap(),
+            "wm",
+            "prod",
+            None,
+            Some("staging"),
+            std::path::Path::new("/tmp/p"),
+        )
+        .unwrap();
+        assert_eq!(p.yaml.matches("\"schema\":").count(), 1, "{}", p.yaml);
+        assert!(p.yaml.contains("\"schema\": \"staging\"\n"), "{}", p.yaml);
+        assert_eq!(p.schema.as_deref(), Some("staging"));
+    }
+
+    // `fabric` is a distinct dbt adapter AND a Windmill resource type for SQL
+    // Server. Resolving dbt's `type:` through the resource table installed
+    // dbt-sqlserver for it, under an enterprise gate, and never said Fabric.
+    #[test]
+    fn a_dbt_type_is_not_a_resource_type() {
+        let fabric = DbtAdapter::from_dbt_type("fabric").unwrap();
+        assert_eq!(fabric.dbt_type(), "fabric");
+        assert_eq!(fabric.pip_package(), "dbt-fabric");
+        assert!(!fabric.requires_enterprise());
+        // The Windmill resource type keeps mapping where it always did.
+        assert_eq!(
+            KnownAdapter::from_resource_type("fabric"),
+            Some(KnownAdapter::Mssql)
+        );
+    }
+
+    // `PartialEq` covers the carried name, so two spellings of one adapter must
+    // normalise or the descriptor/resource agreement check rejects a valid
+    // config with a message naming the same adapter on both sides.
+    #[test]
+    fn two_spellings_of_one_adapter_are_one_value() {
+        for (a, b) in [("postgres", "postgresql"), ("sqlserver", "mssql")] {
+            assert_eq!(
+                DbtAdapter::from_dbt_type(a).unwrap(),
+                DbtAdapter::from_dbt_type(b).unwrap(),
+                "{a} vs {b}"
+            );
+        }
+    }
+
+    // An adapter Windmill has no facts about is still an adapter: this is what
+    // "whatever dbt supports" rests on.
+    #[test]
+    fn an_unknown_adapter_is_carried_by_name() {
+        let stated = DbtAdapter::stated_by_dbt_profile(&json!({"type": "trino", "host": "h"}))
+            .unwrap();
+        assert_eq!(stated.dbt_type(), "trino");
+        assert_eq!(stated.pip_package(), "dbt-trino");
+        assert!(stated.known().is_none());
+        // A block with no adapter cannot be rendered, and says which key is missing.
+        assert!(DbtAdapter::stated_by_dbt_profile(&json!({"host": "h"})).is_err());
+    }
+
+    // A block whose CA is a path on the worker keeps it: Windmill only takes the
+    // key over when it has a PEM of its own to point at.
+    #[test]
+    fn a_path_only_sslrootcert_survives() {
+        let r = json!({"type": "postgres", "host": "h", "sslmode": "verify-full",
+                       "sslrootcert": "/etc/ssl/certs/warehouse-ca.pem"});
+        let p = render_dbt_profile(
+            &KnownAdapter::Postgres.into(),
+            r.as_object().unwrap(),
+            "wm",
+            "prod",
+            None,
+            None,
+            std::path::Path::new("/tmp/p"),
+        )
+        .unwrap();
+        assert!(
+            p.yaml
+                .contains("\"sslrootcert\": \"/etc/ssl/certs/warehouse-ca.pem\"\n"),
+            "{}",
+            p.yaml
+        );
+        // And a PEM in the block still wins, exactly once.
+        let r = json!({"type": "postgres", "host": "h", "sslrootcert": "/ignored",
+                       "root_certificate_pem": "-----BEGIN CERTIFICATE-----\nx\n"});
+        let p = render_dbt_profile(
+            &KnownAdapter::Postgres.into(),
+            r.as_object().unwrap(),
+            "wm",
+            "prod",
+            None,
+            None,
+            std::path::Path::new("/tmp/p"),
+        )
+        .unwrap();
+        assert_eq!(p.yaml.matches("sslrootcert").count(), 1, "{}", p.yaml);
+        assert!(p.yaml.contains(ROOT_CERT_FILENAME), "{}", p.yaml);
+    }
+
+    // dbt hands these to the adapter as it finds them, so a collection must survive the
+    // round trip: a block with no children reads back as `null`, not as `[]` or `{}`.
+    #[test]
+    fn collections_keep_their_type() {
+        let r = json!({"type": "duckdb", "extensions": [], "settings": {},
+                       "attach": [{"path": "raw.db", "read_only": true}],
+                       "matrix": [["a", 1], []], "plugins": ["excel", "json"]});
+        let p = render_dbt_profile(
+            &DbtAdapter::from_dbt_type("duckdb").unwrap(),
+            r.as_object().unwrap(),
+            "wm",
+            "prod",
+            None,
+            None,
+            std::path::Path::new("/tmp/p"),
+        )
+        .unwrap();
+        // Parsed back rather than string-matched: the point is what a YAML reader sees.
+        let y: serde_json::Value = serde_yml::from_str(&p.yaml).expect(&p.yaml);
+        let t = &y["wm"]["outputs"]["prod"];
+        assert_eq!(t["extensions"], json!([]), "{}", p.yaml);
+        assert_eq!(t["settings"], json!({}), "{}", p.yaml);
+        assert_eq!(t["attach"], json!([{"path": "raw.db", "read_only": true}]), "{}", p.yaml);
+        assert_eq!(t["matrix"], json!([["a", 1], []]), "{}", p.yaml);
+        assert_eq!(t["plugins"], json!(["excel", "json"]), "{}", p.yaml);
+    }
+
+    // An unknown adapter's name becomes `dbt-<name>` in a pip requirement and a
+    // venv path, both on the host and outside the jail.
+    #[test]
+    fn an_adapter_name_cannot_be_a_pip_flag_or_a_path() {
+        for bad in [
+            "--index-url=http://evil",
+            "-e .",
+            "../../etc/passwd",
+            "dbt postgres",
+            "",
+        ] {
+            assert!(DbtAdapter::from_dbt_type(bad).is_err(), "{bad}");
+        }
+        assert_eq!(
+            DbtAdapter::from_dbt_type("TRINO").unwrap().dbt_type(),
+            "trino"
+        );
+    }
+
+    // Windmill's databricks resource spells the workspace as a full URL under
+    // `workspace_url`; dbt-databricks builds its own URL from a bare `host`.
+    #[test]
+    fn databricks_takes_its_host_from_the_workspace_url() {
+        let r = json!({"workspace_url": "https://dbc-a1b2.cloud.databricks.com/",
+                       "http_path": "/sql/1.0/warehouses/x", "token": "t"});
+        let p = render_profile(
+            &KnownAdapter::Databricks.into(),
+            &r,
+            "wm",
+            "prod",
+            None,
+            None,
+            std::path::Path::new("/tmp/p"),
+        )
+        .unwrap();
+        assert!(
+            p.yaml
+                .contains("      host: \"dbc-a1b2.cloud.databricks.com\"\n"),
+            "{}",
+            p.yaml
+        );
+    }
+
+    // A resource's private CA is the only way a `verify-full` connection can
+    // succeed, and `root_certificate_pem` is also what identifies the resource as
+    // Postgres — forwarding one and dropping the other is incoherent.
+    #[test]
+    fn postgres_forwards_its_root_certificate() {
+        let r = json!({"host": "h", "dbname": "d", "sslmode": "verify-full",
+                       "root_certificate_pem": "-----BEGIN CERTIFICATE-----\nx\n"});
+        let p = render_profile(
+            &KnownAdapter::Postgres.into(),
+            &r,
+            "wm",
+            "prod",
+            None,
+            None,
+            std::path::Path::new("/tmp/p"),
+        )
+        .unwrap();
+        // Absolute: dbt runs with the PROJECT as its cwd and hands this to the
+        // driver unchanged, so a profiles-relative path would never be found.
+        let cert_path = std::path::Path::new("/tmp/p").join(ROOT_CERT_FILENAME);
+        assert!(
+            p.yaml.contains(&format!(
+                "      sslrootcert: {}\n",
+                yaml_scalar(&cert_path.to_string_lossy())
+            )),
+            "{}",
+            p.yaml
+        );
+        assert_eq!(
+            p.root_certificate_pem.as_deref(),
+            Some("-----BEGIN CERTIFICATE-----\nx\n")
+        );
+        // No CA configured, no dangling sslrootcert pointing at a missing file.
+        let plain = json!({"host": "h", "dbname": "d", "sslmode": "require"});
+        let p = render_profile(
+            &KnownAdapter::Postgres.into(),
+            &plain,
+            "wm",
+            "prod",
+            None,
+            None,
+            std::path::Path::new("/tmp/p"),
+        )
+        .unwrap();
+        assert!(!p.yaml.contains("sslrootcert"));
+        assert_eq!(p.root_certificate_pem, None);
+    }
+
+    // `snowflake_oauth` maps to the Snowflake adapter, but its credential is a
+    // token, which dbt honors only with `authenticator: oauth`. Forwarding neither
+    // renders a profile with no credential at all.
+    #[test]
+    fn snowflake_oauth_renders_its_token() {
+        let r = json!({"account_identifier": "acc", "username": "u", "token": "tok",
+                       "database": "db", "warehouse": "wh"});
+        let p = render_profile(
+            &KnownAdapter::Snowflake.into(),
+            &r,
+            "wm",
+            "prod",
+            None,
+            None,
+            std::path::Path::new("/tmp/p"),
+        )
+        .unwrap();
+        assert!(
+            p.yaml.contains("      authenticator: \"oauth\"\n"),
+            "{}",
+            p.yaml
+        );
+        assert!(p.yaml.contains("      token: \"tok\"\n"));
+    }
+
+    // dbt rejects a BigQuery target with no dataset and a service-account JSON
+    // carries none, so the descriptor has to supply it — and naming the missing
+    // field beats a downstream dbt error.
+    #[test]
+    fn bigquery_requires_a_dataset() {
+        let r = json!({"project_id": "p", "client_email": "e", "private_key": "k"});
+        let err = render_profile(
+            &KnownAdapter::Bigquery.into(),
+            &r,
+            "wm",
+            "prod",
+            None,
+            None,
+            std::path::Path::new("/tmp/p"),
+        )
+        .unwrap_err()
+        .to_string();
+        assert!(err.contains("profile.schema"), "{err}");
+        let p = render_profile(
+            &KnownAdapter::Bigquery.into(),
+            &r,
+            "wm",
+            "prod",
+            None,
+            Some("marts"),
+            std::path::Path::new("/tmp/p"),
+        )
+        .unwrap();
+        // dbt-bigquery's key is `dataset`, not `schema`.
+        assert!(p.yaml.contains("      dataset: \"marts\"\n"), "{}", p.yaml);
+        assert!(!p.yaml.contains("      schema:"));
+        assert_eq!(p.schema.as_deref(), Some("marts"));
+    }
+
+    // A SQL Server resource has a Postgres resource's shape, so guessing Postgres
+    // points dbt-postgres at port 1433 instead of producing the licensing error.
+    #[test]
+    fn ambiguous_host_resources_decline_rather_than_guess() {
+        let mssql = json!({"host": "h", "dbname": "d", "user": "u", "password": "p"});
+        assert_eq!(KnownAdapter::infer_from_resource(&mssql), None);
+        let pg = json!({"host": "h", "dbname": "d", "sslmode": "require"});
+        assert_eq!(
+            KnownAdapter::infer_from_resource(&pg),
+            Some(KnownAdapter::Postgres)
+        );
+        let sf = json!({"account_identifier": "acc", "database": "d"});
+        assert_eq!(
+            KnownAdapter::infer_from_resource(&sf),
+            Some(KnownAdapter::Snowflake)
+        );
+    }
+
+    // dbt-mysql has no database/schema split: one `schema` key is the database, so
+    // emitting the generic one too yields a profile with two.
+    #[test]
+    fn mysql_emits_exactly_one_schema_key() {
+        let r = json!({"host": "h", "dbname": "sales", "user": "u"});
+        let p = render_profile(
+            &KnownAdapter::Mysql.into(),
+            &r,
+            "wm",
+            "dev",
+            None,
+            None,
+            std::path::Path::new("/tmp/p"),
+        )
+        .unwrap();
+        assert_eq!(p.yaml.matches("      schema:").count(), 1);
+        assert!(p.yaml.contains("      schema: \"sales\"\n"));
+        assert!(p.yaml.contains("      port: 3306\n"));
+        assert_eq!(p.schema.as_deref(), Some("sales"));
+    }
+
+    // The profile name is the project's own `dbt_project.yml`, the target the
+    // descriptor's — both the author's text, and both were mapping keys.
+    #[test]
+    fn a_profile_name_or_target_cannot_open_a_sibling_key() {
+        let rendered = render_profile(
+            &KnownAdapter::Postgres.into(),
+            &serde_json::json!({"host": "h", "user": "u", "password": "p", "dbname": "d"}),
+            "prod # hidden",
+            "dev\n  evil: yes",
+            None,
+            None,
+            std::path::Path::new("/tmp"),
+        )
+        .unwrap();
+        // Every occurrence is quoted, so neither the comment nor the newline is
+        // structure: the document still has exactly the keys we wrote.
+        assert!(
+            rendered.yaml.contains("\"prod # hidden\":"),
+            "{}",
+            rendered.yaml
+        );
+        assert!(
+            rendered.yaml.contains("\\n  evil: yes"),
+            "{}",
+            rendered.yaml
+        );
+        let v: serde_yml::Value = serde_yml::from_str(&rendered.yaml).expect("valid yaml");
+        let profile = v.get("prod # hidden").expect("profile is one key");
+        assert!(profile.get("evil").is_none());
+        assert!(v.get("evil").is_none());
+    }
+
+    // A credential is attacker-influenced text. Unquoted, a `\n` or `"` closes the
+    // scalar and the rest reads as further profile keys — a different `host`,
+    // silently redirecting the run at another warehouse.
+    #[test]
+    fn credentials_cannot_break_out_of_their_scalar() {
+        let r = json!({"host": "h", "dbname": "d",
+                       "password": "p\"\nhost: evil.example.com\n#"});
+        let p = render_profile(
+            &KnownAdapter::Postgres.into(),
+            &r,
+            "wm",
+            "dev",
+            None,
+            None,
+            std::path::Path::new("/tmp/p"),
+        )
+        .unwrap();
+        assert!(p
+            .yaml
+            .contains(r#"password: "p\"\nhost: evil.example.com\n#""#));
+        let parsed: serde_yml::Value = serde_yml::from_str(&p.yaml).unwrap();
+        assert_eq!(
+            parsed["wm"]["outputs"]["dev"]["host"].as_str(),
+            Some("h"),
+            "the injected host must not have won"
+        );
+    }
+
+    // A RUNTIME check, because one dbt executor serves every adapter. A refactor
+    // reaching for a bare `LICENSE_KEY_VALID` would silently let CE through, since
+    // the OSS variant initializes it to `true`.
+    #[test]
+    fn only_mssql_and_oracle_are_enterprise_gated() {
+        for a in [
+            KnownAdapter::Postgres,
+            KnownAdapter::Redshift,
+            KnownAdapter::Mysql,
+            KnownAdapter::Duckdb,
+            KnownAdapter::Clickhouse,
+            KnownAdapter::Snowflake,
+            KnownAdapter::Bigquery,
+            KnownAdapter::Databricks,
+            KnownAdapter::Salesforce,
+        ] {
+            assert!(!a.requires_enterprise(), "{a:?}");
+            assert!(ensure_adapter_licensed(&a.into()).is_ok(), "{a:?}");
+        }
+        for (a, name) in [
+            (KnownAdapter::Mssql, "Microsoft SQL server"),
+            (KnownAdapter::OracleDB, "Oracle DB"),
+        ] {
+            assert!(a.requires_enterprise(), "{a:?}");
+            match ensure_adapter_licensed(&a.into()) {
+                Ok(()) => assert!(
+                    enterprise_licensed(),
+                    "{a:?} was accepted without an enterprise license"
+                ),
+                Err(e) => {
+                    assert!(!enterprise_licensed(), "{a:?} rejected despite a license");
+                    // Naming the adapter is the point: the user must not be left
+                    // with a generic connection failure to diagnose.
+                    assert_eq!(
+                        e.to_string(),
+                        format!("Bad request: {name} is only available with an enterprise license")
+                    );
+                }
+            }
+        }
+    }
+}
diff --git a/backend/windmill-worker/src/docker_v2.rs b/backend/windmill-worker/src/docker_v2.rs
index 3a4936e85d..52d1060b67 100644
--- a/backend/windmill-worker/src/docker_v2.rs
+++ b/backend/windmill-worker/src/docker_v2.rs
@@ -32,8 +32,9 @@ use windmill_queue::{append_logs, CanceledBy, MiniPulledJob};
 
 use crate::{
     common::{
-        build_args_map, get_reserved_variables, raw_to_string, resolve_nsjail_timeout,
-        resolve_nsjail_tmp_mount_block, start_child_process, OccupancyMetrics, DEV_CONF_NSJAIL,
+        build_args_map, get_reserved_variables, raw_to_string, read_and_check_file,
+        resolve_nsjail_timeout, resolve_nsjail_tmp_mount_block, start_child_process,
+        OccupancyMetrics, DEV_CONF_NSJAIL,
     },
     get_proxy_envs_for_lang,
     handle_child::handle_child,
@@ -169,6 +170,10 @@ struct OciConfig {
 /// directives and break out of the sandbox. Every byte is emitted as a printable
 /// ASCII char or a valid protobuf escape (`\"`, `\\`, `\n`/`\r`/`\t`, or 3-digit
 /// octal `\NNN` for control/non-ASCII bytes), so the result always parses.
+///
+/// `{` and `}` are escaped too: the profile is rendered by substituting `{PLACEHOLDER}`
+/// tokens one after another, so a value that still contained braces could smuggle in a
+/// later placeholder's expansion — and `{ENVARS}` expands to unquoted directives.
 fn proto_str(s: &str) -> String {
     let mut out = String::with_capacity(s.len() + 2);
     out.push('"');
@@ -179,6 +184,7 @@ fn proto_str(s: &str) -> String {
             b'\n' => out.push_str("\\n"),
             b'\r' => out.push_str("\\r"),
             b'\t' => out.push_str("\\t"),
+            b'{' | b'}' => out.push_str(&format!("\\{b:03o}")),
             0x20..=0x7e => out.push(b as char),
             _ => out.push_str(&format!("\\{b:03o}")),
         }
@@ -187,6 +193,83 @@ fn proto_str(s: &str) -> String {
     out
 }
 
+/// Why `./result.json` can't be collected, phrased for the job log.
+const UNVERIFIABLE_DST: &str =
+    "it cannot be proven to resolve inside the container root (a `..` component, or a \
+    symlink in the image rootfs)";
+const SHADOWED_DST: &str =
+    "it is under /tmp, /proc, /dev or /sys, which are mounted over the result file";
+
+/// In-jail destination for the `./result.json` bind — `{working_dir}/result.json` — or the
+/// reason the image's `WorkingDir` makes it uncollectable.
+///
+/// nsjail resolves a mount destination against its temporary root *before* pivot_root,
+/// with ordinary path resolution, and then creates it. A destination that walks out of
+/// that root therefore has nsjail create — and mount over — a path on the *host*, as the
+/// worker user. The profile places this mount directly after the rootfs binds and before
+/// every other mount, so the extracted rootfs is the only thing that can steer the
+/// resolution, and this walks the whole destination against it on the host:
+///
+/// - relative components (`..`) are rejected outright — they escape a fresh tmpfs too;
+/// - `/tmp`, `/proc`, `/dev` and `/sys` are mounted *after* this one (or aren't writable),
+///   so a destination under them would be shadowed rather than collected — rejected so
+///   the job says so instead of silently dropping the result;
+/// - every remaining component, **including the final `result.json`**, must exist as a
+///   non-symlink or not exist at all. The first absent component ends the walk: nsjail
+///   creates the rest as real directories under a parent already proven non-symlink.
+///   Any other error (an unreadable mode-000 directory the jail's uid 0 could still
+///   traverse) is treated as unsafe.
+///
+/// Nothing mutates the rootfs between this walk and the mount — extraction is finished and
+/// the container has not started — so there is no window to swap a component.
+async fn result_mount_dst(job_dir: &str, working_dir: &str) -> Result<String, &'static str> {
+    if !working_dir.starts_with('/') {
+        return Err(UNVERIFIABLE_DST);
+    }
+    let mut components = Vec::new();
+    for c in working_dir.split('/') {
+        match c {
+            "" | "." => continue,
+            ".." => return Err(UNVERIFIABLE_DST),
+            _ => components.push(c),
+        }
+    }
+    if matches!(
+        components.first(),
+        Some(&"tmp") | Some(&"proc") | Some(&"dev") | Some(&"sys")
+    ) {
+        return Err(SHADOWED_DST);
+    }
+    components.push("result.json");
+
+    let mut path = std::path::PathBuf::from(format!("{job_dir}/rootfs"));
+    for c in &components {
+        path.push(c);
+        match tokio::fs::symlink_metadata(&path).await {
+            Ok(m) if m.is_symlink() => return Err(UNVERIFIABLE_DST),
+            Ok(_) => {}
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => break,
+            Err(_) => return Err(UNVERIFIABLE_DST),
+        }
+    }
+    Ok(format!("/{}", components.join("/")))
+}
+
+/// Render the nsjail mount that exposes `{job_dir}/result.json` inside the container at
+/// `dst`, i.e. the `./result.json` a bash script writes.
+///
+/// The host side deliberately sits *outside* `{job_dir}/rootfs`: the worker reads the
+/// result from a path it created itself, never one the image could have planted as a
+/// symlink to a host file. The container can't swap it either — unlinking a
+/// bind-mount point fails.
+fn render_result_mount(job_dir: &str, dst: &str) -> String {
+    format!(
+        "mount {{\n  src: {}\n  dst: {}\n  is_bind: true\n  rw: true\n  mandatory: false\n}}\n",
+        proto_str(&format!("{job_dir}/result.json")),
+        proto_str(dst),
+    )
+}
+
 /// Render container env vars as nsjail `envar:` directives (one per line). Each
 /// `KEY=VALUE` is proto-escaped, so image-controlled keys/values can neither break
 /// the config nor reach nsjail's own process environment.
@@ -717,6 +800,21 @@ pub async fn handle_docker_v2_job(
     // Render the nsjail profile: dynamic per-entry rootfs binds + image WorkingDir.
     let nsjail_timeout = resolve_nsjail_timeout(conn, &job.workspace_id, job.id, job.timeout).await;
     let rootfs_mounts = generate_rootfs_mounts(&rootfs).await?;
+    // Bind source for `./result.json` inside the container; empty means "no result".
+    write_file(job_dir, "result.json", "")?;
+    let result_dst = result_mount_dst(job_dir, working_dir).await;
+    if let Err(reason) = result_dst {
+        append_logs(
+            &job.id,
+            &job.workspace_id,
+            format!(
+                "WARNING: `./result.json` will not be collected for this job: the image's \
+                WorkingDir ({working_dir}) is unusable because {reason}\n"
+            ),
+            conn,
+        )
+        .await;
+    }
     write_file(
         job_dir,
         "run.docker.config.proto",
@@ -733,6 +831,13 @@ pub async fn handle_docker_v2_job(
             )
             // `# volume` mounts + same-worker shared folder (empty if none).
             .replace("{SHARED_MOUNT}", shared_mount)
+            .replace(
+                "{RESULT_MOUNT}",
+                &result_dst
+                    .as_deref()
+                    .map(|dst| render_result_mount(job_dir, dst))
+                    .unwrap_or_default(),
+            )
             // Image env as `envar:` directives (child-only), so it never touches
             // nsjail's process env.
             .replace("{ENVARS}", &envars)
@@ -774,7 +879,7 @@ pub async fn handle_docker_v2_job(
         .stderr(Stdio::piped());
     let child = start_child_process(nsjail_cmd, NSJAIL_PATH.as_str(), false).await?;
 
-    handle_child(
+    let child_result = handle_child(
         &job.id,
         conn,
         mem_peak,
@@ -792,6 +897,27 @@ pub async fn handle_docker_v2_job(
     )
     .await?;
 
+    // Same result conventions as a plain bash script: a non-empty `./result.json`
+    // wins, otherwise the last line of stdout, otherwise a completion message.
+    let result_json_path = format!("{job_dir}/result.json");
+    if tokio::fs::metadata(&result_json_path)
+        .await
+        .is_ok_and(|m| m.len() > 0)
+    {
+        // Checked, not `read_file`: the container is untrusted, and handing malformed
+        // JSON to `unsafe_raw` is undefined behavior.
+        return read_and_check_file(&result_json_path).await.map_err(|e| {
+            Error::ExecutionErr(format!(
+                "the `./result.json` written by the sandboxed container is not a valid \
+                JSON result: {e}"
+            ))
+        });
+    }
+
+    if let Some(last_line) = child_result.last_line {
+        return Ok(to_raw_value(&json!(last_line.trim())));
+    }
+
     Ok(to_raw_value(&json!(format!(
         "sandboxed container ({image}) completed successfully"
     ))))
@@ -799,7 +925,90 @@ pub async fn handle_docker_v2_job(
 
 #[cfg(test)]
 mod tests {
-    use super::{digest_key, proto_str, ref_key, registry_qualified, render_envars};
+    use super::{
+        digest_key, proto_str, ref_key, registry_qualified, render_envars, render_result_mount,
+        result_mount_dst, SHADOWED_DST, UNVERIFIABLE_DST,
+    };
+
+    #[tokio::test]
+    async fn result_mount_dst_targets_working_dir() {
+        let job = tempfile::tempdir().unwrap();
+        let job_dir = job.path().to_str().unwrap();
+        std::fs::create_dir_all(format!("{job_dir}/rootfs/app/sub")).unwrap();
+
+        // `./result.json` relative to the image's WorkingDir, with no doubled slash
+        // when WorkingDir is the root and no trailing-slash artifact.
+        for (wd, expected) in [
+            ("/app/sub", "/app/sub/result.json"),
+            ("/", "/result.json"),
+            ("/app/", "/app/result.json"),
+            // Absent from the rootfs — nsjail creates it as real directories under a
+            // parent already proven non-symlink.
+            ("/app/new/deep", "/app/new/deep/result.json"),
+        ] {
+            assert_eq!(
+                result_mount_dst(job_dir, wd).await.as_deref(),
+                Ok(expected),
+                "{wd}"
+            );
+        }
+    }
+
+    // The rootfs symlinks this plants have no Windows equivalent; the runtime is
+    // Linux-only (nsjail) anyway.
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn result_mount_dst_rejects_escapes() {
+        let job = tempfile::tempdir().unwrap();
+        let job_dir = job.path().to_str().unwrap();
+        std::fs::create_dir_all(format!("{job_dir}/rootfs/app")).unwrap();
+        std::fs::create_dir_all(format!("{job_dir}/rootfs/wd")).unwrap();
+        // Image rootfs entries pointing out of the rootfs: as a directory component at
+        // both depths, and as the final `result.json` element itself (top level, and
+        // inside the WorkingDir).
+        std::os::unix::fs::symlink("/etc", format!("{job_dir}/rootfs/evil")).unwrap();
+        std::os::unix::fs::symlink("/etc", format!("{job_dir}/rootfs/app/evil")).unwrap();
+        std::os::unix::fs::symlink("/etc/passwd", format!("{job_dir}/rootfs/result.json")).unwrap();
+        std::os::unix::fs::symlink("/etc/passwd", format!("{job_dir}/rootfs/wd/result.json"))
+            .unwrap();
+
+        // nsjail resolves the mount dst against its temp root *before* pivot_root, so
+        // each of these would otherwise have it create a file on the host.
+        for wd in [
+            "/../../../etc",
+            "/app/../../etc",
+            "/evil",
+            "/evil/deeper",
+            "/app/evil",
+            "relative/path",
+            "/",   // the rootfs ships `result.json` as a symlink
+            "/wd", // ...and so does this WorkingDir
+        ] {
+            assert_eq!(
+                result_mount_dst(job_dir, wd).await,
+                Err(UNVERIFIABLE_DST),
+                "{wd} should be rejected as unverifiable"
+            );
+        }
+
+        // Mounted over the result file rather than escaping it — the job log must not
+        // blame a symlink that isn't there.
+        for wd in ["/tmp/work", "/proc/x", "/dev/x", "/sys/x"] {
+            assert_eq!(
+                result_mount_dst(job_dir, wd).await,
+                Err(SHADOWED_DST),
+                "{wd} should be rejected as shadowed"
+            );
+        }
+    }
+
+    #[test]
+    fn result_mount_renders_escaped() {
+        // The host side is the worker-created file, never a path inside the rootfs.
+        let m = render_result_mount("/j", "/app/result.json");
+        assert!(m.contains("src: \"/j/result.json\""));
+        assert!(m.contains("dst: \"/app/result.json\""));
+    }
 
     #[test]
     fn digest_key_is_filesystem_safe() {
@@ -870,6 +1079,9 @@ mod tests {
                                           // a raw byte or an invalid `\u{..}` that nsjail's parser would reject).
         assert_eq!(proto_str("a\u{1b}b"), "\"a\\033b\""); // ESC (0x1b)
         assert_eq!(proto_str("é"), "\"\\303\\251\""); // UTF-8 bytes 0xc3 0xa9
+                                                      // Braces are escaped so a value can never survive as a `{PLACEHOLDER}` token for
+                                                      // a later substitution pass to expand (`{ENVARS}` expands to unquoted directives).
+        assert_eq!(proto_str("/{ENVARS}"), "\"/\\173ENVARS\\175\"");
     }
 
     #[test]
diff --git a/backend/windmill-worker/src/duckdb_executor.rs b/backend/windmill-worker/src/duckdb_executor.rs
index e2807547e7..e91a1957c6 100644
--- a/backend/windmill-worker/src/duckdb_executor.rs
+++ b/backend/windmill-worker/src/duckdb_executor.rs
@@ -1597,6 +1597,10 @@ pub async fn do_duckdb(
         )
         .await?;
 
+        #[cfg(feature = "private")]
+        let query_block_list =
+            crate::duckdb_isolation_ee::apply_duckdb_isolation(query_block_list)?;
+
         let base_internal_url = client.base_internal_url.clone();
         let w_id = job.workspace_id.clone();
         let job_dir = job_dir.to_string();
@@ -2617,7 +2621,7 @@ fn pg_secret_attach_statements(db_resource: Value, alias_name: &str) -> Result<V
             esc(&res.host),
             res.port.unwrap_or(5432),
             esc(&res.dbname),
-            esc(res.user.as_deref().unwrap_or("postgres")),
+            esc(res.login_name()),
             esc(res.password.as_deref().unwrap_or("")),
         ),
         format!("ATTACH 'sslmode={sslmode}' AS {alias_name} (TYPE postgres, SECRET {secret_name});"),
diff --git a/backend/windmill-worker/src/handle_child.rs b/backend/windmill-worker/src/handle_child.rs
index b7ac2d54e2..e1b365bcf1 100644
--- a/backend/windmill-worker/src/handle_child.rs
+++ b/backend/windmill-worker/src/handle_child.rs
@@ -50,7 +50,7 @@ use futures::{
 };
 
 use crate::common::{resolve_job_timeout, OccupancyMetrics, StreamNotifier};
-use crate::job_logger::{append_job_logs, append_result_stream, append_with_limit};
+use crate::job_logger::{append_job_logs, append_result_stream, append_with_limit, strip_nul};
 use crate::job_logger_oss::process_streaming_log_lines;
 use crate::worker_utils::{ping_job_status, update_worker_ping_from_job};
 use crate::{MAX_RESULT_SIZE, MAX_WAIT_FOR_SIGINT, MAX_WAIT_FOR_SIGTERM};
@@ -89,6 +89,18 @@ async fn kill_process_tree(pid: Option<u32>) -> Result<(), String> {
 
 pub struct HandleChildResult {
     pub result_stream: Option<String>,
+    /// Last non-empty line the child wrote to **stdout**, unmasked, for executors
+    /// whose result convention is "last line of stdout" and that have no wrapper
+    /// script to tee it to a file (sandboxed containers). stderr is excluded: the two
+    /// pipes are merged by a fair `select`, so their relative order is arbitrary — a
+    /// diagnostic on stderr must not be able to win over the real result.
+    pub last_line: Option<String>,
+}
+
+/// A line read from a child, tagged with the pipe it came from.
+struct OutputLine {
+    stderr: bool,
+    line: String,
 }
 
 /// - wait until child exits and return with exit status
@@ -125,13 +137,17 @@ pub async fn handle_child(
     let pid = child.id();
     #[cfg(target_os = "linux")]
     if let Some(pid) = pid {
+        let oom_score_adj = *windmill_common::worker::JOB_OOM_SCORE_ADJ;
         // procfs handles writes synchronously in-kernel; no fsync (it returns
         // EINVAL on procfs files).
-        match std::fs::write(format!("/proc/{pid}/oom_score_adj"), b"1000") {
+        match std::fs::write(
+            format!("/proc/{pid}/oom_score_adj"),
+            oom_score_adj.to_string(),
+        ) {
             Ok(()) => {}
             Err(e) => {
                 tracing::error!(
-                    "Failed to set oom_score_adj=1000 for pid {pid}: {e:#}. \
+                    "Failed to set oom_score_adj={oom_score_adj} for pid {pid}: {e:#}. \
                     OOM killer may target the worker instead of this job"
                 );
             }
@@ -307,6 +323,7 @@ pub async fn handle_child(
     };
 
     let mut stream_result = Vec::new();
+    let mut last_line = String::new();
     /* a future that reads output from the child and appends to the database */
     let lines = write_lines(
         output,
@@ -321,6 +338,7 @@ pub async fn handle_child(
         child_name,
         &mut stream_result,
         stream_notifier,
+        Some(&mut last_line),
     )
     .instrument(trace_span!("child_lines"));
 
@@ -335,7 +353,10 @@ pub async fn handle_child(
         _ if *too_many_logs.borrow() => Err(Error::ExecutionErr(format!(
             "logs or result reached limit. (current max size: {MAX_RESULT_SIZE} characters)"
         ))),
-        Ok(Ok(status)) => process_status(&child_name, status, stream_result),
+        Ok(Ok(status)) => process_status(&child_name, status, stream_result).map(|mut r| {
+            r.last_line = (!last_line.is_empty()).then_some(last_line);
+            r
+        }),
         Ok(Err(kill_reason)) => match kill_reason {
             KillReason::AlreadyCompleted => {
                 Err(Error::AlreadyCompleted("Job already completed".to_string()))
@@ -350,8 +371,8 @@ pub async fn handle_child(
 
 pub const WAC_STEP_PREFIX: &str = "WM_WAC_STEP: ";
 
-pub async fn write_lines(
-    output: impl stream::Stream<Item = io::Result<String>> + Send,
+async fn write_lines(
+    output: impl stream::Stream<Item = io::Result<OutputLine>> + Send,
     job_id: &Uuid,
     w_id: &str,
     worker: &str,
@@ -363,6 +384,7 @@ pub async fn write_lines(
     child_name: &str,
     stream_result: &mut Vec<String>,
     stream_notifier: Option<StreamNotifier>,
+    mut last_line: Option<&mut String>,
 ) {
     let max_log_size = if *CLOUD_HOSTED {
         MAX_RESULT_SIZE
@@ -430,24 +452,26 @@ pub async fn write_lines(
 
         while let Some(line) = read_lines.next().await {
             match line {
-                Ok(line) => {
+                Ok(OutputLine { stderr, line }) => {
                     if line.is_empty() {
                         continue;
                     }
-                    let line = if let Some(ref snap) = mask_snapshot {
-                        match snap.mask(&line) {
-                            std::borrow::Cow::Owned(masked) => masked,
-                            std::borrow::Cow::Borrowed(_) => line,
-                        }
-                    } else {
-                        line
-                    };
+                    // Masking is a log concern only: `mask` also appends a multi-line
+                    // notice, which would end up inside a captured result. Keep `line`
+                    // raw and log `logged`.
+                    let masked = mask_snapshot
+                        .as_ref()
+                        .and_then(|snap| match snap.mask(&line) {
+                            std::borrow::Cow::Owned(masked) => Some(masked),
+                            std::borrow::Cow::Borrowed(_) => None,
+                        });
+                    let logged = masked.as_deref().unwrap_or(line.as_str());
                     if *OTEL_JOB_LOGS {
-                        if let Some(otel_suffix) = line.strip_prefix(OTEL_PREFIX) {
+                        if let Some(otel_suffix) = logged.strip_prefix(OTEL_PREFIX) {
                             tracing::event!(tracing::Level::INFO, otel_suffix);
                         }
                     }
-                    if let Some(step_json) = line.strip_prefix(WAC_STEP_PREFIX) {
+                    if let Some(step_json) = logged.strip_prefix(WAC_STEP_PREFIX) {
                         // Real-time WAC step start marker — fire-and-forget DB write
                         let conn = conn.clone();
                         let job_id = job_id.clone();
@@ -460,7 +484,7 @@ pub async fn write_lines(
                         });
                         continue;
                     }
-                    if let Some(stream) = extract_stream_from_logs(&line) {
+                    if let Some(stream) = extract_stream_from_logs(logged) {
                         let len = stream.len();
                         if log_remaining >= len {
                             log_remaining -= len;
@@ -470,7 +494,15 @@ pub async fn write_lines(
                             log_remaining = 0;
                         }
                     } else {
-                        append_with_limit(&mut joined, &line, &mut log_remaining);
+                        if let Some(buf) = last_line.as_mut() {
+                            if !stderr && !line.trim().is_empty() {
+                                buf.clear();
+                                // Same NUL scrub the log path applies: Postgres rejects
+                                // a NUL in the resulting jsonb too.
+                                buf.push_str(&strip_nul(&line));
+                            }
+                        }
+                        append_with_limit(&mut joined, logged, &mut log_remaining);
                     }
                     if log_remaining == 0 {
                         tracing::info!(%job_id, "Too many logs lines for job {job_id}");
@@ -690,6 +722,68 @@ pub(crate) async fn get_mem_peak(pid: Option<u32>, nsjail: bool) -> i32 {
     }
 }
 
+/// The job state a command run outside the main script needs to stay
+/// cancellable. `dbt deps` can hang on an unreachable package endpoint and
+/// `dbt parse`/`ls` on a warehouse handshake, so running them detached would
+/// hold a worker slot past a cancel or a timeout.
+pub struct JobCtx<'a> {
+    pub mem_peak: &'a mut i32,
+    pub canceled_by: &'a mut Option<CanceledBy>,
+    pub occupancy_metrics: &'a mut OccupancyMetrics,
+    pub worker_name: &'a str,
+    pub deadline: JobDeadline,
+}
+
+impl JobCtx<'_> {
+    /// What is left of the job's wall clock, for the phase about to start.
+    pub fn timeout(&self) -> Option<i32> {
+        self.deadline.remaining_secs()
+    }
+}
+
+/// One wall clock for a job that runs several subprocesses in sequence.
+///
+/// Both `handle_child` and `run_future_with_polling_update_job_poller` resolve
+/// the timeout they are handed into a fresh duration, so handing each phase the
+/// job's full timeout lets a job with N phases run for N times it. Resolved
+/// once at the start, then spent down.
+#[derive(Clone, Copy)]
+pub struct JobDeadline(Option<Instant>);
+
+impl JobDeadline {
+    pub async fn start(
+        conn: &Connection,
+        w_id: &str,
+        job_id: Uuid,
+        custom_timeout: Option<i32>,
+    ) -> Self {
+        let (d, _, _) = resolve_job_timeout(conn, w_id, job_id, custom_timeout).await;
+        Self(Some(Instant::now() + d))
+    }
+
+    /// Whether the job's wall clock is already spent.
+    ///
+    /// Distinct from `remaining_secs`, which deliberately never reports zero:
+    /// an expired budget still has to hand the next phase a positive timeout so
+    /// the poller fires. A caller deciding whether to START more work needs the
+    /// honest answer.
+    pub fn is_expired(&self) -> bool {
+        self.0.is_some_and(|d| d <= Instant::now())
+    }
+
+    pub fn remaining_secs(&self) -> Option<i32> {
+        let deadline = self.0?;
+        // A non-positive timeout reads as "unset" downstream, so an expired
+        // budget must still ask for a positive one and let the poller fire.
+        Some(
+            deadline
+                .saturating_duration_since(Instant::now())
+                .as_secs()
+                .clamp(1, i32::MAX as u64) as i32,
+        )
+    }
+}
+
 pub async fn run_future_with_polling_update_job_poller<Fut, T, S>(
     job_id: Uuid,
     timeout: Option<i32>,
@@ -963,7 +1057,7 @@ fn child_joined_output_stream(
     child: &mut Box<dyn TokioChildWrapper>,
     job_id: Uuid,
     w_id: String,
-) -> impl stream::FusedStream<Item = io::Result<String>> {
+) -> impl stream::FusedStream<Item = io::Result<OutputLine>> {
     let stderr = child
         .stderr()
         .take()
@@ -977,8 +1071,10 @@ fn child_joined_output_stream(
     let stdout = BufReader::new(stdout).lines();
     let stderr = BufReader::new(stderr).lines();
     stream::select(
-        lines_to_stream(stderr, true, job_id.clone(), w_id.clone()),
-        lines_to_stream(stdout, false, job_id, w_id),
+        lines_to_stream(stderr, true, job_id.clone(), w_id.clone())
+            .map(|l| l.map(|line| OutputLine { stderr: true, line })),
+        lines_to_stream(stdout, false, job_id, w_id)
+            .map(|l| l.map(|line| OutputLine { stderr: false, line })),
     )
 }
 
@@ -1007,6 +1103,7 @@ pub fn process_status(
             } else {
                 Some(stream_result.join(""))
             },
+            last_line: None,
         })
     } else if let Some(code) = status.code() {
         Err(error::Error::ExitStatus(program.to_string(), code))
@@ -1025,3 +1122,19 @@ pub fn process_status(
         )));
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    // A non-positive timeout means "unset" to `resolve_job_timeout`, so an
+    // exhausted budget that reported 0 would hand the next phase no deadline at
+    // all — the opposite of what running out of time should do.
+    #[test]
+    fn an_exhausted_budget_still_asks_for_a_positive_timeout() {
+        let spent = JobDeadline(Some(Instant::now() - Duration::from_secs(30)));
+        assert_eq!(spent.remaining_secs(), Some(1));
+        let left = JobDeadline(Some(Instant::now() + Duration::from_secs(120)));
+        assert!(matches!(left.remaining_secs(), Some(s) if (118..=120).contains(&s)));
+    }
+}
diff --git a/backend/windmill-worker/src/java_executor.rs b/backend/windmill-worker/src/java_executor.rs
index 35541c3ee3..bb0518f22d 100644
--- a/backend/windmill-worker/src/java_executor.rs
+++ b/backend/windmill-worker/src/java_executor.rs
@@ -1,4 +1,8 @@
-use std::{collections::HashMap, path::PathBuf, process::Stdio};
+use std::{
+    collections::HashMap,
+    path::{Path, PathBuf},
+    process::Stdio,
+};
 
 use crate::global_cache::save_cache;
 use anyhow::{anyhow, bail};
@@ -23,12 +27,13 @@ use windmill_queue::{append_logs, CanceledBy, MiniPulledJob};
 use crate::{
     common::{
         build_command_with_isolation, create_args_and_out_file, get_reserved_variables,
-        read_result, resolve_nsjail_timeout, resolve_nsjail_tmp_mount_block, start_child_process,
-        OccupancyMetrics,
+        read_result, resolve_job_timeout, resolve_nsjail_timeout, resolve_nsjail_tmp_mount_block,
+        start_child_process, OccupancyMetrics,
     },
     handle_child, is_sandboxing_enabled, read_ee_registry_bool_with_workspace_override,
     read_ee_registry_with_workspace_override,
     universal_pkg_installer::{par_install_language_dependencies_all_at_once, RequiredDependency},
+    worker_utils::JobPingHeartbeat,
     COURSIER_CACHE_DIR, DISABLE_NUSER, JAVA_CACHE_DIR, JAVA_HOME_DIR, JAVA_REPOSITORY_DIR,
     MAVEN_REPOS, NO_DEFAULT_MAVEN, NSJAIL_PATH, PATH_ENV, PROXY_ENVS,
 };
@@ -294,7 +299,21 @@ pub async fn resolve<'a>(
                     std::env::var("TMP").unwrap_or_else(|_| String::from("/tmp")),
                 );
         }
-        let output = cmd.output().await?;
+        // The lockfile has to be read from a clean stdout, so this cannot go through handle_child's
+        // polling loop. That leaves resolution with neither a ping nor a time bound of its own: it
+        // needs the heartbeat not to be reaped as a zombie mid-resolution, and the timeout so a
+        // wedged registry connection cannot park the job in `running` forever.
+        cmd.kill_on_drop(true);
+        let (timeout, ..) = resolve_job_timeout(conn, w_id, *job_id, None).await;
+        let _heartbeat = JobPingHeartbeat::start(conn, *job_id, "java lockfile resolution");
+        let output = tokio::time::timeout(timeout, cmd.output())
+            .await
+            .map_err(|_| {
+                Error::ExecutionErr(format!(
+                    "resolving the java lockfile timed out after {}s",
+                    timeout.as_secs()
+                ))
+            })??;
         // Check if the command was successful
         if output.status.success() {
             String::from_utf8(output.stdout).expect("Failed to convert output to String")
@@ -371,8 +390,8 @@ async fn install<'a>(
     );
     let job_dir = job_dir.to_owned();
     let fetch_dir = format!("{}/tmp-fetch-{}", *JAVA_CACHE_DIR, Uuid::new_v4());
-    let fetch_dir2 = fetch_dir.clone();
-    par_install_language_dependencies_all_at_once(
+    let (cmd_fetch_dir, postinstall_fetch_dir) = (fetch_dir.clone(), fetch_dir.clone());
+    let installed = par_install_language_dependencies_all_at_once(
         deps,
         "java",
         "java",
@@ -431,7 +450,7 @@ async fn install<'a>(
                 "--parallel",
                 &format!("{}", *JAVA_CONCURRENT_DOWNLOADS),
                 "--cache",
-                &fetch_dir,
+                &cmd_fetch_dir,
             ])
             .args(&repos)
             .arg("--intransitive")
@@ -450,35 +469,11 @@ async fn install<'a>(
 
             Ok(cmd)
         },
-        async move |_| {
-            move_to_repository(&fetch_dir2, 0).await?;
-            remove_dir_all(&fetch_dir2).await?;
-            #[async_recursion]
-            async fn move_to_repository(path: &str, depth: u8) -> anyhow::Result<()> {
-                if depth == 3 {
-                    copy_dir_recursively(
-                        &PathBuf::from(path),
-                        &PathBuf::from(&*JAVA_REPOSITORY_DIR),
-                    )?;
-
-                    return Ok(());
-                }
-                let mut entries = tokio::fs::read_dir(path).await?;
-                loop {
-                    let Some(entry) = entries.next_entry().await? else {
-                        break Ok(());
-                    };
-
-                    let path = entry
-                        .path()
-                        .to_str()
-                        .ok_or(anyhow!("Internal Error: Cannot convert Path to Str"))?
-                        .to_owned();
-
-                    move_to_repository(&path, depth + 1).await?;
-                }
-            }
-            Ok(())
+        async move |dependencies| {
+            Ok(
+                move_to_repository(&postinstall_fetch_dir, &*JAVA_REPOSITORY_DIR, &dependencies)
+                    .await?,
+            )
         },
         &job.id,
         &job.workspace_id,
@@ -486,10 +481,122 @@ async fn install<'a>(
         is_sandboxing_enabled(),
         conn,
     )
-    .await?;
+    .await;
+
+    // coursier failing against the registry bails before the postinstall step ever runs, so the
+    // cache it was writing into has to be reclaimed on every path out
+    match remove_dir_all(&fetch_dir).await {
+        Err(e) if e.kind() != std::io::ErrorKind::NotFound => {
+            tracing::warn!("could not remove java fetch dir {fetch_dir}: {e}")
+        }
+        _ => {}
+    }
+    installed?;
     Ok(classpath)
 }
 
+/// Copies every fetched artifact out of coursier's cache into the `<group as path>/<artifact>/
+/// <version>` location the classpath is built from. Coursier's cache is laid out as
+/// `<scheme>/<host>/<registry url path>/<group as path>/...`, so the depth at which the maven
+/// layout starts varies with the registry url and only the coordinate can be matched on.
+async fn move_to_repository(
+    fetch_dir: &str,
+    repository_dir: &str,
+    deps: &[RequiredDependency<()>],
+) -> anyhow::Result<()> {
+    struct Wanted {
+        coordinate: Vec<String>,
+        destination: String,
+        display_name: String,
+        found: bool,
+    }
+
+    #[async_recursion]
+    async fn find_and_copy(
+        dir: &Path,
+        // components walked past below the fetch dir, compared against coordinates one component
+        // at a time so that windows' native separator cannot defeat the match
+        below: &mut Vec<String>,
+        wanted: &mut Vec<Wanted>,
+    ) -> anyhow::Result<()> {
+        if wanted.iter().all(|w| w.found) {
+            return Ok(());
+        }
+        let (mut subdirs, mut holds_artifact) = (vec![], false);
+        let mut entries = tokio::fs::read_dir(dir).await?;
+        while let Some(entry) = entries.next_entry().await? {
+            let name = entry.file_name().to_string_lossy().into_owned();
+            if entry.file_type().await?.is_dir() {
+                subdirs.push((name, entry));
+            } else {
+                // coursier's own bookkeeping (`.<name>.checked`, `.<name>.error`, checksums) is
+                // dot-prefixed; only a downloaded artifact is not
+                holds_artifact |= !name.starts_with('.');
+            }
+        }
+        // a repository coursier probed and did not get the artifact from keeps a directory at the
+        // coordinate holding nothing but that bookkeeping, and default repositories are probed
+        // before the configured ones, so claiming the first match would cache an empty directory
+        // as the installed artifact
+        if holds_artifact {
+            if let Some(w) = wanted
+                .iter_mut()
+                .find(|w| !w.found && below.ends_with(&w.coordinate))
+            {
+                copy_dir_recursively(dir, &PathBuf::from(&w.destination))?;
+                w.found = true;
+                return Ok(());
+            }
+        }
+        for (name, entry) in subdirs {
+            below.push(name);
+            find_and_copy(&entry.path(), below, wanted).await?;
+            below.pop();
+        }
+        Ok(())
+    }
+
+    let mut wanted = deps
+        .iter()
+        .map(|RequiredDependency { path, display_name, .. }| {
+            let suffix = path
+                .strip_prefix(repository_dir)
+                .filter(|suffix| suffix.starts_with('/'))
+                .ok_or_else(|| anyhow!("Internal Error: {path} is not under {repository_dir}"))?;
+            Ok(Wanted {
+                coordinate: suffix
+                    .split('/')
+                    .filter(|component| !component.is_empty())
+                    .map(str::to_owned)
+                    .collect(),
+                destination: path.clone(),
+                display_name: display_name.clone(),
+                found: false,
+            })
+        })
+        .collect::<anyhow::Result<Vec<_>>>()?;
+    // longest coordinate first: a group id ending in another one's coordinates (com.org.foo:bar
+    // over org.foo:bar) would otherwise be free to claim the shorter one's directory
+    wanted.sort_by_key(|w| std::cmp::Reverse(w.coordinate.len()));
+
+    find_and_copy(&PathBuf::from(fetch_dir), &mut vec![], &mut wanted).await?;
+
+    let missing = wanted
+        .iter()
+        .filter(|w| !w.found)
+        .map(|w| w.display_name.as_str())
+        .sorted()
+        .collect_vec();
+    if !missing.is_empty() {
+        bail!(
+            "the configured maven repositories did not serve: {}. \
+            Coursier reported success but no artifact for them was found in its cache.",
+            missing.join(", ")
+        );
+    }
+    Ok(())
+}
+
 async fn compile<'a>(
     JobHandlerInput {
         occupancy_metrics,
@@ -1012,3 +1119,161 @@ class Wmill {
     }
 }
 "#;
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn dep(
+        repository_dir: &str,
+        group_path: &str,
+        artifact: &str,
+        version: &str,
+    ) -> RequiredDependency<()> {
+        RequiredDependency {
+            path: format!("{repository_dir}/{group_path}/{artifact}/{version}"),
+            _s3_handle: format!("{}:{artifact}:{version}", group_path.replace("/", ".")),
+            display_name: format!("{artifact}:{version}"),
+            custom_payload: (),
+        }
+    }
+
+    async fn touch(path: &str) {
+        let path = PathBuf::from(path);
+        create_dir_all(path.parent().unwrap()).await.unwrap();
+        File::create(path).await.unwrap();
+    }
+
+    #[tokio::test]
+    async fn artifacts_are_found_whatever_the_registry_url_path_is() {
+        let tmp = tempfile::tempdir().unwrap();
+        let fetch_dir = tmp.path().join("fetch").to_str().unwrap().to_owned();
+        let repository_dir = tmp.path().join("repository").to_str().unwrap().to_owned();
+
+        // maven central has a single url segment before the maven layout, a nexus repository two,
+        // and a root-hosted mirror none at all
+        touch(&format!("{fetch_dir}/https/repo1.maven.org/maven2/commons-cli/commons-cli/1.4/commons-cli-1.4.jar")).await;
+        touch(&format!("{fetch_dir}/https/nexus.local/repository/maven-public/com/google/code/gson/gson/2.8.9/gson-2.8.9.jar")).await;
+        touch(&format!("{fetch_dir}/https/maven.local/org/apache/commons/commons-lang3/3.8.1/commons-lang3-3.8.1.jar")).await;
+
+        let deps = vec![
+            dep(&repository_dir, "commons-cli", "commons-cli", "1.4"),
+            dep(&repository_dir, "com/google/code/gson", "gson", "2.8.9"),
+            dep(
+                &repository_dir,
+                "org/apache/commons",
+                "commons-lang3",
+                "3.8.1",
+            ),
+        ];
+
+        move_to_repository(&fetch_dir, &repository_dir, &deps)
+            .await
+            .unwrap();
+
+        for (dep, jar) in deps.iter().zip([
+            "commons-cli-1.4.jar",
+            "gson-2.8.9.jar",
+            "commons-lang3-3.8.1.jar",
+        ]) {
+            assert!(
+                metadata(format!("{}/{jar}", dep.path)).await.is_ok(),
+                "{} was not copied to {}",
+                dep.display_name,
+                dep.path
+            );
+        }
+    }
+
+    #[tokio::test]
+    async fn the_empty_directory_a_404_leaves_behind_does_not_claim_the_coordinate() {
+        let tmp = tempfile::tempdir().unwrap();
+        let fetch_dir = tmp.path().join("fetch").to_str().unwrap().to_owned();
+        let repository_dir = tmp.path().join("repository").to_str().unwrap().to_owned();
+
+        // a repository that 404s is left with an empty directory at the coordinate. Each artifact
+        // is served by one of the two repositories and left empty under the other, so whichever
+        // one the walk reaches first, an empty directory precedes an artifact.
+        let central = format!("{fetch_dir}/https/repo1.maven.org/maven2");
+        let nexus = format!("{fetch_dir}/https/nexus.local/repository/maven-public");
+        touch(&format!("{central}/com/corp/public/1.0/public-1.0.jar")).await;
+        touch(&format!(
+            "{nexus}/com/corp/public/1.0/.public-1.0.jar.error"
+        ))
+        .await;
+        touch(&format!("{nexus}/com/corp/internal/1.0/internal-1.0.jar")).await;
+        touch(&format!(
+            "{central}/com/corp/internal/1.0/.internal-1.0.jar.error"
+        ))
+        .await;
+
+        let deps = vec![
+            dep(&repository_dir, "com/corp", "public", "1.0"),
+            dep(&repository_dir, "com/corp", "internal", "1.0"),
+        ];
+
+        move_to_repository(&fetch_dir, &repository_dir, &deps)
+            .await
+            .unwrap();
+
+        for (dep, jar) in deps.iter().zip(["public-1.0.jar", "internal-1.0.jar"]) {
+            assert!(
+                metadata(format!("{}/{jar}", dep.path)).await.is_ok(),
+                "{} was not copied to {}",
+                dep.display_name,
+                dep.path
+            );
+        }
+    }
+
+    #[tokio::test]
+    async fn a_group_id_ending_in_another_coordinate_does_not_claim_it() {
+        let tmp = tempfile::tempdir().unwrap();
+        let fetch_dir = tmp.path().join("fetch").to_str().unwrap().to_owned();
+        let repository_dir = tmp.path().join("repository").to_str().unwrap().to_owned();
+        let root = format!("{fetch_dir}/https/nexus.local/repository/maven-public");
+
+        touch(&format!("{root}/org/foo/bar/1/bar-1.jar")).await;
+        touch(&format!("{root}/com/org/foo/bar/1/bar-1.jar")).await;
+
+        let deps = vec![
+            dep(&repository_dir, "org/foo", "bar", "1"),
+            dep(&repository_dir, "com/org/foo", "bar", "1"),
+        ];
+
+        move_to_repository(&fetch_dir, &repository_dir, &deps)
+            .await
+            .unwrap();
+
+        for dep in &deps {
+            assert!(
+                metadata(format!("{}/bar-1.jar", dep.path)).await.is_ok(),
+                "{} was not copied to {}",
+                dep.display_name,
+                dep.path
+            );
+        }
+    }
+
+    #[tokio::test]
+    async fn artifact_missing_from_the_cache_is_named_in_the_error() {
+        let tmp = tempfile::tempdir().unwrap();
+        let fetch_dir = tmp.path().join("fetch").to_str().unwrap().to_owned();
+        let repository_dir = tmp.path().join("repository").to_str().unwrap().to_owned();
+
+        touch(&format!("{fetch_dir}/https/nexus.local/repository/maven-public/commons-cli/commons-cli/1.4/commons-cli-1.4.jar")).await;
+
+        let deps = vec![
+            dep(&repository_dir, "commons-cli", "commons-cli", "1.4"),
+            dep(&repository_dir, "com/google/code/gson", "gson", "2.8.9"),
+        ];
+
+        let err = move_to_repository(&fetch_dir, &repository_dir, &deps)
+            .await
+            .unwrap_err()
+            .to_string();
+
+        assert!(err.contains("gson:2.8.9"), "unexpected error: {err}");
+        assert!(!err.contains("commons-cli:1.4"), "unexpected error: {err}");
+    }
+}
diff --git a/backend/windmill-worker/src/job_logger.rs b/backend/windmill-worker/src/job_logger.rs
index 364c352a21..54c8d923e1 100644
--- a/backend/windmill-worker/src/job_logger.rs
+++ b/backend/windmill-worker/src/job_logger.rs
@@ -143,6 +143,11 @@ lazy_static::lazy_static! {
     static ref RE_00: Regex = Regex::new('\u{00}'.to_string().as_str()).unwrap();
     pub static ref NO_LOGS_AT_ALL: bool = std::env::var("NO_LOGS_AT_ALL").ok().is_some_and(|x| x == "1" || x == "true");
 }
+/// Drop NUL bytes: Postgres rejects them in both `text` logs and a `jsonb` result.
+pub fn strip_nul(src: &str) -> std::borrow::Cow<'_, str> {
+    RE_00.replace_all(src, "")
+}
+
 // as a detail, `BufReader::lines()` removes \n and \r\n from the strings it yields,
 // so this pushes \n to thd destination string in each call
 pub fn append_with_limit(dst: &mut String, src: &str, limit: &mut usize) {
@@ -152,7 +157,7 @@ pub fn append_with_limit(dst: &mut String, src: &str, limit: &mut usize) {
 
     let src_str;
     let src = {
-        src_str = RE_00.replace_all(src, "");
+        src_str = strip_nul(src);
         src_str.as_ref()
     };
     if !*CLOUD_HOSTED {
diff --git a/backend/windmill-worker/src/lib.rs b/backend/windmill-worker/src/lib.rs
index fe2fffb93e..e3e7868548 100644
--- a/backend/windmill-worker/src/lib.rs
+++ b/backend/windmill-worker/src/lib.rs
@@ -33,6 +33,9 @@ pub mod common;
 mod config;
 mod csharp_executor;
 
+mod dbt_engine;
+mod dbt_executor;
+mod dbt_profiles;
 #[cfg(feature = "private")]
 mod dedicated_worker_ee;
 mod dedicated_worker_oss;
@@ -40,6 +43,8 @@ mod deno_executor;
 mod docker_v2;
 #[cfg(feature = "duckdb")]
 mod duckdb_executor;
+#[cfg(all(feature = "duckdb", feature = "private"))]
+mod duckdb_isolation_ee;
 mod global_cache;
 mod go_executor;
 mod graphql_executor;
diff --git a/backend/windmill-worker/src/mssql_executor.rs b/backend/windmill-worker/src/mssql_executor.rs
index a5b4a06509..02d0da1164 100644
--- a/backend/windmill-worker/src/mssql_executor.rs
+++ b/backend/windmill-worker/src/mssql_executor.rs
@@ -11,6 +11,9 @@ use tiberius::{
 use tokio::net::TcpStream;
 use tokio_util::compat::TokioAsyncWriteCompatExt;
 use uuid::Uuid;
+use windmill_common::azure_workload_identity::{
+    WorkloadIdentityConfig, AZURE_SQL_SCOPE, WORKLOAD_IDENTITY_PASSWORD,
+};
 use windmill_common::utils::merge_raw_values_to_object;
 use windmill_common::worker::SqlResultCollectionStrategy;
 use windmill_common::{
@@ -61,6 +64,32 @@ lazy_static::lazy_static! {
     static ref RE_MSSQL_READONLY_INTENT: Regex = Regex::new(r#"(?mi)^-- ApplicationIntent=ReadOnly *(?:\r|\n|$)"#).unwrap();
 }
 
+/// Point a rejected login at the sentinel, but only where the advice is actionable: an
+/// Azure host, a worker that holds an identity, and a login the server rejected rather
+/// than a connection that never reached it.
+fn connect_error(e: tiberius::error::Error, host: &str, sql_auth_user: Option<&str>) -> Error {
+    const LOGIN_FAILED: u32 = 18456;
+    // Matches the sovereign clouds as well as `.database.windows.net`.
+    let azure_host = host.to_ascii_lowercase().contains(".database.");
+
+    let hint = sql_auth_user
+        .filter(|_| {
+            azure_host
+                && e.code() == Some(LOGIN_FAILED)
+                && WorkloadIdentityConfig::resolve().is_ok()
+        })
+        .map(|user| {
+            format!(
+                "\n\nThis tried to authenticate as SQL Server user `{user}`. This worker has an \
+                 Azure workload identity available: to authenticate as it instead, set the \
+                 resource password to `{WORKLOAD_IDENTITY_PASSWORD}` (`user` is then ignored)."
+            )
+        })
+        .unwrap_or_default();
+
+    Error::ExecutionErr(format!("{e}{hint}"))
+}
+
 pub async fn do_mssql(
     job: &MiniPulledJob,
     authed_client: &AuthedClient,
@@ -131,7 +160,9 @@ pub async fn do_mssql(
         append_logs(&job.id, &job.workspace_id, logs, conn).await;
     }
 
-    // Handle authentication based on available credentials
+    // Handle authentication based on available credentials. Every branch must name the
+    // mode it picked: the job log is the only place that choice is visible.
+    let mut sql_auth_user = None;
     if database.integrated_auth.unwrap_or(false) {
         #[cfg(any(feature = "mssql-kerberos", feature = "mssql-winauth"))]
         {
@@ -148,8 +179,24 @@ pub async fn do_mssql(
                 "Integrated authentication is not available in this build. Requires mssql-kerberos (Linux) or mssql-winauth (Windows) feature.".to_string(),
             ));
         }
+    } else if database.password.as_deref().map(str::trim) == Some(WORKLOAD_IDENTITY_PASSWORD) {
+        let workload_identity = WorkloadIdentityConfig::resolve()?;
+        let logs = format!(
+            "\nUsing Azure Workload Identity (client id {})",
+            workload_identity.client_id()
+        );
+        append_logs(&job.id, &job.workspace_id, logs, conn).await;
+        let token = workload_identity.access_token(AZURE_SQL_SCOPE).await?;
+        config.authentication(AuthMethod::aad_token(token));
     } else if let Some(token_value) = &database.aad_token {
         if let Some(token) = &token_value.token {
+            append_logs(
+                &job.id,
+                &job.workspace_id,
+                "\nUsing the AAD token set on the resource",
+                conn,
+            )
+            .await;
             config.authentication(AuthMethod::aad_token(token));
         } else {
             return Err(Error::BadRequest(
@@ -157,10 +204,13 @@ pub async fn do_mssql(
             ));
         }
     } else if let (Some(user), Some(password)) = (&database.user, &database.password) {
+        let logs = format!("\nUsing SQL Server authentication (user {user})");
+        append_logs(&job.id, &job.workspace_id, logs, conn).await;
+        sql_auth_user = Some(user.clone());
         config.authentication(AuthMethod::sql_server(user.clone(), password.clone()));
     } else {
         return Err(Error::BadRequest(
-            "No authentication method configured. Set integrated_auth, aad_token, or user/password.".to_string(),
+            "No authentication method configured. Set integrated_auth, aad_token, or user/password (password `ms_entraid` for Azure workload identity).".to_string(),
         ));
     }
 
@@ -212,9 +262,9 @@ pub async fn do_mssql(
 
             Client::connect(config, tcp.compat_write())
                 .await
-                .map_err(to_anyhow)?
+                .map_err(|e| connect_error(e, host_ref, sql_auth_user.as_deref()))?
         }
-        Err(e) => return Err(to_anyhow(e).into()),
+        Err(e) => return Err(connect_error(e, host_ref, sql_auth_user.as_deref())),
     };
 
     let sig = parse_mssql_sig(&query)
diff --git a/backend/windmill-worker/src/pg_executor.rs b/backend/windmill-worker/src/pg_executor.rs
index 71e78f92fe..0135cf4fcc 100644
--- a/backend/windmill-worker/src/pg_executor.rs
+++ b/backend/windmill-worker/src/pg_executor.rs
@@ -22,6 +22,7 @@ use tokio_postgres::{
     Column,
 };
 use uuid::Uuid;
+use windmill_common::azure_workload_identity::WORKLOAD_IDENTITY_PASSWORD;
 use windmill_common::error::to_anyhow;
 use windmill_common::error::{self, Error};
 use windmill_common::worker::{
@@ -65,24 +66,94 @@ pub async fn clear_pg_cache() {
     CONNECTION_COUNTER.write().await.clear();
 }
 
+/// How the connection authenticates, which also keys the connection cache: a
+/// connection established under one mode must never be handed to a request asking
+/// for another.
+#[derive(Clone, Copy, Debug, PartialEq)]
+enum PgAuthMode {
+    Password,
+    /// AWS RDS IAM.
+    Iam,
+    /// Azure Entra ID, via the worker's federated identity.
+    WorkloadIdentity,
+}
+
+impl PgAuthMode {
+    fn of(database: &PgDatabase) -> error::Result<Self> {
+        let workload_identity =
+            database.password.as_deref().map(str::trim) == Some(WORKLOAD_IDENTITY_PASSWORD);
+        match (database.use_iam_auth == Some(true), workload_identity) {
+            (true, true) => Err(Error::BadRequest(
+                "IAM RDS authentication cannot use the Azure workload identity password"
+                    .to_string(),
+            )),
+            (true, false) => Ok(PgAuthMode::Iam),
+            (false, true) => Ok(PgAuthMode::WorkloadIdentity),
+            (false, false) => Ok(PgAuthMode::Password),
+        }
+    }
+
+    /// What to announce in the job log. Password auth is the default and stays silent.
+    /// The token modes name the login they present, which is the one thing the token
+    /// itself does not carry.
+    fn log_name(&self, database: &PgDatabase) -> Option<String> {
+        match self {
+            PgAuthMode::Password => None,
+            PgAuthMode::Iam => Some(format!(
+                "IAM RDS authentication (login {})",
+                database.login_name()
+            )),
+            PgAuthMode::WorkloadIdentity => Some(match database.entra_login() {
+                Ok(login) => format!("Azure Workload Identity (login {login})"),
+                // Connecting rejects a missing login; do not invent one here.
+                Err(_) => "Azure Workload Identity".to_string(),
+            }),
+        }
+    }
+
+    fn cache_key_segment(&self) -> &'static str {
+        match self {
+            // Workload identity needs no segment of its own: to_uri() carries the raw
+            // password and the mode is a pure function of it, so two modes can never
+            // share a key even though the mode is selected on the trimmed value.
+            PgAuthMode::Password | PgAuthMode::WorkloadIdentity => "",
+            PgAuthMode::Iam => "&iam=true",
+        }
+    }
+}
+
 async fn new_pg_connection(
     database: &PgDatabase,
-    _use_iam_auth: bool,
+    auth_mode: PgAuthMode,
     main_db: Option<&DB>,
 ) -> error::Result<(tokio_postgres::Client, tokio::task::JoinHandle<()>)> {
-    let (client, connection) = if _use_iam_auth {
-        #[cfg(all(feature = "enterprise", feature = "private"))]
-        {
-            database.connect_with_iam().await?
+    let (client, connection) = match auth_mode {
+        PgAuthMode::Iam => {
+            #[cfg(all(feature = "enterprise", feature = "private"))]
+            {
+                database.connect_with_iam().await?
+            }
+            #[cfg(not(all(feature = "enterprise", feature = "private")))]
+            {
+                return Err(Error::ExecutionErr(
+                    "IAM RDS authentication requires Windmill Enterprise Edition".to_string(),
+                ));
+            }
         }
-        #[cfg(not(all(feature = "enterprise", feature = "private")))]
-        {
-            return Err(Error::ExecutionErr(
-                "IAM RDS authentication requires Windmill Enterprise Edition".to_string(),
-            ));
+        PgAuthMode::WorkloadIdentity => {
+            #[cfg(feature = "enterprise")]
+            {
+                database.connect_with_workload_identity().await?
+            }
+            #[cfg(not(feature = "enterprise"))]
+            {
+                return Err(Error::ExecutionErr(
+                    "Azure workload identity authentication requires Windmill Enterprise Edition"
+                        .to_string(),
+                ));
+            }
         }
-    } else {
-        database.connect(main_db).await?
+        PgAuthMode::Password => database.connect(main_db).await?,
     };
     let handle = tokio::spawn(async move {
         if let Err(e) = connection.await {
@@ -643,11 +714,17 @@ pub async fn do_postgresql(
         annotations.result_collection
     };
 
-    let use_iam_auth = database.use_iam_auth == Some(true);
+    let auth_mode = PgAuthMode::of(&database)?;
 
-    // Include use_iam_auth in cache key to distinguish IAM vs non-IAM connections to the same host.
-    // The cache key is static (doesn't include the token), which is correct because PostgreSQL
-    // connections remain valid after initial auth — fresh tokens are generated on cache miss.
+    if let Some(mode) = auth_mode.log_name(&database) {
+        windmill_queue::append_logs(&job.id, &job.workspace_id, format!("Using {mode}\n"), conn)
+            .await;
+    }
+
+    // Include the auth mode in the cache key to distinguish connections to the same host
+    // authenticated differently. The cache key is static (doesn't include the token), which
+    // is correct because PostgreSQL connections remain valid after initial auth — fresh
+    // tokens are generated on cache miss.
     //
     // to_uri() collapses require/verify-ca/verify-full to the same string, so the TLS verification
     // inputs are folded into the key separately. Without this a connection established under a
@@ -664,11 +741,11 @@ pub async fn do_postgresql(
     // to_uri() already ends with `?sslmode=...`, so append further key segments
     // with `&` to keep database_string a well-formed URI (it is only ever a cache
     // key, but a malformed one would mislead anyone who later logs or parses it).
-    let database_string = if use_iam_auth {
-        format!("{}&iam=true&tls={tls_disc:x}", database.to_uri())
-    } else {
-        format!("{}&tls={tls_disc:x}", database.to_uri())
-    };
+    let database_string = format!(
+        "{}{}&tls={tls_disc:x}",
+        database.to_uri(),
+        auth_mode.cache_key_segment()
+    );
     let database_string_clone = database_string.clone();
 
     let cached_client;
@@ -748,18 +825,18 @@ pub async fn do_postgresql(
                 }
                 drop(guard);
                 cached_client = None;
-                new_client = Some(new_pg_connection(&database, use_iam_auth, conn.as_sql()).await?);
+                new_client = Some(new_pg_connection(&database, auth_mode, conn.as_sql()).await?);
             }
         } else {
             // Release the lock before connecting so the post-query caching
             // code can re-acquire it.
             drop(guard);
             cached_client = None;
-            new_client = Some(new_pg_connection(&database, use_iam_auth, conn.as_sql()).await?);
+            new_client = Some(new_pg_connection(&database, auth_mode, conn.as_sql()).await?);
         }
     } else {
         cached_client = None;
-        new_client = Some(new_pg_connection(&database, use_iam_auth, conn.as_sql()).await?);
+        new_client = Some(new_pg_connection(&database, auth_mode, conn.as_sql()).await?);
     }
 
     let (mut sig, _) = parse_pgsql_sig_with_typed_schema(&query)
@@ -2058,6 +2135,59 @@ impl FromSql<'_> for StringCollector {
 mod tests {
     use super::*;
 
+    /// The sentinel password is the whole opt-in: nothing else marks the resource, so a
+    /// resource carrying it must not fall through to password auth.
+    #[test]
+    fn test_workload_identity_password_selects_the_auth_mode() {
+        let db = |password: &str| {
+            PgDatabase::parse_uri(&format!("postgres://someuser:{password}@host:5432/db")).unwrap()
+        };
+        assert_eq!(
+            PgAuthMode::of(&db(WORKLOAD_IDENTITY_PASSWORD)).unwrap(),
+            PgAuthMode::WorkloadIdentity
+        );
+        assert_eq!(
+            PgAuthMode::of(&db("hunter2")).unwrap(),
+            PgAuthMode::Password
+        );
+        // A pasted sentinel keeps its surrounding whitespace, and an unrecognized one is
+        // forwarded to the server as a real password instead of selecting the mode.
+        assert_eq!(
+            PgAuthMode::of(&db("%20ms_entraid%0A")).unwrap(),
+            PgAuthMode::WorkloadIdentity
+        );
+    }
+
+    /// The job log is the only place the presented login is visible, and the two token
+    /// modes differ on whether a missing one has a default at all.
+    #[test]
+    fn test_log_name_reports_the_presented_login() {
+        let db = |user: &str| {
+            PgDatabase::parse_uri(&format!("postgres://{user}:pw@host:5432/db")).unwrap()
+        };
+
+        assert_eq!(PgAuthMode::Password.log_name(&db("someuser")), None);
+        assert_eq!(
+            PgAuthMode::Iam.log_name(&db("someuser")).unwrap(),
+            "IAM RDS authentication (login someuser)"
+        );
+        assert_eq!(
+            PgAuthMode::Iam.log_name(&db("")).unwrap(),
+            "IAM RDS authentication (login postgres)"
+        );
+        assert_eq!(
+            PgAuthMode::WorkloadIdentity
+                .log_name(&db("someuser"))
+                .unwrap(),
+            "Azure Workload Identity (login someuser)"
+        );
+        // Entra has no default login, so none is named rather than implying `postgres`.
+        assert_eq!(
+            PgAuthMode::WorkloadIdentity.log_name(&db("")).unwrap(),
+            "Azure Workload Identity"
+        );
+    }
+
     #[test]
     fn test_map_s3object_jsonb_overflow() {
         let pg_err = Error::ExecutionErr(
diff --git a/backend/windmill-worker/src/php_executor.rs b/backend/windmill-worker/src/php_executor.rs
index 08a92b3641..1ede0933cb 100644
--- a/backend/windmill-worker/src/php_executor.rs
+++ b/backend/windmill-worker/src/php_executor.rs
@@ -20,8 +20,8 @@ use windmill_queue::{append_logs, CanceledBy};
 use crate::{
     common::{
         build_command_with_isolation, check_executor_binary_exists, create_args_and_out_file,
-        get_reserved_variables, read_result, resolve_nsjail_timeout, resolve_nsjail_tmp_mount_block,
-        start_child_process, MaybeLock, OccupancyMetrics,
+        get_reserved_variables, read_result, resolve_nsjail_timeout,
+        resolve_nsjail_tmp_mount_block, start_child_process, MaybeLock, OccupancyMetrics,
     },
     handle_child::handle_child,
     is_sandboxing_enabled, COMPOSER_CACHE_DIR, COMPOSER_PATH, DISABLE_NUSER, NSJAIL_PATH, PHP_PATH,
diff --git a/backend/windmill-worker/src/prepare_deps.rs b/backend/windmill-worker/src/prepare_deps.rs
index 70b5718cf7..9c8a5179e3 100644
--- a/backend/windmill-worker/src/prepare_deps.rs
+++ b/backend/windmill-worker/src/prepare_deps.rs
@@ -12,7 +12,12 @@ use regex::Regex;
 use serde::{Deserialize, Serialize};
 use tokio::process::Command;
 
-use crate::{BUN_CACHE_DIR, BUN_PATH, HOME_ENV, PATH_ENV, PROXY_ENVS, UV_CACHE_DIR};
+use crate::bun_executor::{write_bun_registry_config, BUN_CONFIG_FILE, BUN_NPMRC_FILE};
+use crate::worker::non_empty_env;
+use crate::{
+    BUN_CACHE_DIR, BUN_PATH, HOME_ENV, INDEX_CERT, NATIVE_CERT, PATH_ENV, PROXY_ENVS, TRUSTED_HOST,
+    UV_CACHE_DIR, UV_HTTP_TIMEOUT,
+};
 use windmill_common::worker::write_file;
 
 const LOADER_BUILDER_CONTENT: &str = include_str!("../loader_builder.bun.js");
@@ -87,6 +92,16 @@ lazy_static::lazy_static! {
 
     /// UV binary path
     static ref UV_PATH: String = std::env::var("UV_PATH").unwrap_or_else(|_| "/usr/local/bin/uv".to_string());
+
+    /// Fallbacks for the registry settings, used when the caller sends none: this process has
+    /// no database, so the instance settings only reach it through the request (see
+    /// [`RegistryConfig`]), and a debug service that cannot fetch them still configures the
+    /// installer from its own environment.
+    static ref PY_INDEX_URL: Option<String> = non_empty_env("PY_INDEX_URL").or_else(|| non_empty_env("PIP_INDEX_URL"));
+    static ref PY_EXTRA_INDEX_URL: Option<String> = non_empty_env("PY_EXTRA_INDEX_URL").or_else(|| non_empty_env("PIP_EXTRA_INDEX_URL"));
+    /// uv defaults to `first-index`; the job path overrides it so a package missing from the
+    /// first index is still resolved from the others. Same default here.
+    static ref PY_INDEX_STRATEGY: String = non_empty_env("UV_INDEX_STRATEGY").unwrap_or_else(|| "unsafe-best-match".to_string());
 }
 
 /// Simple loader that doesn't require Windmill API for relative imports
@@ -99,10 +114,153 @@ const p = {
 };
 "#;
 
+/// The registry settings resolved from the instance settings by the caller.
+///
+/// This process runs without a database, so `GET /api/debug/registry_config` is where the
+/// debug service reads them and this request field is how they get here. They are consumed
+/// to configure the installer and never handed to the debug session itself: an index URL
+/// embeds credentials and the session executes user-supplied code.
+///
+/// Field names are the `global_settings` keys, so the service forwards the endpoint's
+/// response verbatim.
+#[derive(Deserialize, Default)]
+pub struct RegistryConfig {
+    pub npm_config_registry: Option<String>,
+    pub npmrc: Option<String>,
+    pub bunfig_install_scopes: Option<String>,
+    pub pip_index_url: Option<String>,
+    pub pip_extra_index_url: Option<String>,
+    pub uv_index_strategy: Option<String>,
+}
+
 #[derive(Deserialize)]
 pub struct PrepareRequest {
     pub code: String,
     pub language: String,
+    /// Interpreter the caller will run the script with. The venv must be built against it:
+    /// site-packages is put on that interpreter's sys.path, and a wheel with a compiled
+    /// extension built for another version is simply invisible there.
+    #[serde(default)]
+    pub python_path: Option<String>,
+    #[serde(default)]
+    pub registry: RegistryConfig,
+}
+
+/// A blank value means unset, as it does for the same setting on a worker.
+fn configured(value: &Option<String>) -> Option<String> {
+    value.clone().filter(|v| !v.trim().is_empty())
+}
+
+/// Where the registry configuration for one `bun install` is written.
+///
+/// Deliberately not the install directory: the debug session resolves its `node_modules`
+/// symlink into that directory, and the sandbox bind-mounts all of `/tmp` into every session,
+/// so a concurrent session could read the credentials of an install in flight. `/var/tmp` is a
+/// tmpfs private to each jail (`debugger/nsjail.debug.config.proto`), which also takes the
+/// credentials with it when a jailed install is killed. `bun install` reads them from here
+/// through `--config` and `HOME`.
+const REGISTRY_CONFIG_ROOT: &str = "/var/tmp/windmill-debug-registry";
+
+/// How long a configuration directory may survive before the next install treats it as debris.
+/// The caller kills an install with SIGKILL, leaving nothing able to clean up after it, and an
+/// unjailed install is the only one that writes somewhere outliving the process at all. Well
+/// past any install: the caller's own timeout is two minutes by default.
+const REGISTRY_CONFIG_MAX_AGE: std::time::Duration = std::time::Duration::from_secs(60 * 60);
+
+/// Removes the registry configuration when the install ends, whichever way it ends.
+struct RegistryConfigDir(Option<String>);
+
+impl Drop for RegistryConfigDir {
+    fn drop(&mut self) {
+        if let Some(dir) = self.0.as_deref() {
+            remove_registry_config_dir(dir);
+        }
+    }
+}
+
+/// Write the registry configuration for one install and return the directory holding it, empty
+/// when there is nothing to write.
+///
+/// Falls back to the install directory if the private root is not writable: an install that
+/// reaches its registry matters more than the isolation above, which only holds for sessions
+/// that run under nsjail in the first place.
+fn write_registry_config_dir(
+    job_id: &uuid::Uuid,
+    job_dir: &str,
+    registry: &RegistryConfig,
+) -> anyhow::Result<RegistryConfigDir> {
+    let npmrc = configured(&registry.npmrc);
+    let npm_config_registry = configured(&registry.npm_config_registry);
+    let bunfig_install_scopes = configured(&registry.bunfig_install_scopes);
+    if npmrc.is_none() && npm_config_registry.is_none() && bunfig_install_scopes.is_none() {
+        return Ok(RegistryConfigDir(None));
+    }
+
+    let dir = format!("{}/{}", REGISTRY_CONFIG_ROOT, job_id);
+    let dir = match create_private_dir(&dir) {
+        Ok(()) => dir,
+        Err(e) => {
+            tracing::warn!("Could not create {dir} ({e}), keeping the registry configuration in the install directory");
+            job_dir.to_string()
+        }
+    };
+    // Claimed before anything is written to it, so a failure below still takes it down.
+    let held = RegistryConfigDir(Some(dir.clone()));
+    write_bun_registry_config(&dir, npmrc, npm_config_registry, bunfig_install_scopes)?;
+    Ok(held)
+}
+
+fn create_private_dir(dir: &str) -> std::io::Result<()> {
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::DirBuilderExt;
+        std::fs::create_dir_all(REGISTRY_CONFIG_ROOT)?;
+        sweep_stale_registry_config();
+        std::fs::DirBuilder::new().mode(0o700).create(dir)
+    }
+    #[cfg(not(unix))]
+    {
+        sweep_stale_registry_config();
+        std::fs::create_dir_all(dir)
+    }
+}
+
+/// Drop what an install that was killed could not clean up itself.
+fn sweep_stale_registry_config() {
+    let Ok(entries) = std::fs::read_dir(REGISTRY_CONFIG_ROOT) else {
+        return;
+    };
+    for entry in entries.flatten() {
+        let stale = entry
+            .metadata()
+            .and_then(|m| m.modified())
+            .is_ok_and(|m| m.elapsed().is_ok_and(|age| age > REGISTRY_CONFIG_MAX_AGE));
+        if stale {
+            let _ = std::fs::remove_dir_all(entry.path());
+        }
+    }
+}
+
+/// Delete the registry configuration once the install that needed it is over. A failure to
+/// remove credentials has to be visible.
+fn remove_registry_config_dir(dir: &str) {
+    if dir.starts_with(REGISTRY_CONFIG_ROOT) {
+        if let Err(e) = std::fs::remove_dir_all(dir) {
+            if e.kind() != std::io::ErrorKind::NotFound {
+                tracing::error!("Failed to remove registry configuration {dir}: {e}");
+            }
+        }
+        return;
+    }
+    // The fallback path above put them in the install directory, which has to survive.
+    for file in [BUN_NPMRC_FILE, BUN_CONFIG_FILE] {
+        let path = format!("{}/{}", dir, file);
+        if let Err(e) = std::fs::remove_file(&path) {
+            if e.kind() != std::io::ErrorKind::NotFound {
+                tracing::error!("Failed to remove registry configuration {path}: {e}");
+            }
+        }
+    }
 }
 
 #[derive(Serialize)]
@@ -114,6 +272,11 @@ pub struct PrepareResponse {
     pub job_dir: String,
     pub success: bool,
     pub error: Option<String>,
+    /// Raw stderr of the dependency installer when it exited non-zero, so a caller can show the
+    /// registry/TLS failure verbatim instead of the bare ModuleNotFoundError that follows.
+    /// Omitted from the JSON when absent, so callers that only know `success`/`error` are unaffected.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub install_stderr: Option<String>,
 }
 
 /// Parse Python imports and return a list of package names that need to be installed.
@@ -160,8 +323,49 @@ fn get_proc_envs(cache_env: Option<(&str, &str)>) -> HashMap<String, String> {
     envs
 }
 
+/// CA bundle for the package index, most specific spelling first. A host behind a TLS-intercepting
+/// proxy configures it under whichever name its other tooling uses, and the environment is cleared
+/// below, so falling back past `PY_INDEX_CERT` is what makes those hosts work at all.
+fn index_ca_bundle() -> Option<String> {
+    INDEX_CERT
+        .clone()
+        .or_else(|| non_empty_env("SSL_CERT_FILE"))
+        .or_else(|| non_empty_env("REQUESTS_CA_BUNDLE"))
+        .or_else(|| non_empty_env("CURL_CA_BUNDLE"))
+}
+
+/// uv registry arguments, mirroring what the job path passes in `python_executor`.
+fn uv_registry_args(registry: &RegistryConfig) -> Vec<String> {
+    let index_url = configured(&registry.pip_index_url).or_else(|| PY_INDEX_URL.clone());
+    let extra_index_url =
+        configured(&registry.pip_extra_index_url).or_else(|| PY_EXTRA_INDEX_URL.clone());
+
+    let mut args: Vec<String> = vec![];
+    if let Some(urls) = extra_index_url.as_ref() {
+        for url in urls.split(',') {
+            args.extend(["--extra-index-url".to_string(), url.to_string()]);
+        }
+    }
+    if let Some(url) = index_url.as_ref() {
+        args.extend(["--index-url".to_string(), url.to_string()]);
+    }
+    if let Some(hosts) = TRUSTED_HOST.as_ref() {
+        for host in hosts.split_whitespace() {
+            args.extend(["--trusted-host".to_string(), host.to_string()]);
+        }
+    }
+    if *NATIVE_CERT {
+        args.push("--native-tls".to_string());
+    }
+    args
+}
+
 /// Prepare Python dependencies using uv
-async fn prepare_python_deps_standalone(code: &str) -> PrepareResponse {
+async fn prepare_python_deps_standalone(
+    code: &str,
+    python_path: Option<&str>,
+    registry: &RegistryConfig,
+) -> PrepareResponse {
     // Parse imports from the code
     let packages = parse_python_imports(code);
 
@@ -172,6 +376,7 @@ async fn prepare_python_deps_standalone(code: &str) -> PrepareResponse {
             job_dir: String::new(),
             success: true,
             error: None,
+            install_stderr: None,
         };
     }
 
@@ -189,17 +394,50 @@ async fn prepare_python_deps_standalone(code: &str) -> PrepareResponse {
             job_dir: job_dir.clone(),
             success: false,
             error: Some(format!("Failed to create job directory: {}", e)),
+            install_stderr: None,
         };
     }
 
-    let common_uv_envs = get_proc_envs(Some(("UV_CACHE_DIR", &UV_CACHE_DIR)));
+    let mut common_uv_envs = get_proc_envs(Some(("UV_CACHE_DIR", &UV_CACHE_DIR)));
+    common_uv_envs.insert(
+        "UV_INDEX_STRATEGY".to_string(),
+        configured(&registry.uv_index_strategy).unwrap_or_else(|| PY_INDEX_STRATEGY.to_string()),
+    );
+    if let Some(timeout) = UV_HTTP_TIMEOUT.as_ref() {
+        common_uv_envs.insert("UV_HTTP_TIMEOUT".to_string(), timeout.to_string());
+    }
+    if let Some(cert_path) = index_ca_bundle() {
+        // uv has no `--cert` on `venv`/`pip install` (astral-sh/uv#6715), so a custom CA bundle
+        // reaches it through SSL_CERT_FILE, as in the job path. It replaces uv's own roots rather
+        // than adding to them, so the file has to be a complete bundle.
+        common_uv_envs.insert("SSL_CERT_FILE".to_string(), cert_path);
+    }
+    // The other spelling uv accepts. Like the bundle above it replaces uv's own roots rather than
+    // adding to them, so a directory holding only a private CA leaves public indexes untrusted.
+    if let Some(cert_dir) = non_empty_env("SSL_CERT_DIR") {
+        common_uv_envs.insert("SSL_CERT_DIR".to_string(), cert_dir);
+    }
+
+    let registry_args = uv_registry_args(registry);
 
     // Step 1: Create virtual environment using uv
+    // `--seed` resolves pip/setuptools from the index, so the venv also needs the registry
+    // arguments: on a network that only reaches a private mirror it fails without them.
+    let mut venv_args = vec!["venv".to_string(), venv_dir.clone(), "--seed".to_string()];
+    // Without this uv picks its own interpreter, and the caller then puts a site-packages built
+    // for that version on a different interpreter's sys.path: pure-Python packages still import,
+    // anything with a compiled extension does not, and the error names the missing extension
+    // rather than the mismatch.
+    if let Some(python_path) = python_path {
+        venv_args.extend(["-p".to_string(), python_path.to_string()]);
+    }
+    venv_args.extend(registry_args.iter().cloned());
+
     let output = Command::new(UV_PATH.as_str())
         .current_dir(&job_dir)
         .env_clear()
         .envs(common_uv_envs.clone())
-        .args(["venv", &venv_dir, "--seed"])
+        .args(&venv_args)
         .stdout(Stdio::piped())
         .stderr(Stdio::piped())
         .output()
@@ -212,26 +450,33 @@ async fn prepare_python_deps_standalone(code: &str) -> PrepareResponse {
             job_dir: job_dir.clone(),
             success: false,
             error: Some(format!("Failed to create venv: {}", e)),
+            install_stderr: None,
         };
     }
 
     let out = output.unwrap();
     if !out.status.success() {
-        let stderr = String::from_utf8_lossy(&out.stderr);
+        let stderr = String::from_utf8_lossy(&out.stderr).to_string();
         return PrepareResponse {
             node_modules_path: None,
             venv_path: None,
             job_dir: job_dir.clone(),
             success: false,
             error: Some(format!("uv venv failed: {}", stderr)),
+            install_stderr: Some(stderr),
         };
     }
 
     // Step 2: Install packages using uv pip install
     let python_path = format!("{}/bin/python", venv_dir);
-    let mut args = vec!["pip", "install", "--python", &python_path];
-    let package_refs: Vec<&str> = packages.iter().map(|s| s.as_str()).collect();
-    args.extend(package_refs.iter());
+    let mut args = vec![
+        "pip".to_string(),
+        "install".to_string(),
+        "--python".to_string(),
+        python_path,
+    ];
+    args.extend(packages.iter().cloned());
+    args.extend(registry_args);
 
     let output = Command::new(UV_PATH.as_str())
         .current_dir(&job_dir)
@@ -246,11 +491,19 @@ async fn prepare_python_deps_standalone(code: &str) -> PrepareResponse {
     match output {
         Ok(out) => {
             if !out.status.success() {
-                let stderr = String::from_utf8_lossy(&out.stderr);
-                // Installation might fail for some packages (e.g., wrong package name)
-                // Log the error but continue - the script might still work if the
-                // package is actually installed elsewhere or the import is optional
-                tracing::warn!("uv pip install warning: {}", stderr);
+                // uv installs the whole set atomically, so a failure here means an empty venv:
+                // returning success would leave the caller with a bare ModuleNotFoundError and
+                // no way to see the registry/TLS/package-name error that caused it.
+                let stderr = String::from_utf8_lossy(&out.stderr).to_string();
+                tracing::warn!("uv pip install failed: {}", stderr);
+                return PrepareResponse {
+                    node_modules_path: None,
+                    venv_path: None,
+                    job_dir: job_dir.clone(),
+                    success: false,
+                    error: Some(format!("uv pip install failed: {}", stderr)),
+                    install_stderr: Some(stderr),
+                };
             }
         }
         Err(e) => {
@@ -260,6 +513,7 @@ async fn prepare_python_deps_standalone(code: &str) -> PrepareResponse {
                 job_dir: job_dir.clone(),
                 success: false,
                 error: Some(format!("Failed to run uv pip install: {}", e)),
+                install_stderr: None,
             };
         }
     }
@@ -292,21 +546,32 @@ async fn prepare_python_deps_standalone(code: &str) -> PrepareResponse {
         job_dir,
         success: true,
         error: None,
+        install_stderr: None,
     }
 }
 
 /// Get common environment variables for Bun processes
 pub fn get_simple_bun_proc_envs() -> HashMap<String, String> {
-    get_proc_envs(Some(("BUN_INSTALL_CACHE_DIR", &BUN_CACHE_DIR)))
+    let mut envs = get_proc_envs(Some(("BUN_INSTALL_CACHE_DIR", &BUN_CACHE_DIR)));
+    // Bun reads none of the spellings uv does, so a custom CA reaches `bun install` only here.
+    if let Some(cert_path) = non_empty_env("NODE_EXTRA_CA_CERTS").or_else(index_ca_bundle) {
+        envs.insert("NODE_EXTRA_CA_CERTS".to_string(), cert_path);
+    }
+    envs
 }
 
 /// Prepare dependencies for a script without requiring database access.
 /// This is meant to be called from the CLI.
-pub async fn prepare_deps_standalone(code: &str, language: &str) -> PrepareResponse {
+pub async fn prepare_deps_standalone(
+    code: &str,
+    language: &str,
+    python_path: Option<&str>,
+    registry: &RegistryConfig,
+) -> PrepareResponse {
     // Route to the appropriate handler based on language
     match language {
         "python3" | "python" => {
-            return prepare_python_deps_standalone(code).await;
+            return prepare_python_deps_standalone(code, python_path, registry).await;
         }
         "bun" | "typescript" | "deno" => {
             // Continue with JS/TS handling below
@@ -321,6 +586,7 @@ pub async fn prepare_deps_standalone(code: &str, language: &str) -> PrepareRespo
                     "Unsupported language for dependency preparation: {}",
                     language
                 )),
+                install_stderr: None,
             };
         }
     }
@@ -336,6 +602,7 @@ pub async fn prepare_deps_standalone(code: &str, language: &str) -> PrepareRespo
             job_dir: job_dir.clone(),
             success: false,
             error: Some(format!("Failed to create job directory: {}", e)),
+            install_stderr: None,
         };
     }
 
@@ -347,6 +614,7 @@ pub async fn prepare_deps_standalone(code: &str, language: &str) -> PrepareRespo
             job_dir: job_dir.clone(),
             success: false,
             error: Some(format!("Failed to write main.ts: {}", e)),
+            install_stderr: None,
         };
     }
 
@@ -366,10 +634,11 @@ pub async fn prepare_deps_standalone(code: &str, language: &str) -> PrepareRespo
             job_dir: job_dir.clone(),
             success: false,
             error: Some(format!("Failed to write build.js: {}", e)),
+            install_stderr: None,
         };
     }
 
-    let common_bun_proc_envs = get_simple_bun_proc_envs();
+    let mut common_bun_proc_envs = get_simple_bun_proc_envs();
 
     // Step 1: Run build.js to generate package.json
     let output = Command::new(&*BUN_PATH)
@@ -398,6 +667,7 @@ pub async fn prepare_deps_standalone(code: &str, language: &str) -> PrepareRespo
                             job_dir: job_dir.clone(),
                             success: false,
                             error: Some(format!("Failed to write empty package.json: {}", e)),
+                            install_stderr: None,
                         };
                     }
                 }
@@ -411,6 +681,7 @@ pub async fn prepare_deps_standalone(code: &str, language: &str) -> PrepareRespo
                 job_dir: job_dir.clone(),
                 success: false,
                 error: Some(format!("Failed to run build.js: {}", e)),
+                install_stderr: None,
             };
         }
     }
@@ -427,6 +698,7 @@ pub async fn prepare_deps_standalone(code: &str, language: &str) -> PrepareRespo
                 job_dir: job_dir.clone(),
                 success: true,
                 error: None,
+                install_stderr: None,
             };
         }
     };
@@ -441,6 +713,7 @@ pub async fn prepare_deps_standalone(code: &str, language: &str) -> PrepareRespo
                 job_dir: job_dir.clone(),
                 success: false,
                 error: Some(format!("Failed to parse package.json: {}", e)),
+                install_stderr: None,
             };
         }
     };
@@ -454,30 +727,58 @@ pub async fn prepare_deps_standalone(code: &str, language: &str) -> PrepareRespo
             job_dir: job_dir.clone(),
             success: true,
             error: None,
+            install_stderr: None,
         };
     }
 
-    // Step 2: Run bun install
+    // Step 2: Run bun install, from the same registry configuration a job installs with.
+    let mut args = vec!["install".to_string()];
+    let registry_config_dir = match write_registry_config_dir(&job_id, &job_dir, registry) {
+        Ok(dir) => dir,
+        Err(e) => {
+            return PrepareResponse {
+                node_modules_path: None,
+                venv_path: None,
+                job_dir: job_dir.clone(),
+                success: false,
+                error: Some(format!("Failed to write registry configuration: {}", e)),
+                install_stderr: None,
+            };
+        }
+    };
+    if let Some(dir) = registry_config_dir.0.as_ref() {
+        // Only one of the two files exists: `.npmrc` is read from the installer's home,
+        // `bunfig.toml` only from the path named here.
+        common_bun_proc_envs.insert("HOME".to_string(), dir.to_string());
+        let bunfig = format!("{}/{}", dir, BUN_CONFIG_FILE);
+        if std::path::Path::new(&bunfig).exists() {
+            args.push(format!("--config={}", bunfig));
+        }
+    }
+
     let output = Command::new(&*BUN_PATH)
         .current_dir(&job_dir)
         .env_clear()
         .envs(common_bun_proc_envs)
-        .args(vec!["install"])
+        .args(args)
         .stdout(Stdio::piped())
         .stderr(Stdio::piped())
         .output()
         .await;
 
+    drop(registry_config_dir);
+
     match output {
         Ok(out) => {
             if !out.status.success() {
-                let stderr = String::from_utf8_lossy(&out.stderr);
+                let stderr = String::from_utf8_lossy(&out.stderr).to_string();
                 return PrepareResponse {
                     node_modules_path: None,
                     venv_path: None,
                     job_dir: job_dir.clone(),
                     success: false,
                     error: Some(format!("bun install failed: {}", stderr)),
+                    install_stderr: Some(stderr),
                 };
             }
         }
@@ -488,6 +789,7 @@ pub async fn prepare_deps_standalone(code: &str, language: &str) -> PrepareRespo
                 job_dir: job_dir.clone(),
                 success: false,
                 error: Some(format!("Failed to run bun install: {}", e)),
+                install_stderr: None,
             };
         }
     }
@@ -500,6 +802,7 @@ pub async fn prepare_deps_standalone(code: &str, language: &str) -> PrepareRespo
             job_dir,
             success: true,
             error: None,
+            install_stderr: None,
         }
     } else {
         PrepareResponse {
@@ -508,6 +811,7 @@ pub async fn prepare_deps_standalone(code: &str, language: &str) -> PrepareRespo
             job_dir,
             success: true,
             error: None,
+            install_stderr: None,
         }
     }
 }
@@ -531,6 +835,7 @@ pub async fn run_prepare_deps_cli() -> anyhow::Result<()> {
                     job_dir: String::new(),
                     success: false,
                     error: Some(format!("Failed to read stdin: {}", e)),
+                    install_stderr: None,
                 };
                 println!("{}", serde_json::to_string(&response)?);
                 return Ok(());
@@ -550,14 +855,81 @@ pub async fn run_prepare_deps_cli() -> anyhow::Result<()> {
                     "Failed to parse JSON input: {}. Expected {{\"code\": \"...\", \"language\": \"bun\" or \"python3\"}}",
                     e
                 )),
+                install_stderr: None,
             };
             println!("{}", serde_json::to_string(&response)?);
             return Ok(());
         }
     };
 
-    let response = prepare_deps_standalone(&request.code, &request.language).await;
+    let response = prepare_deps_standalone(
+        &request.code,
+        &request.language,
+        request.python_path.as_deref(),
+        &request.registry,
+    )
+    .await;
     println!("{}", serde_json::to_string(&response)?);
 
     Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::{PrepareRequest, PrepareResponse};
+
+    /// The debug service and this CLI are deployed as separate images, and the service
+    /// forwards `GET /api/debug/registry_config` verbatim, `message` field included. So a
+    /// request from an older service carries no `registry` at all, and one from a newer
+    /// service carries fields this binary does not know.
+    #[test]
+    fn test_registry_is_optional_and_tolerates_unknown_fields() {
+        let without: PrepareRequest =
+            serde_json::from_str(r#"{"code": "import lodash", "language": "bun"}"#).unwrap();
+        assert!(without.registry.npm_config_registry.is_none());
+
+        let with: PrepareRequest = serde_json::from_str(
+            r#"{"code": "", "language": "bun", "registry": {"npm_config_registry": "https://npm.example", "message": "for the user"}}"#,
+        )
+        .unwrap();
+        assert_eq!(
+            with.registry.npm_config_registry.as_deref(),
+            Some("https://npm.example")
+        );
+    }
+
+    /// The debugger (`debugger/dap_websocket_server.py`) parses this JSON out of the CLI's
+    /// stdout, so `install_stderr` has to stay additive: a response without an install failure
+    /// must serialize to the shape callers already know.
+    #[test]
+    fn test_install_stderr_is_additive() {
+        let ok = PrepareResponse {
+            node_modules_path: None,
+            venv_path: Some("/tmp/windmill-deps/x/venv".to_string()),
+            job_dir: "/tmp/windmill-deps/x".to_string(),
+            success: true,
+            error: None,
+            install_stderr: None,
+        };
+        assert_eq!(
+            serde_json::to_value(&ok).unwrap(),
+            serde_json::json!({
+                "node_modules_path": null,
+                "venv_path": "/tmp/windmill-deps/x/venv",
+                "job_dir": "/tmp/windmill-deps/x",
+                "success": true,
+                "error": null,
+            })
+        );
+
+        let failed = PrepareResponse {
+            install_stderr: Some("error: no such package".to_string()),
+            success: false,
+            error: Some("uv pip install failed: error: no such package".to_string()),
+            ..ok
+        };
+        let failed = serde_json::to_value(&failed).unwrap();
+        assert_eq!(failed["install_stderr"], "error: no such package");
+        assert_eq!(failed["success"], false);
+    }
+}
diff --git a/backend/windmill-worker/src/python_executor.rs b/backend/windmill-worker/src/python_executor.rs
index 13e3749fbd..883b035a32 100644
--- a/backend/windmill-worker/src/python_executor.rs
+++ b/backend/windmill-worker/src/python_executor.rs
@@ -62,20 +62,8 @@ lazy_static::lazy_static! {
     static ref PY_CONCURRENT_DOWNLOADS: usize =
     var("PY_CONCURRENT_DOWNLOADS").ok().map(|flag| flag.parse().unwrap_or(20)).unwrap_or(20);
 
-    // uv's HTTP request timeout (seconds). spawn_uv_install uses env_clear(), so a
-    // UV_HTTP_TIMEOUT set on the worker is dropped unless forwarded explicitly.
-    // Only forwarded when set; otherwise uv keeps its own default. Lets operators
-    // raise it for slow/contended private registries ("operation timed out").
-    static ref UV_HTTP_TIMEOUT: Option<String> =
-    var("UV_HTTP_TIMEOUT").ok().filter(|v| !v.is_empty());
-
-
     static ref NON_ALPHANUM_CHAR: Regex = regex::Regex::new(r"[^0-9A-Za-z=.-]").unwrap();
 
-    static ref TRUSTED_HOST: Option<String> = var("PY_TRUSTED_HOST").ok().or(var("PIP_TRUSTED_HOST").ok());
-    pub static ref INDEX_CERT: Option<String> = var("PY_INDEX_CERT").ok().or(var("PIP_INDEX_CERT").ok());
-    pub static ref NATIVE_CERT: bool = var("PY_NATIVE_CERT").ok().or(var("UV_NATIVE_TLS").ok()).map(|flag| flag == "true").unwrap_or(false);
-
     static ref RELATIVE_IMPORT_REGEX: Regex = Regex::new(r#"(import|from)\s(((u|f)\.)|\.)"#).unwrap();
 
     static ref EPHEMERAL_TOKEN_CMD: Option<String> = var("EPHEMERAL_TOKEN_CMD").ok();
@@ -163,9 +151,10 @@ use crate::{
     handle_child::handle_child,
     is_sandboxing_enabled, read_ee_registry_with_workspace_override,
     worker_utils::ping_job_status,
-    PyV, DISABLE_NUSER, HOME_ENV, NSJAIL_AVAILABLE, NSJAIL_PATH, NSJAIL_PY_RLIMIT_AS_MB, PATH_ENV,
-    PIP_EXTRA_INDEX_URL, PIP_INDEX_URL, PROXY_ENVS, PY_INSTALL_DIR, TRACING_PROXY_CA_CERT_PATH,
-    TZ_ENV, UV_CACHE_DIR, UV_EXCLUDE_NEWER, UV_INDEX_STRATEGY, UV_PYTHON_INSTALL_MIRROR,
+    PyV, DISABLE_NUSER, HOME_ENV, INDEX_CERT, NATIVE_CERT, NSJAIL_AVAILABLE, NSJAIL_PATH,
+    NSJAIL_PY_RLIMIT_AS_MB, PATH_ENV, PIP_EXTRA_INDEX_URL, PIP_INDEX_URL, PROXY_ENVS,
+    PY_INSTALL_DIR, TRACING_PROXY_CA_CERT_PATH, TRUSTED_HOST, TZ_ENV, UV_CACHE_DIR,
+    UV_EXCLUDE_NEWER, UV_HTTP_TIMEOUT, UV_INDEX_STRATEGY, UV_PYTHON_INSTALL_MIRROR,
 };
 use windmill_common::client::AuthedClient;
 
@@ -3026,7 +3015,11 @@ pub async fn handle_python_reqs(
                     "failed to get PID for python installation process: {}",
                     &req
                   )))
-                  .and_then(|pid| write_file(&format!("/proc/{pid}"), "oom_score_adj", "1000"))
+                  .and_then(|pid| write_file(
+                      &format!("/proc/{pid}"),
+                      "oom_score_adj",
+                      &windmill_common::worker::JOB_OOM_SCORE_ADJ.to_string(),
+                  ))
                 {
                   tracing::error!(
                       req = %req,
diff --git a/backend/windmill-worker/src/python_versions.rs b/backend/windmill-worker/src/python_versions.rs
index 3a1f35a302..11f673e8f4 100644
--- a/backend/windmill-worker/src/python_versions.rs
+++ b/backend/windmill-worker/src/python_versions.rs
@@ -23,9 +23,9 @@ use crate::python_executor::UV_PATH;
 use crate::{
     common::{start_child_process, OccupancyMetrics},
     handle_child::handle_child,
-    python_executor::{INDEX_CERT, NATIVE_CERT, PYTHON_PATH},
-    HOME_ENV, INSTANCE_PYTHON_VERSION, PATH_ENV, PROXY_ENVS, PY_INSTALL_DIR, UV_CACHE_DIR,
-    UV_PYTHON_INSTALL_MIRROR, WIN_ENVS,
+    python_executor::PYTHON_PATH,
+    HOME_ENV, INDEX_CERT, INSTANCE_PYTHON_VERSION, NATIVE_CERT, PATH_ENV, PROXY_ENVS,
+    PY_INSTALL_DIR, UV_CACHE_DIR, UV_PYTHON_INSTALL_MIRROR, WIN_ENVS,
 };
 
 impl From<PyV> for PyVAlias {
diff --git a/backend/windmill-worker/src/result_processor.rs b/backend/windmill-worker/src/result_processor.rs
index bf3993bfe6..2b99b9ff84 100644
--- a/backend/windmill-worker/src/result_processor.rs
+++ b/backend/windmill-worker/src/result_processor.rs
@@ -52,7 +52,7 @@ use crate::{
     otel_oss::add_root_flow_job_to_otlp,
     worker_flow::update_flow_status_after_job_completion,
     JobCompletedReceiver, JobCompletedSender, SameWorkerSender, SendResult, SendResultPayload,
-    UpdateFlow, SAME_WORKER_REQUIREMENTS,
+    StepFailureKind, UpdateFlow, SAME_WORKER_REQUIREMENTS,
 };
 use windmill_common::client::AuthedClient;
 
@@ -212,7 +212,7 @@ async fn process_jc(
         span.record("root_job", root_job.to_string().as_str());
     }
     if let Some(trigger_kind) = jc.job.trigger_kind.as_ref() {
-        span.record("trigger_kind", trigger_kind.to_string().as_str());
+        span.record("trigger_kind", trigger_kind.as_str());
     }
     if let Some(trigger) = jc.job.trigger.as_ref() {
         span.record("trigger", trigger.as_str());
@@ -465,6 +465,7 @@ pub fn start_background_processor(
                             worker_dir,
                             stop_early_override,
                             token,
+                            step_failure,
                         }),
                     time,
                 }) => {
@@ -485,7 +486,7 @@ pub fn start_background_processor(
                         None,
                         Arc::new(result),
                         None,
-                        true,
+                        step_failure,
                         &same_worker_tx,
                         &worker_dir,
                         stop_early_override,
@@ -690,46 +691,60 @@ pub async fn handle_receive_completed_job(
     #[cfg(feature = "benchmark")] bench: &mut BenchmarkIter,
 ) -> Option<Arc<MiniPulledJob>> {
     let workspace = jc.job.workspace_id.clone();
-    // The client built here drives post-completion orchestration (the next step's input
-    // transforms fetch prior step results), which outlives the finished step. The step's own
-    // token has a `SCRIPT_TOKEN_EXPIRY` lifetime, so reusing it would fail that orchestration
-    // once the step itself ran longer than the token lives; refresh it when the step is old enough.
-    let token_maybe_expired = jc
-        .duration
-        .is_some_and(|d| d as u64 >= *windmill_common::worker::SCRIPT_TOKEN_EXPIRY * 1000 / 2);
-    let token = if jc.job.is_flow_step() && token_maybe_expired {
-        // Mirror `create_token`'s label so run-on-behalf-of flows keep their end-user override.
-        let label = if jc.job.permissioned_as != format!("u/{}", jc.job.created_by)
-            && jc.job.permissioned_as != jc.job.created_by
-        {
-            format!("ephemeral-script-end-user-{}", jc.job.created_by)
-        } else {
-            "ephemeral-script".to_string()
-        };
-        match windmill_common::auth::create_token_for_owner(
-            db,
-            &jc.job.workspace_id,
+    // This client drives post-completion orchestration (the next step's input transforms fetch
+    // prior results) and outlives the finished step, so the step's own token can already be near
+    // expiry. Refresh it — but only from the server-written job_perms row, never from the
+    // completion payload's owner fields, which are untrusted on the agent-worker path.
+    let token = if jc.job.is_flow_step()
+        && windmill_common::auth::job_token_remaining_lifetime_secs(&jc.token)
+            .is_some_and(|r| r < windmill_common::auth::JOB_TOKEN_REFRESH_MARGIN_SECS)
+    {
+        let label = windmill_common::auth::ephemeral_script_token_label(
             &jc.job.permissioned_as,
-            &label,
-            *windmill_common::worker::SCRIPT_TOKEN_EXPIRY,
-            &jc.job.permissioned_as_email,
-            &jc.job.id,
-            None,
-            Some(format!(
-                "job-span-{}",
-                jc.job.flow_innermost_root_job.unwrap_or(jc.job.id)
-            )),
-        )
-        .warn_after_seconds(5)
-        .await
-        {
-            Ok(t) => t,
-            Err(e) => {
+            &jc.job.created_by,
+        );
+        match windmill_common::auth::get_job_perms(db, &jc.job.id, &jc.job.workspace_id).await {
+            Ok(Some(perms)) => windmill_common::auth::create_token_for_owner(
+                db,
+                &jc.job.workspace_id,
+                &jc.job.permissioned_as,
+                &label,
+                *windmill_common::worker::SCRIPT_TOKEN_EXPIRY,
+                &jc.job.permissioned_as_email,
+                &jc.job.id,
+                Some(perms),
+                Some(format!(
+                    "job-span-{}",
+                    jc.job.flow_innermost_root_job.unwrap_or(jc.job.id)
+                )),
+            )
+            .warn_after_seconds(5)
+            .await
+            .unwrap_or_else(|e| {
                 tracing::warn!(
                     "could not mint fresh flow-orchestration token for job {}, reusing step token: {e:#}",
                     jc.job.id
                 );
                 jc.token.clone()
+            }),
+            // No perms row (e.g. a zombie replay after the queue row was reaped): keep the step
+            // token rather than minting an identity from untrusted payload fields. The token is
+            // near expiry, so trace it — the downstream fetch may hit the original failure.
+            Ok(None) => {
+                tracing::warn!(
+                    "no job_perms row to refresh flow-orchestration token for job {}, reusing step token",
+                    jc.job.id
+                );
+                jc.token.clone()
+            }
+            // A transient DB error must not silently reuse the near-expired token without a trace,
+            // or the very failure this guards against recurs invisibly.
+            Err(e) => {
+                tracing::warn!(
+                    "could not load job_perms to refresh flow-orchestration token for job {}, reusing step token: {e:#}",
+                    jc.job.id
+                );
+                jc.token.clone()
             }
         }
     } else {
@@ -777,7 +792,7 @@ pub async fn handle_receive_completed_job(
                 mem_peak,
                 canceled_by,
                 err,
-                false,
+                StepFailureKind::Normal,
                 same_worker_tx.clone(),
                 &worker_dir,
                 worker_name,
@@ -852,6 +867,20 @@ fn parse_git_sync_changes(result_raw: &str) -> Option<(Vec<(String, String)>, bo
     ))
 }
 
+/// The pull script reports an unmergeable PR as a top-level `pr_check_error`
+/// sentinel field. Matched as an exact field, never a substring: a successful
+/// diff lists user-controlled repo paths that could embed the sentinel text.
+#[cfg(all(feature = "enterprise", feature = "private"))]
+fn parse_pr_check_error(result_raw: &str) -> Option<String> {
+    serde_json::from_str::<serde_json::Value>(result_raw)
+        .ok()
+        .and_then(|v| {
+            v.get("pr_check_error")
+                .and_then(|e| e.as_str())
+                .map(|s| s.to_string())
+        })
+}
+
 #[cfg(all(feature = "enterprise", feature = "private"))]
 fn format_change_list(changes: &[(String, String)]) -> Vec<String> {
     let mut lines = Vec::new();
@@ -866,7 +895,19 @@ fn format_change_list(changes: &[(String, String)]) -> Vec<String> {
 
 #[cfg(all(test, feature = "enterprise", feature = "private"))]
 mod git_sync_check_tests {
-    use super::{format_change_list, parse_git_sync_changes};
+    use super::{format_change_list, parse_git_sync_changes, parse_pr_check_error};
+
+    #[test]
+    fn pr_check_error_is_a_field_not_a_substring() {
+        // A diff whose paths embed the sentinel text must not trip the verdict.
+        let diff = r#"{"changes":[{"type":"edited","path":"f/team/PR_MERGE_CONFLICTS.ts"}]}"#;
+        assert_eq!(parse_pr_check_error(diff), None);
+        let sentinel = r#"{"pr_check_error":"PR_MERGE_CONFLICTS","message":"m"}"#;
+        assert_eq!(
+            parse_pr_check_error(sentinel).as_deref(),
+            Some("PR_MERGE_CONFLICTS")
+        );
+    }
 
     #[test]
     fn parse_empty_changes_is_in_sync() {
@@ -958,7 +999,7 @@ async fn maybe_reconcile_git_sync_auto_pull(
 
 /// Branch a git-sync push job deployed to, mirroring the hub script's
 /// derivation: a dev workspace deploys to its environment-label branch
-/// (`dev`/`staging`), other fork workspaces to `wm-fork/<base>/<id-suffix>`,
+/// (`dev`, `staging`, ...), other fork workspaces to `wm-fork/<base>/<id-suffix>`,
 /// else the promotion `wm_deploy/**` formula (per-folder or per-item form).
 /// A dev workspace in promotion mode is the exception: it takes the promotion
 /// `wm_deploy/**` formula (per-item PRs into the parent) instead of its label
@@ -1376,8 +1417,37 @@ async fn maybe_post_git_sync_check(
             }
         }
     } else {
-        // Phase 4: dry-run diff preview for a PR.
-        if !success {
+        // Phase 4: dry-run diff preview for a PR. An unmergeable PR has no
+        // diff; the pull script reports which sentinel applies (returned as a
+        // result — thrown bun errors reach the job result as truncated log tails).
+        let pr_check_error = parse_pr_check_error(result_raw);
+        if pr_check_error.as_deref() == Some("PR_MERGE_CONFLICTS") {
+            (
+                "failure",
+                "Merge conflicts with the base branch".to_string(),
+                "This PR cannot be merged cleanly, so there is no deploy diff to compute. Resolve the conflicts and push again to re-run this check."
+                    .to_string(),
+            )
+        } else if pr_check_error.as_deref() == Some("PR_HEAD_REF_UNAVAILABLE") {
+            // Neutral, not failure: a transient fetch problem is Windmill-side
+            // and, unlike conflicts, has no fixing push that would re-run the
+            // check on its own — it must not hard-block the PR.
+            (
+                "neutral",
+                "Could not compute the deploy diff".to_string(),
+                "Windmill could not fetch this PR's head or enough history from GitHub to compute its merge with the base. Push again to re-run this check."
+                    .to_string(),
+            )
+        } else if pr_check_error.is_some() {
+            // Unknown sentinel (script newer than this backend): an explicit
+            // error signal must not degrade into a "diff computed" verdict.
+            (
+                "failure",
+                "Windmill diff failed".to_string(),
+                "The dry-run pull reported an unrecognized error. See the job in Windmill for details."
+                    .to_string(),
+            )
+        } else if !success {
             (
                 "failure",
                 "Windmill diff failed".to_string(),
@@ -1579,7 +1649,7 @@ pub async fn process_completed_job(
                     canceled_by,
                     result,
                     started_at.map(|x| FlowJobDuration { started_at: x, duration_ms: duration }),
-                    false,
+                    StepFailureKind::Normal,
                     &same_worker_tx.expect(SAME_WORKER_REQUIREMENTS).to_owned(),
                     &worker_dir,
                     None,
@@ -1686,7 +1756,7 @@ pub async fn process_completed_job(
                             duration_ms: d,
                         })
                     }),
-                    false,
+                    StepFailureKind::Normal,
                     &same_worker_tx.expect(SAME_WORKER_REQUIREMENTS).to_owned(),
                     &worker_dir,
                     None,
@@ -1964,7 +2034,7 @@ pub async fn handle_job_error(
     mem_peak: i32,
     canceled_by: Option<CanceledBy>,
     err: Error,
-    unrecoverable: bool,
+    step_failure: StepFailureKind,
     same_worker_tx: Option<&SameWorkerSender>,
     worker_dir: &str,
     worker_name: &str,
@@ -2014,7 +2084,7 @@ pub async fn handle_job_error(
             canceled_by.clone(),
             Arc::new(serde_json::value::to_raw_value(&wrapped_error).unwrap()),
             None,
-            unrecoverable,
+            step_failure,
             &same_worker_tx.expect(SAME_WORKER_REQUIREMENTS).clone(),
             worker_dir,
             None,
diff --git a/backend/windmill-worker/src/rust_executor.rs b/backend/windmill-worker/src/rust_executor.rs
index 5941e9db1c..bee5dc4b68 100644
--- a/backend/windmill-worker/src/rust_executor.rs
+++ b/backend/windmill-worker/src/rust_executor.rs
@@ -23,8 +23,8 @@ use windmill_queue::{append_logs, CanceledBy};
 use crate::{
     common::{
         build_command_with_isolation, check_executor_binary_exists, create_args_and_out_file,
-        get_reserved_variables, read_result, resolve_nsjail_timeout, resolve_nsjail_tmp_mount_block,
-        start_child_process, OccupancyMetrics, DEV_CONF_NSJAIL,
+        get_reserved_variables, read_result, resolve_nsjail_timeout,
+        resolve_nsjail_tmp_mount_block, start_child_process, OccupancyMetrics, DEV_CONF_NSJAIL,
     },
     get_proxy_envs_for_lang,
     handle_child::handle_child,
diff --git a/backend/windmill-worker/src/universal_pkg_installer.rs b/backend/windmill-worker/src/universal_pkg_installer.rs
index 47b3d95358..f36a5e6fc9 100644
--- a/backend/windmill-worker/src/universal_pkg_installer.rs
+++ b/backend/windmill-worker/src/universal_pkg_installer.rs
@@ -291,6 +291,11 @@ pub async fn par_install_language_dependencies_all_at_once<
         let child = start_child_process(cmd, &installer_executable_name, false).await?;
         let mut buf = "".to_owned();
         let pipe_stdout = if stdout_on_err { Some(&mut buf) } else { None };
+        // handle_child only pings the job id it is handed, and that one is nil while output is
+        // buffered, so nothing would refresh this job's ping for the length of the batch install.
+        let _heartbeat = stdout_on_err.then(|| {
+            crate::worker_utils::JobPingHeartbeat::start(conn, *job_id, "dependency installation")
+        });
 
         if let Err(e) = crate::handle_child::handle_child(
             &(if pipe_stdout.is_some() {
diff --git a/backend/windmill-worker/src/worker.rs b/backend/windmill-worker/src/worker.rs
index 65b17c21aa..4703c12556 100644
--- a/backend/windmill-worker/src/worker.rs
+++ b/backend/windmill-worker/src/worker.rs
@@ -361,6 +361,8 @@ lazy_static::lazy_static! {
         std::env::var("NSJAIL_PY_RLIMIT_AS_MB").ok();
     pub static ref NSJAIL_ANSIBLE_RLIMIT_AS_MB: Option<String> =
         std::env::var("NSJAIL_ANSIBLE_RLIMIT_AS_MB").ok();
+    pub static ref NSJAIL_DBT_RLIMIT_AS_MB: Option<String> =
+        std::env::var("NSJAIL_DBT_RLIMIT_AS_MB").ok();
 
     // pub static ref DISABLE_NSJAIL: bool = false;
     pub static ref DISABLE_NSJAIL: bool = std::env::var("DISABLE_NSJAIL")
@@ -702,6 +704,26 @@ lazy_static::lazy_static! {
     pub static ref FLOW_RUNNER_RUNNING: Mutex<bool> = Mutex::new(false);
 }
 
+lazy_static::lazy_static! {
+    /// Registry TLS/timeout settings for uv. Env-only (they have no instance setting), and read
+    /// both by the job path and by the DB-less `prepare-deps` CLI, which has no other source of
+    /// registry configuration.
+    pub static ref TRUSTED_HOST: Option<String> = non_empty_env("PY_TRUSTED_HOST").or_else(|| non_empty_env("PIP_TRUSTED_HOST"));
+    pub static ref INDEX_CERT: Option<String> = non_empty_env("PY_INDEX_CERT").or_else(|| non_empty_env("PIP_INDEX_CERT"));
+    pub static ref NATIVE_CERT: bool = non_empty_env("PY_NATIVE_CERT").or_else(|| non_empty_env("UV_NATIVE_TLS")).map(|flag| flag == "true").unwrap_or(false);
+    /// uv's HTTP request timeout (seconds). The uv invocations use env_clear(), so a
+    /// UV_HTTP_TIMEOUT set on the worker is dropped unless forwarded explicitly.
+    /// Only forwarded when set; otherwise uv keeps its own default. Lets operators
+    /// raise it for slow/contended private registries ("operation timed out").
+    pub static ref UV_HTTP_TIMEOUT: Option<String> = non_empty_env("UV_HTTP_TIMEOUT");
+}
+
+/// A variable declared but left empty (a common shape in compose/k8s manifests) must not
+/// shadow the fallback name it is checked against.
+pub(crate) fn non_empty_env(key: &str) -> Option<String> {
+    std::env::var(key).ok().filter(|v| !v.is_empty())
+}
+
 lazy_static::lazy_static! {
     /// Optional override for the size of the `/tmp` tmpfs mount in nsjail sandboxes (in megabytes).
     /// When `None` (or non-positive), executors fall back to the unified
@@ -1576,7 +1598,7 @@ pub fn create_span_with_name(
         span.record("hostname", hostname);
     }
     if let Some(trigger_kind) = arc_job.trigger_kind.as_ref() {
-        span.record("trigger_kind", trigger_kind.to_string().as_str());
+        span.record("trigger_kind", trigger_kind.as_str());
     }
     if let Some(trigger) = arc_job.trigger.as_ref() {
         span.record("trigger", trigger.as_str());
@@ -1686,7 +1708,7 @@ pub fn log_context_for_job(
         flow_step_id: arc_job.flow_step_id.clone(),
         parent_job: arc_job.parent_job.map(|id| id.to_string()),
         root_job: arc_job.flow_innermost_root_job.map(|id| id.to_string()),
-        trigger_kind: arc_job.trigger_kind.as_ref().map(|k| k.to_string()),
+        trigger_kind: arc_job.trigger_kind.as_ref().map(|k| k.as_str().to_string()),
         trigger: arc_job.trigger.clone(),
         hostname: hostname.map(|h| h.to_string()),
         inbound_traceparent: job_inbound_traceparent(arc_job),
@@ -1725,7 +1747,7 @@ pub async fn handle_all_job_kind_error(
                 0,
                 None,
                 err,
-                false,
+                StepFailureKind::Normal,
                 same_worker_tx,
                 &worker_dir,
                 &worker_name,
@@ -3617,6 +3639,38 @@ pub struct UpdateFlow {
     pub worker_dir: String,
     pub stop_early_override: Option<bool>,
     pub token: String,
+    pub step_failure: StepFailureKind,
+}
+
+/// Why the step a flow is being resumed from failed, which bounds what the engine may do next.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum StepFailureKind {
+    /// The step failed by running, or did not fail at all.
+    Normal,
+    /// A suspend gate was disapproved or timed out. The worker that ran the approval step is
+    /// still alive, but the failure is recorded against the step the gate was holding back,
+    /// which never ran — so that step's `retry` and `continue_on_error` describe nothing that
+    /// happened, and honouring them would re-open the gate or skip the step outright.
+    /// `suspend.continue_on_disapprove_timeout` is how a flow opts into continuing past a gate.
+    SuspendNotApproved,
+    /// The step's worker died (OOM/zombie), or the flow status update itself errored. Neither
+    /// leaves state worth pinning to: in the first case that worker is gone, in the second the
+    /// flow's own bookkeeping is what just broke.
+    Unrecoverable,
+}
+
+impl StepFailureKind {
+    /// Whether the failed module's own `retry` / `continue_on_error` still describe the
+    /// failure at hand. When they don't, the failure module is the only way forward.
+    pub fn honors_step_error_policy(self) -> bool {
+        matches!(self, Self::Normal)
+    }
+
+    /// Whether follow-up work may still be pinned to the worker that ran the previous step,
+    /// via `same_worker` or dedicated flow-module runners.
+    pub fn keeps_worker_pin(self) -> bool {
+        !matches!(self, Self::Unrecoverable)
+    }
 }
 
 async fn do_nativets(
@@ -3918,8 +3972,8 @@ pub async fn handle_queued_job(
                 flow_runners,
                 &killpill_rx,
                 // A freshly pulled flow job is being executed by a live worker; the prior
-                // step (if any) completed normally, so this is never unrecoverable here.
-                false,
+                // step (if any) completed normally.
+                StepFailureKind::Normal,
             ))
             .warn_after_seconds(10)
             .await?;
@@ -5865,6 +5919,30 @@ mount {{
                 .await
             }
         }
+        ScriptLang::Dbt => {
+            if run_inline {
+                return Err(Error::internal_err(
+                    "Inline execution is not yet supported for this language".to_string(),
+                ));
+            }
+            Box::pin(crate::dbt_executor::handle_dbt_job(
+                lock.as_ref(),
+                job_dir,
+                worker_name,
+                job,
+                mem_peak,
+                canceled_by,
+                conn,
+                client,
+                &code,
+                envs,
+                occupancy_metrics,
+                // The project's identity is derived from these, so the dbt
+                // executor needs them even though they are already on disk.
+                modules.as_ref(),
+            ))
+            .await
+        }
         // for related places search: ADD_NEW_LANG
         _ => panic!("unreachable, language is not supported: {language:#?}"),
     };
@@ -6002,6 +6080,7 @@ pub fn parse_sig_of_lang(
             ScriptLang::Rlang => Some(windmill_parser_r::parse_r_signature(code)?),
             #[cfg(not(feature = "rlang"))]
             ScriptLang::Rlang => None,
+            ScriptLang::Dbt => Some(windmill_parser_yaml::parse_dbt_sig(code)?),
             // for related places search: ADD_NEW_LANG
         }
     } else {
diff --git a/backend/windmill-worker/src/worker_flow.rs b/backend/windmill-worker/src/worker_flow.rs
index 6bd468e42e..7066b35945 100644
--- a/backend/windmill-worker/src/worker_flow.rs
+++ b/backend/windmill-worker/src/worker_flow.rs
@@ -15,8 +15,8 @@ use crate::common::{cached_result_path, get_root_job_id, save_in_cache, transfor
 use crate::js_eval::{eval_timeout, IdContext};
 use crate::worker_utils::get_tag_and_concurrency;
 use crate::{
-    JobCompletedSender, PreviousResult, SameWorkerSender, SendResultPayload, UpdateFlow,
-    KEEP_JOB_DIR,
+    JobCompletedSender, PreviousResult, SameWorkerSender, SendResultPayload, StepFailureKind,
+    UpdateFlow, KEEP_JOB_DIR,
 };
 
 use anyhow::Context;
@@ -51,7 +51,6 @@ use windmill_common::runnable_settings::{
     ConcurrencySettingsWithCustom, DebouncingSettings, RunnableSettingsTrait,
 };
 use windmill_common::scripts::{ScriptHash, ScriptRunnableSettingsInline};
-use windmill_common::users::username_to_permissioned_as;
 use windmill_common::utils::WarnAfterExt;
 use windmill_common::worker::{error_to_value, to_raw_value, Connection};
 use windmill_common::{
@@ -170,7 +169,7 @@ pub async fn update_flow_status_after_job_completion(
     canceled_by: Option<CanceledBy>,
     result: Arc<Box<RawValue>>,
     flow_job_duration: Option<FlowJobDuration>,
-    unrecoverable: bool,
+    step_failure: StepFailureKind,
     same_worker_tx: &SameWorkerSender,
     worker_dir: &str,
     stop_early_override: Option<bool>,
@@ -193,7 +192,7 @@ pub async fn update_flow_status_after_job_completion(
         stop_early_override,
         has_triggered_error_handler: false,
     };
-    let mut unrecoverable = unrecoverable;
+    let mut step_failure = step_failure;
     loop {
         potentially_crash_for_testing();
         let nrec = match Box::pin(update_flow_status_after_job_completion_internal(
@@ -206,7 +205,7 @@ pub async fn update_flow_status_after_job_completion(
             rec.canceled_by,
             rec.flow_job_duration.clone(),
             rec.result,
-            unrecoverable,
+            step_failure,
             same_worker_tx,
             worker_dir,
             rec.stop_early_override,
@@ -235,7 +234,7 @@ pub async fn update_flow_status_after_job_completion(
                     Arc::new(to_raw_value(&Json(&WrappedError {
                         error: json!(e.to_string()),
                     }))),
-                    true,
+                    StepFailureKind::Unrecoverable,
                     same_worker_tx,
                     worker_dir,
                     rec.stop_early_override,
@@ -250,7 +249,7 @@ pub async fn update_flow_status_after_job_completion(
                 .await?
             }
         };
-        unrecoverable = false;
+        step_failure = StepFailureKind::Normal;
 
         match nrec {
             UpdateFlowStatusAfterJobCompletion::Done(job) => {
@@ -422,7 +421,7 @@ pub async fn update_flow_status_after_job_completion_internal(
     canceled_by: Option<CanceledBy>,
     mut flow_job_duration: Option<FlowJobDuration>,
     result: Arc<Box<RawValue>>,
-    unrecoverable: bool,
+    step_failure: StepFailureKind,
     same_worker_tx: &SameWorkerSender,
     worker_dir: &str,
     stop_early_override: Option<bool>,
@@ -1299,11 +1298,11 @@ pub async fn update_flow_status_after_job_completion_internal(
                         }),
                     )
                 } else {
-                    // An unrecoverable failure (worker crash/OOM) must reach the error handler
-                    // even on a continue_on_error step, so don't advance the step counter past
-                    // the failed module — otherwise the flow would silently continue to the next
-                    // step and hide the worker death.
-                    let inc = if !unrecoverable && continue_on_error {
+                    // A failure the module's error policy does not describe must reach the error
+                    // handler even on a continue_on_error step, so don't advance the step
+                    // counter past the failed module — otherwise the flow would silently
+                    // continue to the next step and hide it.
+                    let inc = if step_failure.honors_step_error_policy() && continue_on_error {
                         let retry = current_module
                             .as_ref()
                             .and_then(|x| x.retry.clone())
@@ -1742,19 +1741,20 @@ pub async fn update_flow_status_after_job_completion_internal(
         // enclosing job/subflow. Detect that case and treat the flow as successful.
         let recoverable_failure_at_last_step = !success
             && is_last_step
-            && !unrecoverable
+            && step_failure.honors_step_error_policy()
             && (skip_seq_branch_failure || skip_loop_failures || continue_on_error);
 
         let should_continue_flow = match success {
             _ if stop_early => stop_early_err_msg.is_some() && flow_value.failure_module.is_some(), // if stop_early_err_msg some, we want to trigger the error handler before stopping the flow, if any
             _ if flow_job.is_canceled() => false,
             true => !is_last_step,
-            // An unrecoverable failure (a step killed by a worker crash/OOM and surfaced by
-            // the zombie handler, or an error raised while updating the flow status itself)
-            // must not be retried or silently skipped, but it should still trigger the flow's
-            // error handler: an OOM/worker death is precisely when the error handler is expected
-            // to run. Continue the flow only to reach the failure module, never to retry.
-            false if unrecoverable => {
+            // A failure the module's error policy does not describe (a worker crash/OOM
+            // surfaced by the zombie handler, an error raised while updating the flow status,
+            // a suspend gate that ended without approval) must not be retried or silently
+            // skipped, but it should still trigger the flow's error handler — that is
+            // precisely when the error handler is expected to run. Continue the flow only to
+            // reach the failure module, never to retry.
+            false if !step_failure.honors_step_error_policy() => {
                 !is_failure_step
                     && !has_triggered_error_handler
                     && flow_value.failure_module.is_some()
@@ -1777,7 +1777,7 @@ pub async fn update_flow_status_after_job_completion_internal(
             success = true;
         }
 
-        tracing::info!(id = %flow_job.id, root_id = %job_root, success = %success, stop_early = %stop_early, is_last_step = %is_last_step, unrecoverable = %unrecoverable,
+        tracing::info!(id = %flow_job.id, root_id = %job_root, success = %success, stop_early = %stop_early, is_last_step = %is_last_step, step_failure = ?step_failure,
              skip_seq_branch_failure = %skip_seq_branch_failure, skip_loop_failures = %skip_loop_failures,
              current_module_id = %current_module.map(|x| x.id.clone()).unwrap_or_default(),
             continue_on_error = %continue_on_error, should_continue_flow = %should_continue_flow, "computed if flow should continue");
@@ -2109,7 +2109,7 @@ pub async fn update_flow_status_after_job_completion_internal(
             worker_name,
             flow_runners,
             &killpill_rx,
-            unrecoverable,
+            step_failure,
         ))
         .warn_after_seconds(10)
         .await
@@ -2800,10 +2800,9 @@ pub async fn handle_flow(
     worker_name: &str,
     flow_runners: Option<Arc<FlowRunners>>,
     killpill_rx: &tokio::sync::broadcast::Receiver<()>,
-    // The previous step failed unrecoverably (e.g. a worker crash/OOM surfaced by the
-    // zombie handler). The next pushed step can only be the error handler (failure
-    // module), and it must not be pinned to the dead worker via same_worker.
-    unrecoverable: bool,
+    // How the step this flow is resuming from failed, which bounds what may be pushed next:
+    // see [`StepFailureKind`].
+    step_failure: StepFailureKind,
 ) -> anyhow::Result<()> {
     let flow = flow_data.value();
 
@@ -2985,7 +2984,7 @@ pub async fn handle_flow(
             flow_runners.clone(),
             job_completed_tx.clone(),
             &killpill_rx,
-            unrecoverable,
+            step_failure,
         ))
         .warn_after_seconds(10)
         .await?;
@@ -3168,10 +3167,9 @@ async fn push_next_flow_job(
     flow_runners: Option<Arc<FlowRunners>>,
     job_completed_tx: JobCompletedSender,
     killpill_rx: &tokio::sync::broadcast::Receiver<()>,
-    // The prior step failed unrecoverably (worker crash/OOM). The only step pushed
-    // from here is the error handler, which must run on a live worker rather than
-    // being pinned to the dead one via same_worker / dedicated runners.
-    unrecoverable: bool,
+    // How the prior step failed, which bounds what may be pushed next: see
+    // [`StepFailureKind`].
+    step_failure: StepFailureKind,
 ) -> error::Result<PushNextFlowJob> {
     let job_root = flow_job
         .flow_innermost_root_job
@@ -3232,6 +3230,7 @@ async fn push_next_flow_job(
             w_id: flow_job.workspace_id.clone(),
             worker_dir: worker_dir.to_string(),
             token: client.token.clone(),
+            step_failure,
         })));
     }
 
@@ -3286,6 +3285,7 @@ async fn push_next_flow_job(
                             w_id: flow_job.workspace_id.clone(),
                             worker_dir: worker_dir.to_string(),
                             token: client.token.clone(),
+                            step_failure,
                         }
                     )));
                 }
@@ -3330,6 +3330,7 @@ async fn push_next_flow_job(
                     w_id: flow_job.workspace_id.clone(),
                     worker_dir: worker_dir.to_string(),
                     token: client.token.clone(),
+                    step_failure,
                 })));
             }
         }
@@ -3662,6 +3663,7 @@ async fn push_next_flow_job(
                     w_id: flow_job.workspace_id.clone(),
                     worker_dir: worker_dir.to_string(),
                     token: client.token.clone(),
+                    step_failure: StepFailureKind::SuspendNotApproved,
                 })));
             }
         }
@@ -3731,10 +3733,11 @@ async fn push_next_flow_job(
         }
     };
 
-    // An unrecoverable failure (worker crash/OOM) must not be retried — the original worker
-    // and its state are gone — so skip retry evaluation and fall straight through to the
-    // failure module below.
-    let retry = if !unrecoverable && matches!(&status_module, FlowStatusModule::Failure { .. },) {
+    // Retry is a policy on the step's own execution: skip it for a failure the step did not
+    // produce by running, and fall straight through to the failure module below.
+    let retry = if step_failure.honors_step_error_policy()
+        && matches!(&status_module, FlowStatusModule::Failure { .. },)
+    {
         let retry = &module.retry.clone().unwrap_or_default();
         evaluate_retry(
             retry,
@@ -3749,13 +3752,13 @@ async fn push_next_flow_job(
         None
     };
     let get_args_from_id = match &status_module {
-        // `|| unrecoverable`: a worker crash/OOM routes to the failure module even on a
-        // continue_on_error step (whose failures are normally tolerated), matching the
-        // `unrecoverable` decision in update_flow_status_after_job_completion_internal.
+        // `|| !honors_step_error_policy()`: such a failure routes to the failure module even
+        // on a continue_on_error step (whose failures are normally tolerated), matching the
+        // decision in update_flow_status_after_job_completion_internal.
         FlowStatusModule::Failure { job, .. }
             if retry.as_ref().is_some()
                 || !module.continue_on_error.is_some_and(|x| x)
-                || unrecoverable =>
+                || !step_failure.honors_step_error_policy() =>
         {
             if let Some((fail_count, retry_in)) = retry {
                 tracing::debug!(
@@ -4076,7 +4079,7 @@ async fn push_next_flow_job(
                 None,
                 result,
                 None,
-                false,
+                StepFailureKind::Normal,
                 same_worker_tx,
                 worker_dir,
                 None,
@@ -4104,7 +4107,7 @@ async fn push_next_flow_job(
             .as_ref()
             .is_some_and(|fr| fr.job_id == flow_job.id);
 
-    let continue_with_runners = !unrecoverable
+    let continue_with_runners = step_failure.keeps_worker_pin()
         && (start_runners || (flow_runners.is_some() && !do_not_pass_runners))
         && module.suspend.is_none()
         && module.sleep.is_none();
@@ -4114,10 +4117,10 @@ async fn push_next_flow_job(
     let job_same_worker = flow_job.same_worker
         && matches!(flow_job.kind, JobKind::Flow)
         && flow_job.runnable_id.is_some();
-    // After an unrecoverable failure the original worker is gone, so the error handler
-    // step is pushed as a regular queued job (any live worker can pick it up) instead of
-    // being signaled to the dead worker via same_worker — which would strand it forever.
-    let continue_on_same_worker = !unrecoverable
+    // Without a worker worth pinning to, the error handler step is pushed as a regular queued
+    // job (any live worker can pick it up) instead of being signaled via same_worker to a
+    // worker that may be dead — which would strand it forever.
+    let continue_on_same_worker = step_failure.keeps_worker_pin()
         && (flow.same_worker || job_same_worker)
         && module.suspend.is_none()
         && module.sleep.is_none();
@@ -4344,10 +4347,17 @@ async fn push_next_flow_job(
         let flow_root_job = get_root_job_id(&flow_job);
 
         // forward root job permissions to the new job
-        let job_perms: Option<Authed> =
-            get_job_perms(&mut *tx, &flow_root_job, &flow_job.workspace_id)
-                .await?
-                .map(|x| x.into());
+        let root_job_perms =
+            get_job_perms(&mut *tx, &flow_root_job, &flow_job.workspace_id).await?;
+        // The end user is a property of whoever triggered the root run, so every step (and
+        // transitively every subflow's step) must see the same WM_END_USER_EMAIL as the run.
+        // It is read from the root's `job_perms` rather than off `flow_job`: only a freshly
+        // pulled job carries `permissioned_as_end_user_email`, and every step past the first
+        // is pushed from a flow job re-fetched by `get_mini_pulled_job`, which does not.
+        let end_user_email = root_job_perms
+            .as_ref()
+            .and_then(|x| x.end_user_email.clone());
+        let job_perms: Option<Authed> = root_job_perms.map(|x| x.into());
 
         tracing::debug!(id = %flow_job.id, root_id = %job_root, "computed perms for job {i} of {len}");
         let tag = resolve_flow_step_tag(
@@ -4425,6 +4435,7 @@ async fn push_next_flow_job(
                 "job-span-{}",
                 flow_job.flow_innermost_root_job.unwrap_or(flow_job.id)
             )),
+            None,
             scheduled_for_o,
             flow_job.schedule_path(),
             Some(flow_job.id),
@@ -4441,7 +4452,7 @@ async fn push_next_flow_job(
             new_job_priority_override,
             job_perms.as_ref(),
             continue_with_runners,
-            None,
+            end_user_email,
             None,
             None,
         )
@@ -6035,13 +6046,9 @@ async fn flow_to_payload(
     w_id: &str,
     db: &DB,
 ) -> Result<JobPayloadWithTag, Error> {
-    let FlowVersionInfo { version, on_behalf_of_email, edited_by, tag, .. } =
-        get_latest_flow_version_info_for_path(None, &db, w_id, &path, true).await?;
-    let on_behalf_of = if let Some(email) = on_behalf_of_email {
-        Some(OnBehalfOf { email, permissioned_as: username_to_permissioned_as(&edited_by) })
-    } else {
-        None
-    };
+    let flow_info = get_latest_flow_version_info_for_path(None, &db, w_id, &path, true).await?;
+    let on_behalf_of = flow_info.on_behalf_of(w_id, &db).await?;
+    let FlowVersionInfo { version, tag, .. } = flow_info;
     let payload = JobPayload::Flow {
         path,
         dedicated_worker: None,
@@ -6107,6 +6114,13 @@ pub async fn script_to_payload(
         } else {
             let hash = script_hash.unwrap();
 
+            let script_info = get_script_info_for_hash(None, db, &flow_job.workspace_id, hash.0)
+                .await?
+                .prefetch_cached(&db)
+                .await?;
+            let on_behalf_of = script_info
+                .on_behalf_of(&flow_job.workspace_id, db)
+                .await?;
             let ScriptHashInfo {
                 tag,
                 cache_ttl,
@@ -6116,24 +6130,10 @@ pub async fn script_to_payload(
                 delete_after_use,
                 delete_after_secs,
                 timeout,
-                on_behalf_of_email,
-                created_by,
                 runnable_settings:
                     ScriptRunnableSettingsInline { concurrency_settings, debouncing_settings },
                 ..
-            } = get_script_info_for_hash(None, db, &flow_job.workspace_id, hash.0)
-                .await?
-                .prefetch_cached(&db)
-                .await?;
-
-            let on_behalf_of = if let Some(email) = on_behalf_of_email {
-                Some(OnBehalfOf {
-                    email,
-                    permissioned_as: username_to_permissioned_as(&created_by),
-                })
-            } else {
-                None
-            };
+            } = script_info;
             (
                 JobPayload::ScriptHash {
                     hash,
diff --git a/backend/windmill-worker/src/worker_lockfiles.rs b/backend/windmill-worker/src/worker_lockfiles.rs
index 6c6f8ffd77..f7e0be6b99 100644
--- a/backend/windmill-worker/src/worker_lockfiles.rs
+++ b/backend/windmill-worker/src/worker_lockfiles.rs
@@ -169,6 +169,7 @@ pub async fn handle_dependency_job(
         base_internal_url,
         token,
         script_path,
+        script_data.modules.as_ref(),
         occupancy_metrics,
         &raw_workspace_dependencies_o,
         None,
@@ -195,52 +196,63 @@ pub async fn handle_dependency_job(
             let (deployment_message, parent_path) =
                 get_deployment_msg_and_parent_path_from_args(job.args.clone());
 
-            // Generate lockfiles for module files (if any)
-            let updated_modules = if let Some(modules) = &script_data.modules {
-                let mut updated = modules.clone();
-                for (module_path, module) in updated.iter_mut() {
-                    if module.content.is_empty() {
-                        continue;
-                    }
-                    match capture_dependency_job(
-                        &job.id,
-                        &module.language,
-                        &module.content,
-                        mem_peak,
-                        canceled_by,
-                        job_dir,
-                        db,
-                        worker_name,
-                        &job.workspace_id,
-                        worker_dir,
-                        base_internal_url,
-                        token,
-                        script_path,
-                        occupancy_metrics,
-                        &raw_workspace_dependencies_o,
-                        module.lock.as_deref(),
-                        triggered_by_relative_import,
-                        script_path,
-                        None,
-                        "script",
-                        &None,
-                    )
-                    .await
-                    {
-                        Ok(lock) => {
-                            module.lock = Some(lock);
+            // Generate lockfiles for module files (if any).
+            //
+            // Not for dbt: a dbt script's modules are its dbt project, not
+            // helper code with dependencies of its own. The parent lock above
+            // already ran `dbt deps` and `dbt parse` over the whole project,
+            // which is the one dependency pass it has. Locking each file
+            // separately would re-materialise the bundle and re-invoke dbt once
+            // per file, so a project of N files pays N project-sized passes and
+            // a large one times the deploy out.
+            let per_module_locks = job.script_lang != Some(ScriptLang::Dbt);
+            let updated_modules =
+                if let Some(modules) = script_data.modules.as_ref().filter(|_| per_module_locks) {
+                    let mut updated = modules.clone();
+                    for (module_path, module) in updated.iter_mut() {
+                        if module.content.is_empty() {
+                            continue;
                         }
-                        Err(e) => {
-                            tracing::warn!(
-                                "Failed to generate lockfile for module {module_path}: {e}"
-                            );
+                        match capture_dependency_job(
+                            &job.id,
+                            &module.language,
+                            &module.content,
+                            mem_peak,
+                            canceled_by,
+                            job_dir,
+                            db,
+                            worker_name,
+                            &job.workspace_id,
+                            worker_dir,
+                            base_internal_url,
+                            token,
+                            script_path,
+                            script_data.modules.as_ref(),
+                            occupancy_metrics,
+                            &raw_workspace_dependencies_o,
+                            module.lock.as_deref(),
+                            triggered_by_relative_import,
+                            script_path,
+                            None,
+                            "script",
+                            &None,
+                        )
+                        .await
+                        {
+                            Ok(lock) => {
+                                module.lock = Some(lock);
+                            }
+                            Err(e) => {
+                                tracing::warn!(
+                                    "Failed to generate lockfile for module {module_path}: {e}"
+                                );
+                            }
                         }
                     }
-                }
-                Some(updated)
-            } else {
-                None
-            };
+                    Some(updated)
+                } else {
+                    None
+                };
 
             // We do not create new row for this update
             // That means we can keep current hash and just update lock
@@ -283,7 +295,9 @@ pub async fn handle_dependency_job(
                 },
                 deployment_message.clone(),
                 false,
-                None,
+                // As the flow and app dependency handlers do — it names the rename
+                // in the git-sync commit. The tally ignores it off a request task.
+                parent_path.as_deref(),
             )
             .await
             {
@@ -885,9 +899,7 @@ pub(crate) async fn tally_unfinished_dependency_deploy(
         return;
     };
     let (_, parent_path) = get_deployment_msg_and_parent_path_from_args(job.args.clone());
-    // `parent_path` is the previous path, set whether or not the deploy renamed the
-    // item. Only an actual rename is a second (now removed) path to tally.
-    let renamed_from = parent_path.clone().filter(|p| *p != path);
+    let renamed_from = parent_path.clone();
 
     let obj = match job.kind {
         JobKind::Dependencies => {
@@ -920,7 +932,8 @@ pub(crate) async fn tally_unfinished_dependency_deploy(
     };
 
     if let Err(e) =
-        tally_deployed_object_changes(&job.workspace_id, &obj, db, renamed_from.as_deref()).await
+        tally_deployed_object_changes(&job.workspace_id, &obj, db, renamed_from.as_deref(), None)
+            .await
     {
         tracing::error!(%e, "error tallying fork changes for unfinished dependency job {}", job.id);
     }
@@ -1438,6 +1451,8 @@ async fn lock_modules(
                 "{}/flow",
                 &path.clone().unwrap_or_else(|| job_path.to_string())
             ),
+            // An inline flow step has no module bundle of its own.
+            None,
             occupancy_metrics,
             raw_workspace_dependencies_o,
             lock.as_deref(),
@@ -1957,6 +1972,7 @@ async fn lock_modules_app(
                                 base_internal_url,
                                 token,
                                 &format!("{}/app", job.runnable_path()),
+                                None,
                                 occupancy_metrics,
                                 &None,
                                 existing_lock,
@@ -2697,6 +2713,9 @@ async fn capture_dependency_job(
     base_internal_url: &str,
     token: &str,
     script_path: &str,
+    // A dbt script's project rides in its modules; the dbt dependency job
+    // materialises them itself, having no generic module-writing step.
+    modules: Option<&std::collections::HashMap<String, windmill_common::scripts::ScriptModule>>,
     occupancy_metrics: &mut OccupancyMetrics,
     raw_workspace_dependencies_o: &Option<RawWorkspaceDependencies>,
     existing_lock: Option<&str>,
@@ -2843,6 +2862,24 @@ async fn capture_dependency_job(
                 .await?
             }
         }
+        ScriptLang::Dbt => {
+            crate::dbt_executor::dbt_dep(
+                job_raw_code,
+                modules,
+                job_id,
+                mem_peak,
+                canceled_by,
+                job_dir,
+                db,
+                worker_name,
+                w_id,
+                script_path,
+                occupancy_metrics,
+                token,
+                base_internal_url,
+            )
+            .await?
+        }
         ScriptLang::Go => {
             install_go_dependencies(
                 job_id,
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index 57c877b441..f4b3d6b689 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.775.2";
+export const VERSION = "v1.783.0";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/.gitignore b/cli/.gitignore
index e6c9bd2655..91d60ec213 100644
--- a/cli/.gitignore
+++ b/cli/.gitignore
@@ -1,4 +1,8 @@
 npm/
 gen/
 node_modules/
-windmill-utils-internal/.npmrc
\ No newline at end of file
+windmill-utils-internal/.npmrc
+
+# bun.lock is the CLI's lockfile: every install path here (CI, build.sh, install_dev.sh)
+# runs `bun install`. A committed npm lockfile is read by nothing and goes stale unnoticed.
+package-lock.json
diff --git a/cli/bun.lock b/cli/bun.lock
index f43fa66869..998724a4b6 100644
--- a/cli/bun.lock
+++ b/cli/bun.lock
@@ -32,7 +32,8 @@
         "windmill-parser-wasm-ruby": "1.526.1",
         "windmill-parser-wasm-rust": "1.647.1",
         "windmill-parser-wasm-ts": "1.695.0",
-        "windmill-parser-wasm-yaml": "1.593.0",
+        "windmill-parser-wasm-yaml": "1.770.0",
+        "windmill-yaml-validator": "1.1.1",
         "ws": "8.18.0",
         "yaml": "^2.7.0",
       },
@@ -148,6 +149,14 @@
 
     "@jsr/std__text": ["@jsr/std__text@1.0.17", "https://npm.jsr.io/~/11/@jsr/std__text/1.0.17.tgz", { "dependencies": { "@jsr/std__regexp": "^1.0.1" } }, "sha512-oZsihl1bcTy1Ixzven8rin8kjChj1zDJWqgpS0oSMGCJDzyB365gtIfAvcMmji+M+FcIWo3goDXfHcFYt+k/kg=="],
 
+    "@stoplight/ordered-object-literal": ["@stoplight/ordered-object-literal@1.0.5", "", {}, "sha512-COTiuCU5bgMUtbIFBuyyh2/yVVzlr5Om0v5utQDgBCuQUOPgU1DwoffkTfg4UBQOvByi5foF4w4T+H9CoRe5wg=="],
+
+    "@stoplight/types": ["@stoplight/types@14.1.1", "", { "dependencies": { "@types/json-schema": "^7.0.4", "utility-types": "^3.10.0" } }, "sha512-/kjtr+0t0tjKr+heVfviO9FrU/uGLc+QNX3fHJc19xsCNYqU7lVhaXxDmEID9BZTjG+/r9pK9xP/xU02XGg65g=="],
+
+    "@stoplight/yaml": ["@stoplight/yaml@4.3.0", "", { "dependencies": { "@stoplight/ordered-object-literal": "^1.0.5", "@stoplight/types": "^14.1.1", "@stoplight/yaml-ast-parser": "0.0.50", "tslib": "^2.2.0" } }, "sha512-JZlVFE6/dYpP9tQmV0/ADfn32L9uFarHWxfcRhReKUnljz1ZiUM5zpX+PH8h5CJs6lao3TuFqnPm9IJJCEkE2w=="],
+
+    "@stoplight/yaml-ast-parser": ["@stoplight/yaml-ast-parser@0.0.50", "", {}, "sha512-Pb6M8TDO9DtSVla9yXSTAxmo9GVEouq5P40DWXdOie69bXogZTkgvopCq+yEvTMA0F6PEvdJmbtTV3ccIp11VQ=="],
+
     "@sveltejs/acorn-typescript": ["@sveltejs/acorn-typescript@1.0.11", "", { "peerDependencies": { "acorn": "^8.9.0" } }, "sha512-LFuZUkjJ9iF7JZye/aG5XM0SFcQ5VyL0oVX4WJ9dc0Va3R3s0OauX1BESVCb+YN/ol8TAfqGDDAQsTG627Y5kw=="],
 
     "@types/bun": ["@types/bun@1.3.9", "", { "dependencies": { "bun-types": "1.3.9" } }, "sha512-KQ571yULOdWJiMH+RIWIOZ7B2RXQGpL1YQrBtLIV3FqDcCu6FsbFUBwhdKUlCKUpS3PJDsHlJ1QKlpxoVR+xtw=="],
@@ -156,6 +165,8 @@
 
     "@types/estree": ["@types/estree@1.0.8", "", {}, "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w=="],
 
+    "@types/json-schema": ["@types/json-schema@7.0.15", "", {}, "sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA=="],
+
     "@types/node": ["@types/node@22.19.11", "", { "dependencies": { "undici-types": "~6.21.0" } }, "sha512-BH7YwL6rA93ReqeQS1c4bsPpcfOmJasG+Fkr6Y59q83f9M1WcBRHR2vM+P9eOisYRcN3ujQoiZY8uk5W+1WL8w=="],
 
     "@types/tar-stream": ["@types/tar-stream@3.1.4", "", { "dependencies": { "@types/node": "*" } }, "sha512-921gW0+g29mCJX0fRvqeHzBlE/XclDaAG0Ousy1LCghsOhvaKacDeRGEVzQP9IPfKn8Vysy7FEXAIxycpc/CMg=="],
@@ -270,12 +281,16 @@
 
     "text-decoder": ["text-decoder@1.2.7", "", { "dependencies": { "b4a": "^1.6.4" } }, "sha512-vlLytXkeP4xvEq2otHeJfSQIRyWxo/oZGEbXrtEEF9Hnmrdly59sUbzZ/QgyWuLYHctCHxFF4tRQZNQ9k60ExQ=="],
 
+    "tslib": ["tslib@2.8.1", "", {}, "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w=="],
+
     "typescript": ["typescript@5.9.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw=="],
 
     "undici-types": ["undici-types@6.21.0", "", {}, "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ=="],
 
     "util-deprecate": ["util-deprecate@1.0.2", "", {}, "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw=="],
 
+    "utility-types": ["utility-types@3.11.0", "", {}, "sha512-6Z7Ma2aVEWisaL6TvBCy7P8rm2LQoPv6dJ7ecIaIixHcwfbJ0x7mWdbcwlIM5IGQxPZSFYeqRCqlOOeKoJYMkw=="],
+
     "windmill-parser-wasm-asset": ["windmill-parser-wasm-asset@1.753.0", "", {}, "sha512-zpJhjvcU8EWRoOJzas/nRGKjGdQnvzeB9GOxP+Mdmnk8BFk3uehsmHS2Krxyjo36fUrCHqobbnffEqf0g3LIGg=="],
 
     "windmill-parser-wasm-csharp": ["windmill-parser-wasm-csharp@1.510.1", "", {}, "sha512-qm09YmnbeYHLwYn1jUnObVzPhYO9NZKMlIO7nlo7zPJBXqksgG5fK/KCtwGw9rChrnz+DsvM9wP5FhrwRLMtwQ=="],
@@ -302,7 +317,9 @@
 
     "windmill-parser-wasm-ts": ["windmill-parser-wasm-ts@1.695.0", "", {}, "sha512-9EFxeRZWmfb7EyhSlcG7dzTTKETPRYAvpRlxxLkhhtI5I219wFgI7kwrMpz4stXHJj/aqBknVv66NQHRstSJmw=="],
 
-    "windmill-parser-wasm-yaml": ["windmill-parser-wasm-yaml@1.593.0", "", {}, "sha512-Gyx4aR2jsJYuDrD3mCNTmz7LWOQQXPw5yKNCC1xRgUOPfjsD/tINAFfsBLwVOSmlQQcFZO+wHm4KtDtXOcnGVw=="],
+    "windmill-parser-wasm-yaml": ["windmill-parser-wasm-yaml@1.770.0", "", {}, "sha512-RngxbcKYYFt3MHYqdYTzbtH6EMPfqJtY4/mqRqfLUie4cE9mmOBa9X9M3VEFVo53CD1dCRa9wJKZmeJzE5We5Q=="],
+
+    "windmill-yaml-validator": ["windmill-yaml-validator@1.1.1", "", { "dependencies": { "@stoplight/yaml": "^4.3.0", "ajv": "^8.17.1" } }, "sha512-CVgAwEoBdJhF39q2N012QffhlGPRIyIWd8gj7NnfG+/lMWgH2k5CBLtKIt6cPF8Bxz+6DGC3st1ARSsecDtbTg=="],
 
     "ws": ["ws@8.18.0", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-8VbfWfHLbbwu3+N6OKsOMpBdT4kXPDDB9cJk2bJ6mh9ucxdlnNvH1e+roYkKmN9Nxw2yjz7VzeO9oOz2zJ04Pw=="],
 
diff --git a/cli/generate-dev-recorder.ts b/cli/generate-dev-recorder.ts
new file mode 100644
index 0000000000..372da5b699
--- /dev/null
+++ b/cli/generate-dev-recorder.ts
@@ -0,0 +1,137 @@
+/**
+ * Bundles the frontend's raw-app session recorder into a browser script the dev
+ * server can serve, and writes it as a string constant the CLI bundle carries.
+ *
+ * The recorder is not re-implemented here: `wmill app dev --recording` must
+ * produce the exact recording format the players read, and the event
+ * classification it encodes is the hard part. The one adaptation is the `$state`
+ * rune: outside Svelte the store's fields are read through its getters, so the
+ * rune is stripped and the values become plain `let`s.
+ *
+ * Run `bun run gen:dev-recorder` after touching anything under
+ * frontend/src/lib/components/recording/; test/dev_recorder_bundle_unit.test.ts
+ * fails when the committed bundle no longer matches those sources.
+ */
+import * as esbuild from "esbuild";
+import { createHash } from "node:crypto";
+import { readFileSync, writeFileSync } from "node:fs";
+import { join, relative } from "node:path";
+
+const REPO_ROOT = join(import.meta.dir, "..");
+const RECORDING_DIR = join(
+  REPO_ROOT,
+  "frontend",
+  "src",
+  "lib",
+  "components",
+  "recording",
+);
+const ENTRY = "./rawAppRecording.svelte";
+const OUT_FILE = join(
+  import.meta.dir,
+  "src",
+  "commands",
+  "app",
+  "devRecorderBundle.gen.ts",
+);
+
+/** Hash of everything that went into the bundle. Over the modules esbuild
+ * actually pulled in rather than a hand-kept list, so a module added to the
+ * recorder's import graph can't slip past the staleness check. Line endings are
+ * normalized: a CRLF checkout is the same source, and must not read as drift. */
+export function hashRecorderSources(
+  sources: string[],
+  root: string = REPO_ROOT,
+): string {
+  const hash = createHash("sha256");
+  for (const file of sources) {
+    hash.update(file);
+    hash.update(
+      readFileSync(join(root, file), "utf-8").replace(/\r\n/g, "\n"),
+    );
+  }
+  return hash.digest("hex");
+}
+
+/** Reactivity has no meaning in a plain browser script, and the store exposes
+ * every rune-backed field through a getter, so `$state(x)` collapses to `x`.
+ * Every other rune is compiled away by Svelte and would survive here as an
+ * undefined identifier, so refuse rather than emit a bundle that throws. */
+function stripRunes(source: string, file: string): string {
+  const unsupported = [
+    ...(source.match(/\$state[\w.]*\s*\(?/g) ?? []).filter(
+      (r) => r.replace(/\s/g, "") !== "$state(",
+    ),
+    ...(source.match(
+      /\$(derived|effect|props|bindable|inspect|host)[\w.]*/g,
+    ) ?? []),
+  ];
+  if (unsupported.length > 0) {
+    throw new Error(
+      `${file} uses ${
+        [...new Set(unsupported)].join(", ")
+      }, which this generator cannot strip. ` +
+        `Keep the recorder store free of runes beyond \`$state(...)\`.`,
+    );
+  }
+  return source.replace(/\$state\s*\(/g, "(");
+}
+
+const runeStripper: esbuild.Plugin = {
+  name: "strip-svelte-runes",
+  setup(build) {
+    build.onLoad({ filter: /\.svelte\.ts$/ }, (args) => ({
+      contents: stripRunes(readFileSync(args.path, "utf-8"), args.path),
+      loader: "ts",
+    }));
+  },
+};
+
+if (import.meta.main) {
+  const result = await esbuild.build({
+    stdin: {
+      contents: `export { createRawAppRecording } from '${ENTRY}'`,
+      resolveDir: RECORDING_DIR,
+      loader: "ts",
+    },
+    plugins: [runeStripper],
+    bundle: true,
+    format: "iife",
+    globalName: "__wmillRecorder",
+    target: "es2020",
+    minify: true,
+    metafile: true,
+    write: false,
+    legalComments: "none",
+  });
+
+  const js = result.outputFiles[0].text;
+  // Repo-relative and sorted, so the hash does not move with the checkout path
+  // or with esbuild's traversal order. `<stdin>` is the entry above, not a file.
+  const sources = Object.keys(result.metafile.inputs)
+    .filter((f) => f !== "<stdin>")
+    .map((f) => relative(REPO_ROOT, join(import.meta.dir, f)))
+    .sort();
+  writeFileSync(
+    OUT_FILE,
+    `// Generated by cli/generate-dev-recorder.ts. Do not edit.\n` +
+      `// Run \`bun run gen:dev-recorder\` from cli/ to rebuild it from\n` +
+      `// frontend/src/lib/components/recording/.\n\n` +
+      `/** Repo-relative sources bundled below. */\n` +
+      `export const DEV_RECORDER_SOURCES = ${
+        JSON.stringify(sources, null, 2)
+      };\n\n` +
+      `/** SHA-256 of those sources, as of this build. */\n` +
+      `export const DEV_RECORDER_SOURCE_HASH = ${
+        JSON.stringify(hashRecorderSources(sources))
+      };\n\n` +
+      `/** IIFE exposing \`createRawAppRecording\` on \`window.__wmillRecorder\`. */\n` +
+      `export const DEV_RECORDER_BUNDLE = ${JSON.stringify(js)};\n`,
+    "utf-8",
+  );
+  console.log(
+    `Wrote ${OUT_FILE} (${
+      Math.round(js.length / 1024)
+    } KB of bundled JS from ${sources.length} sources)`,
+  );
+}
diff --git a/cli/package-lock.json b/cli/package-lock.json
deleted file mode 100644
index 3a9b04c8a2..0000000000
--- a/cli/package-lock.json
+++ /dev/null
@@ -1,1492 +0,0 @@
-{
-  "name": "wmill-dev",
-  "lockfileVersion": 3,
-  "requires": true,
-  "packages": {
-    "": {
-      "name": "wmill-dev",
-      "hasInstallScript": true,
-      "dependencies": {
-        "@cliffy/ansi": "npm:@jsr/cliffy__ansi@1.0.0",
-        "@cliffy/command": "npm:@jsr/cliffy__command@1.0.0",
-        "@cliffy/prompt": "npm:@jsr/cliffy__prompt@1.0.0",
-        "@cliffy/table": "npm:@jsr/cliffy__table@1.0.0",
-        "@windmill-labs/shared-utils": "^1.0.12",
-        "diff": "^5.2.0",
-        "esbuild": "0.28.0",
-        "get-port": "7.1.0",
-        "jszip": "3.8.0",
-        "minimatch": "^10.0.0",
-        "open": "^10.0.0",
-        "pg-gateway": "0.3.0-beta.4",
-        "svelte": "^5.56.8",
-        "tar-stream": "^3.1.7",
-        "windmill-parser-wasm-asset": "1.753.0",
-        "windmill-parser-wasm-csharp": "1.510.1",
-        "windmill-parser-wasm-go": "1.761.0",
-        "windmill-parser-wasm-java": "1.510.1",
-        "windmill-parser-wasm-nu": "1.510.1",
-        "windmill-parser-wasm-php": "1.647.1",
-        "windmill-parser-wasm-py": "1.693.1",
-        "windmill-parser-wasm-py-imports": "1.693.1",
-        "windmill-parser-wasm-r": "1.668.1",
-        "windmill-parser-wasm-regex": "1.764.0",
-        "windmill-parser-wasm-ruby": "1.526.1",
-        "windmill-parser-wasm-rust": "1.647.1",
-        "windmill-parser-wasm-ts": "1.695.0",
-        "windmill-parser-wasm-yaml": "1.593.0",
-        "ws": "8.18.0",
-        "yaml": "^2.7.0"
-      },
-      "bin": {
-        "wmill": "src/main.ts"
-      },
-      "devDependencies": {
-        "@types/bun": "^1.3.9",
-        "@types/diff": "^5.2.3",
-        "@types/node": "^22.0.0",
-        "@types/tar-stream": "^3.1.4",
-        "@types/ws": "^8.5.0",
-        "ajv": "^8.17.1",
-        "typescript": "^5.7.0"
-      }
-    },
-    "node_modules/@cliffy/ansi": {
-      "name": "@jsr/cliffy__ansi",
-      "version": "1.0.0",
-      "resolved": "https://npm.jsr.io/~/11/@jsr/cliffy__ansi/1.0.0.tgz",
-      "integrity": "sha512-JesgTdgR0aW1mZv96VqvRHr2efzr4MgDFMnoT+hkhaiCpmyBz33sHM5peAoMJUbGVfEfQAsysIXvvgoFYoveYg==",
-      "dependencies": {
-        "@jsr/cliffy__internal": "1.0.0",
-        "@jsr/std__encoding": "^1.0.10",
-        "@jsr/std__fmt": "^1.0.9",
-        "@jsr/std__io": "~0.225.3"
-      }
-    },
-    "node_modules/@cliffy/command": {
-      "name": "@jsr/cliffy__command",
-      "version": "1.0.0",
-      "resolved": "https://npm.jsr.io/~/11/@jsr/cliffy__command/1.0.0.tgz",
-      "integrity": "sha512-oObplVtu1tvpkhgpuPDHZidx9g3axVOfRMQGmw7ZSGxp0+vZIJGiEtpcSvlN0XfuEhOG8neqfVBSSE9txrKanw==",
-      "dependencies": {
-        "@jsr/cliffy__flags": "1.0.0",
-        "@jsr/cliffy__internal": "1.0.0",
-        "@jsr/cliffy__table": "1.0.0",
-        "@jsr/std__fmt": "^1.0.9",
-        "@jsr/std__semver": "^1.0.8",
-        "@jsr/std__text": "^1.0.17"
-      }
-    },
-    "node_modules/@cliffy/prompt": {
-      "name": "@jsr/cliffy__prompt",
-      "version": "1.0.0",
-      "resolved": "https://npm.jsr.io/~/11/@jsr/cliffy__prompt/1.0.0.tgz",
-      "integrity": "sha512-JDuHcCAjScV0IUj389brneF6AzJyyP0pK8mymsrGN5/PGQfqK8zr96QpFlo1wmo8BY/3JQAdNfy6NZkPCJ6VWA==",
-      "dependencies": {
-        "@jsr/cliffy__ansi": "1.0.0",
-        "@jsr/cliffy__internal": "1.0.0",
-        "@jsr/cliffy__keycode": "1.0.0",
-        "@jsr/std__assert": "^1.0.18",
-        "@jsr/std__fmt": "^1.0.9",
-        "@jsr/std__io": "~0.225.3",
-        "@jsr/std__path": "^1.1.4",
-        "@jsr/std__text": "^1.0.17"
-      }
-    },
-    "node_modules/@cliffy/table": {
-      "name": "@jsr/cliffy__table",
-      "version": "1.0.0",
-      "resolved": "https://npm.jsr.io/~/11/@jsr/cliffy__table/1.0.0.tgz",
-      "integrity": "sha512-VoLxH0DjofHWPWKUc5N+oCwXB6O6e+carnhp23yJTa7qokBb+SCrTIABEgQdIe/p0bxgmZhz17xt2efaAxXvbQ==",
-      "dependencies": {
-        "@jsr/std__fmt": "^1.0.9"
-      }
-    },
-    "node_modules/@esbuild/aix-ppc64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.0.tgz",
-      "integrity": "sha512-lhRUCeuOyJQURhTxl4WkpFTjIsbDayJHih5kZC1giwE+MhIzAb7mEsQMqMf18rHLsrb5qI1tafG20mLxEWcWlA==",
-      "cpu": [
-        "ppc64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "aix"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/android-arm": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.0.tgz",
-      "integrity": "sha512-wqh0ByljabXLKHeWXYLqoJ5jKC4XBaw6Hk08OfMrCRd2nP2ZQ5eleDZC41XHyCNgktBGYMbqnrJKq/K/lzPMSQ==",
-      "cpu": [
-        "arm"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/android-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.0.tgz",
-      "integrity": "sha512-+WzIXQOSaGs33tLEgYPYe/yQHf0WTU0X42Jca3y8NWMbUVhp7rUnw+vAsRC/QiDrdD31IszMrZy+qwPOPjd+rw==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/android-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.0.tgz",
-      "integrity": "sha512-+VJggoaKhk2VNNqVL7f6S189UzShHC/mR9EE8rDdSkdpN0KflSwWY/gWjDrNxxisg8Fp1ZCD9jLMo4m0OUfeUA==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/darwin-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.0.tgz",
-      "integrity": "sha512-0T+A9WZm+bZ84nZBtk1ckYsOvyA3x7e2Acj1KdVfV4/2tdG4fzUp91YHx+GArWLtwqp77pBXVCPn2We7Letr0Q==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/darwin-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.0.tgz",
-      "integrity": "sha512-fyzLm/DLDl/84OCfp2f/XQ4flmORsjU7VKt8HLjvIXChJoFFOIL6pLJPH4Yhd1n1gGFF9mPwtlN5Wf82DZs+LQ==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/freebsd-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.0.tgz",
-      "integrity": "sha512-l9GeW5UZBT9k9brBYI+0WDffcRxgHQD8ShN2Ur4xWq/NFzUKm3k5lsH4PdaRgb2w7mI9u61nr2gI2mLI27Nh3Q==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/freebsd-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.0.tgz",
-      "integrity": "sha512-BXoQai/A0wPO6Es3yFJ7APCiKGc1tdAEOgeTNy3SsB491S3aHn4S4r3e976eUnPdU+NbdtmBuLncYir2tMU9Nw==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-arm": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.0.tgz",
-      "integrity": "sha512-CjaaREJagqJp7iTaNQjjidaNbCKYcd4IDkzbwwxtSvjI7NZm79qiHc8HqciMddQ6CKvJT6aBd8lO9kN/ZudLlw==",
-      "cpu": [
-        "arm"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.0.tgz",
-      "integrity": "sha512-RVyzfb3FWsGA55n6WY0MEIEPURL1FcbhFE6BffZEMEekfCzCIMtB5yyDcFnVbTnwk+CLAgTujmV/Lgvih56W+A==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-ia32": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.0.tgz",
-      "integrity": "sha512-KBnSTt1kxl9x70q+ydterVdl+Cn0H18ngRMRCEQfrbqdUuntQQ0LoMZv47uB97NljZFzY6HcfqEZ2SAyIUTQBQ==",
-      "cpu": [
-        "ia32"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-loong64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.0.tgz",
-      "integrity": "sha512-zpSlUce1mnxzgBADvxKXX5sl8aYQHo2ezvMNI8I0lbblJtp8V4odlm3Yzlj7gPyt3T8ReksE6bK+pT3WD+aJRg==",
-      "cpu": [
-        "loong64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-mips64el": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.0.tgz",
-      "integrity": "sha512-2jIfP6mmjkdmeTlsX/9vmdmhBmKADrWqN7zcdtHIeNSCH1SqIoNI63cYsjQR8J+wGa4Y5izRcSHSm8K3QWmk3w==",
-      "cpu": [
-        "mips64el"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-ppc64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.0.tgz",
-      "integrity": "sha512-bc0FE9wWeC0WBm49IQMPSPILRocGTQt3j5KPCA8os6VprfuJ7KD+5PzESSrJ6GmPIPJK965ZJHTUlSA6GNYEhg==",
-      "cpu": [
-        "ppc64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-riscv64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.0.tgz",
-      "integrity": "sha512-SQPZOwoTTT/HXFXQJG/vBX8sOFagGqvZyXcgLA3NhIqcBv1BJU1d46c0rGcrij2B56Z2rNiSLaZOYW5cUk7yLQ==",
-      "cpu": [
-        "riscv64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-s390x": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.0.tgz",
-      "integrity": "sha512-SCfR0HN8CEEjnYnySJTd2cw0k9OHB/YFzt5zgJEwa+wL/T/raGWYMBqwDNAC6dqFKmJYZoQBRfHjgwLHGSrn3Q==",
-      "cpu": [
-        "s390x"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.0.tgz",
-      "integrity": "sha512-us0dSb9iFxIi8srnpl931Nvs65it/Jd2a2K3qs7fz2WfGPHqzfzZTfec7oxZJRNPXPnNYZtanmRc4AL/JwVzHQ==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/netbsd-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.0.tgz",
-      "integrity": "sha512-CR/RYotgtCKwtftMwJlUU7xCVNg3lMYZ0RzTmAHSfLCXw3NtZtNpswLEj/Kkf6kEL3Gw+BpOekRX0BYCtklhUw==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/netbsd-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.0.tgz",
-      "integrity": "sha512-nU1yhmYutL+fQ71Kxnhg8uEOdC0pwEW9entHykTgEbna2pw2dkbFSMeqjjyHZoCmt8SBkOSvV+yNmm94aUrrqw==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/openbsd-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.0.tgz",
-      "integrity": "sha512-cXb5vApOsRsxsEl4mcZ1XY3D4DzcoMxR/nnc4IyqYs0rTI8ZKmW6kyyg+11Z8yvgMfAEldKzP7AdP64HnSC/6g==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/openbsd-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.0.tgz",
-      "integrity": "sha512-8wZM2qqtv9UP3mzy7HiGYNH/zjTA355mpeuA+859TyR+e+Tc08IHYpLJuMsfpDJwoLo1ikIJI8jC3GFjnRClzA==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/openharmony-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.0.tgz",
-      "integrity": "sha512-FLGfyizszcef5C3YtoyQDACyg95+dndv79i2EekILBofh5wpCa1KuBqOWKrEHZg3zrL3t5ouE5jgr94vA+Wb2w==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openharmony"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/sunos-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.0.tgz",
-      "integrity": "sha512-1ZgjUoEdHZZl/YlV76TSCz9Hqj9h9YmMGAgAPYd+q4SicWNX3G5GCyx9uhQWSLcbvPW8Ni7lj4gDa1T40akdlw==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "sunos"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/win32-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.0.tgz",
-      "integrity": "sha512-Q9StnDmQ/enxnpxCCLSg0oo4+34B9TdXpuyPeTedN/6+iXBJ4J+zwfQI28u/Jl40nOYAxGoNi7mFP40RUtkmUA==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/win32-ia32": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.0.tgz",
-      "integrity": "sha512-zF3ag/gfiCe6U2iczcRzSYJKH1DCI+ByzSENHlM2FcDbEeo5Zd2C86Aq0tKUYAJJ1obRP84ymxIAksZUcdztHA==",
-      "cpu": [
-        "ia32"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/win32-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.0.tgz",
-      "integrity": "sha512-pEl1bO9mfAmIC+tW5btTmrKaujg3zGtUmWNdCw/xs70FBjwAL3o9OEKNHvNmnyylD6ubxUERiEhdsL0xBQ9efw==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@jridgewell/gen-mapping": {
-      "version": "0.3.13",
-      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
-      "integrity": "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==",
-      "license": "MIT",
-      "dependencies": {
-        "@jridgewell/sourcemap-codec": "^1.5.0",
-        "@jridgewell/trace-mapping": "^0.3.24"
-      }
-    },
-    "node_modules/@jridgewell/remapping": {
-      "version": "2.3.5",
-      "resolved": "https://registry.npmjs.org/@jridgewell/remapping/-/remapping-2.3.5.tgz",
-      "integrity": "sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@jridgewell/gen-mapping": "^0.3.5",
-        "@jridgewell/trace-mapping": "^0.3.24"
-      }
-    },
-    "node_modules/@jridgewell/resolve-uri": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
-      "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=6.0.0"
-      }
-    },
-    "node_modules/@jridgewell/sourcemap-codec": {
-      "version": "1.5.5",
-      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
-      "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==",
-      "license": "MIT"
-    },
-    "node_modules/@jridgewell/trace-mapping": {
-      "version": "0.3.31",
-      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
-      "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==",
-      "license": "MIT",
-      "dependencies": {
-        "@jridgewell/resolve-uri": "^3.1.0",
-        "@jridgewell/sourcemap-codec": "^1.4.14"
-      }
-    },
-    "node_modules/@jsr/cliffy__ansi": {
-      "version": "1.0.0",
-      "resolved": "https://npm.jsr.io/~/11/@jsr/cliffy__ansi/1.0.0.tgz",
-      "integrity": "sha512-JesgTdgR0aW1mZv96VqvRHr2efzr4MgDFMnoT+hkhaiCpmyBz33sHM5peAoMJUbGVfEfQAsysIXvvgoFYoveYg==",
-      "dependencies": {
-        "@jsr/cliffy__internal": "1.0.0",
-        "@jsr/std__encoding": "^1.0.10",
-        "@jsr/std__fmt": "^1.0.9",
-        "@jsr/std__io": "~0.225.3"
-      }
-    },
-    "node_modules/@jsr/cliffy__flags": {
-      "version": "1.0.0",
-      "resolved": "https://npm.jsr.io/~/11/@jsr/cliffy__flags/1.0.0.tgz",
-      "integrity": "sha512-j/v3J8MWu0tkYyisZ2w1HxELxxL/qg6vey9+fRkbTJ+S9J0GeLUn2joouikG7aXpULKCXHTjJ9XH9gQx+F3npw==",
-      "dependencies": {
-        "@jsr/cliffy__internal": "1.0.0",
-        "@jsr/std__text": "^1.0.17"
-      }
-    },
-    "node_modules/@jsr/cliffy__internal": {
-      "version": "1.0.0",
-      "resolved": "https://npm.jsr.io/~/11/@jsr/cliffy__internal/1.0.0.tgz",
-      "integrity": "sha512-YPkbccbuu+kE55k+nia5jJx5Tu/IolBDXZTAgEA+YRGOzq8I1VkXajwykFXvSbXeVee3zQBU7y0HajVDB7ujQA==",
-      "dependencies": {
-        "@jsr/std__fmt": "^1.0.9"
-      }
-    },
-    "node_modules/@jsr/cliffy__keycode": {
-      "version": "1.0.0",
-      "resolved": "https://npm.jsr.io/~/11/@jsr/cliffy__keycode/1.0.0.tgz",
-      "integrity": "sha512-1ot+y8oZheBTpfgCazWjSOAK2Y2nOQD7NwMuiSAkcRuc1t7VizQZfDpZtBx97NlkYWgjn6ylArt2xyhiyLKRhA=="
-    },
-    "node_modules/@jsr/cliffy__table": {
-      "version": "1.0.0",
-      "resolved": "https://npm.jsr.io/~/11/@jsr/cliffy__table/1.0.0.tgz",
-      "integrity": "sha512-VoLxH0DjofHWPWKUc5N+oCwXB6O6e+carnhp23yJTa7qokBb+SCrTIABEgQdIe/p0bxgmZhz17xt2efaAxXvbQ==",
-      "dependencies": {
-        "@jsr/std__fmt": "^1.0.9"
-      }
-    },
-    "node_modules/@jsr/std__assert": {
-      "version": "1.0.19",
-      "resolved": "https://npm.jsr.io/~/11/@jsr/std__assert/1.0.19.tgz",
-      "integrity": "sha512-pEj6RPkGbqlgRmyKwATp4cUs6+ijxtdrv3bq8v1d2I2CEcMEyPaO8cVKro61wGRDH4cNg8Zx6haztvK/9m7gkA==",
-      "dependencies": {
-        "@jsr/std__internal": "^1.0.12"
-      }
-    },
-    "node_modules/@jsr/std__bytes": {
-      "version": "1.0.6",
-      "resolved": "https://npm.jsr.io/~/11/@jsr/std__bytes/1.0.6.tgz",
-      "integrity": "sha512-St6yKggjFGhxS52IFLJWvkchRFbAKg2Xh8UxA4S1EGz7GJ2Ui+ssDDldj/w2c8vCxvl6qgR0HaYbKeFJNqujmA=="
-    },
-    "node_modules/@jsr/std__encoding": {
-      "version": "1.0.10",
-      "resolved": "https://npm.jsr.io/~/11/@jsr/std__encoding/1.0.10.tgz",
-      "integrity": "sha512-WK2njnDTyKefroRNk2Ooq7GStp6Y0ccAvr4To+Z/zecRAGe7+OSvH9DbiaHpAKwEi2KQbmpWMOYsdNt+TsdmSw=="
-    },
-    "node_modules/@jsr/std__fmt": {
-      "version": "1.0.9",
-      "resolved": "https://npm.jsr.io/~/11/@jsr/std__fmt/1.0.9.tgz",
-      "integrity": "sha512-YFJJMozmORj2K91c5J9opWeh0VUwrd+Mwb7Pr0FkVCAKVLu2UhT4LyvJqWiyUT+eF+MdfqQ9F7RtQj4bXn9Smw=="
-    },
-    "node_modules/@jsr/std__internal": {
-      "version": "1.0.12",
-      "resolved": "https://npm.jsr.io/~/11/@jsr/std__internal/1.0.12.tgz",
-      "integrity": "sha512-6xReMW9p+paJgqoFRpOE2nogJFvzPfaLHLIlyADYjKMUcwDyjKZxryIbgcU+gxiTygn8yCjld1HoI0ET4/iZeA=="
-    },
-    "node_modules/@jsr/std__io": {
-      "version": "0.225.3",
-      "resolved": "https://npm.jsr.io/~/11/@jsr/std__io/0.225.3.tgz",
-      "integrity": "sha512-IDXY253ipW6FV34CJVxO+3ubfvSEEzw9N2W303KnLe9K/Y9+v/ID1dQYf9VsCCOFMpFtCmOLqzIZsRqv6yQnWw==",
-      "dependencies": {
-        "@jsr/std__bytes": "^1.0.6"
-      }
-    },
-    "node_modules/@jsr/std__path": {
-      "version": "1.1.4",
-      "resolved": "https://npm.jsr.io/~/11/@jsr/std__path/1.1.4.tgz",
-      "integrity": "sha512-SK4u9H6NVTfolhPdlvdYXfNFefy1W04AEHWJydryYbk+xqzNiVmr5o7TLJLJFqwHXuwMRhwrn+mcYeUfS0YFaA==",
-      "dependencies": {
-        "@jsr/std__internal": "^1.0.12"
-      }
-    },
-    "node_modules/@jsr/std__regexp": {
-      "version": "1.0.1",
-      "resolved": "https://npm.jsr.io/~/11/@jsr/std__regexp/1.0.1.tgz",
-      "integrity": "sha512-AnGeP//DHpPvhCWjI5dR4o013JhCQioD8yMF8drD7PWb0X4kvmO35hbZi+NZhfSolz4Ts2cpPzJY+DUpi2XE9A=="
-    },
-    "node_modules/@jsr/std__semver": {
-      "version": "1.0.8",
-      "resolved": "https://npm.jsr.io/~/11/@jsr/std__semver/1.0.8.tgz",
-      "integrity": "sha512-YhkykPU2Majz66e+rQbP0okYc7kKv+U32aguLPCXZZAL+vEVmBA+khHjPHhLBpWR073gzU3WHqGRgB7a/aXCjg=="
-    },
-    "node_modules/@jsr/std__text": {
-      "version": "1.0.17",
-      "resolved": "https://npm.jsr.io/~/11/@jsr/std__text/1.0.17.tgz",
-      "integrity": "sha512-oZsihl1bcTy1Ixzven8rin8kjChj1zDJWqgpS0oSMGCJDzyB365gtIfAvcMmji+M+FcIWo3goDXfHcFYt+k/kg==",
-      "dependencies": {
-        "@jsr/std__regexp": "^1.0.1"
-      }
-    },
-    "node_modules/@sveltejs/acorn-typescript": {
-      "version": "1.0.11",
-      "resolved": "https://registry.npmjs.org/@sveltejs/acorn-typescript/-/acorn-typescript-1.0.11.tgz",
-      "integrity": "sha512-LFuZUkjJ9iF7JZye/aG5XM0SFcQ5VyL0oVX4WJ9dc0Va3R3s0OauX1BESVCb+YN/ol8TAfqGDDAQsTG627Y5kw==",
-      "license": "MIT",
-      "peerDependencies": {
-        "acorn": "^8.9.0"
-      }
-    },
-    "node_modules/@types/bun": {
-      "version": "1.3.9",
-      "resolved": "https://registry.npmjs.org/@types/bun/-/bun-1.3.9.tgz",
-      "integrity": "sha512-KQ571yULOdWJiMH+RIWIOZ7B2RXQGpL1YQrBtLIV3FqDcCu6FsbFUBwhdKUlCKUpS3PJDsHlJ1QKlpxoVR+xtw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "bun-types": "1.3.9"
-      }
-    },
-    "node_modules/@types/diff": {
-      "version": "5.2.3",
-      "resolved": "https://registry.npmjs.org/@types/diff/-/diff-5.2.3.tgz",
-      "integrity": "sha512-K0Oqlrq3kQMaO2RhfrNQX5trmt+XLyom88zS0u84nnIcLvFnRUMRRHmrGny5GSM+kNO9IZLARsdQHDzkhAgmrQ==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@types/estree": {
-      "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.8.tgz",
-      "integrity": "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==",
-      "license": "MIT"
-    },
-    "node_modules/@types/node": {
-      "version": "22.19.11",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.19.11.tgz",
-      "integrity": "sha512-BH7YwL6rA93ReqeQS1c4bsPpcfOmJasG+Fkr6Y59q83f9M1WcBRHR2vM+P9eOisYRcN3ujQoiZY8uk5W+1WL8w==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "undici-types": "~6.21.0"
-      }
-    },
-    "node_modules/@types/tar-stream": {
-      "version": "3.1.4",
-      "resolved": "https://registry.npmjs.org/@types/tar-stream/-/tar-stream-3.1.4.tgz",
-      "integrity": "sha512-921gW0+g29mCJX0fRvqeHzBlE/XclDaAG0Ousy1LCghsOhvaKacDeRGEVzQP9IPfKn8Vysy7FEXAIxycpc/CMg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@types/node": "*"
-      }
-    },
-    "node_modules/@types/trusted-types": {
-      "version": "2.0.7",
-      "resolved": "https://registry.npmjs.org/@types/trusted-types/-/trusted-types-2.0.7.tgz",
-      "integrity": "sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw==",
-      "license": "MIT"
-    },
-    "node_modules/@types/ws": {
-      "version": "8.18.1",
-      "resolved": "https://registry.npmjs.org/@types/ws/-/ws-8.18.1.tgz",
-      "integrity": "sha512-ThVF6DCVhA8kUGy+aazFQ4kXQ7E1Ty7A3ypFOe0IcJV8O/M511G99AW24irKrW56Wt44yG9+ij8FaqoBGkuBXg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@types/node": "*"
-      }
-    },
-    "node_modules/@windmill-labs/shared-utils": {
-      "name": "@jsr/windmill-labs__shared-utils",
-      "version": "1.0.12",
-      "resolved": "https://npm.jsr.io/~/11/@jsr/windmill-labs__shared-utils/1.0.12.tgz",
-      "integrity": "sha512-bJOacyfxxNPwNTzA4AxCB5iGFop0h3mCgs+E9j3ZaJYDo1soblY16CebnQ56EPy/M3V344X/QoOFBORyRo1Mnw=="
-    },
-    "node_modules/acorn": {
-      "version": "8.18.0",
-      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.18.0.tgz",
-      "integrity": "sha512-lGq+9yr1/GuAWaVYIHRjvvySG5/4VfKIvC8EWxStPdcDh/Ka7FG3twP6v4d5BkravUilhIAsG4Qj83t02LWUPQ==",
-      "license": "MIT",
-      "bin": {
-        "acorn": "bin/acorn"
-      },
-      "engines": {
-        "node": ">=0.4.0"
-      }
-    },
-    "node_modules/ajv": {
-      "version": "8.20.0",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
-      "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "fast-deep-equal": "^3.1.3",
-        "fast-uri": "^3.0.1",
-        "json-schema-traverse": "^1.0.0",
-        "require-from-string": "^2.0.2"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/epoberezkin"
-      }
-    },
-    "node_modules/aria-query": {
-      "version": "5.3.1",
-      "resolved": "https://registry.npmjs.org/aria-query/-/aria-query-5.3.1.tgz",
-      "integrity": "sha512-Z/ZeOgVl7bcSYZ/u/rh0fOpvEpq//LZmdbkXyc7syVzjPAhfOa9ebsdTSjEBDU4vs5nC98Kfduj1uFo0qyET3g==",
-      "license": "Apache-2.0",
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/axobject-query": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/axobject-query/-/axobject-query-4.1.0.tgz",
-      "integrity": "sha512-qIj0G9wZbMGNLjLmg1PT6v2mE9AH2zlnADJD/2tC6E00hgmhUOfEB6greHPAfLRSufHqROIUTkw6E+M3lH0PTQ==",
-      "license": "Apache-2.0",
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/b4a": {
-      "version": "1.8.0",
-      "resolved": "https://registry.npmjs.org/b4a/-/b4a-1.8.0.tgz",
-      "integrity": "sha512-qRuSmNSkGQaHwNbM7J78Wwy+ghLEYF1zNrSeMxj4Kgw6y33O3mXcQ6Ie9fRvfU/YnxWkOchPXbaLb73TkIsfdg==",
-      "license": "Apache-2.0",
-      "peerDependencies": {
-        "react-native-b4a": "*"
-      },
-      "peerDependenciesMeta": {
-        "react-native-b4a": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/balanced-match": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.3.tgz",
-      "integrity": "sha512-1pHv8LX9CpKut1Zp4EXey7Z8OfH11ONNH6Dhi2WDUt31VVZFXZzKwXcysBgqSumFCmR+0dqjMK5v5JiFHzi0+g==",
-      "license": "MIT",
-      "engines": {
-        "node": "20 || >=22"
-      }
-    },
-    "node_modules/bare-events": {
-      "version": "2.8.2",
-      "resolved": "https://registry.npmjs.org/bare-events/-/bare-events-2.8.2.tgz",
-      "integrity": "sha512-riJjyv1/mHLIPX4RwiK+oW9/4c3TEUeORHKefKAKnZ5kyslbN+HXowtbaVEqt4IMUB7OXlfixcs6gsFeo/jhiQ==",
-      "license": "Apache-2.0",
-      "peerDependencies": {
-        "bare-abort-controller": "*"
-      },
-      "peerDependenciesMeta": {
-        "bare-abort-controller": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/brace-expansion": {
-      "version": "5.0.2",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.2.tgz",
-      "integrity": "sha512-Pdk8c9poy+YhOgVWw1JNN22/HcivgKWwpxKq04M/jTmHyCZn12WPJebZxdjSa5TmBqISrUSgNYU3eRORljfCCw==",
-      "license": "MIT",
-      "dependencies": {
-        "balanced-match": "^4.0.2"
-      },
-      "engines": {
-        "node": "20 || >=22"
-      }
-    },
-    "node_modules/bun-types": {
-      "version": "1.3.9",
-      "resolved": "https://registry.npmjs.org/bun-types/-/bun-types-1.3.9.tgz",
-      "integrity": "sha512-+UBWWOakIP4Tswh0Bt0QD0alpTY8cb5hvgiYeWCMet9YukHbzuruIEeXC2D7nMJPB12kbh8C7XJykSexEqGKJg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@types/node": "*"
-      }
-    },
-    "node_modules/bundle-name": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/bundle-name/-/bundle-name-4.1.0.tgz",
-      "integrity": "sha512-tjwM5exMg6BGRI+kNmTntNsvdZS1X8BFYS6tnJ2hdH0kVxM6/eVZ2xy+FqStSWvYmtfFMDLIxurorHwDKfDz5Q==",
-      "license": "MIT",
-      "dependencies": {
-        "run-applescript": "^7.0.0"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/clsx": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/clsx/-/clsx-2.1.1.tgz",
-      "integrity": "sha512-eYm0QWBtUrBWZWG0d386OGAw16Z995PiOVo2B7bjWSbHedGl5e0ZWaq65kOGgUSNesEIDkB9ISbTg/JK9dhCZA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/core-util-is": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.3.tgz",
-      "integrity": "sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ==",
-      "license": "MIT"
-    },
-    "node_modules/default-browser": {
-      "version": "5.5.0",
-      "resolved": "https://registry.npmjs.org/default-browser/-/default-browser-5.5.0.tgz",
-      "integrity": "sha512-H9LMLr5zwIbSxrmvikGuI/5KGhZ8E2zH3stkMgM5LpOWDutGM2JZaj460Udnf1a+946zc7YBgrqEWwbk7zHvGw==",
-      "license": "MIT",
-      "dependencies": {
-        "bundle-name": "^4.1.0",
-        "default-browser-id": "^5.0.0"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/default-browser-id": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/default-browser-id/-/default-browser-id-5.0.1.tgz",
-      "integrity": "sha512-x1VCxdX4t+8wVfd1so/9w+vQ4vx7lKd2Qp5tDRutErwmR85OgmfX7RlLRMWafRMY7hbEiXIbudNrjOAPa/hL8Q==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/define-lazy-prop": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/define-lazy-prop/-/define-lazy-prop-3.0.0.tgz",
-      "integrity": "sha512-N+MeXYoqr3pOgn8xfyRPREN7gHakLYjhsHhWGT3fWAiL4IkAt0iDw14QiiEm2bE30c5XX5q0FtAA3CK5f9/BUg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/devalue": {
-      "version": "5.8.2",
-      "resolved": "https://registry.npmjs.org/devalue/-/devalue-5.8.2.tgz",
-      "integrity": "sha512-DObPPAfdtFbXjxLqK8s2Xk9ZuWz5+ZoFEhC7J76es4GU/rEiXwHTmbImoCdyoCOcBH1UF3+Cz6Z2sYD4hyl5TA==",
-      "license": "MIT"
-    },
-    "node_modules/diff": {
-      "version": "5.2.2",
-      "resolved": "https://registry.npmjs.org/diff/-/diff-5.2.2.tgz",
-      "integrity": "sha512-vtcDfH3TOjP8UekytvnHH1o1P4FcUdt4eQ1Y+Abap1tk/OB2MWQvcwS2ClCd1zuIhc3JKOx6p3kod8Vfys3E+A==",
-      "license": "BSD-3-Clause",
-      "engines": {
-        "node": ">=0.3.1"
-      }
-    },
-    "node_modules/esbuild": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.0.tgz",
-      "integrity": "sha512-sNR9MHpXSUV/XB4zmsFKN+QgVG82Cc7+/aaxJ8Adi8hyOac+EXptIp45QBPaVyX3N70664wRbTcLTOemCAnyqw==",
-      "hasInstallScript": true,
-      "license": "MIT",
-      "bin": {
-        "esbuild": "bin/esbuild"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "optionalDependencies": {
-        "@esbuild/aix-ppc64": "0.28.0",
-        "@esbuild/android-arm": "0.28.0",
-        "@esbuild/android-arm64": "0.28.0",
-        "@esbuild/android-x64": "0.28.0",
-        "@esbuild/darwin-arm64": "0.28.0",
-        "@esbuild/darwin-x64": "0.28.0",
-        "@esbuild/freebsd-arm64": "0.28.0",
-        "@esbuild/freebsd-x64": "0.28.0",
-        "@esbuild/linux-arm": "0.28.0",
-        "@esbuild/linux-arm64": "0.28.0",
-        "@esbuild/linux-ia32": "0.28.0",
-        "@esbuild/linux-loong64": "0.28.0",
-        "@esbuild/linux-mips64el": "0.28.0",
-        "@esbuild/linux-ppc64": "0.28.0",
-        "@esbuild/linux-riscv64": "0.28.0",
-        "@esbuild/linux-s390x": "0.28.0",
-        "@esbuild/linux-x64": "0.28.0",
-        "@esbuild/netbsd-arm64": "0.28.0",
-        "@esbuild/netbsd-x64": "0.28.0",
-        "@esbuild/openbsd-arm64": "0.28.0",
-        "@esbuild/openbsd-x64": "0.28.0",
-        "@esbuild/openharmony-arm64": "0.28.0",
-        "@esbuild/sunos-x64": "0.28.0",
-        "@esbuild/win32-arm64": "0.28.0",
-        "@esbuild/win32-ia32": "0.28.0",
-        "@esbuild/win32-x64": "0.28.0"
-      }
-    },
-    "node_modules/esm-env": {
-      "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/esm-env/-/esm-env-1.2.2.tgz",
-      "integrity": "sha512-Epxrv+Nr/CaL4ZcFGPJIYLWFom+YeV1DqMLHJoEd9SYRxNbaFruBwfEX/kkHUJf55j2+TUbmDcmuilbP1TmXHA==",
-      "license": "MIT"
-    },
-    "node_modules/esrap": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/esrap/-/esrap-2.3.0.tgz",
-      "integrity": "sha512-GQ/7RN8uOtEfNpzZzBMTzW9JBcX42oaSVtPzdF+6cEL8pqIL094iUpr9jzYGn4O4P/1S60dJ6izyT8F4LYARng==",
-      "license": "MIT",
-      "dependencies": {
-        "@jridgewell/sourcemap-codec": "^1.4.15"
-      },
-      "peerDependencies": {
-        "@typescript-eslint/types": "^8.2.0"
-      },
-      "peerDependenciesMeta": {
-        "@typescript-eslint/types": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/events-universal": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/events-universal/-/events-universal-1.0.1.tgz",
-      "integrity": "sha512-LUd5euvbMLpwOF8m6ivPCbhQeSiYVNb8Vs0fQ8QjXo0JTkEHpz8pxdQf0gStltaPpw0Cca8b39KxvK9cfKRiAw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "bare-events": "^2.7.0"
-      }
-    },
-    "node_modules/fast-deep-equal": {
-      "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
-      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/fast-fifo": {
-      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/fast-fifo/-/fast-fifo-1.3.2.tgz",
-      "integrity": "sha512-/d9sfos4yxzpwkDkuN7k2SqFKtYNmCTzgfEpz82x34IM9/zc8KGxQoXg1liNC/izpRM/MBdt44Nmx41ZWqk+FQ==",
-      "license": "MIT"
-    },
-    "node_modules/fast-uri": {
-      "version": "3.1.4",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz",
-      "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/fastify"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/fastify"
-        }
-      ],
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/get-port": {
-      "version": "7.1.0",
-      "resolved": "https://registry.npmjs.org/get-port/-/get-port-7.1.0.tgz",
-      "integrity": "sha512-QB9NKEeDg3xxVwCCwJQ9+xycaz6pBB6iQ76wiWMl1927n0Kir6alPiP+yuiICLLU4jpMe08dXfpebuQppFA2zw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=16"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/immediate": {
-      "version": "3.0.6",
-      "resolved": "https://registry.npmjs.org/immediate/-/immediate-3.0.6.tgz",
-      "integrity": "sha512-XXOFtyqDjNDAQxVfYxuF7g9Il/IbWmmlQg2MYKOH8ExIT1qg6xc4zyS3HaEEATgs1btfzxq15ciUiY7gjSXRGQ==",
-      "license": "MIT"
-    },
-    "node_modules/inherits": {
-      "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
-      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
-      "license": "ISC"
-    },
-    "node_modules/is-docker": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/is-docker/-/is-docker-3.0.0.tgz",
-      "integrity": "sha512-eljcgEDlEns/7AXFosB5K/2nCM4P7FQPkGc/DWLy5rmFEWvZayGrik1d9/QIY5nJ4f9YsVvBkA6kJpHn9rISdQ==",
-      "license": "MIT",
-      "bin": {
-        "is-docker": "cli.js"
-      },
-      "engines": {
-        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/is-inside-container": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/is-inside-container/-/is-inside-container-1.0.0.tgz",
-      "integrity": "sha512-KIYLCCJghfHZxqjYBE7rEy0OBuTd5xCHS7tHVgvCLkx7StIoaxwNW3hCALgEUjFfeRk+MG/Qxmp/vtETEF3tRA==",
-      "license": "MIT",
-      "dependencies": {
-        "is-docker": "^3.0.0"
-      },
-      "bin": {
-        "is-inside-container": "cli.js"
-      },
-      "engines": {
-        "node": ">=14.16"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/is-reference": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/is-reference/-/is-reference-3.0.3.tgz",
-      "integrity": "sha512-ixkJoqQvAP88E6wLydLGGqCJsrFUnqoH6HnaczB8XmDH1oaWU+xxdptvikTgaEhtZ53Ky6YXiBuUI2WXLMCwjw==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/estree": "^1.0.6"
-      }
-    },
-    "node_modules/is-wsl": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/is-wsl/-/is-wsl-3.1.1.tgz",
-      "integrity": "sha512-e6rvdUCiQCAuumZslxRJWR/Doq4VpPR82kqclvcS0efgt430SlGIk05vdCN58+VrzgtIcfNODjozVielycD4Sw==",
-      "license": "MIT",
-      "dependencies": {
-        "is-inside-container": "^1.0.0"
-      },
-      "engines": {
-        "node": ">=16"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/isarray": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/isarray/-/isarray-1.0.0.tgz",
-      "integrity": "sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ==",
-      "license": "MIT"
-    },
-    "node_modules/json-schema-traverse": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
-      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/jszip": {
-      "version": "3.8.0",
-      "resolved": "https://registry.npmjs.org/jszip/-/jszip-3.8.0.tgz",
-      "integrity": "sha512-cnpQrXvFSLdsR9KR5/x7zdf6c3m8IhZfZzSblFEHSqBaVwD2nvJ4CuCKLyvKvwBgZm08CgfSoiTBQLm5WW9hGw==",
-      "license": "(MIT OR GPL-3.0-or-later)",
-      "dependencies": {
-        "lie": "~3.3.0",
-        "pako": "~1.0.2",
-        "readable-stream": "~2.3.6",
-        "set-immediate-shim": "~1.0.1"
-      }
-    },
-    "node_modules/lie": {
-      "version": "3.3.0",
-      "resolved": "https://registry.npmjs.org/lie/-/lie-3.3.0.tgz",
-      "integrity": "sha512-UaiMJzeWRlEujzAuw5LokY1L5ecNQYZKfmyZ9L7wDHb/p5etKaxXhohBcrw0EYby+G/NA52vRSN4N39dxHAIwQ==",
-      "license": "MIT",
-      "dependencies": {
-        "immediate": "~3.0.5"
-      }
-    },
-    "node_modules/locate-character": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/locate-character/-/locate-character-3.0.0.tgz",
-      "integrity": "sha512-SW13ws7BjaeJ6p7Q6CO2nchbYEc3X3J6WrmTTDto7yMPqVSZTUyY5Tjbid+Ab8gLnATtygYtiDIJGQRRn2ZOiA==",
-      "license": "MIT"
-    },
-    "node_modules/magic-string": {
-      "version": "0.30.21",
-      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.21.tgz",
-      "integrity": "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@jridgewell/sourcemap-codec": "^1.5.5"
-      }
-    },
-    "node_modules/minimatch": {
-      "version": "10.2.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.2.tgz",
-      "integrity": "sha512-+G4CpNBxa5MprY+04MbgOw1v7So6n5JY166pFi9KfYwT78fxScCeSNQSNzp6dpPSW2rONOps6Ocam1wFhCgoVw==",
-      "license": "BlueOak-1.0.0",
-      "dependencies": {
-        "brace-expansion": "^5.0.2"
-      },
-      "engines": {
-        "node": "18 || 20 || >=22"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/open": {
-      "version": "10.2.0",
-      "resolved": "https://registry.npmjs.org/open/-/open-10.2.0.tgz",
-      "integrity": "sha512-YgBpdJHPyQ2UE5x+hlSXcnejzAvD0b22U2OuAP+8OnlJT+PjWPxtgmGqKKc+RgTM63U9gN0YzrYc71R2WT/hTA==",
-      "license": "MIT",
-      "dependencies": {
-        "default-browser": "^5.2.1",
-        "define-lazy-prop": "^3.0.0",
-        "is-inside-container": "^1.0.0",
-        "wsl-utils": "^0.1.0"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/pako": {
-      "version": "1.0.11",
-      "resolved": "https://registry.npmjs.org/pako/-/pako-1.0.11.tgz",
-      "integrity": "sha512-4hLB8Py4zZce5s4yd9XzopqwVv/yGNhV1Bl8NTmCq1763HeK2+EwVTv+leGeL13Dnh2wfbqowVPXCIO0z4taYw==",
-      "license": "(MIT AND Zlib)"
-    },
-    "node_modules/pg-gateway": {
-      "version": "0.3.0-beta.4",
-      "resolved": "https://registry.npmjs.org/pg-gateway/-/pg-gateway-0.3.0-beta.4.tgz",
-      "integrity": "sha512-CTjsM7Z+0Nx2/dyZ6r8zRsc3f9FScoD5UAOlfUx1Fdv/JOIWvRbF7gou6l6vP+uypXQVoYPgw8xZDXgMGvBa4Q==",
-      "license": "MIT"
-    },
-    "node_modules/process-nextick-args": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/process-nextick-args/-/process-nextick-args-2.0.1.tgz",
-      "integrity": "sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==",
-      "license": "MIT"
-    },
-    "node_modules/readable-stream": {
-      "version": "2.3.8",
-      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.8.tgz",
-      "integrity": "sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==",
-      "license": "MIT",
-      "dependencies": {
-        "core-util-is": "~1.0.0",
-        "inherits": "~2.0.3",
-        "isarray": "~1.0.0",
-        "process-nextick-args": "~2.0.0",
-        "safe-buffer": "~5.1.1",
-        "string_decoder": "~1.1.1",
-        "util-deprecate": "~1.0.1"
-      }
-    },
-    "node_modules/require-from-string": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
-      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/run-applescript": {
-      "version": "7.1.0",
-      "resolved": "https://registry.npmjs.org/run-applescript/-/run-applescript-7.1.0.tgz",
-      "integrity": "sha512-DPe5pVFaAsinSaV6QjQ6gdiedWDcRCbUuiQfQa2wmWV7+xC9bGulGI8+TdRmoFkAPaBXk8CrAbnlY2ISniJ47Q==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/safe-buffer": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
-      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
-      "license": "MIT"
-    },
-    "node_modules/set-immediate-shim": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/set-immediate-shim/-/set-immediate-shim-1.0.1.tgz",
-      "integrity": "sha512-Li5AOqrZWCVA2n5kryzEmqai6bKSIvpz5oUJHPVj6+dsbD3X1ixtsY5tEnsaNpH3pFAHmG8eIHUrtEtohrg+UQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/streamx": {
-      "version": "2.23.0",
-      "resolved": "https://registry.npmjs.org/streamx/-/streamx-2.23.0.tgz",
-      "integrity": "sha512-kn+e44esVfn2Fa/O0CPFcex27fjIL6MkVae0Mm6q+E6f0hWv578YCERbv+4m02cjxvDsPKLnmxral/rR6lBMAg==",
-      "license": "MIT",
-      "dependencies": {
-        "events-universal": "^1.0.0",
-        "fast-fifo": "^1.3.2",
-        "text-decoder": "^1.1.0"
-      }
-    },
-    "node_modules/string_decoder": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
-      "integrity": "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==",
-      "license": "MIT",
-      "dependencies": {
-        "safe-buffer": "~5.1.0"
-      }
-    },
-    "node_modules/svelte": {
-      "version": "5.56.8",
-      "resolved": "https://registry.npmjs.org/svelte/-/svelte-5.56.8.tgz",
-      "integrity": "sha512-PY8LOw7xP6c8IOiVqdo0sbbZVYhXRSfklOQLAUyGBKqjTX0wx/z4l/9J+PmBpmlLnxzEb1NqltxQ5/wZme/Cmg==",
-      "license": "MIT",
-      "dependencies": {
-        "@jridgewell/remapping": "^2.3.4",
-        "@jridgewell/sourcemap-codec": "^1.5.0",
-        "@sveltejs/acorn-typescript": "^1.0.10",
-        "@types/estree": "^1.0.5",
-        "@types/trusted-types": "^2.0.7",
-        "acorn": "^8.12.1",
-        "aria-query": "5.3.1",
-        "axobject-query": "^4.1.0",
-        "clsx": "^2.1.1",
-        "devalue": "^5.8.1",
-        "esm-env": "^1.2.1",
-        "esrap": "^2.2.12",
-        "is-reference": "^3.0.3",
-        "locate-character": "^3.0.0",
-        "magic-string": "^0.30.11",
-        "zimmerframe": "^1.1.2"
-      },
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/tar-stream": {
-      "version": "3.1.7",
-      "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-3.1.7.tgz",
-      "integrity": "sha512-qJj60CXt7IU1Ffyc3NJMjh6EkuCFej46zUqJ4J7pqYlThyd9bO0XBTmcOIhSzZJVWfsLks0+nle/j538YAW9RQ==",
-      "license": "MIT",
-      "dependencies": {
-        "b4a": "^1.6.4",
-        "fast-fifo": "^1.2.0",
-        "streamx": "^2.15.0"
-      }
-    },
-    "node_modules/text-decoder": {
-      "version": "1.2.7",
-      "resolved": "https://registry.npmjs.org/text-decoder/-/text-decoder-1.2.7.tgz",
-      "integrity": "sha512-vlLytXkeP4xvEq2otHeJfSQIRyWxo/oZGEbXrtEEF9Hnmrdly59sUbzZ/QgyWuLYHctCHxFF4tRQZNQ9k60ExQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "b4a": "^1.6.4"
-      }
-    },
-    "node_modules/typescript": {
-      "version": "5.9.3",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
-      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "bin": {
-        "tsc": "bin/tsc",
-        "tsserver": "bin/tsserver"
-      },
-      "engines": {
-        "node": ">=14.17"
-      }
-    },
-    "node_modules/undici-types": {
-      "version": "6.21.0",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
-      "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/util-deprecate": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
-      "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
-      "license": "MIT"
-    },
-    "node_modules/windmill-parser-wasm-asset": {
-      "version": "1.753.0",
-      "resolved": "https://registry.npmjs.org/windmill-parser-wasm-asset/-/windmill-parser-wasm-asset-1.753.0.tgz",
-      "integrity": "sha512-zpJhjvcU8EWRoOJzas/nRGKjGdQnvzeB9GOxP+Mdmnk8BFk3uehsmHS2Krxyjo36fUrCHqobbnffEqf0g3LIGg=="
-    },
-    "node_modules/windmill-parser-wasm-csharp": {
-      "version": "1.510.1",
-      "resolved": "https://registry.npmjs.org/windmill-parser-wasm-csharp/-/windmill-parser-wasm-csharp-1.510.1.tgz",
-      "integrity": "sha512-qm09YmnbeYHLwYn1jUnObVzPhYO9NZKMlIO7nlo7zPJBXqksgG5fK/KCtwGw9rChrnz+DsvM9wP5FhrwRLMtwQ=="
-    },
-    "node_modules/windmill-parser-wasm-go": {
-      "version": "1.761.0",
-      "resolved": "https://registry.npmjs.org/windmill-parser-wasm-go/-/windmill-parser-wasm-go-1.761.0.tgz",
-      "integrity": "sha512-jNM0kh0U5uSetwBVSmueFs91GTdbn/tffny2XB1LrrSUElP5i+PK7i12zrWNT2q9JUK2L215CbmyfNmkacbo1Q=="
-    },
-    "node_modules/windmill-parser-wasm-java": {
-      "version": "1.510.1",
-      "resolved": "https://registry.npmjs.org/windmill-parser-wasm-java/-/windmill-parser-wasm-java-1.510.1.tgz",
-      "integrity": "sha512-Zle+JZT/ZwUArUVacUudYlS+CaHp2lSnkqD/IhWaRUG+gcv26VbERnrrHPonqXbVMS+eA9ElfXrFM5j0ukaXUw=="
-    },
-    "node_modules/windmill-parser-wasm-nu": {
-      "version": "1.510.1",
-      "resolved": "https://registry.npmjs.org/windmill-parser-wasm-nu/-/windmill-parser-wasm-nu-1.510.1.tgz",
-      "integrity": "sha512-AJLFiUy6af+LpUe7CddDo4+JOmw3c0K/1iOWh8NdTwXcLDj90lL6089mdsVo1apyloLgrTbcuFDzZMXVGBgtCg=="
-    },
-    "node_modules/windmill-parser-wasm-php": {
-      "version": "1.647.1",
-      "resolved": "https://registry.npmjs.org/windmill-parser-wasm-php/-/windmill-parser-wasm-php-1.647.1.tgz",
-      "integrity": "sha512-u2qaMkupSdhJibxvkLh3r/y36IARvnYNTLXWvOKxcQ0G/BPUB4+yF5o/yf47vv9zUV5WZv4mrdsKDt/pZDYeDg=="
-    },
-    "node_modules/windmill-parser-wasm-py": {
-      "version": "1.693.1",
-      "resolved": "https://registry.npmjs.org/windmill-parser-wasm-py/-/windmill-parser-wasm-py-1.693.1.tgz",
-      "integrity": "sha512-qSXKxDsKjt1UOEK1NnpKJmDrXIx/sZaGHktC6+Sj6CfhLi1X/Qj37FalOq4Es5l2qzm2NPvk4jkCXsV1QdkcHA=="
-    },
-    "node_modules/windmill-parser-wasm-py-imports": {
-      "version": "1.693.1",
-      "resolved": "https://registry.npmjs.org/windmill-parser-wasm-py-imports/-/windmill-parser-wasm-py-imports-1.693.1.tgz",
-      "integrity": "sha512-FC0KbREe2G/sa/9kYIR930wmWw+VL6PvEIqg12J3dsJes3A+0x5JIUPT/jeD+c24DrG0ko/Ub7yDnYs56Bem7g=="
-    },
-    "node_modules/windmill-parser-wasm-r": {
-      "version": "1.668.1",
-      "resolved": "https://registry.npmjs.org/windmill-parser-wasm-r/-/windmill-parser-wasm-r-1.668.1.tgz",
-      "integrity": "sha512-5YNeUibxpNBvYrxCgQcz1PxGhTFx2CyEpg2udtIhq7bx0d4gF/KDZVupMeQmAObmrEtTSFGUWNRJ4zXSWNrSpQ=="
-    },
-    "node_modules/windmill-parser-wasm-regex": {
-      "version": "1.764.0",
-      "resolved": "https://registry.npmjs.org/windmill-parser-wasm-regex/-/windmill-parser-wasm-regex-1.764.0.tgz",
-      "integrity": "sha512-V2eFdKD90gqWikOvjl2fwMpFqiFt/21+4iQMbiNJYl7Lm2UiEcEZ4r9bpgJLG4TLOLqvD6+u4Ju3WaytxN2O2w=="
-    },
-    "node_modules/windmill-parser-wasm-ruby": {
-      "version": "1.526.1",
-      "resolved": "https://registry.npmjs.org/windmill-parser-wasm-ruby/-/windmill-parser-wasm-ruby-1.526.1.tgz",
-      "integrity": "sha512-rMBQA8s21wmL2kA5ztRs/ZgVA3ckxe9/NLjxl3iQPL0CX6DlvfaUH0O+AnhpXXDMyBs1Y1SZIhcnbnvsHZ3R8g=="
-    },
-    "node_modules/windmill-parser-wasm-rust": {
-      "version": "1.647.1",
-      "resolved": "https://registry.npmjs.org/windmill-parser-wasm-rust/-/windmill-parser-wasm-rust-1.647.1.tgz",
-      "integrity": "sha512-9yGLYZX2Hn9TdTqGY/5Fp50ftzgUsrfBkSK9vJkKJd5Amyg+yXLBGzd8pz6Org+4uxMenz/16wpsgijvo6uhhQ=="
-    },
-    "node_modules/windmill-parser-wasm-ts": {
-      "version": "1.695.0",
-      "resolved": "https://registry.npmjs.org/windmill-parser-wasm-ts/-/windmill-parser-wasm-ts-1.695.0.tgz",
-      "integrity": "sha512-9EFxeRZWmfb7EyhSlcG7dzTTKETPRYAvpRlxxLkhhtI5I219wFgI7kwrMpz4stXHJj/aqBknVv66NQHRstSJmw=="
-    },
-    "node_modules/windmill-parser-wasm-yaml": {
-      "version": "1.593.0",
-      "resolved": "https://registry.npmjs.org/windmill-parser-wasm-yaml/-/windmill-parser-wasm-yaml-1.593.0.tgz",
-      "integrity": "sha512-Gyx4aR2jsJYuDrD3mCNTmz7LWOQQXPw5yKNCC1xRgUOPfjsD/tINAFfsBLwVOSmlQQcFZO+wHm4KtDtXOcnGVw=="
-    },
-    "node_modules/ws": {
-      "version": "8.18.0",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.18.0.tgz",
-      "integrity": "sha512-8VbfWfHLbbwu3+N6OKsOMpBdT4kXPDDB9cJk2bJ6mh9ucxdlnNvH1e+roYkKmN9Nxw2yjz7VzeO9oOz2zJ04Pw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=10.0.0"
-      },
-      "peerDependencies": {
-        "bufferutil": "^4.0.1",
-        "utf-8-validate": ">=5.0.2"
-      },
-      "peerDependenciesMeta": {
-        "bufferutil": {
-          "optional": true
-        },
-        "utf-8-validate": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/wsl-utils": {
-      "version": "0.1.0",
-      "resolved": "https://registry.npmjs.org/wsl-utils/-/wsl-utils-0.1.0.tgz",
-      "integrity": "sha512-h3Fbisa2nKGPxCpm89Hk33lBLsnaGBvctQopaBSOW/uIs6FTe1ATyAnKFJrzVs9vpGdsTe73WF3V4lIsk4Gacw==",
-      "license": "MIT",
-      "dependencies": {
-        "is-wsl": "^3.1.0"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/yaml": {
-      "version": "2.8.2",
-      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.2.tgz",
-      "integrity": "sha512-mplynKqc1C2hTVYxd0PU2xQAc22TI1vShAYGksCCfxbn/dFwnHTNi1bvYsBTkhdUNtGIf5xNOg938rrSSYvS9A==",
-      "license": "ISC",
-      "bin": {
-        "yaml": "bin.mjs"
-      },
-      "engines": {
-        "node": ">= 14.6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/eemeli"
-      }
-    },
-    "node_modules/zimmerframe": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/zimmerframe/-/zimmerframe-1.1.4.tgz",
-      "integrity": "sha512-B58NGBEoc8Y9MWWCQGl/gq9xBCe4IiKM0a2x7GZdQKOW5Exr8S1W24J6OgM1njK8xCRGvAJIL/MxXHf6SkmQKQ==",
-      "license": "MIT"
-    }
-  }
-}
diff --git a/cli/package.json b/cli/package.json
index 7f3ba944f0..9a51e8c1ae 100644
--- a/cli/package.json
+++ b/cli/package.json
@@ -9,6 +9,7 @@
     "preinstall": "node ./prepare-yaml-validator.mjs",
     "dev": "bun run src/main.ts",
     "build": "./build.sh",
+    "gen:dev-recorder": "bun run generate-dev-recorder.ts",
     "test": "bun test test/",
     "test:unit": "UNIT_ONLY=1 bun test test/*_unit*",
     "check": "bunx tsc --noEmit",
@@ -42,7 +43,8 @@
     "windmill-parser-wasm-ruby": "1.526.1",
     "windmill-parser-wasm-rust": "1.647.1",
     "windmill-parser-wasm-ts": "1.695.0",
-    "windmill-parser-wasm-yaml": "1.593.0",
+    "windmill-parser-wasm-yaml": "1.770.0",
+    "windmill-yaml-validator": "1.1.1",
     "ws": "8.18.0",
     "yaml": "^2.7.0"
   },
diff --git a/cli/src/commands/app/app.ts b/cli/src/commands/app/app.ts
index 6f0263c5cf..7772dafedd 100644
--- a/cli/src/commands/app/app.ts
+++ b/cli/src/commands/app/app.ts
@@ -12,10 +12,11 @@ import * as wmill from "../../../gen/services.gen.ts";
 import { ListableApp, Policy } from "../../../gen/types.gen.ts";
 
 import { GlobalOptions, isSuperset } from "../../types.ts";
-import { getWmillYamlPath } from "../../core/conf.ts";
+import { getWmillYamlPath, mergeConfigWithConfigFile } from "../../core/conf.ts";
 import { readInlinePathSync } from "../../utils/utils.ts";
 import devCommand from "./dev.ts";
 import lintCommand from "./lint.ts";
+import bundleCommand from "./bundle_command.ts";
 import newCommand from "./new.ts";
 import generateAgentsCommand from "./generate_agents.ts";
 import { isVersionsGeq1585 } from "../sync/global.ts";
@@ -402,7 +403,14 @@ async function push(
 
   if (isRawAppByName || hasRawAppYaml) {
     const { pushRawApp } = await import("./raw_apps.ts");
-    await pushRawApp(workspace.workspaceId, remotePath, absoluteFilePath);
+    const merged = await mergeConfigWithConfigFile(opts);
+    await pushRawApp(
+      workspace.workspaceId,
+      remotePath,
+      absoluteFilePath,
+      undefined,
+      merged.defaultTs,
+    );
     log.info(colors.bold.underline.green("Raw app pushed"));
   } else {
     await pushApp(workspace.workspaceId, remotePath, absoluteFilePath);
@@ -429,6 +437,7 @@ const command = new Command()
   .action(push as any)
   .command("dev", devCommand)
   .command("lint", lintCommand)
+  .command("bundle", bundleCommand)
   .command("new", newCommand)
   .command("generate-agents", generateAgentsCommand)
   .command(
diff --git a/cli/src/commands/app/app_metadata.ts b/cli/src/commands/app/app_metadata.ts
index 10e5373741..9513256d2d 100644
--- a/cli/src/commands/app/app_metadata.ts
+++ b/cli/src/commands/app/app_metadata.ts
@@ -51,6 +51,9 @@ import { pollJobWithQueueLogging } from "../../utils/job_polling.ts";
 
 const TOP_HASH = "__app_hash";
 export const APP_BACKEND_FOLDER = "backend";
+/** Where `wmill app dev --recording` writes finished session recordings. Local
+ * artifacts, so the app source push skips them. */
+export const RECORDINGS_FOLDER = "recordings";
 
 // Union type for app files that can be either raw or normal apps
 type AppFile = RawAppFile | NormalAppFile;
@@ -187,7 +190,20 @@ export async function generateAppLocksInternal(
   );
   const appFile = (await yamlParseFile(appFilePath)) as AppFile;
 
-  const appValue = rawApp ? (appFile as RawAppFile).runnables : (appFile as NormalAppFile).value;
+  // Raw-app runnables live in their own files under backend/; raw_app.yaml only
+  // carries them in the legacy layout. Resolve them here, before any workspace
+  // dependency filtering, otherwise the deps of a file-based raw app are
+  // filtered against an empty runnables map and silently dropped.
+  const runnablesFolder = path.join(appFolder, APP_BACKEND_FOLDER);
+  let rawAppRunnables: Record<string, any> = {};
+  if (rawApp) {
+    rawAppRunnables = await loadRunnablesFromBackend(runnablesFolder, opts.defaultTs);
+    if (Object.keys(rawAppRunnables).length === 0) {
+      rawAppRunnables = (appFile as RawAppFile).runnables ?? {};
+    }
+  }
+
+  const appValue = rawApp ? rawAppRunnables : (appFile as NormalAppFile).value;
   const folderNormalized = appFolder.replaceAll(SEP, "/");
 
   let filteredDeps: Record<string, string> = {};
@@ -199,15 +215,7 @@ export async function generateAppLocksInternal(
       const hashes = await generateAppHash({}, appFolder, rawApp, opts.defaultTs);
       const isDirectlyStale = await isAppDirectlyStale(appFolder, hashes, conf);
 
-      // For raw apps in new format, runnables are in separate files under backend/
-      let treeAppValue = structuredClone(appValue);
-      if (rawApp) {
-        const runnablesPath = path.join(appFolder, APP_BACKEND_FOLDER);
-        const runnablesFromFiles = await loadRunnablesFromBackend(runnablesPath);
-        if (Object.keys(runnablesFromFiles).length > 0) {
-          treeAppValue = runnablesFromFiles;
-        }
-      }
+      const treeAppValue = structuredClone(appValue);
 
       // First pass: add inline scripts as separate nodes, then add app node importing them
       const inlineScriptPaths: string[] = [];
@@ -303,23 +311,13 @@ export async function generateAppLocksInternal(
       }
 
       if (rawApp) {
-        const runnablesPath = path.join(appFolder, APP_BACKEND_FOLDER);
-
-        // Load runnables from separate files (new format) or fall back to raw_app.yaml (old format)
-        const rawAppFile = appFile as RawAppFile;
-        let runnables = await loadRunnablesFromBackend(runnablesPath);
-        if (Object.keys(runnables).length === 0 && rawAppFile.runnables) {
-          // Fall back to old format
-          runnables = rawAppFile.runnables;
-        }
-
         // Replace inline scripts for changed runnables
-        replaceInlineScripts(runnables, runnablesPath + SEP, false);
+        replaceInlineScripts(rawAppRunnables, runnablesFolder + SEP, false);
 
         // Update the app runnables with new locks (writes to separate files)
         updatedScripts = await updateRawAppRunnables(
           workspace,
-          runnables,
+          rawAppRunnables,
           remote_path,
           appFolder,
           filteredDeps,
diff --git a/cli/src/commands/app/bundle_command.ts b/cli/src/commands/app/bundle_command.ts
new file mode 100644
index 0000000000..bef13f4268
--- /dev/null
+++ b/cli/src/commands/app/bundle_command.ts
@@ -0,0 +1,72 @@
+import { Command } from "@cliffy/command";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import process from "node:process";
+import * as log from "../../core/log.ts";
+import { colors } from "@cliffy/ansi/colors";
+import { createBundle, detectFrameworks } from "./bundle.ts";
+
+interface BundleOptions {
+  out?: string;
+  minify?: boolean;
+}
+
+/** Every entry point a raw app may have, most specific first, with the
+ * framework's preferred one promoted — Svelte and Vue mount from a `.ts`. */
+function entryPointFor(appDir: string): string {
+  const frameworks = detectFrameworks(appDir);
+  const candidates = frameworks.svelte || frameworks.vue
+    ? ["index.ts", "index.tsx", "index.js"]
+    : ["index.tsx", "index.ts", "index.js"];
+  const entry = candidates.find((c) => fs.existsSync(path.join(appDir, c)));
+  if (!entry) {
+    throw new Error(
+      `No entry point in ${appDir}: expected one of ${candidates.join(", ")}`,
+    );
+  }
+  return path.join(appDir, entry);
+}
+
+/**
+ * Bundle a raw app folder without deploying it. `wmill app push` bundles as part
+ * of deploying; this exposes the same build on its own, so anything that needs a
+ * raw app's js/css — the server-side bundler behind `/apps/update_raw_source`,
+ * most of all — runs this exact build rather than reimplementing it.
+ *
+ * The result goes to files, not stdout: the build logs to stdout as it runs, so
+ * a caller can't read the bundle off the pipe.
+ */
+async function bundleApp(opts: BundleOptions, appFolder?: string) {
+  const appDir = path.resolve(appFolder ?? process.cwd());
+
+  const { js, css } = await createBundle({
+    entryPoint: entryPointFor(appDir),
+    production: true,
+    minify: opts.minify ?? true,
+    // Same as `wmill app push`: the workspace's shared UI is `ui/` under the
+    // directory the command runs from, not under the app.
+    sharedUiDir: path.join(process.cwd(), "ui"),
+    // createBundle removes its own outDir when it is done, and it resolves the
+    // path against cwd — so name one that is ours to delete rather than let it
+    // default to `dist`, which is very likely the caller's.
+    outDir: `.wmill-bundle-${process.pid}`,
+  });
+
+  const outDir = path.resolve(opts.out ?? path.join(appDir, "dist"));
+  fs.mkdirSync(outDir, { recursive: true });
+  fs.writeFileSync(path.join(outDir, "bundle.js"), js);
+  fs.writeFileSync(path.join(outDir, "bundle.css"), css);
+  log.info(colors.green(`Wrote bundle.js and bundle.css to ${outDir}`));
+}
+
+const command = new Command()
+  .description("Bundle a raw app folder to js/css without deploying it")
+  .arguments("[app_folder:string]")
+  .option(
+    "--out <dir:string>",
+    "Directory to write bundle.js and bundle.css into (default: <app_folder>/dist)",
+  )
+  .option("--no-minify", "Skip minification")
+  .action(bundleApp as any);
+
+export default command;
diff --git a/cli/src/commands/app/dev.ts b/cli/src/commands/app/dev.ts
index 1842e1d007..b45666a1e1 100644
--- a/cli/src/commands/app/dev.ts
+++ b/cli/src/commands/app/dev.ts
@@ -48,7 +48,21 @@ import {
   hasFolderSuffix,
   loadNonDottedPathsSetting,
 } from "../../utils/resource_folders.ts";
+import {
+  createRecorderShellHTML,
+  DEV_RECORDER_BUNDLE,
+  isOwnOrigin,
+  isRecordingFileName,
+  RECORDER_BUNDLE_PATH,
+  RECORDER_SAVE_PATH,
+  RECORDER_SHELL_PATH,
+  recordingFileName,
+  RECORDINGS_FOLDER,
+} from "./devRecorder.ts";
 
+// Resolved once per `wmill app dev` run from wmill.yaml; a bare `.ts` under
+// backend/ denotes this runtime, so readers must agree with the path assigner.
+let defaultTs: "bun" | "deno" = "bun";
 const DEFAULT_PORT = 4000;
 const DEFAULT_HOST = "localhost";
 
@@ -330,6 +344,7 @@ interface DevOptions extends GlobalOptions {
   host?: string;
   entry?: string;
   open?: boolean;
+  recording?: boolean;
 }
 
 async function dev(opts: DevOptions, appFolder?: string) {
@@ -406,6 +421,7 @@ async function dev(opts: DevOptions, appFolder?: string) {
       : originalCwd;
     const relAppFolder = path.relative(workspaceRoot, targetDir) || ".";
     const mergedOpts = await mergeConfigWithConfigFile(opts);
+    defaultTs = mergedOpts.defaultTs ?? "bun";
     const codebases = await listSyncCodebases(mergedOpts);
     const { buildPreviewTempScriptRefs } = await import(
       "../generate-metadata/generate-metadata.ts"
@@ -491,7 +507,10 @@ async function dev(opts: DevOptions, appFolder?: string) {
   // change to trigger the watcher).
   const inferredSchemas: Record<string, any> = {};
   try {
-    Object.assign(inferredSchemas, await inferAllInlineSchemas(process.cwd()));
+    Object.assign(
+      inferredSchemas,
+      await inferAllInlineSchemas(process.cwd(), defaultTs),
+    );
   } catch (err: any) {
     log.warn(
       colors.yellow(
@@ -508,6 +527,7 @@ async function dev(opts: DevOptions, appFolder?: string) {
   try {
     const initialRunnables = await loadRunnablesFromBackend(
       path.join(process.cwd(), APP_BACKEND_FOLDER),
+      defaultTs,
     );
     Object.assign(
       pathRunnableSchemas,
@@ -529,6 +549,23 @@ async function dev(opts: DevOptions, appFolder?: string) {
     fs.mkdirSync(distDir);
   }
 
+  // Session recording: the app moves into an iframe of a shell page holding the
+  // recorder toolbar, and finished recordings land in the app folder.
+  const recordingEnabled = opts.recording ?? false;
+  const recordingsDir = path.join(process.cwd(), RECORDINGS_FOLDER);
+  // The player is a page of the instance this app is developed against, so the
+  // recording it fetches from here crosses origins.
+  const playerBaseUrl = workspace.remote.endsWith("/")
+    ? workspace.remote
+    : `${workspace.remote}/`;
+  const playerOrigin = (() => {
+    try {
+      return new URL(playerBaseUrl).origin;
+    } catch {
+      return undefined;
+    }
+  })();
+
   // SSE clients for live reload
   const clients: http.ServerResponse[] = [];
 
@@ -675,6 +712,7 @@ async function dev(opts: DevOptions, appFolder?: string) {
           const result = await inferRunnableSchemaFromFile(
             process.cwd(),
             relativeToRunnables,
+            defaultTs,
           );
           if (result) {
             // Store inferred schema in memory
@@ -712,10 +750,152 @@ async function dev(opts: DevOptions, appFolder?: string) {
     );
   }
 
+  // Same ceiling the player refuses to load past, so nothing is written here
+  // that could not be replayed.
+  const MAX_RECORDING_BYTES = 100 * 1024 * 1024;
+
+  function sendJson(res: http.ServerResponse, status: number, body: unknown) {
+    res.writeHead(status, { "Content-Type": "application/json" });
+    res.end(JSON.stringify(body));
+  }
+
+  /** Write the recording under a name nothing else holds. `wx` is what makes
+   * this safe: two tabs stopping in the same millisecond both create, and the
+   * loser retries rather than overwriting the winner. */
+  async function writeRecording(body: string): Promise<string> {
+    const now = new Date();
+    for (let attempt = 0; attempt < 100; attempt++) {
+      const file = recordingFileName(now, attempt);
+      try {
+        await fs.promises.writeFile(path.join(recordingsDir, file), body, {
+          flag: "wx",
+        });
+        return file;
+      } catch (error: any) {
+        if (error?.code !== "EEXIST") throw error;
+      }
+    }
+    throw new Error("Could not find a free recording file name");
+  }
+
+  function saveRecording(req: http.IncomingMessage, res: http.ServerResponse) {
+    if (!isOwnOrigin(req.headers.origin, req.headers.host)) {
+      sendJson(res, 403, { error: "Cross-origin recording upload refused" });
+      return;
+    }
+    const chunks: Buffer[] = [];
+    let size = 0;
+    let refused = false;
+    // An upload cut short (by the refusal below, or by the browser) raises
+    // 'error' on the request, which unhandled takes the dev server down.
+    req.on("error", (error: Error) => {
+      if (!refused) {
+        log.warn(colors.yellow(`Recording upload failed: ${error.message}`));
+      }
+    });
+    req.on("data", (chunk: Buffer) => {
+      if (refused) return;
+      size += chunk.length;
+      if (size > MAX_RECORDING_BYTES) {
+        refused = true;
+        // Torn down only once the 413 is on the wire: destroying the socket
+        // first loses the response the browser is waiting to read.
+        res.on("finish", () => req.destroy());
+        sendJson(res, 413, {
+          error: `Recording exceeds ${MAX_RECORDING_BYTES} bytes`,
+        });
+        return;
+      }
+      chunks.push(chunk);
+    });
+    req.on("end", async () => {
+      if (refused) return;
+      const body = Buffer.concat(chunks).toString("utf-8");
+      try {
+        JSON.parse(body);
+      } catch {
+        sendJson(res, 400, { error: "Body is not valid JSON" });
+        return;
+      }
+      let file: string;
+      try {
+        await fs.promises.mkdir(recordingsDir, { recursive: true });
+        file = await writeRecording(body);
+      } catch (error: any) {
+        log.error(colors.red(`Failed to save recording: ${error.message}`));
+        sendJson(res, 500, { error: error.message });
+        return;
+      }
+      log.info(
+        colors.green(
+          `🎬 Recording saved to ${path.join(RECORDINGS_FOLDER, file)}`,
+        ),
+      );
+      log.info(
+        colors.gray(
+          `   Replay it at ${playerBaseUrl}replay (open the file, or use ?src=)`,
+        ),
+      );
+      sendJson(res, 200, { file });
+    });
+  }
+
+  function serveRecording(url: string, res: http.ServerResponse) {
+    const file = url.slice(RECORDER_SAVE_PATH.length + 1);
+    if (!isRecordingFileName(file)) {
+      sendJson(res, 400, { error: "Invalid recording name" });
+      return;
+    }
+    const filePath = path.join(recordingsDir, file);
+    if (!fs.existsSync(filePath)) {
+      sendJson(res, 404, { error: "Recording not found" });
+      return;
+    }
+    res.writeHead(200, {
+      "Content-Type": "application/json",
+      // The player runs on the instance, not on the dev server: without this it
+      // can fetch the recording but never read it.
+      ...(playerOrigin ? { "Access-Control-Allow-Origin": playerOrigin } : {}),
+    });
+    // Streamed: a recording is megabytes, and this server also carries the app,
+    // its live reload and every runnable call.
+    fs.createReadStream(filePath).on("error", () => res.end()).pipe(res);
+  }
+
   // Create HTTP server
   const server = http.createServer((req, res) => {
     const url = req.url || "/";
 
+    if (recordingEnabled) {
+      const pathname = url.split("?")[0];
+      if (pathname === RECORDER_BUNDLE_PATH) {
+        res.writeHead(200, { "Content-Type": "application/javascript" });
+        res.end(DEV_RECORDER_BUNDLE);
+        return;
+      }
+      if (pathname === RECORDER_SAVE_PATH && req.method === "POST") {
+        saveRecording(req, res);
+        return;
+      }
+      if (
+        pathname.startsWith(`${RECORDER_SAVE_PATH}/`) && req.method === "GET"
+      ) {
+        serveRecording(pathname, res);
+        return;
+      }
+      if (pathname === RECORDER_SHELL_PATH) {
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end(
+          createRecorderShellHTML({
+            appPath,
+            workspace: workspaceId,
+            playerBaseUrl,
+          }),
+        );
+        return;
+      }
+    }
+
     // SSE endpoint for live reload
     if (url === "/__events") {
       res.writeHead(200, {
@@ -1350,18 +1530,29 @@ async function dev(opts: DevOptions, appFolder?: string) {
 
   server.listen(port, host, () => {
     const url = `http://${host}:${port}`;
+    // The toolbar lives beside the app, not in front of it, so recording mode
+    // is what the browser should land on.
+    const openUrl = recordingEnabled ? `${url}${RECORDER_SHELL_PATH}` : url;
     log.info(colors.bold.green(`🚀 Dev server running at ${url}`));
     log.info(
       colors.cyan(`🔌 WebSocket server running at ws://${host}:${port}`),
     );
     log.info(colors.gray(`📦 Serving files from: ${process.cwd()}`));
-    log.info(colors.gray(`🔄 Live reload enabled\n`));
+    log.info(colors.gray(`🔄 Live reload enabled`));
+    if (recordingEnabled) {
+      log.info(
+        colors.magenta(
+          `🎬 Session recording at ${openUrl} : press Record in the toolbar. Recordings are saved to ${RECORDINGS_FOLDER}/`,
+        ),
+      );
+    }
+    log.info("");
 
     // Open browser if requested
     if (shouldOpen) {
       try {
         open
-          .openApp(open.apps.browser, { arguments: [url] })
+          .openApp(open.apps.browser, { arguments: [openUrl] })
           .catch((error: any) => {
             log.error(
               colors.yellow(
@@ -1414,6 +1605,10 @@ const command = new Command()
     "Entry point file (default: index.ts for Svelte/Vue, index.tsx otherwise)",
   )
   .option("--no-open", "Don't automatically open the browser")
+  .option(
+    "--recording",
+    "Frame the app in a shell with a Record button, to capture a replayable session recording of the app under development",
+  )
   .action(dev as any);
 
 export default command;
@@ -1437,7 +1632,7 @@ async function genRunnablesTs(
   const backendPath = path.join(localPath, APP_BACKEND_FOLDER);
 
   // Load runnables from separate files (new format) or fall back to raw_app.yaml (old format)
-  let runnables = await loadRunnablesFromBackend(backendPath);
+  let runnables = await loadRunnablesFromBackend(backendPath, defaultTs);
 
   if (Object.keys(runnables).length === 0) {
     // Fall back to old format
@@ -1581,7 +1776,7 @@ async function loadRunnables(): Promise<Record<string, Runnable>> {
     const backendPath = path.join(localPath, APP_BACKEND_FOLDER);
 
     // Load runnables from separate files (new format) or fall back to raw_app.yaml (old format)
-    let runnables = await loadRunnablesFromBackend(backendPath);
+    let runnables = await loadRunnablesFromBackend(backendPath, defaultTs);
 
     if (Object.keys(runnables).length === 0) {
       // Fall back to old format
diff --git a/cli/src/commands/app/devRecorder.ts b/cli/src/commands/app/devRecorder.ts
new file mode 100644
index 0000000000..dc7b6e5032
--- /dev/null
+++ b/cli/src/commands/app/devRecorder.ts
@@ -0,0 +1,270 @@
+/**
+ * `wmill app dev --recording`: a shell page that frames the app under
+ * development and records the session with the same recorder the Windmill UI
+ * uses, so a locally-built app can be demoed without deploying it first.
+ *
+ * The shell holds the toolbar rather than the app page: the recorder snapshots
+ * the framed document on every mutation, and a toolbar living in that document
+ * would record itself. It also lives at its own path, so the app keeps the root
+ * URL its router and its own links expect.
+ */
+import { DEV_RECORDER_BUNDLE } from "./devRecorderBundle.gen.ts";
+
+/** Path the bundled recorder is served from. */
+export const RECORDER_BUNDLE_PATH = "/__wm_recorder.js";
+/** Path the toolbar shell is served from. Not the root: the app stays there, so
+ * a link or a router push to `/` inside it reloads the app rather than nesting
+ * another shell in the frame. */
+export const RECORDER_SHELL_PATH = "/__record";
+/** Recordings are POSTed here and served back from `<path>/<file>`. */
+export const RECORDER_SAVE_PATH = "/__recordings";
+
+export { DEV_RECORDER_BUNDLE };
+export { RECORDINGS_FOLDER } from "./app_metadata.ts";
+
+/** Whether a request to the save route came from the shell this server serves.
+ * A cross-site POST carrying JSON under a simple content type (`text/plain`)
+ * needs no preflight, so without this any page open in the developer's browser
+ * could write files into the app folder. Compared against the `Host` the browser
+ * actually reached us on, since the shell is equally `localhost`, `127.0.0.1` or
+ * whatever `--host` binds. */
+export function isOwnOrigin(
+  origin: string | undefined,
+  host: string | undefined,
+): boolean {
+  // Absent on a same-origin request in some browsers, and on non-browser
+  // clients (curl, a script); a forged one is no worse than no header at all.
+  if (origin === undefined) return true;
+  if (host === undefined) return false;
+  try {
+    return new URL(origin).host === host;
+  } catch {
+    return false;
+  }
+}
+
+/** Name a recording after the moment it was saved. Millisecond resolution plus
+ * the caller's collision retry: two tabs stopping together must not have one
+ * silently overwrite the other. */
+export function recordingFileName(now: Date, attempt = 0): string {
+  const stamp = now.toISOString().slice(0, 23).replace(/[:T.]/g, "-");
+  return `recording-${stamp}${attempt > 0 ? `-${attempt}` : ""}.json`;
+}
+
+/** Names the read route accepts. Rejects every separator and escape, so the
+ * name can only ever resolve inside the recordings folder. */
+export function isRecordingFileName(file: string): boolean {
+  return /^[A-Za-z0-9._-]+\.json$/.test(file) && !file.includes("..");
+}
+
+export function createRecorderShellHTML(opts: {
+  appPath: string;
+  workspace: string;
+  /** Base URL of the Windmill instance, for the "Open in player" link. */
+  playerBaseUrl?: string;
+}): string {
+  // `<` escaped: this lands inside an inline <script>, where a `</script>` in
+  // any value (the app path comes from raw_app.yaml) would end the block.
+  const config = JSON.stringify({
+    appPath: opts.appPath,
+    workspace: opts.workspace,
+    playerBaseUrl: opts.playerBaseUrl ?? null,
+    savePath: RECORDER_SAVE_PATH,
+  }).replace(/</g, "\\u003c");
+  return `
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Windmill App Dev Recording</title>
+  <style>
+    * { margin: 0; padding: 0; box-sizing: border-box; }
+    html, body { height: 100%; }
+    body {
+      display: flex;
+      flex-direction: column;
+      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', 'Roboto', sans-serif;
+      background: #18181b;
+    }
+    #wm-rec-bar {
+      display: flex;
+      align-items: center;
+      gap: 12px;
+      padding: 8px 12px;
+      color: #e4e4e7;
+      font-size: 13px;
+      border-bottom: 1px solid #27272a;
+      flex-wrap: wrap;
+    }
+    #wm-rec-bar button, #wm-rec-bar a.wm-rec-action {
+      font: inherit;
+      display: inline-flex;
+      align-items: center;
+      gap: 6px;
+      padding: 5px 12px;
+      border-radius: 6px;
+      border: 1px solid #3f3f46;
+      background: #27272a;
+      color: #e4e4e7;
+      cursor: pointer;
+      text-decoration: none;
+    }
+    #wm-rec-bar button:hover, #wm-rec-bar a.wm-rec-action:hover { background: #3f3f46; }
+    #wm-rec-bar button:disabled { opacity: 0.5; cursor: not-allowed; }
+    #wm-rec-toggle.recording { background: #dc2626; border-color: #dc2626; color: white; }
+    #wm-rec-toggle.recording:hover { background: #b91c1c; }
+    .wm-rec-dot { width: 8px; height: 8px; border-radius: 50%; background: #dc2626; }
+    #wm-rec-toggle.recording .wm-rec-dot { background: white; }
+    #wm-rec-status { color: #a1a1aa; }
+    #wm-rec-hint { margin-left: auto; color: #71717a; font-size: 12px; }
+    #wm-rec-hint code { background: #27272a; padding: 1px 5px; border-radius: 4px; }
+    #wm-rec-frame { flex: 1; width: 100%; border: 0; background: white; }
+    [hidden] { display: none !important; }
+  </style>
+</head>
+<body>
+  <div id="wm-rec-bar">
+    <button id="wm-rec-toggle"><span class="wm-rec-dot"></span><span id="wm-rec-toggle-label">Record</span></button>
+    <span id="wm-rec-status">Not recording</span>
+    <a id="wm-rec-open" class="wm-rec-action" target="_blank" rel="noopener" hidden>Open in player</a>
+    <button id="wm-rec-download" hidden>Download JSON</button>
+    <span id="wm-rec-hint">Passwords are masked. Mark sensitive elements with <code>data-wm-no-record</code></span>
+  </div>
+  <iframe id="wm-rec-frame" src="/"></iframe>
+  <script src="${RECORDER_BUNDLE_PATH}"></script>
+  <script>
+    (function () {
+      var config = ${config};
+      var iframe = document.getElementById('wm-rec-frame');
+      var toggle = document.getElementById('wm-rec-toggle');
+      var toggleLabel = document.getElementById('wm-rec-toggle-label');
+      var status = document.getElementById('wm-rec-status');
+      var openLink = document.getElementById('wm-rec-open');
+      var downloadBtn = document.getElementById('wm-rec-download');
+      var recorder = window.__wmillRecorder.createRawAppRecording();
+      var recording = null;
+      var ticker = null;
+
+      // The dev-server shim posts both the request and its answer up to the
+      // shell; the recorder reads the answer off the framed window, the way the
+      // deployed runner delivers it. Relaying is what makes a step wait for the
+      // job it launched instead of recording the spinner.
+      var pending = [];
+      var stranded = [];
+      window.addEventListener('message', function (e) {
+        var frameWindow = iframe.contentWindow;
+        if (!frameWindow || e.source !== frameWindow) return;
+        var data = e.data;
+        if (!data || typeof data.type !== 'string') return;
+        // A fresh document announced itself, so every call the previous one had
+        // in flight died with its WebSocket.
+        if (data.type === 'wmillDevReady') {
+          stranded = stranded.concat(pending);
+          pending = [];
+          return;
+        }
+        if (data.reqId === undefined) return;
+        if (!/Res$/.test(data.type)) {
+          pending.push(data.reqId);
+          return;
+        }
+        pending = pending.filter(function (id) { return id !== data.reqId });
+        frameWindow.postMessage(data, window.location.origin);
+      });
+
+      // The recorder keeps a reload's outstanding request ids on purpose (a
+      // deployed app is answered by its parent, which survives). Here the answer
+      // died with the frame's WebSocket, so Stop would wait out the whole job
+      // budget unless the shell settles them. Deferred past the load handlers:
+      // the recorder rebinds its listener onto the new document in one of them.
+      iframe.addEventListener('load', function () {
+        if (stranded.length === 0) return;
+        var ids = stranded;
+        stranded = [];
+        setTimeout(function () {
+          var frameWindow = iframe.contentWindow;
+          if (!frameWindow) return;
+          ids.forEach(function (reqId) {
+            frameWindow.postMessage({ type: 'unloadRes', reqId: reqId }, window.location.origin);
+          });
+        }, 0);
+      });
+
+      function setStatus(text) { status.textContent = text; }
+
+      function steps(n) { return n + (n === 1 ? ' step' : ' steps'); }
+
+      function tick() {
+        // Stop can wait a minute on a runnable the last step launched, so the
+        // toolbar has to say what it is waiting for rather than look wedged.
+        if (recorder.stopping) setStatus('Waiting for the last job to finish…');
+        else if (recorder.active) {
+          setStatus('Recording: ' + steps(recorder.stepCount));
+        }
+      }
+
+      function start() {
+        recording = null;
+        openLink.hidden = true;
+        downloadBtn.hidden = true;
+        if (!recorder.start(iframe, { appPath: config.appPath, workspace: config.workspace })) {
+          setStatus('Cannot record: the app document is unreachable');
+          return;
+        }
+        toggle.classList.add('recording');
+        toggleLabel.textContent = 'Stop';
+        tick();
+        ticker = setInterval(tick, 250);
+      }
+
+      async function stop() {
+        toggle.disabled = true;
+        setStatus('Finishing…');
+        // The ticker outlives the click: it is what reports the drain below.
+        recording = await recorder.stop();
+        clearInterval(ticker);
+        ticker = null;
+        toggle.classList.remove('recording');
+        toggleLabel.textContent = 'Record';
+        downloadBtn.hidden = false;
+        setStatus(steps(recording.steps.length) + ' recorded');
+        // Only now: starting a fresh recording drops the one being uploaded.
+        await save();
+        toggle.disabled = false;
+      }
+
+      async function save() {
+        try {
+          var res = await fetch(config.savePath, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(recording)
+          });
+          var body = await res.json();
+          if (!res.ok) throw new Error(body.error || res.statusText);
+          setStatus(steps(recording.steps.length) + ' saved to ' + body.file);
+          if (config.playerBaseUrl) {
+            var src = window.location.origin + config.savePath + '/' + body.file;
+            openLink.href = config.playerBaseUrl + 'replay?src=' + encodeURIComponent(src);
+            openLink.hidden = false;
+          }
+        } catch (e) {
+          setStatus('Recorded, but saving failed: ' + (e && e.message ? e.message : e));
+        }
+      }
+
+      toggle.addEventListener('click', function () {
+        if (recorder.active) stop();
+        else start();
+      });
+
+      downloadBtn.addEventListener('click', function () {
+        if (recording) recorder.download(recording);
+      });
+    })();
+  </script>
+</body>
+</html>
+`;
+}
diff --git a/cli/src/commands/app/devRecorderBundle.gen.ts b/cli/src/commands/app/devRecorderBundle.gen.ts
new file mode 100644
index 0000000000..0e7f004b4b
--- /dev/null
+++ b/cli/src/commands/app/devRecorderBundle.gen.ts
@@ -0,0 +1,15 @@
+// Generated by cli/generate-dev-recorder.ts. Do not edit.
+// Run `bun run gen:dev-recorder` from cli/ to rebuild it from
+// frontend/src/lib/components/recording/.
+
+/** Repo-relative sources bundled below. */
+export const DEV_RECORDER_SOURCES = [
+  "frontend/src/lib/components/recording/rawAppRecording.svelte.ts",
+  "frontend/src/lib/components/recording/rawAppSnapshot.ts"
+];
+
+/** SHA-256 of those sources, as of this build. */
+export const DEV_RECORDER_SOURCE_HASH = "c93b8b23455528be0a03da303fb573536bd3f0b8386e6f5f1078a6b988f59082";
+
+/** IIFE exposing `createRawAppRecording` on `window.__wmillRecorder`. */
+export const DEV_RECORDER_BUNDLE = "var __wmillRecorder=(()=>{var ne=Object.defineProperty;var Fe=Object.getOwnPropertyDescriptor;var Xe=Object.getOwnPropertyNames;var Be=Object.prototype.hasOwnProperty;var je=(t,o)=>{for(var n in o)ne(t,n,{get:o[n],enumerable:!0})},Ke=(t,o,n,s)=>{if(o&&typeof o==\"object\"||typeof o==\"function\")for(let l of Xe(o))!Be.call(t,l)&&l!==n&&ne(t,l,{get:()=>o[l],enumerable:!(s=Fe(o,l))||s.enumerable});return t};var We=t=>Ke(ne({},\"__esModule\",{value:!0}),t);var mt={};je(mt,{createRawAppRecording:()=>Ie});var G=\"data-wm-rec-target\",D=\"data-wm-no-record\";function Ye(t,o){let n=(u,c,f)=>{let d=f.trim();if(!d||/^(data:|blob:|about:|https?:|\\/\\/|#)/i.test(d))return u;try{return`url(${c}${new URL(d,o).href}${c})`}catch{return u}},s=\"\",l=0;for(;l<t.length;){let u=t[l];if(u==='\"'||u===\"'\"){let c=Ve(t,l);s+=t.slice(l,c),l=c}else if(u===\"/\"&&t[l+1]===\"*\"){let c=t.indexOf(\"*/\",l+2),f=c===-1?t.length:c+2;s+=t.slice(l,f),l=f}else{let c=/^url\\(\\s*(['\"]?)([^'\")]+)\\1\\s*\\)/i.exec(t.slice(l));c?(s+=n(c[0],c[1],c[2]),l+=c[0].length):(s+=u,l++)}}return s}function Ve(t,o){let n=t[o],s=o+1;for(;s<t.length;)if(t[s]===\"\\\\\")s+=2;else{if(t[s]===n)return s+1;s++}return t.length}function C(t){return!!t&&typeof t==\"object\"&&t.nodeType===1}function g(t,o){return t.tagName===o}function Y(t){return t?\"\\u2022\\u2022\\u2022\\u2022\\u2022\\u2022\\u2022\\u2022\":\"\"}function re(t,o){let n=[],s=o;for(;s&&s!==t;){let l=s.parentElement;if(!l)return;n.unshift(Array.prototype.indexOf.call(l.children,s)),s=l}return s===t?n:void 0}function ie(t,o){let n=t;for(let s of o)if(n=n?.children[s],!n)return;return n}var ze=new Set([\"class\",\"colspan\",\"cols\",\"disabled\",\"height\",\"hidden\",\"id\",\"multiple\",\"open\",\"readonly\",\"rows\",\"rowspan\",\"size\",\"type\",\"width\"]);function _(t){return!!t.closest(`[${D}]`)}function Ae(t){let o=t.tagName.toLowerCase(),n=(t.getAttribute(\"type\")??\"text\").toLowerCase();return`${o===\"input\"?`input[${n}]`:o} (redacted)`}var Te=String.raw`(?:[-\\w\\u00a0-\\uffff]|\\\\[0-9a-fA-F]{1,6}[ \\t\\r\\n\\f]?|\\\\[^\\r\\n\\f0-9a-fA-F])`,Ge=new RegExp(String.raw`\\.(${Te}+)`,\"g\"),Je=new RegExp(String.raw`#(${Te}+)`,\"g\");function Ee(t){return t.replace(/\\\\([0-9a-fA-F]{1,6})[ \\t\\r\\n\\f]?|\\\\([^])/g,(o,n,s)=>n?String.fromCodePoint(parseInt(n,16)):s)}function Qe(t){let o=new Set,n=new Set;for(let s of Array.from(t.querySelectorAll(\"style\"))){if(_(s))continue;let l=s.textContent??\"\";for(let u of l.matchAll(Ge))o.add(Ee(u[1]));for(let u of l.matchAll(Je))n.add(Ee(u[1]))}return{classes:o,ids:n}}function Ze(t,o){let n=Qe(o),s=[...o.hasAttribute(D)?[o]:[],...Array.from(o.querySelectorAll(`[${D}]`))];for(let l of s){l.replaceChildren(t.createTextNode(\"\\u2022\\u2022\\u2022\")),l.setAttribute(D,\"\");for(let u of Array.from(l.attributes)){if(u.name===D)continue;let c=u.localName.toLowerCase();if(!ze.has(c))l.removeAttributeNode(u);else if(c===\"class\"){let f=u.value.split(/\\s+/).filter(d=>d&&n.classes.has(d));f.length?l.setAttribute(\"class\",f.join(\" \")):l.removeAttributeNode(u)}else c===\"id\"&&!n.ids.has(u.value)&&l.removeAttributeNode(u)}}}var et=4e6,tt=8e6;function nt(t,o){let n=t.querySelectorAll(\"canvas\"),s=o.querySelectorAll(\"canvas\");if(n.length!==s.length)return;let l=tt;for(let u=0;u<n.length;u++){let c=n[u];if(!c.width||!c.height)continue;let f=c.width*c.height;if(f>et||f>l)continue;l-=f;let d;try{d=c.toDataURL(\"image/webp\",.85)}catch{continue}if(!d.startsWith(\"data:image/\"))continue;let m=c.getBoundingClientRect();if(!m.width||!m.height)continue;let y=t.defaultView?.getComputedStyle(c).display,v=!y||y===\"inline\"?\"inline-block\":y,F=s[u],X=F.getAttribute(\"style\");F.setAttribute(\"style\",`${X?X+\";\":\"\"}display:${v};box-sizing:border-box;width:${m.width}px;height:${m.height}px;background-image:url(\"${d}\");background-size:100% 100%;background-repeat:no-repeat`)}}function rt(t,o){let n=t.querySelectorAll(\"select\"),s=o.querySelectorAll(\"select\");if(n.length===s.length)for(let l=0;l<n.length;l++){let u=n[l];if(!Array.from(u.selectedOptions).some(f=>_(f)))continue;let c=t.createElement(\"option\");c.setAttribute(\"selected\",\"\"),c.textContent=\"\\u2022\\u2022\\u2022\",s[l].replaceChildren(c)}}function it(t,o){let n=\"input, textarea, select\",s=t.querySelectorAll(n),l=o.querySelectorAll(n);if(s.length===l.length)for(let u=0;u<s.length;u++){let c=s[u],f=l[u];if(c.tagName!==f.tagName)return;if(g(c,\"INPUT\")){let d=c,m=f;d.type===\"checkbox\"||d.type===\"radio\"?d.checked?m.setAttribute(\"checked\",\"\"):m.removeAttribute(\"checked\"):d.type===\"password\"||_(d)?m.setAttribute(\"value\",Y(d.value)):d.type!==\"file\"&&m.setAttribute(\"value\",d.value)}else if(g(c,\"TEXTAREA\"))f.textContent=c.value;else if(g(c,\"SELECT\")){let d=c,m=f;for(let y=0;y<d.options.length;y++){let v=m.options[y];v&&(d.options[y].selected?v.setAttribute(\"selected\",\"\"):v.removeAttribute(\"selected\"))}}}}function be(t){return Array.from(t).map(o=>{let n=o.styleSheet;if(!n)return o.cssText;try{let s=be(n.cssRules),l=n.media?.mediaText;return l?`@media ${l} {\n${s}\n}`:s}catch{return o.cssText}}).join(`\n`)}function ot(t,o){let n=be(o);t.href&&(n=Ye(n,t.href));let s=t.media?.mediaText;return s&&(n=`@media ${s} {\n${n}\n}`),n}function st(t,o,n){for(let s of Array.from(t.styleSheets)){let l=s.ownerNode;if(!C(l))continue;if(s.disabled){let m=re(o,l),y=m?ie(n,m):void 0;y&&(y.setAttribute(\"media\",\"not all\"),y.tagName===\"STYLE\"&&(y.textContent=\"\"));continue}if(_(l))continue;let u;try{let m=s.cssRules;if(!m)continue;u=m}catch{continue}let c=re(o,l);if(!c)continue;let f=ie(n,c);if(!f)continue;let d=ot(s,u);if(l.tagName===\"LINK\"){let m=t.createElement(\"style\");m.textContent=d,f.replaceWith(m)}else l.tagName===\"STYLE\"&&(f.textContent=d)}}function Se(t,o={}){let n=t.documentElement,s=n.cloneNode(!0);if(it(t,s),st(t,n,s),nt(t,s),rt(t,s),Ze(t,s),o.target){let d=re(n,o.target);(d?ie(s,d):void 0)?.setAttribute(G,\"\")}s.querySelectorAll(\"template, noscript\").forEach(d=>d.remove()),s.querySelectorAll(\"script\").forEach(d=>d.remove()),s.querySelectorAll('meta[http-equiv=\"refresh\" i]').forEach(d=>d.remove()),s.querySelectorAll(\"*\").forEach(d=>{for(let m of Array.from(d.attributes))m.name.toLowerCase().startsWith(\"on\")&&d.removeAttribute(m.name)});let l=t.defaultView,u=Math.round(l?.scrollY??t.documentElement.scrollTop??0),c=Math.round(l?.scrollX??t.documentElement.scrollLeft??0);if(u>0||c>0){let d=t.createElement(\"style\");d.textContent=`html { margin-top: -${u}px !important; margin-left: -${c}px !important; }`,s.querySelector(\"head\")?.appendChild(d)}let f=s.querySelector(\"head\");if(o.baseHref&&f&&!f.querySelector(\"base\")){let d=t.createElement(\"base\");d.setAttribute(\"href\",o.baseHref),f.prepend(d)}return`<!DOCTYPE html>${s.outerHTML}`}var gt=`[${G}] {\n\toutline: 3px solid #ef4444 !important;\n\toutline-offset: 2px !important;\n\tbox-shadow: 0 0 0 6px rgba(239, 68, 68, 0.25) !important;\n}`;function oe(t){if(!t||_(t))return\"\";let o=t;return t.querySelector(`[${D}]`)&&(o=t.cloneNode(!0),o.querySelectorAll(`[${D}]`).forEach(n=>n.remove())),(o.textContent??\"\").replace(/\\s+/g,\" \").trim()}function ye(t,o=40){let n=oe(t);return n.length>o?`${n.slice(0,o)}\\u2026`:n}function we(t){let o=t.tagName.toLowerCase(),n=(t.getAttribute(\"type\")??\"text\").toLowerCase(),s=o===\"input\"?`input[${n}]`:o,l=t.labels?.[0],u=t.getAttribute(\"aria-label\")||(l&&!_(l)?ye(l):\"\")||(o===\"input\"&&[\"button\",\"submit\",\"reset\"].includes(n)?t.getAttribute(\"value\"):\"\")||t.getAttribute(\"placeholder\")||t.getAttribute(\"title\")||ye(t)||t.getAttribute(\"name\")||t.getAttribute(\"id\")||\"\";return u?`${s} \"${u}\"`:s}function Re(t){let o=[],n=t,s=0;for(;n&&s<5;){let l=n.tagName.toLowerCase();if(n.id){o.unshift(`#${n.id}`);break}let u=typeof n.className==\"string\"?n.className.trim().split(/\\s+/).filter(Boolean)[0]:void 0,c=n.parentElement,f=u?`${l}.${u}`:l;if(c){let d=Array.from(c.children).filter(m=>m.tagName===n.tagName);d.length>1&&(f+=`:nth-of-type(${d.indexOf(n)+1})`)}o.unshift(f),n=c,s++}return o.join(\" > \")}function Le(t,o,n){switch(t){case\"click\":return`Clicked ${o}`;case\"fill\":return`Filled ${o} with \"${n??\"\"}\"`;case\"select\":return`Selected \"${n??\"\"}\" in ${o}`;case\"toggle\":return n?`${n===\"checked\"?\"Checked\":\"Unchecked\"} ${o}`:`Toggled ${o}`;case\"submit\":return`Submitted ${o}`;case\"key\":return`Pressed ${n??\"key\"} in ${o}`;case\"navigate\":return n?`Navigated to ${n}`:\"Reloaded the app\"}}var V=400,ct=3e3,ve=6e4,Ce=800,_e=new Set([\"button\",\"submit\",\"reset\",\"image\"]),ut=new Set([\"range\",\"color\",\"date\",\"time\",\"datetime-local\",\"month\",\"week\"]),dt=new Set([\"\",\"text\",\"search\",\"url\",\"tel\",\"email\",\"password\",\"number\"]),J=200,ft=250,xe=500;function Ie(){let t=!1,o=0,n=0,s=\"\",l,u,c=[],f=[],d=new Map,m=0,y=!1,v=!1,F={width:0,height:0},X=\"\",z=[],A,M,O=0,L,b,h,q=new Set,Q,N=0,B,Z=!1;function ke(e){return new Promise(a=>{let i=()=>{if(N===0||Date.now()-e>=ve||!P()){a();return}setTimeout(i,V)};i()})}let Me=e=>new Promise(a=>setTimeout(a,e));function P(){try{return u?.contentDocument??void 0}catch{return}}function $(e){if(e===void 0)return;let a=d.get(e);if(a!==void 0)return a;if(m+e.length>41943040){y=!0,v=!0;return}let i=f.length;return f.push(e),d.set(e,i),m+=e.length,i}function S(e){if(v)return;let a=P();if(a)try{return Se(a,{target:e,baseHref:X})}catch(i){console.warn(\"raw app recorder: snapshot failed\",i);return}}function Ne(e){return e.replace(` ${G}=\"\"`,\"\")}function j(){h&&(h.observer.disconnect(),clearTimeout(h.timer),clearTimeout(h.cap),h=void 0)}function se(e){j();let a=P();if(!a)return;let i=()=>{if(N>0&&h&&Date.now()-h.startedAt<ve){clearTimeout(h.timer),h.timer=setTimeout(i,V);return}j(),e.after=$(S())},r=new MutationObserver(()=>{h&&(clearTimeout(h.timer),h.timer=setTimeout(i,V))});r.observe(a,{subtree:!0,childList:!0,attributes:!0,characterData:!0}),h={step:e,observer:r,startedAt:Date.now(),timer:setTimeout(i,V),cap:setTimeout(i,ct)}}function ae(e){if(!h)return;let a=h.step;j();let i=e!==void 0&&(L?.html===e||b?.html===e);a.after=$(i?Ne(e):S())}function x(e,a,i,r,w=!1){if(!t)return;let E=Date.now()-n,p=c[c.length-1],R=!!p&&!!a&&ue(M,a)&&p.kind===e&&(w||Ue(a)&&E-O<ft);if(R||ae(i),c.length>=500&&!R){y=!0,v=!0;return}let T=!!a&&_(a),H=le(a?T?Ae(a):we(a):\"the app\")??\"the app\",W=r&&r.length>J?`${r.slice(0,J)}\\u2026`:r,k=!T||!W?W:e===\"toggle\"?void 0:Y(W),ge=Le(e,H,k);if(R&&p){p.value=k,p.label=ge,O=E,se(p);return}let he={t:E,kind:e,label:ge,target:H,selector:a&&!T?le(Re(a)):void 0,value:k,before:$(i??(e===\"key\"?S(a):void 0))};c.push(he),i!==void 0&&L?.html===i&&(L=void 0),i!==void 0&&b?.html===i&&(b=void 0),M=a,O=E,o=c.length,se(he)}function Pe(e){let i=e.closest(\"label\")?.control;return!i||e===i||i.contains(e)?!1:!e.closest(\"a, button, input, select, textarea\")}function $e(e){return e.ctrlKey||e.metaKey||e.altKey?!1:e.key.length===1||[\" \",\"Enter\",\"ArrowUp\",\"ArrowDown\",\"ArrowLeft\",\"ArrowRight\",\"Home\",\"End\"].includes(e.key)}function ee(e){if(g(e,\"SELECT\"))return!0;if(!g(e,\"INPUT\"))return!1;let a=e.type;return!K(e)&&!_e.has(a)}function He(e){return g(e,\"BUTTON\")?(e.type||\"submit\")===\"submit\":g(e,\"INPUT\")&&[\"submit\",\"image\"].includes(e.type)}function De(e){let a=c[c.length-1];return a?.kind===\"key\"&&a.value===\"Enter\"&&!!e&&!!M&&e.contains(M)&&Date.now()-n-O<xe}function Oe(e){return g(e,\"TEXTAREA\")||e.isContentEditable}function qe(e){return g(e,\"BUTTON\")||g(e,\"SUMMARY\")||g(e,\"A\")&&e.hasAttribute(\"href\")?!0:g(e,\"INPUT\")&&_e.has(e.type)}function Ue(e){return g(e,\"INPUT\")&&ut.has(e.type)}function le(e){if(e!==void 0)return e.length>J?`${e.slice(0,J)}\\u2026`:e}function K(e){return g(e,\"TEXTAREA\")||e.isContentEditable?!0:g(e,\"INPUT\")&&dt.has(e.type)}function ce(e){let a=g(e,\"INPUT\")||g(e,\"TEXTAREA\")?e.value:oe(e);return g(e,\"INPUT\")&&e.type===\"password\"||_(e)?Y(a):a}function U(e){let a=L?.el;if(!a)return;if(a===e||a.contains(e)||e.contains(a))return L?.html;let i=e.labels;if(i&&Array.from(i).some(r=>r===a||r.contains(a)))return L?.html}function ue(e,a){if(!e||!a)return!1;if(e===a)return!0;let i=e,r=a;return i.type===\"radio\"&&r.type===\"radio\"&&!!i.name&&i.name===r.name&&i.form===r.form}function te(e){if(b)return ue(b.el,e)?b.html:void 0}function I(){if(!A)return;let{el:e,before:a}=A;clearTimeout(A.timer),A=void 0,U(e)!==void 0&&(L=void 0),b?.el===e&&(b=void 0),x(\"fill\",e,a,ce(e))}function de(e){let a=(i,r)=>{e.addEventListener(i,r,!0),z.push(()=>e.removeEventListener(i,r,!0))};a(\"pointerdown\",i=>{let r=C(i.target)?i.target:void 0;r&&(L={el:r,html:S(r)})}),a(\"click\",i=>{let r=C(i.target)?i.target:void 0;r&&(A&&A.el!==r&&I(),!(K(r)||ee(r)||g(r,\"OPTION\"))&&(i.detail===0&&He(r)&&De(r.closest(\"form\"))||Pe(r)||x(\"click\",r,U(r)??S(r))))}),a(\"focusin\",i=>{let r=C(i.target)?i.target:void 0;L&&(!r||U(r)===void 0)&&(L=void 0)}),a(\"beforeinput\",i=>{let r=C(i.target)?i.target:void 0;!r||!K(r)||A?.el===r||U(r)===void 0&&(b={el:r,html:S(r),repeat:!1})}),a(\"input\",i=>{let r=C(i.target)?i.target:void 0;if(!(!r||!K(r)))if(A&&A.el!==r&&I(),A)clearTimeout(A.timer),A.timer=setTimeout(I,Ce);else{let w=U(r),E=te(r),p=w??E??S(r);ae(p),A={el:r,before:p,timer:setTimeout(I,Ce)}}}),a(\"change\",i=>{let r=C(i.target)?i.target:void 0;if(!r)return;if(K(r)){I();return}A&&I();let w=U(r),E=te(r),p=w??E,R=w===void 0&&E!==void 0&&!!b?.repeat;if(g(r,\"SELECT\")){let T=Array.from(r.selectedOptions),H=T.map(k=>k.label||k.value).join(\", \"),W=T.some(k=>_(k));x(\"select\",r,p,W?Y(H):H,R)}else if(g(r,\"INPUT\")){let T=r;[\"checkbox\",\"radio\"].includes(T.type)?x(\"toggle\",r,p,T.checked?\"checked\":\"unchecked\",R):T.type===\"file\"?x(\"fill\",r,p,Array.from(T.files??[]).map(H=>H.name).join(\", \")):x(\"fill\",r,p,ce(r),R)}}),a(\"submit\",i=>{let r=C(i.target)?i.target:void 0;I();let w=c[c.length-1];(w?.kind===\"click\"||w?.kind===\"key\"&&w.value===\"Enter\")&&M&&r&&r.contains(M)&&Date.now()-n-O<xe||x(\"submit\",r,S(r))}),a(\"keydown\",i=>{let r=C(i.target)?i.target:void 0;r&&ee(r)&&$e(i)&&(i.repeat&&b&&te(r)!==void 0?b.repeat=!0:b={el:r,html:S(r),repeat:i.repeat}),!(i.key!==\"Enter\"&&i.key!==\"Escape\")&&(i.key===\"Enter\"&&r&&(ee(r)||qe(r)||Oe(r))||(I(),x(\"key\",r,i.repeat?void 0:S(r),i.key,i.repeat)))})}function fe(){z.forEach(e=>e()),z=[]}function me(e){let a=e.contentWindow,i=E=>{let p=E.data;if(!p||typeof p!=\"object\"||E.source!==window)return;let{type:R,reqId:T}=p;typeof R!=\"string\"||!R.endsWith(\"Res\")||(q.delete(T),N=q.size)},r=()=>{let E=P();!E||E===Q||(a?.addEventListener(\"message\",i),Q=E)},w=E=>{let p=E.data;if(!p||typeof p!=\"object\"||E.source!==a)return;let{type:R,reqId:T}=p;typeof R!=\"string\"||R.endsWith(\"Res\")||T===void 0||(r(),q.add(T),N=q.size)};return window.addEventListener(\"message\",w),r(),()=>{window.removeEventListener(\"message\",w),a?.removeEventListener(\"message\",i),Q=void 0}}function pe(){fe();let e=h?.step;j(),A&&clearTimeout(A.timer),A=void 0,L=void 0,b=void 0;let a=P();if(!a)return;de(a),u&&(B?.(),B=me(u));let i=S();if(e&&(e.after=$(i)),f.length===0){$(i);return}x(\"navigate\",void 0,i,a.location?.hash||void 0)}return{get active(){return t},get stepCount(){return o},get stopping(){return Z},start(e,a){u=e;let i=P();return i?.documentElement?(t=!0,n=Date.now(),s=a.appPath,l=a.workspace,c=[],M=void 0,O=0,o=0,f=[],d=new Map,m=0,y=!1,v=!1,X=typeof window<\"u\"?window.location.origin:\"\",F={width:e.clientWidth||i.documentElement.clientWidth,height:e.clientHeight||i.documentElement.clientHeight},i.readyState===\"complete\"&&i.location?.href!==\"about:blank\"&&$(S()),de(i),e.addEventListener(\"load\",pe),q.clear(),N=0,B=me(e),!0):(u=void 0,!1)},async stop(){if(I(),fe(),t=!1,h&&N>0){Z=!0;let a=h.startedAt;await ke(a),P()&&await Me(V),Z=!1}if(h){let a=h.step;j(),a.after=$(S())}B?.(),B=void 0,q.clear(),N=0,u?.removeEventListener(\"load\",pe),L=void 0,b=void 0,u=void 0;let e={version:1,type:\"app\",recorded_at:new Date().toISOString(),app_path:s,workspace:l,total_duration_ms:Date.now()-n,viewport:F,frames:f,steps:c,truncated:y||void 0};return c=[],f=[],d=new Map,m=0,e},download(e){let a=new Blob([JSON.stringify(e)],{type:\"application/json\"}),i=URL.createObjectURL(a),r=document.createElement(\"a\");r.href=i,r.download=`app-recording-${(e.app_path||\"untitled\").replace(/\\//g,\"-\")}-${Date.now()}.json`,r.click(),URL.revokeObjectURL(i)}}}return We(mt);})();\n";
diff --git a/cli/src/commands/app/raw_apps.ts b/cli/src/commands/app/raw_apps.ts
index fcfc68915e..9f83d0322a 100644
--- a/cli/src/commands/app/raw_apps.ts
+++ b/cli/src/commands/app/raw_apps.ts
@@ -1,5 +1,6 @@
 import { requireLogin } from "../../core/auth.ts";
 import { resolveWorkspace, validatePath } from "../../core/context.ts";
+import { mergeConfigWithConfigFile } from "../../core/conf.ts";
 import { colors } from "@cliffy/ansi/colors";
 import * as log from "../../core/log.ts";
 import { sep as SEP } from "node:path";
@@ -16,7 +17,7 @@ import { deepEqual, readTextFile } from "../../utils/utils.ts";
 
 import { replaceInlineScripts, repopulateFields } from "./app.ts";
 import { createBundle, detectFrameworks } from "./bundle.ts";
-import { APP_BACKEND_FOLDER } from "./app_metadata.ts";
+import { APP_BACKEND_FOLDER, RECORDINGS_FOLDER } from "./app_metadata.ts";
 import { writeIfChanged } from "../../utils/utils.ts";
 import { yamlOptions } from "../sync/sync.ts";
 import { applyExtraPermsDiff } from "../../core/extra_perms.ts";
@@ -143,7 +144,8 @@ function getRunnableIdFromCodeFile(fileName: string): string | undefined {
  * Returns an empty object if the backend folder doesn't exist.
  *
  * @param backendPath - Path to the backend folder
- * @param defaultTs - Default TypeScript runtime ("bun" or "deno")
+ * @param defaultTs - TypeScript runtime a bare `.ts` denotes. Must match what
+ *   newRawAppPathAssigner used to write the file, or the round-trip relabels it.
  */
 export async function loadRunnablesFromBackend(
   backendPath: string,
@@ -317,6 +319,12 @@ async function collectAppFiles(
         ) {
           continue;
         }
+        // Session recordings, which the dev server only ever writes at the app
+        // root. Matched there alone, so an app of its own with a `recordings/`
+        // component folder still ships it.
+        if (basePath === "/" && entry.name === RECORDINGS_FOLDER) {
+          continue;
+        }
         await readDirRecursive(fullPath + SEP, relativePath + "/");
       } else if (entry.isFile()) {
         // Skip generated/metadata files that shouldn't be part of the app
@@ -344,6 +352,7 @@ export async function pushRawApp(
   remotePath: string,
   localPath: string,
   message?: string,
+  defaultTs: "bun" | "deno" = "bun",
 ): Promise<void> {
   if (alreadySynced.includes(localPath)) {
     return;
@@ -377,7 +386,10 @@ export async function pushRawApp(
   // Load runnables from separate YAML files in the backend folder
   // Falls back to reading from raw_app.yaml if no separate files exist (backward compat)
   const backendPath = path.join(localPath, APP_BACKEND_FOLDER);
-  const runnablesFromBackend = await loadRunnablesFromBackend(backendPath);
+  const runnablesFromBackend = await loadRunnablesFromBackend(
+    backendPath,
+    defaultTs,
+  );
 
   let runnables: Record<string, any>;
   if (Object.keys(runnablesFromBackend).length > 0) {
@@ -539,7 +551,14 @@ async function pushRawAppCommand(
   }
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
+  const merged = await mergeConfigWithConfigFile(opts);
 
-  await pushRawApp(workspace.workspaceId, remotePath, filePath);
+  await pushRawApp(
+    workspace.workspaceId,
+    remotePath,
+    filePath,
+    undefined,
+    merged.defaultTs,
+  );
   log.info(colors.bold.underline.green("Raw app pushed"));
 }
diff --git a/cli/src/commands/app/wmillTsDev.ts b/cli/src/commands/app/wmillTsDev.ts
index cd77652f53..7cb2ea328b 100644
--- a/cli/src/commands/app/wmillTsDev.ts
+++ b/cli/src/commands/app/wmillTsDev.ts
@@ -68,11 +68,45 @@ function initWebSocket() {
 
 initWebSocket()
 
+/** A runnable call leaves this page over the WebSocket without touching the DOM,
+ * so the session recorder of \`wmill app dev --recording\` (which frames the app)
+ * has nothing else to tell it a step is still waiting on the backend. Announcing
+ * the request and its answer to the shell mirrors what the deployed runner posts
+ * across the same boundary. */
+const framed = typeof window !== 'undefined' && window.parent !== window
+
+function notifyRecorder(type: string, reqId: string) {
+    if (framed) window.parent.postMessage({ type, reqId }, window.location.origin)
+}
+
+// A reload takes the previous context and its WebSocket with it, so whatever it
+// had in flight can never answer. Announcing a fresh module is how the shell
+// learns those calls are dead: a message posted from the unloading document
+// would be dropped with the realm that sent it, and this runs before any app
+// code can issue a call of its own.
+if (framed) {
+    window.parent.postMessage({ type: 'wmillDevReady' }, window.location.origin)
+}
+
+function tracked(type: string, reqId: string, resolve: (v: any) => void, reject: (e: any) => void) {
+    notifyRecorder(type, reqId)
+    let settled = false
+    const done = () => {
+        if (settled) return
+        settled = true
+        notifyRecorder(type + 'Res', reqId)
+    }
+    return {
+        resolve: (v: any) => { done(); resolve(v) },
+        reject: (e: any) => { done(); reject(e) }
+    }
+}
+
 async function doRequest(type: string, o: object) {
     await wsReady
     return new Promise((resolve, reject) => {
         const reqId = Math.random().toString(36)
-        reqs[reqId] = { resolve, reject }
+        reqs[reqId] = tracked(type, reqId, resolve, reject)
         ws?.send(JSON.stringify({ ...o, type, reqId }))
     })
 }
@@ -119,7 +153,7 @@ export function streamJob(
     return new Promise(async (resolve, reject) => {
         await wsReady
         const reqId = Math.random().toString(36)
-        reqs[reqId] = { resolve, reject, onUpdate }
+        reqs[reqId] = { ...tracked('streamJob', reqId, resolve, reject), onUpdate }
         ws?.send(JSON.stringify({ jobId, type: 'streamJob', reqId }))
     })
 }
diff --git a/cli/src/commands/dev/dev.ts b/cli/src/commands/dev/dev.ts
index f588f5841d..00a6f72f0e 100644
--- a/cli/src/commands/dev/dev.ts
+++ b/cli/src/commands/dev/dev.ts
@@ -20,7 +20,19 @@ import {
   SyncOptions,
   mergeConfigWithConfigFile,
 } from "../../core/conf.ts";
-import { exts, removeExtensionToPath } from "../script/script.ts";
+import {
+  exts,
+  hasScriptExt,
+  readModulesFromDisk,
+  removeExtensionToPath,
+} from "../script/script.ts";
+import type { ScriptModule } from "../../../gen/types.gen.ts";
+import {
+  DBT_DESCRIPTOR_NAME,
+  DBT_MODULE_SUFFIX,
+  getScriptBasePathFromModulePath,
+  isDbtModulePath,
+} from "../../utils/resource_folders.ts";
 import { inferContentTypeFromFilePath } from "../../utils/script_common.ts";
 import { OpenFlow } from "../../../gen/types.gen.ts";
 import { FlowFile } from "../flow/flow.ts";
@@ -108,7 +120,7 @@ function findFlowFolderPrefix(cpath: string): string | undefined {
   return undefined;
 }
 
-async function listWorkspacePaths(): Promise<WmPathItem[]> {
+export async function listWorkspacePaths(): Promise<WmPathItem[]> {
   // Walk first, capturing each item's metadata file path. Then read summaries in
   // parallel — one tree pass plus N file reads is faster than a serialized walk.
   const items: (WmPathItem & { _metaPath?: string })[] = [];
@@ -136,6 +148,19 @@ async function listWorkspacePaths(): Promise<WmPathItem[]> {
           items.push({ path: stripFolderSuffix(childRel, APP_SUFFIXES), kind: "raw_app" });
           continue;
         }
+        // A dbt script IS the project directory: its descriptor is optional, so
+        // there may be no file here to recognize it by. Not descended into
+        // either — the project's own `.sql` models would otherwise each be
+        // listed as a script of their own.
+        if (entry.name.endsWith(DBT_MODULE_SUFFIX)) {
+          const base = childRel.slice(0, -DBT_MODULE_SUFFIX.length);
+          items.push({
+            path: base,
+            kind: "script",
+            _metaPath: childAbs.slice(0, -DBT_MODULE_SUFFIX.length) + ".script.yaml",
+          });
+          continue;
+        }
         await walk(childAbs, childRel);
       } else if (entry.isFile()) {
         const matchedExt = exts.find((ext) => entry.name.endsWith(ext));
@@ -282,12 +307,40 @@ export async function dev(opts: GlobalOptions & SyncOptions & DevOpts) {
 
   const flowMetadataFile = getMetadataFileName("flow", "yaml");
   async function loadPaths(pathsToLoad: string[]) {
-    const paths = pathsToLoad.filter((p) =>
-      exts.some(
-        (ext) => p.endsWith(ext)
-          || p.endsWith(".flow/" + flowMetadataFile)
-          || p.endsWith("__flow/" + flowMetadataFile)
-      )
+    // A change ANYWHERE inside a dbt project is a change to that script: the
+    // bundle is the project, so the whole thing is re-read and rebroadcast.
+    // Treating the file as a script of its own would drop the edit — a bare
+    // `.sql` has no language to infer, and a `.yml` or `.csv` is filtered out
+    // below — leaving the browser previewing the snapshot taken at startup.
+    const rest: string[] = [];
+    const dbtProjects = new Set<string>();
+    for (const raw of pathsToLoad) {
+      const rel = (await realpath(raw).catch(() => raw))
+        .replace(base + SEP, "")
+        .replaceAll("\\", "/");
+      const wmPath = isDbtModulePath(rel)
+        ? getScriptBasePathFromModulePath(rel)
+        : undefined;
+      // Every project in the batch, and each only once: a save-all or a
+      // `git checkout` touches many files at once, and returning on the first
+      // would drop both the other projects and whatever else changed with them.
+      if (wmPath) dbtProjects.add(wmPath);
+      else rest.push(raw);
+    }
+    for (const wmPath of dbtProjects) {
+      const edit = await loadWmPath(wmPath);
+      if (edit) {
+        log.info("Updated " + wmPath + " (dbt project)");
+        broadcastChanges(edit);
+      }
+    }
+    if (rest.length === 0) return;
+    pathsToLoad = rest;
+    const paths = pathsToLoad.filter(
+      (p) =>
+        hasScriptExt(p) ||
+        p.endsWith(".flow/" + flowMetadataFile) ||
+        p.endsWith("__flow/" + flowMetadataFile)
     );
     if (paths.length == 0) {
       return;
@@ -380,6 +433,10 @@ export async function dev(opts: GlobalOptions & SyncOptions & DevOpts) {
     tag?: string;
     lock?: string;
     temp_script_refs?: Record<string, string>;
+    /** The bundle the dev page forwards to a preview run. A dbt project cannot
+     *  run without it: the worker looks for `dbt_project.yml` in the bundle and
+     *  refuses the job when it is not there. */
+    modules?: Record<string, ScriptModule>;
   };
 
   type LastEditFlow = {
@@ -441,8 +498,23 @@ export async function dev(opts: GlobalOptions & SyncOptions & DevOpts) {
     for (const ext of exts) {
       const filePath = wmPath + ext;
       try {
-        await access(filePath);
-        const content = await readTextFile(filePath);
+        // A dbt project's descriptor is optional, so what says "this is a dbt
+        // script" is the project beside it. Requiring the descriptor to exist
+        // would list such a project in the picker and then refuse to load it.
+        const isAbsentDbtDescriptor =
+          ext === "__dbt/" + DBT_DESCRIPTOR_NAME &&
+          !(await access(filePath).then(
+            () => true,
+            () => false
+          )) &&
+          (await access(wmPath + DBT_MODULE_SUFFIX + "/dbt_project.yml").then(
+            () => true,
+            () => false
+          ));
+        if (!isAbsentDbtDescriptor) {
+          await access(filePath);
+        }
+        const content = isAbsentDbtDescriptor ? "" : await readTextFile(filePath);
         const lang = inferContentTypeFromFilePath(filePath, opts.defaultTs);
         const typed = (await parseMetadataFile(removeExtensionToPath(filePath), undefined))?.payload;
         const edit: LastEditScript = {
@@ -453,6 +525,18 @@ export async function dev(opts: GlobalOptions & SyncOptions & DevOpts) {
           tag: typed?.tag,
           lock: typed?.lock,
           temp_script_refs: tempScriptRefs,
+          // Read VERBATIM for dbt, the way push does: the project's `.sql` and
+          // `.yml` files are dbt's, and inferring a language for each would
+          // drop the ones that are not Windmill scripts.
+          modules:
+            lang === "dbt"
+              ? await readModulesFromDisk(
+                  wmPath + DBT_MODULE_SUFFIX,
+                  opts.defaultTs,
+                  true,
+                  true
+                )
+              : undefined,
         };
         currentLastEdit = edit;
         return edit;
diff --git a/cli/src/commands/flow/flow.ts b/cli/src/commands/flow/flow.ts
index 17a5e1febb..6ace1eaf48 100644
--- a/cli/src/commands/flow/flow.ts
+++ b/cli/src/commands/flow/flow.ts
@@ -13,7 +13,12 @@ import { mkdirSync, writeFileSync } from "node:fs";
 import { buildFolderPath, getMetadataFileName, loadNonDottedPathsSetting } from "../../utils/resource_folders.ts";
 
 import { requireLogin } from "../../core/auth.ts";
-import { resolveWorkspace, validatePath } from "../../core/context.ts";
+import {
+  assertRemotePath,
+  resolveWorkspace,
+  toSyncRootRelativePath,
+  validatePath,
+} from "../../core/context.ts";
 import { resolve, track_job, pollForJobResult } from "../script/script.ts";
 import { defaultFlowDefinition } from "../../../bootstrap/flow_bootstrap.ts";
 import { SyncOptions, mergeConfigWithConfigFile } from "../../core/conf.ts";
@@ -232,11 +237,19 @@ export async function pushFlow(
 
   const hasOnBehalfOf = (localFlow as any).has_on_behalf_of ?? !!localFlow.on_behalf_of_email;
   delete (localFlow as any).has_on_behalf_of;
+  // The authorization half of the identity is never exported to the repo (the
+  // workspace tarball strips it); it only ever travels back from the remote row.
+  delete (localFlow as any).on_behalf_of;
 
-  const preserveFields: { on_behalf_of_email?: string; preserve_on_behalf_of?: boolean } = {};
+  const preserveFields: {
+    on_behalf_of_email?: string;
+    on_behalf_of?: string;
+    preserve_on_behalf_of?: boolean;
+  } = {};
   if (permissionedAsContext?.userIsAdminOrDeployer && hasOnBehalfOf) {
     if (flow && flow.on_behalf_of_email) {
       preserveFields.on_behalf_of_email = flow.on_behalf_of_email;
+      preserveFields.on_behalf_of = (flow as any).on_behalf_of;
       preserveFields.preserve_on_behalf_of = true;
       log.info(`Preserving ${flow.on_behalf_of_email} as on_behalf_of for flow ${remotePath}`);
     }
@@ -597,6 +610,8 @@ async function preview(
     log.setSilent(true);
   }
   const useLocalPathScripts = !opts.remote;
+  // Captured before the config read, which chdirs to the wmill.yaml root.
+  const cwdBeforeConfig = process.cwd();
   if (useLocalPathScripts) {
     opts = await mergeConfigWithConfigFile(opts);
   }
@@ -604,6 +619,9 @@ async function preview(
   await requireLogin(opts);
   const codebases = useLocalPathScripts ? listSyncCodebases(opts) : [];
 
+  const argPath = flowPath;
+  flowPath = toSyncRootRelativePath(flowPath, cwdBeforeConfig);
+
   // Normalize path - ensure it's a directory path to a .flow or __flow folder
   const isFlowDir = flowPath.endsWith(".flow") || flowPath.endsWith(".flow" + SEP)
     || flowPath.endsWith("__flow") || flowPath.endsWith("__flow" + SEP);
@@ -625,6 +643,14 @@ async function preview(
     flowPath += SEP;
   }
 
+  // The flow's windmill path (e.g. "f/cli_smoke/myrelflow"). It is what the
+  // preview job runs under, and the anchor for relative-import resolution:
+  // inline scripts in this flow are treated as living at
+  // "<flow_wm_path>/<step_id>", so "./util" resolves to
+  // "<flow_wm_path_parent>/util" — matching the keys in temp_script_refs.
+  const flowWmPath = stripFlowSuffix(flowPath).replaceAll(SEP, "/");
+  assertRemotePath(flowWmPath, argPath);
+
   // Read and parse the flow definition
   const localFlow = (await yamlParseFile(flowPath + "flow.yaml")) as FlowFile;
 
@@ -695,12 +721,6 @@ async function preview(
   // too — PathScript modules have already been rewritten to inline rawscript
   // when `useLocalPathScripts` is set, and tempScriptRefs covers relative
   // imports in inline scripts.
-  // Compute the flow's windmill path (e.g. "f/cli_smoke/myrelflow"). Used as
-  // the anchor for relative-import resolution: inline scripts in this flow are
-  // treated as living at "<flow_wm_path>/<step_id>", so "./util" resolves to
-  // "<flow_wm_path_parent>/util" — matching the keys in temp_script_refs.
-  const flowWmPath = stripFlowSuffix(flowPath).replaceAll(SEP, "/");
-
   if (opts.step) {
     await previewStep(opts.step, localFlow, flowWmPath, workspace, input, tempScriptRefs, opts.silent, opts.tag);
     return;
@@ -1218,6 +1238,8 @@ const command = new Command()
         ...remote,
         path: flowPath,
         on_behalf_of_email: email,
+        // Derived server-side; see the script command for why.
+        on_behalf_of: undefined,
         preserve_on_behalf_of: true,
         // Preserve any user draft at this path (see backend skip_draft_deletion).
         skip_draft_deletion: true,
diff --git a/cli/src/commands/generate-metadata/generate-metadata.ts b/cli/src/commands/generate-metadata/generate-metadata.ts
index 7eab79b52d..9680c6abda 100644
--- a/cli/src/commands/generate-metadata/generate-metadata.ts
+++ b/cli/src/commands/generate-metadata/generate-metadata.ts
@@ -22,7 +22,7 @@ import {
   FSFSElement,
   ignoreF,
 } from "../sync/sync.ts";
-import { exts } from "../script/script.ts";
+import { hasScriptExt } from "../script/script.ts";
 import { isFolderResourcePathAnyFormat, isScriptModulePath, isModuleEntryPoint, scriptPathToRemotePath } from "../../utils/resource_folders.ts";
 import { listSyncCodebases, SyncCodebase } from "../../utils/codebase.ts";
 import {
@@ -51,7 +51,7 @@ async function walkLocalScripts(
   const elems = await elementsToMap(
     await FSFSElement(process.cwd(), codebases, false),
     (p, isD) =>
-      (!isD && !exts.some((ext) => p.endsWith(ext))) ||
+      (!isD && !hasScriptExt(p)) ||
       ignore(p, isD) ||
       isFolderResourcePathAnyFormat(p) ||
       // Datatable migration `.sql` files aren't Windmill scripts.
@@ -221,7 +221,7 @@ function categorizeLocalFiles(
     ) {
       appPaths.push(p);
     } else if (
-      exts.some((ext) => p.endsWith(ext)) &&
+      hasScriptExt(p) &&
       !isFolderResourcePathAnyFormat(p) &&
       // Datatable migration `.sql` files aren't Windmill scripts.
       !isDatatableMigrationPath(p) &&
diff --git a/cli/src/commands/gitsync-settings/converter.ts b/cli/src/commands/gitsync-settings/converter.ts
index 6861603bb4..868fa1b330 100644
--- a/cli/src/commands/gitsync-settings/converter.ts
+++ b/cli/src/commands/gitsync-settings/converter.ts
@@ -34,6 +34,7 @@ export class GitSyncSettingsConverter {
       includeSettings: includeTypes.includes("settings"),
       includeKey: includeTypes.includes("key"),
       skipWorkspaceDependencies: !includeTypes.includes("workspacedependencies"),
+      skipDatatableMigrations: !includeTypes.includes("datatablemigration"),
     };
 
     // Only include extraIncludes if it has content
@@ -63,6 +64,7 @@ export class GitSyncSettingsConverter {
     if (opts.includeSettings) includeTypes.push("settings");
     if (opts.includeKey) includeTypes.push("key");
     if (!opts.skipWorkspaceDependencies) includeTypes.push("workspacedependencies");
+    if (!opts.skipDatatableMigrations) includeTypes.push("datatablemigration");
 
     const result: BackendGitSyncSettings = {
       include_path: opts.includes || [],
@@ -102,6 +104,7 @@ export class GitSyncSettingsConverter {
       includeSettings: opts.includeSettings ?? false,
       includeKey: opts.includeKey ?? false,
       skipWorkspaceDependencies: opts.skipWorkspaceDependencies ?? false,
+      skipDatatableMigrations: opts.skipDatatableMigrations ?? false,
     };
   }
 
@@ -126,6 +129,7 @@ export class GitSyncSettingsConverter {
       includeSettings: opts.includeSettings,
       includeKey: opts.includeKey,
       skipWorkspaceDependencies: opts.skipWorkspaceDependencies,
+      skipDatatableMigrations: opts.skipDatatableMigrations,
     };
   }
 
diff --git a/cli/src/commands/gitsync-settings/types.ts b/cli/src/commands/gitsync-settings/types.ts
index 7bebb1f1a1..2a74966ccf 100644
--- a/cli/src/commands/gitsync-settings/types.ts
+++ b/cli/src/commands/gitsync-settings/types.ts
@@ -38,6 +38,7 @@ export const GIT_SYNC_FIELDS = [
   "includeSettings",
   "includeKey",
   "skipWorkspaceDependencies",
+  "skipDatatableMigrations",
 ] as const;
 
 export type GitSyncField = typeof GIT_SYNC_FIELDS[number];
@@ -59,6 +60,7 @@ export const INCLUDE_TYPE_MAPPINGS = {
   settings: "includeSettings",
   key: "includeKey",
   workspacedependencies: "skipWorkspaceDependencies",
+  datatablemigration: "skipDatatableMigrations",
 } as const;
 
 // Write mode for branch-based configuration
diff --git a/cli/src/commands/init/template.ts b/cli/src/commands/init/template.ts
index b0c83d7039..ef2bcad0a6 100644
--- a/cli/src/commands/init/template.ts
+++ b/cli/src/commands/init/template.ts
@@ -97,6 +97,7 @@ export const CONFIG_REFERENCE: ConfigOption[] = [
   { name: "skipApps", type: "boolean", default: "false", description: "Skip syncing apps" },
   { name: "skipFolders", type: "boolean", default: "false", description: "Skip syncing folders" },
   { name: "skipWorkspaceDependencies", type: "boolean", default: "false", description: "Skip syncing workspace dependencies" },
+  { name: "skipDatatableMigrations", type: "boolean", default: "false", description: "Skip syncing data table SQL migrations" },
 
   { name: "includeSchedules", type: "boolean", default: "false", description: "Include schedules in sync",
     commented: true, templateValue: "true", groupNote: "Uncomment to include these (excluded by default):" },
diff --git a/cli/src/commands/pipeline/docs.ts b/cli/src/commands/pipeline/docs.ts
index abee64cbf3..1ae38d5e71 100644
--- a/cli/src/commands/pipeline/docs.ts
+++ b/cli/src/commands/pipeline/docs.ts
@@ -17,11 +17,12 @@ import { colors } from "@cliffy/ansi/colors";
 import { GlobalOptions } from "../../types.ts";
 import {
   type AssetGraph,
+  hideDbtRunnables,
   buildLocalPipelineGraph,
   workspaceRoot,
 } from "./localGraph.ts";
 
-const ASSET_KINDS = "s3object,ducklake,datatable,volume";
+const ASSET_KINDS = "s3object,ducklake,datatable,volume,dbt";
 
 function assetUri(kind: string, p: string): string {
   const prefix = kind === "s3object" ? "s3" : kind;
@@ -39,7 +40,7 @@ async function fetchDeployedGraph(
   if (!res.ok) {
     throw new Error(`GET assets/graph -> ${res.status}: ${await res.text()}`);
   }
-  return (await res.json()) as AssetGraph;
+  return hideDbtRunnables((await res.json()) as AssetGraph);
 }
 
 // Render the pipeline graph as a markdown document.
diff --git a/cli/src/commands/pipeline/localGraph.ts b/cli/src/commands/pipeline/localGraph.ts
index bb51cd98eb..5f9e713f42 100644
--- a/cli/src/commands/pipeline/localGraph.ts
+++ b/cli/src/commands/pipeline/localGraph.ts
@@ -63,6 +63,10 @@ export type GraphRunnable = {
   // `buildMacroEdges` (the wasm asset parser emits neither the marker nor the
   // registry). Non-empty ⇒ definition-only node.
   macros?: { name: string; params?: string; is_table?: boolean }[];
+  // Set by the deployed graph on a dbt script: it owns a whole project, so the
+  // node counts models rather than reading as a single-output script. Never set
+  // locally — a dbt descriptor has no asset parser here.
+  dbt?: { model_count: number };
 };
 export type GraphEdge = {
   runnable_kind: string;
@@ -229,6 +233,7 @@ function commentPrefix(language: string): string {
     language === "ansible" ||
     language === "ruby" ||
     language === "rlang" ||
+    language === "dbt" ||
     language === "nu" ||
     language === "powershell"
   )
@@ -342,7 +347,11 @@ function normalizeRetry(retry: ParseAssetsRaw["retry"]): ParseAssetsRaw["retry"]
 // Read-asset kinds whose read auto-derives a cascade trigger edge inside a
 // `// pipeline`. Mirror of backend `is_auto_trigger_kind` (windmill-common
 // assets.rs) / frontend `AUTO_TRIGGER_KINDS` (resolveGraph.ts) — ducklake
-// tables and s3 objects only; resource/datatable/volume stay explicit-`// on`.
+// tables and s3 objects; resource/datatable/volume/table stay explicit-`// on`.
+// A local graph out of step with that set shows an edge the deploy will not
+// cascade along, and the generated pipeline docs then describe the wrong DAG.
+// `table` is excluded everywhere: a dbt run does not dispatch, and nothing else
+// writes a warehouse relation.
 const AUTO_TRIGGER_KINDS = new Set(["ducklake", "s3object"]);
 
 // Asset-URI prefixes accepted by `// mute <asset>`, in lockstep with the
@@ -550,6 +559,75 @@ export async function collectScripts(
   return out;
 }
 
+// The structural minimum the dbt filter needs. Declared instead of taking
+// `AssetGraph` so the bounded-cascade view of the same payload (`BCGraph`, a
+// narrower shape over identical JSON) passes through without a cast.
+type DbtFilterableGraph = {
+  runnables: { path: string; usage_kind: string; dbt?: unknown }[];
+  edges: { runnable_kind: string; runnable_path: string }[];
+  triggers: { runnable_kind: string; runnable_path: string }[];
+  macro_edges?: { lib_path: string; consumer_path: string }[];
+  test_edges?: {
+    producer_kind: string;
+    producer_path: string;
+    runnable_kind: string;
+    runnable_path: string;
+  }[];
+};
+
+/**
+ * The pipeline's view of a deployed graph whose folder also holds a dbt project.
+ *
+ * `/assets/graph` is asset-usage driven, not membership driven: it lists every
+ * script that reads or writes a relation, so a dbt script appears there like any
+ * producer. That is right for the endpoint — the node is what attributes a
+ * relation to what builds it — but a dbt project is not a pipeline, so it must
+ * not be rendered as one of its scripts. Mirrors the frontend's
+ * `hideDbtRunnables`; the local builder drops these nodes at the source.
+ *
+ * Its relations stay: they are what a downstream pipeline script reads.
+ */
+export function hideDbtRunnables<G extends DbtFilterableGraph>(graph: G): G {
+  // Keyed by `(usage_kind, path)`, the graph's identity for a runnable — a
+  // script and a flow may share a path, and keying on path alone would take the
+  // flow's node, edges and triggers down with the dbt script's.
+  const key = (usage_kind: string, path: string) => `${usage_kind}:${path}`;
+  const dbtKeys = new Set(
+    (graph.runnables ?? [])
+      .filter((r) => r.dbt)
+      .map((r) => key(r.usage_kind, r.path)),
+  );
+  if (dbtKeys.size === 0) return graph;
+  const kept = (usage_kind: string, path: string) =>
+    !dbtKeys.has(key(usage_kind, path));
+  return {
+    ...graph,
+    runnables: graph.runnables.filter((r) => kept(r.usage_kind, r.path)),
+    edges: graph.edges.filter((e) => kept(e.runnable_kind, e.runnable_path)),
+    triggers: graph.triggers.filter((t) =>
+      kept(t.runnable_kind, t.runnable_path),
+    ),
+    // A macro library is a script; a dbt script defines no macros, so neither
+    // end can be a flow.
+    ...(graph.macro_edges
+      ? {
+          macro_edges: graph.macro_edges.filter(
+            (m) => kept("script", m.lib_path) && kept("script", m.consumer_path),
+          ),
+        }
+      : {}),
+    ...(graph.test_edges
+      ? {
+          test_edges: graph.test_edges.filter(
+            (t) =>
+              kept(t.producer_kind, t.producer_path) &&
+              kept(t.runnable_kind, t.runnable_path),
+          ),
+        }
+      : {}),
+  };
+}
+
 // Build the full pipeline asset-graph from local files in `f/<folder>/`.
 // Only `// pipeline` scripts become graph nodes (pipeline membership), mirroring
 // the deployed graph endpoint. Returns the graph plus the in-pipeline scripts'
@@ -617,6 +695,11 @@ export async function buildLocalPipelineGraph(args: {
       });
       continue;
     }
+    // A dbt project is not a data pipeline: the deploy never marks a dbt script
+    // `auto_kind='pipeline'` and the pipeline canvas drops its node, so the
+    // local graph must not invent one. Its models don't belong here either —
+    // they come from the manifest the deploy derives, not from the descriptor.
+    if (s.language === "dbt") continue;
     if (!out.in_pipeline) continue; // not a pipeline member
     if (out.data_tests && out.data_tests.length > 0) {
       dataTestsByPath.set(s.path, out.data_tests);
diff --git a/cli/src/commands/pipeline/pipeline.ts b/cli/src/commands/pipeline/pipeline.ts
index 0738283fba..8d46119e14 100644
--- a/cli/src/commands/pipeline/pipeline.ts
+++ b/cli/src/commands/pipeline/pipeline.ts
@@ -24,6 +24,7 @@ import {
 } from "./boundedCascade.ts";
 import {
   type AssetGraph,
+  hideDbtRunnables,
   type GraphTrigger,
   type LocalScript,
   buildLocalPipelineGraph,
@@ -96,7 +97,7 @@ async function list(opts: GlobalOptions & { json?: boolean }) {
   }
 }
 
-const ASSET_KINDS = "s3object,ducklake,datatable,volume";
+const ASSET_KINDS = "s3object,ducklake,datatable,volume,dbt";
 
 function assetUri(kind: string, path: string): string {
   const prefix = kind === "s3object" ? "s3" : kind;
@@ -132,8 +133,10 @@ async function show(
   } else {
     const workspace = await resolveWorkspace(opts);
     await requireLogin(opts);
-    graph = await apiGet<AssetGraph>(
-      `/w/${workspace.workspaceId}/assets/graph?folder=${encodeURIComponent(f)}&asset_kinds=${ASSET_KINDS}`,
+    graph = hideDbtRunnables(
+      await apiGet<AssetGraph>(
+        `/w/${workspace.workspaceId}/assets/graph?folder=${encodeURIComponent(f)}&asset_kinds=${ASSET_KINDS}`,
+      ),
     );
     enrich = (nativeByScript, roots) => enrichRootMarkers(workspace.workspaceId, graph, nativeByScript, roots);
   }
@@ -612,8 +615,10 @@ async function run(
       }
     }
   } else {
-    graph = await apiGet<BCGraph>(
-      `/w/${workspace.workspaceId}/assets/graph?folder=${encodeURIComponent(f)}&asset_kinds=${ASSET_KINDS}`,
+    graph = hideDbtRunnables(
+      await apiGet<BCGraph>(
+        `/w/${workspace.workspaceId}/assets/graph?folder=${encodeURIComponent(f)}&asset_kinds=${ASSET_KINDS}`,
+      ),
     );
     // Recover marker-only `data_upload`/`webhook`/`email` triggers the graph
     // endpoint can't emit, so input-only entrypoints are cut here as they are
diff --git a/cli/src/commands/script/script.ts b/cli/src/commands/script/script.ts
index c699e3d58f..37000c9ff3 100644
--- a/cli/src/commands/script/script.ts
+++ b/cli/src/commands/script/script.ts
@@ -1,6 +1,11 @@
 import { GlobalOptions } from "../../types.ts";
 import { requireLogin } from "../../core/auth.ts";
-import { resolveWorkspace, validatePath } from "../../core/context.ts";
+import {
+  assertRemotePath,
+  resolveWorkspace,
+  toSyncRootRelativePath,
+  validatePath,
+} from "../../core/context.ts";
 import type { PermissionedAsContext } from "../../core/permissioned_as.ts";
 import { applyExtraPermsDiff } from "../../core/extra_perms.ts";
 import { writeFile, stat, mkdir } from "node:fs/promises";
@@ -71,10 +76,19 @@ import {
   isScriptModulePath,
   buildModuleFolderPath,
   getModuleFolderSuffix,
+  dbtGeneratedDirs,
+  isUnderGeneratedDir,
+  isLocalSecretFile,
+  moduleFileExclusion,
+  oversizedModuleFileError,
+  MAX_MODULE_BYTES,
   isModuleEntryPoint,
   getScriptBasePathFromModulePath,
   scriptPathToRemotePath,
   isRawAppPath,
+  DBT_DESCRIPTOR_NAME,
+  isDbtDescriptorPath,
+  isMissingDbtDescriptor,
 } from "../../utils/resource_folders.ts";
 
 export interface ScriptFile {
@@ -159,9 +173,18 @@ async function push(opts: PushOptions, filePath: string) {
     return;
   }
 
-  const fstat = await stat(filePath);
-  if (!fstat.isFile()) {
-    throw new Error("file path must refer to a file.");
+  // A dbt project's descriptor is optional, so the one content path a
+  // descriptor-less project has is deliberately not on disk. The project beside
+  // it is what says the script is real.
+  const absentDescriptor = await stat(filePath).then(
+    () => false,
+    (e) => isMissingDbtDescriptor(filePath, e)
+  );
+  if (!absentDescriptor) {
+    const fstat = await stat(filePath);
+    if (!fstat.isFile()) {
+      throw new Error("file path must refer to a file.");
+    }
   }
 
   if (filePath.endsWith(".script.json") || filePath.endsWith(".script.yaml")) {
@@ -174,7 +197,7 @@ async function push(opts: PushOptions, filePath: string) {
 
   // Warn about metadata state before pushing
   try {
-    const content = await readTextFile(filePath);
+    const content = await readScriptContent(filePath);
     const remotePath = removeExtensionToPath(filePath).replaceAll(SEP, "/");
     const contentHash = await computePushMetadataHash(filePath, content);
     const conf = await readLockfile();
@@ -272,7 +295,7 @@ const MODULE_ENTRY_META_RE = /([\\/])script\.(yaml|json|lock)$/;
  * `__mod/`, so this only narrows it to the metadata extensions: a `script.yaml`
  * nested deeper in the module tree is a module file, not the script's metadata.
  */
-function isModuleEntryMetadata(p: string): boolean {
+export function isModuleEntryMetadata(p: string): boolean {
   return isModuleEntryPoint(p) && MODULE_ENTRY_META_RE.test(p);
 }
 
@@ -335,7 +358,7 @@ export async function handleFile(
     // standalone scripts — pushed via pushRawApp, not here.
     !isRawAppPath(path) &&
     (!isScriptModulePath(path) || moduleEntryPoint) &&
-    exts.some((exts) => path.endsWith(exts))
+    hasScriptExt(path)
   ) {
     if (alreadySynced.includes(path)) {
       return true;
@@ -345,6 +368,29 @@ export async function handleFile(
     alreadySynced.push(path);
     const remotePath = scriptPathToRemotePath(path);
 
+    // Before anything is written: `<base>.py` and `<base>__dbt/` deploy to ONE
+    // remote path, so whichever is pushed last replaces the other's script.
+    // Refused from either side — the descriptor is exempt only from finding its
+    // OWN project (it is that project's content file, so its base resolves to
+    // the same `dbt_project.yml`), never from an ordinary sibling.
+    // A folder-layout script is `<base>__mod/script.ts`, so stripping its
+    // extension yields `<base>__mod/script`, not the base both layouts deploy
+    // to. Wrong base, and the probe below looks in a directory that cannot
+    // exist — which is how a `__mod` script and a dbt project at one path were
+    // both pushed, each replacing the other.
+    const base = isScriptModulePath(path)
+      ? getScriptBasePathFromModulePath(path) ?? removeExtensionToPath(path)
+      : removeExtensionToPath(path);
+    const isDescriptor = isDbtDescriptorPath(path);
+    const other = isDescriptor
+      ? await collidingOrdinaryScript(base)
+      : await collidingDbtProject(base);
+    if (other) {
+      throw isDescriptor
+        ? dbtPathCollisionError(path, other)
+        : dbtPathCollisionError(other, path);
+    }
+
     const language = inferContentTypeFromFilePath(path, opts?.defaultTs);
 
     const codebase =
@@ -479,7 +525,7 @@ export async function handleFile(
     } catch {
       log.debug(`Script ${remotePath} does not exist on remote`);
     }
-    const content = await readTextFile(path);
+    const content = await readScriptContent(path);
 
     if (opts?.skipScriptsMetadata) {
       // if (codebase) {
@@ -499,8 +545,14 @@ export async function handleFile(
     const scriptBasePath = moduleEntryPoint
       ? getScriptBasePathFromModulePath(path)!
       : path.substring(0, path.indexOf("."));
-    const moduleFolderPath = scriptBasePath + getModuleFolderSuffix();
-    const modules = await readModulesFromDisk(moduleFolderPath, opts?.defaultTs, moduleEntryPoint);
+    const isDbt = language === "dbt";
+    const moduleFolderPath = scriptBasePath + getModuleFolderSuffix(language);
+    const modules = await readModulesFromDisk(
+      moduleFolderPath,
+      opts?.defaultTs,
+      moduleEntryPoint,
+      isDbt,
+    );
 
     // A concurrent_limit of <= 0 means "concurrency disabled", not "zero slots" (which
     // would brick the runnable at the queue's concurrency gate). Emit it as omitted rather
@@ -518,7 +570,11 @@ export async function handleFile(
       path: remotePath.replaceAll(SEP, "/"),
       summary: typed?.summary ?? "",
       kind: typed?.kind,
-      lock: typed?.lock,
+      // A dbt lock pins a resolved commit and engine versions that only a
+      // dependency job can determine, and that job is also what publishes the
+      // script's manifest graph. Sending one suppresses that job, so the push
+      // would deploy a stale lock AND leave the graph unpublished.
+      lock: language === "dbt" ? undefined : typed?.lock,
       schema: typed?.schema,
       tag: typed?.tag,
       ws_error_handler_muted: typed?.ws_error_handler_muted,
@@ -544,10 +600,16 @@ export async function handleFile(
 
     const hasOnBehalfOf = (typed as any)?.has_on_behalf_of ?? !!typed?.on_behalf_of_email;
     delete (typed as any)?.has_on_behalf_of;
+    // The authorization half of the identity is never exported to the repo (the
+    // workspace tarball strips it); it only ever travels back from the remote row.
+    delete (typed as any)?.on_behalf_of;
 
     if (permissionedAsContext?.userIsAdminOrDeployer && hasOnBehalfOf) {
       if (remote && remote.on_behalf_of_email) {
         requestBodyCommon.on_behalf_of_email = remote.on_behalf_of_email;
+        (requestBodyCommon as any).on_behalf_of = (
+          remote as any
+        ).on_behalf_of;
         (requestBodyCommon as any).preserve_on_behalf_of = true;
         log.info(`Preserving ${remote.on_behalf_of_email} as on_behalf_of for script ${remotePath}`);
       }
@@ -679,6 +741,11 @@ export async function readModulesFromDisk(
   moduleFolderPath: string,
   defaultTs: "bun" | "deno" | undefined,
   folderLayout: boolean = false,
+  // A dbt project rides in its module folder as-is: `.sql` models (which the
+  // language inference below rejects as an ambiguous dialect), `.yml` schemas
+  // and `.csv` seeds are all part of the project and none is a Windmill script.
+  // Verbatim, or dbt receives a project missing exactly the files it needs.
+  verbatim: boolean = false,
 ): Promise<Record<string, ScriptModule> | undefined> {
   if (!fs.existsSync(moduleFolderPath) || !fs.statSync(moduleFolderPath).isDirectory()) {
     return undefined;
@@ -686,9 +753,18 @@ export async function readModulesFromDisk(
 
   const modules: Record<string, ScriptModule> = {};
 
+  const skipDirs = verbatim
+    ? dbtGeneratedDirs(moduleFolderPath)
+    : new Set<string>();
+
   // In folder layout mode, skip the entry point files (script.*, script.yaml, etc.)
   const isEntryPointFile = (name: string, isTopLevel: boolean) => {
-    if (!folderLayout || !isTopLevel) return false;
+    if (!isTopLevel) return false;
+    // A dbt project's descriptor is the script's CONTENT, so it must not also
+    // ride along as a module: the push would send the same text twice and dbt
+    // would find a stray file at its project root.
+    if (verbatim) return name === DBT_DESCRIPTOR_NAME;
+    if (!folderLayout) return false;
     return (
       name.startsWith("script.") ||
       name === "script.lock" ||
@@ -705,10 +781,63 @@ export async function readModulesFromDisk(
       const isTopLevel = relPrefix === "";
 
       if (entry.isDirectory()) {
+        // A configured `target-path` may be nested (`build/target`), so the
+        // comparison is on the project-relative path, not the entry name.
+        if (skipDirs.size > 0 && isUnderGeneratedDir(relPath, skipDirs)) continue;
         readDir(fullPath, relPath);
-      } else if (entry.isFile() && !entry.name.endsWith(".lock") && !isEntryPointFile(entry.name, isTopLevel)) {
-        // Skip lock files — they're handled as the `lock` field on ScriptModule
-        if (exts.some((ext) => entry.name.endsWith(ext))) {
+        // `.lock` is the script's own lockfile in a `__mod` bundle (the `lock`
+        // field on ScriptModule) — but a dbt project's files are its author's,
+        // and one may legitimately be named `uv.lock`. Dropping it would break
+        // the unmodified-project round trip this bundle exists to keep.
+      } else if (
+        entry.isFile() &&
+        (verbatim || !entry.name.endsWith(".lock")) &&
+        !isEntryPointFile(entry.name, isTopLevel)
+      ) {
+        if (verbatim) {
+          // Secrets stay on the machine that holds them. Skipped before the
+          // read, and loudly: a `.env` swept into the bundle is a credential
+          // stored in every version of the script and handed back on pull.
+          if (isLocalSecretFile(entry.name)) {
+            log.warn(
+              `Skipping ${relPath}: a local secrets file is not part of the dbt project — ` +
+                `dbt reads its values from the environment, so set them in the script's ` +
+                `environment variables or the descriptor's \`env\``,
+            );
+            continue;
+          }
+          // A dbt project's authored files are text. A binary one -- an image
+          // under `docs/`, a `.DS_Store`, a parquet seed -- would be read as
+          // mojibake and, if it carries a NUL, rejected by Postgres with an
+          // opaque `unsupported Unicode escape sequence`, which the push then
+          // reports as success. Skip it, loudly: dbt does not read it either.
+          //
+          // Asked BEFORE reading: the predicate only stats the file and reads
+          // its first 8 KB, so a multi-gigabyte seed next to the project costs
+          // that rather than being loaded whole just to be rejected.
+          const exclusion = moduleFileExclusion(fullPath);
+          if (exclusion !== undefined) {
+            // Over the limit but readable as text — a large seed CSV is the
+            // realistic case — is refused rather than skipped: dbt WOULD have
+            // read it, so shipping the project without it deploys something that
+            // compiles here and fails at run time with a missing relation.
+            if (exclusion === "oversized") {
+              throw oversizedModuleFileError(relPath, fs.statSync(fullPath).size);
+            }
+            log.warn(
+              `Skipping ${relPath}: not a text file, so it is not part of the dbt project the ` +
+                `bundle carries — dbt does not read it either`,
+            );
+            continue;
+          }
+          // `language` is a required field of the API type and is not used for
+          // these: the worker writes them to their relative path and dbt reads
+          // the tree.
+          modules[relPath] = {
+            content: fs.readFileSync(fullPath).toString("utf-8"),
+            language: "dbt" as ScriptModule["language"],
+          };
+        } else if (exts.some((ext) => entry.name.endsWith(ext))) {
           const content = readTextFileSync(fullPath);
           const language = inferContentTypeFromFilePath(entry.name, defaultTs);
 
@@ -889,6 +1018,90 @@ async function createScript(
  */
 export class UnresolvableScriptContentFileError extends Error {}
 
+/**
+ * A path claimed by both a dbt project and an ordinary script.
+ *
+ * Its own class because the module push tolerates "no parent found" and must
+ * NOT tolerate this: swallowed, the command reports success while deploying
+ * nothing.
+ */
+export class DbtPathCollisionError extends UnresolvableScriptContentFileError {}
+
+/**
+ * The dbt project a path would collide with, if there is one.
+ *
+ * `<base>.py` and `<base>__dbt/` deploy to the SAME remote path, so whichever
+ * is pushed last wins and replaces the other's script. The descriptor is
+ * optional, so `dbt_project.yml` — not the descriptor — is what says a project
+ * is there. Asked on BOTH push paths: an ordinary file goes straight to
+ * `handleFile`, a model reaches its parent through `findContentFile`, and a
+ * guard on one of them leaves the other silently overwriting.
+ */
+export async function collidingDbtProject(
+  basePath: string
+): Promise<string | undefined> {
+  const project = basePath + "__dbt/dbt_project.yml";
+  return (await stat(project).then(() => true).catch(() => false))
+    ? project
+    : undefined;
+}
+
+/**
+ * The ordinary script file sharing a base with a dbt project, if there is one —
+ * the same collision as [`collidingDbtProject`], seen from the dbt side.
+ *
+ * Needed because a descriptor may be pushed DIRECTLY (`wmill script push
+ * <base>__dbt/wm_dbt.yaml`), which never passes through the metadata resolution
+ * that would otherwise catch it.
+ */
+export async function collidingOrdinaryScript(
+  basePath: string
+): Promise<string | undefined> {
+  for (const ext of exts) {
+    if (ext === "__dbt/" + DBT_DESCRIPTOR_NAME) continue;
+    // Both layouts, because both deploy to `basePath`: the flat file, and the
+    // folder layout's entry point.
+    for (const candidate of [
+      basePath + ext,
+      `${basePath}${getModuleFolderSuffix()}/script${ext}`,
+    ]) {
+      const isFile = await stat(candidate)
+        .then((s) => s.isFile())
+        .catch(() => false);
+      if (isFile) return candidate;
+    }
+  }
+  return undefined;
+}
+
+export function dbtPathCollisionError(
+  project: string,
+  other: string
+): DbtPathCollisionError {
+  return new DbtPathCollisionError(
+    `${project} and ${other} deploy to the same path, so pushing either one ` +
+      `replaces the other's script. Keep one: move the dbt project to a path ` +
+      `of its own, or remove ${other}.`
+  );
+}
+
+
+/**
+ * A script's content, tolerating the one content file that may not exist: a dbt
+ * project's descriptor is optional, and absent means an empty descriptor.
+ */
+async function readScriptContent(filePath: string): Promise<string> {
+  try {
+    return await readTextFile(filePath);
+  } catch (e) {
+    // ONLY a missing file is an empty descriptor. A permission or I/O error on a
+    // descriptor that does exist would otherwise deploy the defaults — the
+    // `main` warehouse and the whole project — in place of what the file says.
+    if (isMissingDbtDescriptor(filePath, e)) return "";
+    throw e;
+  }
+}
+
 export async function findContentFile(filePath: string) {
   // Folder layout: __mod/script.yaml -> __mod/script.ts
   const isModuleFolderMeta = isModuleEntryMetadata(filePath);
@@ -924,6 +1137,20 @@ export async function findContentFile(filePath: string) {
   )
     .filter((x) => x.file)
     .map((x) => x.path);
+  // A dbt project's descriptor is OPTIONAL, so `dbt_project.yml` is what says a
+  // dbt script lives at this path — the descriptor is often absent from the
+  // candidates above while the project is perfectly real. Asked BEFORE the
+  // counts below: a project beside an ordinary script is not "one candidate",
+  // it is two scripts claiming one remote path, and returning the ordinary one
+  // deploys it OVER the dbt script on the next push of any model.
+  const dbtCandidate = toCandidate("__dbt/" + DBT_DESCRIPTOR_NAME);
+  const dbtProject = await collidingDbtProject(
+    dbtCandidate.slice(0, -("__dbt/" + DBT_DESCRIPTOR_NAME).length),
+  );
+  const nonDbtCandidates = validCandidates.filter((c) => c !== dbtCandidate);
+  if (dbtProject && nonDbtCandidates.length > 0) {
+    throw dbtPathCollisionError(dbtProject, nonDbtCandidates.join(", "));
+  }
   if (validCandidates.length > 1) {
     throw new UnresolvableScriptContentFileError(
       `Multiple script files found next to ${filePath}: ${validCandidates.join(", ")} — ` +
@@ -931,6 +1158,11 @@ export async function findContentFile(filePath: string) {
     );
   }
   if (validCandidates.length < 1) {
+    // Resolving to the absent descriptor keeps one content path for every
+    // caller; reading it yields an empty descriptor.
+    if (dbtProject) {
+      return dbtCandidate;
+    }
     throw new UnresolvableScriptContentFileError(
       `No script file found next to ${filePath} — a script cannot be deployed from its metadata alone. ` +
         `Add the matching script file (e.g. ${toCandidate(".ts")} or ${toCandidate(
@@ -999,6 +1231,10 @@ export function filePathExtensionFromContentType(
     return ".rb";
   } else if (language === "rlang") {
     return ".r";
+  } else if (language === "dbt") {
+    // Not an extension but a path suffix: a dbt script's content file lives
+    // inside the project folder, so `<base> + this` is where it belongs.
+    return "__dbt/" + DBT_DESCRIPTOR_NAME;
     // for related places search: ADD_NEW_LANG
   } else {
     throw new Error("Invalid language: " + language);
@@ -1031,12 +1267,28 @@ export const exts = [
   ".java",
   ".rb",
   ".r",
+  // Not an extension: a dbt script's content file is its descriptor, inside
+  // the project folder. `<base>.script.yaml` -> `<base>__dbt/wm_dbt.yaml`.
+  "__dbt/" + DBT_DESCRIPTOR_NAME,
   // for related places search: ADD_NEW_LANG
 ];
 
+/**
+ * Whether a path is a script's content file.
+ *
+ * Separators are normalized first: one "extension" is the path suffix
+ * `__dbt/wm_dbt.yaml`, which on Windows is spelled `__dbt\wm_dbt.yaml` and
+ * would match nothing — silently skipping every dbt project on that platform.
+ */
+export function hasScriptExt(p: string): boolean {
+  const norm = p.replaceAll("\\", "/");
+  return exts.some((ext) => norm.endsWith(ext));
+}
+
 export function removeExtensionToPath(path: string): string {
+  const norm = path.replaceAll("\\", "/");
   for (const ext of exts) {
-    if (path.endsWith(ext)) {
+    if (norm.endsWith(ext)) {
       return path.substring(0, path.length - ext.length);
     }
   }
@@ -1450,7 +1702,7 @@ export async function generateMetadata(
       await FSFSElement(process.cwd(), codebases, false),
       (p, isD) => {
         return (
-          (!isD && !exts.some((ext) => p.endsWith(ext))) ||
+          (!isD && !hasScriptExt(p)) ||
           ignore(p, isD) ||
           isFlowPath(p) ||
           isAppPath(p) ||
@@ -1561,17 +1813,28 @@ async function preview(
   if (opts.silent) {
     log.setSilent(true);
   }
+  // Captured before the config read, which chdirs to the wmill.yaml root.
+  const cwdBeforeConfig = process.cwd();
   opts = await mergeConfigWithConfigFile(opts);
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
 
-  if (!validatePath(filePath)) {
-    return;
-  }
+  const argPath = filePath;
+  filePath = toSyncRootRelativePath(filePath, cwdBeforeConfig);
+  const remotePath = scriptPathToRemotePath(filePath);
+  assertRemotePath(remotePath, argPath);
 
-  const fstat = await stat(filePath);
-  if (!fstat.isFile()) {
-    throw new Error("file path must refer to a file.");
+  // Same as push: a descriptor-less dbt project's content path is deliberately
+  // absent, and the project beside it is what says the script is real.
+  const absentDescriptor = await stat(filePath).then(
+    () => false,
+    (e) => isMissingDbtDescriptor(filePath, e)
+  );
+  if (!absentDescriptor) {
+    const fstat = await stat(filePath);
+    if (!fstat.isFile()) {
+      throw new Error("file path must refer to a file.");
+    }
   }
 
   if (filePath.endsWith(".script.json") || filePath.endsWith(".script.yaml")) {
@@ -1582,15 +1845,23 @@ async function preview(
 
   const codebases = await listSyncCodebases(opts);
   const language = inferContentTypeFromFilePath(filePath, opts?.defaultTs);
-  const content = await readTextFile(filePath);
+  const content = await readScriptContent(filePath);
   const input = opts.data ? await resolve(opts.data) : {};
 
-  // Read modules from __mod/ folder if present
+  // Read modules from the bundle folder if present. Same suffix and same
+  // verbatim read as deploy: a dbt project lives in `__dbt/`, and parsing its
+  // files as scripts would drop the `dbt_project.yml` the executor looks for.
   const isFolderLayout = isModuleEntryPoint(filePath);
+  const isDbt = language === "dbt";
   const moduleFolderPath = isFolderLayout
     ? path.dirname(filePath)
-    : filePath.substring(0, filePath.indexOf(".")) + getModuleFolderSuffix();
-  const modules = await readModulesFromDisk(moduleFolderPath, opts?.defaultTs, isFolderLayout);
+    : filePath.substring(0, filePath.indexOf(".")) + getModuleFolderSuffix(language);
+  const modules = await readModulesFromDisk(
+    moduleFolderPath,
+    opts?.defaultTs,
+    isFolderLayout,
+    isDbt
+  );
 
   // Check if this is a codebase script
   const codebase =
@@ -1606,11 +1877,7 @@ async function preview(
   const { extractRelativeImports } = await import(
     "../../utils/relative_imports.ts"
   );
-  const relImports = await extractRelativeImports(
-    content,
-    scriptPathToRemotePath(filePath),
-    language
-  );
+  const relImports = await extractRelativeImports(content, remotePath, language);
   if (relImports.length > 0) {
     const { buildPreviewTempScriptRefs } = await import(
       "../generate-metadata/generate-metadata.ts"
@@ -1713,7 +1980,7 @@ async function preview(
     const form = new FormData();
     const previewPayload = {
       content: content, // Pass the original content (frontend does this too)
-      path: filePath.substring(0, filePath.indexOf(".")).replaceAll(SEP, "/"),
+      path: remotePath,
       args: input,
       language: language,
       tag: opts.tag,
@@ -1783,7 +2050,7 @@ async function preview(
       workspace: workspace.workspaceId,
       requestBody: {
         content,
-        path: filePath.substring(0, filePath.indexOf(".")).replaceAll(SEP, "/"),
+        path: remotePath,
         args: input,
         language: language as any,
         tag: opts.tag,
@@ -1872,6 +2139,10 @@ async function setPermissionedAs(
       lock: Array.isArray(remote.lock) ? remote.lock.join("\n") : remote.lock ?? undefined,
       parent_hash: remote.hash,
       on_behalf_of_email: email,
+      // The principal is derived server-side from the email, which resolves workspace
+      // members, groups and superadmins acting outside their workspaces alike — a
+      // client-side `usr` lookup would see only the first of those.
+      on_behalf_of: undefined,
       preserve_on_behalf_of: true,
       // Preserve any user draft at this path (see backend skip_draft_deletion).
       skip_draft_deletion: true,
diff --git a/cli/src/commands/sync/pull.ts b/cli/src/commands/sync/pull.ts
index 90a31f4919..2702e13714 100644
--- a/cli/src/commands/sync/pull.ts
+++ b/cli/src/commands/sync/pull.ts
@@ -84,7 +84,9 @@ export async function downloadZip(
   includeSettings?: boolean,
   includeKey?: boolean,
   skipWorkspaceDependencies?: boolean,
-  defaultTs?: "bun" | "deno"
+  skipDatatableMigrations?: boolean,
+  defaultTs?: "bun" | "deno",
+  syncBehavior?: string
 ): Promise<JSZip | TarAsZip | undefined> {
   const requestHeaders = new Headers();
   requestHeaders.set("Authorization", "Bearer " + workspace.token);
@@ -98,6 +100,9 @@ export async function downloadZip(
   }
 
   const includeWorkspaceDependenciesValue = !(skipWorkspaceDependencies ?? false);
+  // `sync_behavior_version` lets the server skip work this client would only throw away:
+  // from v1 the on-behalf-of address is stripped below, so the tarball sends the
+  // `has_on_behalf_of` marker instead and never resolves an address.
   // `preserve_extra_perms=true` opts the tarball into surfacing granular ACLs
   // on flow / script / app rows. Default-off on the server protects cross-
   // workspace tarball imports from carrying ACLs that reference identities
@@ -107,7 +112,7 @@ export async function downloadZip(
     }&skip_secrets=${skipSecrets ?? false}&include_schedules=${includeSchedules ?? false
     }&include_triggers=${includeTriggers ?? false}&include_users=${includeUsers ?? false
     }&include_groups=${includeGroups ?? false}&include_settings=${includeSettings ?? false
-    }&include_key=${includeKey ?? false}&include_workspace_dependencies=${includeWorkspaceDependenciesValue}&default_ts=${defaultTs ?? "bun"}&skip_resource_types=${skipResourceTypes ?? false}&settings_version=v2&preserve_extra_perms=true`;
+    }&include_key=${includeKey ?? false}&include_workspace_dependencies=${includeWorkspaceDependenciesValue}&skip_datatable_migrations=${skipDatatableMigrations ?? false}&default_ts=${defaultTs ?? "bun"}&skip_resource_types=${skipResourceTypes ?? false}&settings_version=v2&preserve_extra_perms=true&sync_behavior_version=${syncBehavior ?? "v0"}`;
 
   const baseUrl = workspace.remote + "api/w/" + workspace.workspaceId + "/workspaces/tarball?";
 
diff --git a/cli/src/commands/sync/sync.ts b/cli/src/commands/sync/sync.ts
index 3e6dd464fc..a28dd0fbd5 100644
--- a/cli/src/commands/sync/sync.ts
+++ b/cli/src/commands/sync/sync.ts
@@ -1,13 +1,28 @@
 import { requireLogin } from "../../core/auth.ts";
+import { markRequestsAsSyncOrigin } from "../../core/client.ts";
 import { fetchVersion, resolveWorkspace } from "../../core/context.ts";
-import { writeFile, readdir, stat, rm, copyFile, mkdir } from "node:fs/promises";
+import {
+  writeFile,
+  readdir,
+  stat,
+  rm,
+  copyFile,
+  mkdir,
+} from "node:fs/promises";
+import { existsSync } from "node:fs";
 import { colors } from "@cliffy/ansi/colors";
 import { Command } from "@cliffy/command";
 import { Confirm } from "@cliffy/prompt/confirm";
 import * as log from "../../core/log.ts";
 import * as path from "node:path";
 import { sep as SEP } from "node:path";
-import { stringify as yamlStringify, type DocumentOptions, type SchemaOptions, type CreateNodeOptions, type ToStringOptions } from "yaml";
+import {
+  stringify as yamlStringify,
+  type DocumentOptions,
+  type SchemaOptions,
+  type CreateNodeOptions,
+  type ToStringOptions,
+} from "yaml";
 import JSZip from "jszip";
 import { minimatch } from "minimatch";
 import { yamlParseContent } from "../../utils/yaml.ts";
@@ -39,13 +54,15 @@ import {
   exts,
   findContentFile,
   findResourceFile,
+  isModuleEntryMetadata,
   handleScriptMetadata,
   UnresolvableScriptContentFileError,
   removeExtensionToPath,
   filePathExtensionFromContentType,
+  hasScriptExt,
 } from "../script/script.ts";
 
-import { handleFile } from "../script/script.ts";
+import { DbtPathCollisionError, handleFile } from "../script/script.ts";
 import {
   deepEqual,
   fetchRemoteVersion,
@@ -86,7 +103,9 @@ import {
   gitSyncDeployPush,
   deriveGitSyncDeployIncludes,
   isForkWorkspace,
+  gitRecordedDatatableMigrationPaths,
   type GitSyncDeployItem,
+  type RecordedMigrationPaths,
 } from "../../utils/git.ts";
 import { Workspace } from "../workspace/workspace.ts";
 import { removePathPrefix } from "../../types.ts";
@@ -99,20 +118,31 @@ import {
   MalformedLockfileError,
   workspaceDependenciesPathToLanguageAndFilename,
 } from "../../utils/metadata.ts";
-import { DoubleLinkedDependencyTree, uploadScripts } from "../../utils/dependency_tree.ts";
-import { OpenFlow, NativeServiceName, ScriptModule } from "../../../gen/types.gen.ts";
+import {
+  DoubleLinkedDependencyTree,
+  uploadScripts,
+} from "../../utils/dependency_tree.ts";
+import {
+  OpenFlow,
+  NativeServiceName,
+  ScriptModule,
+} from "../../../gen/types.gen.ts";
 import { pushResource } from "../resource/resource.ts";
 import {
   newPathAssigner,
   newRawAppPathAssigner,
   PathAssigner,
 } from "../../../windmill-utils-internal/src/path-utils/path-assigner.ts";
-import { extractInlineScripts as extractInlineScriptsForFlows, extractCurrentMapping } from "../../../windmill-utils-internal/src/inline-scripts/extractor.ts";
+import {
+  extractInlineScripts as extractInlineScriptsForFlows,
+  extractCurrentMapping,
+} from "../../../windmill-utils-internal/src/inline-scripts/extractor.ts";
 import { generateFlowLockInternal } from "../flow/flow_metadata.ts";
 import { isExecutionModeAnonymous } from "../app/app.ts";
 import {
   APP_BACKEND_FOLDER,
   generateAppLocksInternal,
+  RECORDINGS_FOLDER,
 } from "../app/app_metadata.ts";
 import {
   isFlowPath,
@@ -132,10 +162,15 @@ import {
   getFolderSuffixWithSep,
   getNonDottedPaths,
   isScriptModulePath,
+  oversizedDbtFileError,
   getModuleFolderSuffix,
+  isDbtModulePath,
+  isDbtGeneratedPath,
   isModuleEntryPoint,
   getScriptBasePathFromModulePath,
   hasWrongFormatSuffix,
+  DBT_DESCRIPTOR_NAME,
+  isDbtDescriptorPath,
 } from "../../utils/resource_folders.ts";
 
 let branchDeprecationWarned = false;
@@ -154,12 +189,12 @@ function configKeyForItemKind(
       return "resources";
     case "variable":
       return "variables";
-      // case "schedule":
-      //   return "schedules";
-      // default:
-      //   return kind.endsWith("_trigger") ? "triggers" : null;
-    }
-    return null
+    // case "schedule":
+    //   return "schedules";
+    // default:
+    //   return kind.endsWith("_trigger") ? "triggers" : null;
+  }
+  return null;
 }
 
 // Fetch ws_specific items from the server and merge their paths into specificItems.
@@ -182,8 +217,11 @@ async function mergeWsSpecificFromServer(
     // 404 = endpoint not present on an older server: expected, log at debug.
     // Anything else (401/403/network) is a real failure that produces an
     // incomplete sync — surface it so the user notices.
-    const isApiError = err && typeof err === "object" &&
-      "name" in err && (err as { name: unknown }).name === "ApiError";
+    const isApiError =
+      err &&
+      typeof err === "object" &&
+      "name" in err &&
+      (err as { name: unknown }).name === "ApiError";
     const status = isApiError ? (err as { status?: number }).status : undefined;
     if (status === 404) {
       log.debug("listWsSpecific endpoint not available on server, skipping");
@@ -235,9 +273,7 @@ export function computeWsSpecificFlagOnlyPushes(
 ): Array<{ kind: string; serverPath: string; filePath: string }> {
   if (!localSpecificItems || serverItems === null) return [];
 
-  const serverSet = new Set(
-    serverItems.map((i) => `${i.item_kind}:${i.path}`),
-  );
+  const serverSet = new Set(serverItems.map((i) => `${i.item_kind}:${i.path}`));
 
   const out: Array<{ kind: string; serverPath: string; filePath: string }> = [];
   for (const filePath of Object.keys(localMap)) {
@@ -261,7 +297,10 @@ export function computeWsSpecificFlagOnlyPushes(
 
 // Resolve workspace name from a --branch override (git branch → workspace name).
 // Falls back to using the branch value as-is (backward compat: old key = branch name).
-function resolveWsNameFromBranch(opts: SyncOptions, branchName: string): string {
+function resolveWsNameFromBranch(
+  opts: SyncOptions,
+  branchName: string,
+): string {
   const match = findWorkspaceByGitBranch(opts.workspaces, branchName);
   return match ? match[0] : branchName;
 }
@@ -288,17 +327,23 @@ export function resolveWsNameForConfigFromFlags(
 }
 
 // Warn if --workspace overrides auto-detected branch or if workspace not in config.
-function warnWorkspaceOverride(opts: SyncOptions, wsNameForConfig: string | undefined): void {
+function warnWorkspaceOverride(
+  opts: SyncOptions,
+  wsNameForConfig: string | undefined,
+): void {
   if (!wsNameForConfig || !opts.workspaces) return;
 
   // Check if workspace exists in config
-  const wsEntry = (opts.workspaces as any)?.[wsNameForConfig] as WorkspaceEntryConfig | undefined;
+  const wsEntry = (opts.workspaces as any)?.[wsNameForConfig] as
+    WorkspaceEntryConfig | undefined;
   if (!wsEntry) {
-    const wsNames = Object.keys(opts.workspaces).filter((k) => k !== "commonSpecificItems");
+    const wsNames = Object.keys(opts.workspaces).filter(
+      (k) => k !== "commonSpecificItems",
+    );
     if (wsNames.length > 0) {
       log.warn(
         `⚠️  Workspace '${wsNameForConfig}' is not defined in the 'workspaces' section of wmill.yaml.\n` +
-        `   No workspace-specific overrides will be applied. Available workspaces: ${wsNames.join(", ")}`
+          `   No workspace-specific overrides will be applied. Available workspaces: ${wsNames.join(", ")}`,
       );
     }
     return;
@@ -308,11 +353,14 @@ function warnWorkspaceOverride(opts: SyncOptions, wsNameForConfig: string | unde
   if (isGitRepository()) {
     const currentBranch = getCurrentGitBranch();
     if (currentBranch) {
-      const autoMatch = findWorkspaceByGitBranch(opts.workspaces, currentBranch);
+      const autoMatch = findWorkspaceByGitBranch(
+        opts.workspaces,
+        currentBranch,
+      );
       if (autoMatch && autoMatch[0] !== wsNameForConfig) {
         log.info(
           `Current git branch '${currentBranch}' maps to workspace '${autoMatch[0]}', ` +
-          `but --workspace overrides to '${wsNameForConfig}'.`
+            `but --workspace overrides to '${wsNameForConfig}'.`,
         );
       }
     }
@@ -327,9 +375,14 @@ function resolveWsNameForFiles(_opts: SyncOptions, wsName: string): string {
 
 // After resolveWorkspace, infer the workspace config name from the resolved profile
 // by matching baseUrl + workspaceId against the workspaces config entries.
-function inferWsNameFromProfile(opts: SyncOptions, profile: { remote: string; workspaceId: string }): string | undefined {
+function inferWsNameFromProfile(
+  opts: SyncOptions,
+  profile: { remote: string; workspaceId: string },
+): string | undefined {
   if (!opts.workspaces) return undefined;
-  const wsNames = Object.keys(opts.workspaces).filter((k) => k !== "commonSpecificItems");
+  const wsNames = Object.keys(opts.workspaces).filter(
+    (k) => k !== "commonSpecificItems",
+  );
   for (const name of wsNames) {
     const entry = (opts.workspaces as any)[name] as WorkspaceEntryConfig;
     if (!entry?.baseUrl) continue;
@@ -362,7 +415,13 @@ async function resolveEffectiveSyncOptions(
   promotion?: string,
   workspaceNameOverride?: string,
 ): Promise<SyncOptions> {
-  return await getEffectiveSettings(localConfig, promotion, false, false, workspaceNameOverride);
+  return await getEffectiveSettings(
+    localConfig,
+    promotion,
+    false,
+    false,
+    workspaceNameOverride,
+  );
 }
 
 type DynFSElement = {
@@ -462,6 +521,27 @@ async function addCodebaseDigestIfRelevant(
   return content;
 }
 
+/**
+ * Whether a script's modules ARE a dbt project.
+ *
+ * Keyed on `dbt_project.yml` rather than on the descriptor: the descriptor is
+ * optional, so its absence says nothing, while a dbt project without
+ * `dbt_project.yml` is one dbt itself refuses to run.
+ *
+ * Its LANGUAGE decides, not its name. A dbt bundle is read verbatim and every
+ * file in it is stored as `dbt`; an ordinary modular script that happens to
+ * vendor a dbt project stores that same file as whatever its extension infers,
+ * and calling it dbt would lay the bundle out as `__dbt` and drop it on the
+ * next push.
+ */
+function isDbtModules(modules: unknown): boolean {
+  if (typeof modules !== "object" || modules === null) return false;
+  const marker = (modules as Record<string, { language?: string }>)[
+    "dbt_project.yml"
+  ];
+  return marker?.language === "dbt";
+}
+
 export async function FSFSElement(
   p: string,
   codebases: SyncCodebase[],
@@ -491,8 +571,14 @@ export async function FSFSElement(
         }
       },
       async getContentText(): Promise<string> {
-        const content = await readTextFile(localP);
         const itemPath = localP.substring(p.length + 1);
+        // BEFORE the read: an oversized dbt project file stays visible to the
+        // diff on purpose (so the push reports it rather than silently shipping
+        // an incomplete project), and buffering a multi-gigabyte seed to reach
+        // that error is what this refusal exists to avoid.
+        const oversized = oversizedDbtFileError(localP, itemPath);
+        if (oversized) throw oversized;
+        const content = await readTextFile(localP);
         const r = await addCodebaseDigestIfRelevant(
           itemPath,
           content,
@@ -525,9 +611,14 @@ function prioritizeName(name: string): string {
   return name;
 }
 
-export const yamlOptions: DocumentOptions & SchemaOptions & CreateNodeOptions & ToStringOptions = {
+export const yamlOptions: DocumentOptions &
+  SchemaOptions &
+  CreateNodeOptions &
+  ToStringOptions = {
   sortMapEntries: (a, b) => {
-    return prioritizeName(String(a.key)).localeCompare(prioritizeName(String(b.key)));
+    return prioritizeName(String(a.key)).localeCompare(
+      prioritizeName(String(b.key)),
+    );
   },
   aliasDuplicateObjects: false,
   singleQuote: true,
@@ -591,11 +682,15 @@ export function extractFieldsForRawApps(runnables: Record<string, any>) {
  * References the raw-app skill for complete documentation and includes instance-specific
  * data configuration (datatable, schema, whitelisted tables).
  */
-export function generateAgentsDocumentation(data: {
-  tables?: string[];
-  datatable?: string;
-  schema?: string;
-} | undefined): string {
+export function generateAgentsDocumentation(
+  data:
+    | {
+        tables?: string[];
+        datatable?: string;
+        schema?: string;
+      }
+    | undefined,
+): string {
   const tables = data?.tables ?? [];
   const defaultDatatable = data?.datatable;
   const defaultSchema = data?.schema;
@@ -610,15 +705,19 @@ This file contains **app-specific configuration** for this raw app instance.
 
 ## Data Configuration
 
-${defaultDatatable
-  ? `**Default Datatable:** \`${defaultDatatable}\`${defaultSchema ? ` | **Default Schema:** \`${defaultSchema}\`` : ''}`
-  : '**No default datatable configured.** Set \`data.datatable\` in \`raw_app.yaml\` to enable database access.'}
+${
+  defaultDatatable
+    ? `**Default Datatable:** \`${defaultDatatable}\`${defaultSchema ? ` | **Default Schema:** \`${defaultSchema}\`` : ""}`
+    : "**No default datatable configured.** Set \`data.datatable\` in \`raw_app.yaml\` to enable database access."
+}
 
 ### Whitelisted Tables
 
-${tables.length > 0
-  ? `These tables are accessible to this app:\n\n${tables.map(t => `- \`${t}\``).join('\n')}`
-  : `**No tables whitelisted.** Add tables to \`data.tables\` in \`raw_app.yaml\`.`}
+${
+  tables.length > 0
+    ? `These tables are accessible to this app:\n\n${tables.map((t) => `- \`${t}\``).join("\n")}`
+    : `**No tables whitelisted.** Add tables to \`data.tables\` in \`raw_app.yaml\`.`
+}
 
 ### Adding a Table
 
@@ -626,10 +725,10 @@ Edit \`raw_app.yaml\`:
 
 \`\`\`yaml
 data:
-  datatable: ${defaultDatatable || 'main'}
-  ${defaultSchema ? `schema: ${defaultSchema}\n  ` : ''}tables:
-${tables.length > 0 ? tables.map(t => `    - ${t}`).join('\n') : '    # Add tables here'}
-    - ${defaultDatatable || 'main'}/${defaultSchema ? defaultSchema + ':' : ''}new_table  # ← Add like this
+  datatable: ${defaultDatatable || "main"}
+  ${defaultSchema ? `schema: ${defaultSchema}\n  ` : ""}tables:
+${tables.length > 0 ? tables.map((t) => `    - ${t}`).join("\n") : "    # Add tables here"}
+    - ${defaultDatatable || "main"}/${defaultSchema ? defaultSchema + ":" : ""}new_table  # ← Add like this
 \`\`\`
 
 **Table reference formats:**
@@ -665,11 +764,15 @@ const rows = await sql\`SELECT * FROM table WHERE id = \${id}\`.fetch();
  * Generates a simple DATATABLES.md with just the current configuration summary.
  * The detailed schema information is generated by generate_datatables.ts command.
  */
-export function generateDatatablesDocumentation(data: {
-  tables?: string[];
-  datatable?: string;
-  schema?: string;
-} | undefined): string {
+export function generateDatatablesDocumentation(
+  data:
+    | {
+        tables?: string[];
+        datatable?: string;
+        schema?: string;
+      }
+    | undefined,
+): string {
   const tables = data?.tables ?? [];
   const defaultDatatable = data?.datatable;
   const defaultSchema = data?.schema;
@@ -683,15 +786,19 @@ Run \`wmill app generate-agents\` to refresh with current workspace schemas.
 
 ## Current Configuration
 
-${defaultDatatable
-  ? `**Default Datatable:** \`${defaultDatatable}\`${defaultSchema ? ` | **Default Schema:** \`${defaultSchema}\`` : ''}`
-  : '**No default datatable configured.**'}
+${
+  defaultDatatable
+    ? `**Default Datatable:** \`${defaultDatatable}\`${defaultSchema ? ` | **Default Schema:** \`${defaultSchema}\`` : ""}`
+    : "**No default datatable configured.**"
+}
 
 ## Whitelisted Tables
 
-${tables.length > 0
-  ? `${tables.map(t => `- \`${t}\``).join('\n')}`
-  : `*No tables whitelisted. Add tables to \`data.tables\` in \`raw_app.yaml\`.*`}
+${
+  tables.length > 0
+    ? `${tables.map((t) => `- \`${t}\``).join("\n")}`
+    : `*No tables whitelisted. Add tables to \`data.tables\` in \`raw_app.yaml\`.*`
+}
 
 ---
 
@@ -761,11 +868,17 @@ export function extractInlineScriptsForApps(
   return [];
 }
 
-type FileResourceTypeInfo = { format_extension: string | null; is_fileset: boolean };
+type FileResourceTypeInfo = {
+  format_extension: string | null;
+  is_fileset: boolean;
+};
 
 function parseFileResourceTypeMap(
   raw: Record<string, string | FileResourceTypeInfo>,
-): { formatExtMap: Record<string, string>; filesetMap: Record<string, boolean> } {
+): {
+  formatExtMap: Record<string, string>;
+  filesetMap: Record<string, boolean>;
+} {
   const formatExtMap: Record<string, string> = {};
   const filesetMap: Record<string, boolean> = {};
   for (const [k, v] of Object.entries(raw)) {
@@ -799,7 +912,9 @@ async function findFilesetResourceFile(changePath: string): Promise<string> {
       // not found, try next
     }
   }
-  throw new Error(`No resource metadata file found for fileset resource: ${changePath}`);
+  throw new Error(
+    `No resource metadata file found for fileset resource: ${changePath}`,
+  );
 }
 
 type FilesetPushResult =
@@ -871,9 +986,13 @@ function ZipFSElement(
             const content = await zip.files[filename].async("text");
             const parsed = JSON.parse(content);
             if (parsed.modules && Object.keys(parsed.modules).length > 0) {
-              _moduleScriptPaths.add(
-                filename.slice(0, -".script.json".length)
-              );
+              const base = filename.slice(0, -".script.json".length);
+              // A dbt script's modules ARE its dbt project, so it keeps the flat
+              // layout: only the project goes in the folder, which is what
+              // `--project-dir` expects and what makes the import a plain copy.
+              if (!isDbtModules(parsed.modules)) {
+                _moduleScriptPaths.add(base);
+              }
             }
           } catch {}
         }
@@ -926,7 +1045,7 @@ function ZipFSElement(
     let finalPath = transformPath();
 
     // Redirect content files for scripts with modules into __mod/ folder
-    if (kind == "other" && exts.some((ext) => p.endsWith(ext))) {
+    if (kind == "other" && hasScriptExt(p)) {
       const normalizedP = p.replace(/^\.[\\/]/, "");
       const moduleScripts = await getModuleScriptPaths();
       for (const basePath of moduleScripts) {
@@ -934,7 +1053,11 @@ function ZipFSElement(
           const ext = normalizedP.slice(basePath.length); // e.g., ".ts", ".py"
           const dir = path.dirname(finalPath);
           const base = path.basename(basePath);
-          finalPath = path.join(dir, base + getModuleFolderSuffix(), "script" + ext);
+          finalPath = path.join(
+            dir,
+            base + getModuleFolderSuffix(),
+            "script" + ext,
+          );
           break;
         }
       }
@@ -955,7 +1078,9 @@ function ZipFSElement(
             }
             let inlineScripts;
             try {
-              const assigner = newPathAssigner(defaultTs, { skipInlineScriptSuffix: getNonDottedPaths() });
+              const assigner = newPathAssigner(defaultTs, {
+                skipInlineScriptSuffix: getNonDottedPaths(),
+              });
               // Preserve original !inline filenames from the flow to avoid phantom renames
               const inlineMapping = extractCurrentMapping(
                 flow.value.modules as any,
@@ -969,27 +1094,40 @@ function ZipFSElement(
                 SEP,
                 defaultTs,
                 assigner,
-                { skipInlineScriptSuffix: getNonDottedPaths(), failOnInlineDirective: true },
+                {
+                  skipInlineScriptSuffix: getNonDottedPaths(),
+                  failOnInlineDirective: true,
+                },
               );
               if (flow.value.failure_module) {
-                inlineScripts.push(...extractInlineScriptsForFlows(
-                  [flow.value.failure_module],
-                  inlineMapping,
-                  SEP,
-                  defaultTs,
-                  assigner,
-                  { skipInlineScriptSuffix: getNonDottedPaths(), failOnInlineDirective: true },
-                ));
+                inlineScripts.push(
+                  ...extractInlineScriptsForFlows(
+                    [flow.value.failure_module],
+                    inlineMapping,
+                    SEP,
+                    defaultTs,
+                    assigner,
+                    {
+                      skipInlineScriptSuffix: getNonDottedPaths(),
+                      failOnInlineDirective: true,
+                    },
+                  ),
+                );
               }
               if (flow.value.preprocessor_module) {
-                inlineScripts.push(...extractInlineScriptsForFlows(
-                  [flow.value.preprocessor_module],
-                  inlineMapping,
-                  SEP,
-                  defaultTs,
-                  assigner,
-                  { skipInlineScriptSuffix: getNonDottedPaths(), failOnInlineDirective: true },
-                ));
+                inlineScripts.push(
+                  ...extractInlineScriptsForFlows(
+                    [flow.value.preprocessor_module],
+                    inlineMapping,
+                    SEP,
+                    defaultTs,
+                    assigner,
+                    {
+                      skipInlineScriptSuffix: getNonDottedPaths(),
+                      failOnInlineDirective: true,
+                    },
+                  ),
+                );
               }
             } catch (error) {
               log.error(
@@ -1038,7 +1176,9 @@ function ZipFSElement(
               inlineScripts = extractInlineScriptsForApps(
                 undefined,
                 app?.["value"],
-                newPathAssigner(defaultTs, { skipInlineScriptSuffix: getNonDottedPaths() }),
+                newPathAssigner(defaultTs, {
+                  skipInlineScriptSuffix: getNonDottedPaths(),
+                }),
                 (_, val) => val["name"],
                 false,
               );
@@ -1124,7 +1264,7 @@ function ZipFSElement(
                   isDirectory: false,
                   path: path.join(finalPath, filePath.substring(1)),
                   async *getChildren() {},
-                    async getContentText() {
+                  async getContentText() {
                     if (typeof content !== "string") {
                       throw new Error(
                         `Content of raw app file ${filePath} is not a string`,
@@ -1213,7 +1353,9 @@ function ZipFSElement(
 
               // Simplify fields for cleaner YAML output
               if (simplifiedRunnable.fields) {
-                simplifiedRunnable.fields = simplifyFields(simplifiedRunnable.fields);
+                simplifiedRunnable.fields = simplifyFields(
+                  simplifiedRunnable.fields,
+                );
               }
 
               yield {
@@ -1272,17 +1414,28 @@ function ZipFSElement(
               log.error(`Failed to parse script.yaml at path: ${p}`);
               throw error;
             }
-            const hasModules = parsed["modules"] && Object.keys(parsed["modules"]).length > 0;
+            const hasModules =
+              parsed["modules"] && Object.keys(parsed["modules"]).length > 0;
+            // A dbt script's module folder holds its dbt project and dbt's own
+            // files, so its lock stays outside like a plain script's — only the
+            // descriptor lives in there.
+            const isDbtScript = isDbtModules(parsed["modules"]);
             if (
               parsed["lock"] &&
               parsed["lock"] != "" &&
               parsed["codebase"] == undefined
             ) {
-              if (hasModules) {
+              if (hasModules && !isDbtScript) {
                 // Lock lives inside __mod/ folder as script.lock
-                const scriptBase = removeSuffix(removeSuffix(p.replaceAll(SEP, "/"), ".json"), ".script");
+                const scriptBase = removeSuffix(
+                  removeSuffix(p.replaceAll(SEP, "/"), ".json"),
+                  ".script",
+                );
                 parsed["lock"] =
-                  "!inline " + scriptBase + getModuleFolderSuffix() + "/script.lock";
+                  "!inline " +
+                  scriptBase +
+                  getModuleFolderSuffix() +
+                  "/script.lock";
               } else {
                 parsed["lock"] =
                   "!inline " +
@@ -1322,8 +1475,7 @@ function ZipFSElement(
               throw error;
             }
             const resourceType = parsed["resource_type"];
-            const formatExtension =
-              resourceTypeToFormatExtension[resourceType];
+            const formatExtension = resourceTypeToFormatExtension[resourceType];
             const isFileset = resourceTypeToIsFileset[resourceType] ?? false;
 
             if (isFileset) {
@@ -1388,18 +1540,24 @@ function ZipFSElement(
         throw error;
       }
       const lock = parsed["lock"];
-      const scriptModules: Record<string, ScriptModule> | undefined = parsed["modules"];
+      const scriptModules: Record<string, ScriptModule> | undefined =
+        parsed["modules"];
       const hasModules = scriptModules && Object.keys(scriptModules).length > 0;
+      // A dbt script's module folder is its dbt project, so the metadata and
+      // lock stay beside it — the descriptor is the one Windmill file that goes
+      // in, because it is the script's content.
+      const isDbt = isDbtModules(scriptModules);
 
       // Compute base path and module folder
       const metaExt = useYaml ? ".yaml" : ".json";
       const scriptBasePath = removeSuffix(
         removeSuffix(finalPath, metaExt),
-        ".script"
+        ".script",
       );
-      const moduleFolderPath = scriptBasePath + getModuleFolderSuffix();
+      const moduleFolderPath =
+        scriptBasePath + getModuleFolderSuffix(isDbt ? "dbt" : undefined);
 
-      if (hasModules) {
+      if (hasModules && !isDbt) {
         // Redirect metadata into __mod/script.yaml
         r[0].path = path.join(moduleFolderPath, "script" + metaExt);
       }
@@ -1407,9 +1565,10 @@ function ZipFSElement(
       if (lock && lock != "") {
         r.push({
           isDirectory: false,
-          path: hasModules
-            ? path.join(moduleFolderPath, "script.lock")
-            : removeSuffix(finalPath, metaExt) + ".lock",
+          path:
+            hasModules && !isDbt
+              ? path.join(moduleFolderPath, "script.lock")
+              : removeSuffix(finalPath, metaExt) + ".lock",
           async *getChildren() {},
           async getContentText() {
             return lock;
@@ -1436,7 +1595,7 @@ function ZipFSElement(
 
               // Yield the module lock file if present
               if (mod.lock) {
-                const baseName = relPath.replace(/\.[^.]+$/, '');
+                const baseName = relPath.replace(/\.[^.]+$/, "");
                 yield {
                   isDirectory: false,
                   path: path.join(moduleFolderPath, baseName + ".lock"),
@@ -1464,11 +1623,14 @@ function ZipFSElement(
         throw error;
       }
       const resourceType = parsed["resource_type"];
-      const formatExtension =
-        resourceTypeToFormatExtension[resourceType];
+      const formatExtension = resourceTypeToFormatExtension[resourceType];
       const isFileset = resourceTypeToIsFileset[resourceType] ?? false;
 
-      if (isFileset && typeof parsed["value"] === "object" && parsed["value"] !== null) {
+      if (
+        isFileset &&
+        typeof parsed["value"] === "object" &&
+        parsed["value"] !== null
+      ) {
         const filesetBasePath =
           removeSuffix(finalPath, ".resource.json") + ".fileset";
         // Push directory entry for the fileset
@@ -1476,7 +1638,9 @@ function ZipFSElement(
           isDirectory: true,
           path: filesetBasePath,
           async *getChildren() {
-            for (const [relPath, fileContent] of Object.entries(parsed["value"])) {
+            for (const [relPath, fileContent] of Object.entries(
+              parsed["value"],
+            )) {
               if (typeof fileContent === "string") {
                 yield {
                   isDirectory: false,
@@ -1652,9 +1816,15 @@ export async function elementsToMap(
     }
     const path = entry.path;
     // Include module files in the map so they're compared for changes,
-    // but they're pushed as part of their parent script via handleFile
+    // but they're pushed as part of their parent script via handleFile.
+    // `--skip-scripts` therefore covers them, and has to be applied here: the
+    // filters below are past this shortcut, so a changed module would push the
+    // parent script the flag asked to leave alone — every file of a dbt project
+    // is one of these.
     if (isScriptModulePath(path)) {
-      map[path] = await entry.getContentText();
+      if (!skips.skipScripts) {
+        map[path] = await entry.getContentText();
+      }
       continue;
     }
     if (
@@ -1663,6 +1833,10 @@ export async function elementsToMap(
       !isRawAppFile(path) &&
       !isWorkspaceDependencies(path)
     ) {
+      // The metadata format decides which of the two metadata twins is read,
+      // and drops the other. A dbt descriptor is not metadata and is not
+      // reached here: it lives inside the project folder, so the module branch
+      // above already took it, in both modes.
       if (json && path.endsWith(".yaml")) continue;
       if (!json && path.endsWith(".json")) continue;
 
@@ -1695,9 +1869,16 @@ export async function elementsToMap(
     }
 
     if (isRawAppFile(path)) {
-      const suffix = path.split(getFolderSuffix("raw_app") + SEP).pop();
+      // FSFSElement builds paths with the platform separator, while the checks
+      // below are written with "/": without normalizing, none of them match on
+      // Windows and the push collector's own exclusions become perpetual diffs.
+      const suffix = path
+        .split(getFolderSuffix("raw_app") + SEP)
+        .pop()
+        ?.replaceAll(SEP, "/");
       if (
         suffix?.startsWith("dist/") ||
+        suffix?.startsWith(RECORDINGS_FOLDER + "/") ||
         suffix == "wmill.d.ts" ||
         suffix == "package-lock.json" ||
         suffix == "DATATABLES.md"
@@ -1706,7 +1887,11 @@ export async function elementsToMap(
       }
     }
 
-    if (skips.skipResources && (isFileResource(path) || isFilesetResource(path))) continue;
+    if (
+      skips.skipResources &&
+      (isFileResource(path) || isFilesetResource(path))
+    )
+      continue;
 
     const ext = json ? ".json" : ".yaml";
     if (!skips.includeSchedules && path.endsWith(".schedule" + ext)) continue;
@@ -1749,6 +1934,8 @@ export async function elementsToMap(
         fileType === "workspace_dependencies"
       )
         continue;
+      if (skips.skipDatatableMigrations && fileType === "datatable_migration")
+        continue;
     } catch {
       // If getTypeStrFromPath can't determine the type, continue processing the file
     }
@@ -1827,17 +2014,38 @@ export async function elementsToMap(
 
   if (wrongFormatPaths.length > 0) {
     const isNonDotted = getNonDottedPaths();
-    const foundFormat = isNonDotted ? ".flow/.app/.raw_app" : "__flow/__app/__raw_app";
-    const expectedFormat = isNonDotted ? "__flow/__app/__raw_app" : ".flow/.app/.raw_app";
+    const foundFormat = isNonDotted
+      ? ".flow/.app/.raw_app"
+      : "__flow/__app/__raw_app";
+    const expectedFormat = isNonDotted
+      ? "__flow/__app/__raw_app"
+      : ".flow/.app/.raw_app";
     const configHint = isNonDotted
       ? "Either remove 'nonDottedPaths: true' from wmill.yaml, or rename these directories to use __flow/__app/__raw_app format."
       : "Either add 'nonDottedPaths: true' to wmill.yaml, or rename these directories to use .flow/.app/.raw_app format.";
     const pathList = wrongFormatPaths.map((p) => `  ${p}`).join("\n");
     throw new Error(
-      `Found ${wrongFormatPaths.length} directory(ies) using ${foundFormat} format, but wmill.yaml expects ${expectedFormat}:\n${pathList}\n${configHint}`
+      `Found ${wrongFormatPaths.length} directory(ies) using ${foundFormat} format, but wmill.yaml expects ${expectedFormat}:\n${pathList}\n${configHint}`,
     );
   }
 
+  // A dbt project's descriptor is optional, and the two sides spell "absent"
+  // differently: nothing on disk, and nothing in the export (which omits an
+  // empty one so a project that never named a descriptor never grows one).
+  // Left alone that reads as an addition on every push and a deletion on every
+  // pull, forever. Both sides are given the empty descriptor the absence means,
+  // so a descriptor-less project reaches a clean sync state.
+  for (const key of Object.keys(map)) {
+    // Normalized first: the local map's keys are built with `path.join`, so on
+    // Windows this reads `__dbt\\dbt_project.yml` and an unnormalized match
+    // would synthesize nothing — leaving exactly the perpetual push/pull diff
+    // above unguarded, on that platform only.
+    if (!key.replaceAll("\\", "/").endsWith("__dbt/dbt_project.yml")) continue;
+    const descriptor =
+      key.slice(0, -"dbt_project.yml".length) + DBT_DESCRIPTOR_NAME;
+    if (!(descriptor in map)) map[descriptor] = "";
+  }
+
   return map;
 }
 
@@ -1851,6 +2059,7 @@ export interface Skips {
   skipApps?: boolean | undefined;
   skipFolders?: boolean | undefined;
   skipWorkspaceDependencies?: boolean | undefined;
+  skipDatatableMigrations?: boolean | undefined;
   skipScriptsMetadata?: boolean | undefined;
   includeSchedules?: boolean | undefined;
   includeTriggers?: boolean | undefined;
@@ -1967,7 +2176,11 @@ export function canonicalizeCaseInsensitiveKeys(
       const lk = seg.toLowerCase();
       let entry = node.children.get(lk);
       if (!entry) {
-        entry = { canonical: seg, ambiguous: false, node: { children: new Map() } };
+        entry = {
+          canonical: seg,
+          ambiguous: false,
+          node: { children: new Map() },
+        };
         node.children.set(lk, entry);
       } else if (entry.canonical !== seg) {
         entry.ambiguous = true;
@@ -2141,7 +2354,9 @@ export function preservePendingScriptLocks(
       remoteParsed = isYaml
         ? yamlParseContent(metaKey, remote[metaKey])
         : JSON.parse(remote[metaKey]);
-      localParsed = isYaml ? yamlParseContent(metaKey, localMeta) : JSON.parse(localMeta);
+      localParsed = isYaml
+        ? yamlParseContent(metaKey, localMeta)
+        : JSON.parse(localMeta);
     } catch {
       continue;
     }
@@ -2155,7 +2370,8 @@ export function preservePendingScriptLocks(
 
     // The local side must reference an inline lock backed by a committed file.
     const localLock = localParsed["lock"];
-    if (typeof localLock !== "string" || !localLock.startsWith("!inline ")) continue;
+    if (typeof localLock !== "string" || !localLock.startsWith("!inline "))
+      continue;
 
     // Derive the lock-file key from the `!inline` reference itself, not from the
     // metadata path: a multi-module script keeps its lock at `…__mod/script.lock`,
@@ -2188,10 +2404,37 @@ async function compareDynFSElement(
 ): Promise<{ changes: Change[]; localMap: Record<string, string> }> {
   let [m1, m2] = els2
     ? await Promise.all([
-        elementsToMap(els1, ignore, json, skips, specificItems, branchOverride, isEls1Remote),
-        elementsToMap(els2, ignore, json, skips, specificItems, branchOverride, !isEls1Remote),
+        elementsToMap(
+          els1,
+          ignore,
+          json,
+          skips,
+          specificItems,
+          branchOverride,
+          isEls1Remote,
+        ),
+        elementsToMap(
+          els2,
+          ignore,
+          json,
+          skips,
+          specificItems,
+          branchOverride,
+          !isEls1Remote,
+        ),
       ])
-    : [await elementsToMap(els1, ignore, json, skips, specificItems, branchOverride, isEls1Remote), {}];
+    : [
+        await elementsToMap(
+          els1,
+          ignore,
+          json,
+          skips,
+          specificItems,
+          branchOverride,
+          isEls1Remote,
+        ),
+        {},
+      ];
 
   // Reconcile letter-case differences between the local tree and the
   // authoritative server casing. Only meaningful for an actual two-sided diff
@@ -2506,9 +2749,11 @@ const isNotWmillFile = (p: string, isDirectory: boolean) => {
     );
   }
 
-  // Files inside __mod/ folders are script module files — always valid wmill files
+  // Files inside a module folder belong to their parent script, so they are
+  // always valid wmill files — except the ones dbt generates, which are not
+  // part of the bundle and must not surface as items of their own.
   if (isScriptModulePath(p)) {
-    return false;
+    return isDbtGeneratedPath(p);
   }
 
   try {
@@ -2560,6 +2805,7 @@ export async function ignoreF(wmillconf: {
   extraIncludes?: string[];
   skipResourceTypes?: boolean;
   skipWorkspaceDependencies?: boolean;
+  skipDatatableMigrations?: boolean;
   json?: boolean;
   includeUsers?: boolean;
   includeGroups?: boolean;
@@ -2624,6 +2870,14 @@ export async function ignoreF(wmillconf: {
         ) {
           return false; // Don't ignore workspace dependencies (they are always included unless explicitly skipped)
         }
+        // `migrations/datatable/**` is outside the u/f/g namespaces the path
+        // filters are written against, so the skip flag is its only control.
+        if (
+          !wmillconf.skipDatatableMigrations &&
+          fileType === "datatable_migration"
+        ) {
+          return false;
+        }
       } catch {
         // If getTypeStrFromPath can't determine the type, fall through to normal logic
       }
@@ -2637,6 +2891,46 @@ export async function ignoreF(wmillconf: {
   };
 }
 
+/**
+ * How many migration *records* a set of changed files covers. One migration is two
+ * files (`.up.sql` + optional `.down.sql`) for a single `(datatable, timestamp)`,
+ * so counting paths would overstate what a prompt is about to delete.
+ */
+export function countDatatableMigrationRecords(
+  changes: { path: string }[],
+): number {
+  const records = new Set<string>();
+  for (const c of changes) {
+    const parsed = parseDatatableMigrationPath(c.path);
+    if (parsed) records.add(`${parsed.datatable}\0${parsed.timestamp}`);
+  }
+  return records.size;
+}
+
+/**
+ * The `deleted` changes for data table migrations that a push cannot safely trust.
+ *
+ * Migrations bypass the repo's path filters (they live outside `f/`/`u/`), so a clone
+ * made before they were synced sees every server-side migration as remote-only — and
+ * `pushMigrationFromDisk` reads a locally absent `.up.sql` as an instruction to delete
+ * it. `recorded` is what this repository's own history says (see
+ * `gitRecordedDatatableMigrationPaths`): a recorded path was genuinely tracked, so its
+ * absence now is a real deletion; a path missing from a `known` set is one this branch
+ * has never had, and deleting it is a guess. `unknown` history is not evidence of
+ * anything, so nothing is trusted. The caller confirms whatever comes back explicitly
+ * and never deletes it unattended.
+ */
+export function untrackedDatatableMigrationDeletions<
+  T extends { name: string; path: string },
+>(changes: T[], recorded: RecordedMigrationPaths): T[] {
+  return changes.filter(
+    (c) =>
+      c.name === "deleted" &&
+      isDatatableMigrationPath(c.path) &&
+      !(recorded.kind === "known" && recorded.paths.has(c.path)),
+  );
+}
+
 interface ChangeTracker {
   scripts: string[];
   flows: string[];
@@ -2644,13 +2938,78 @@ interface ChangeTracker {
   rawApps: string[];
 }
 
+/// The script a module file belongs to, added to the tracker so its top hash is
+/// refreshed. Derived with `getScriptBasePathFromModulePath`, which normalizes
+/// separators: searching the raw path for `__dbt/` found nothing on Windows,
+/// where the folder is spelled `__dbt\`, so every model edit there was skipped.
+async function addModuleParentToChanged(p: string, tracker: ChangeTracker) {
+  // A folder layout's METADATA — `<base>__mod/script.yaml` — is an entry-point
+  // path too, and it is not a content file: pushed as one, the metadata pass
+  // asks `inferContentTypeFromFilePath` for the language of `.yaml` and aborts
+  // the whole command. It resolves to its content file like any other metadata.
+  if (isModuleEntryMetadata(p)) {
+    try {
+      const contentPath = await findContentFile(p);
+      if (contentPath && !tracker.scripts.includes(contentPath)) {
+        tracker.scripts.push(contentPath);
+      }
+    } catch {
+      // ignore — content file not found
+    }
+    return;
+  }
+  if (isModuleEntryPoint(p)) {
+    // Entry point (e.g. __mod/script.ts) IS the parent script content file.
+    if (!tracker.scripts.includes(p)) {
+      tracker.scripts.push(p);
+    }
+    return;
+  }
+  const scriptBasePath = getScriptBasePathFromModulePath(p);
+  if (scriptBasePath === undefined) {
+    return;
+  }
+  const push = async (candidate: string): Promise<boolean> => {
+    try {
+      const contentPath = await findContentFile(candidate);
+      if (contentPath && !tracker.scripts.includes(contentPath)) {
+        tracker.scripts.push(contentPath);
+      }
+      return contentPath != undefined;
+    } catch {
+      return false;
+    }
+  };
+  // A dbt script's metadata sits beside its folder; the descriptor is inside.
+  if (isDbtModulePath(p)) {
+    await push(scriptBasePath + ".script.yaml");
+    return;
+  }
+  // Folder layout first (`__mod/script.{ext}`), then flat.
+  if (!(await push(scriptBasePath + getModuleFolderSuffix() + "/script.yaml"))) {
+    await push(scriptBasePath + ".script.yaml");
+  }
+}
+
 async function addToChangedIfNotExists(p: string, tracker: ChangeTracker) {
   // Datatable migration .sql files are not scripts; they're synced via the
   // dedicated datatable_migration handler in the push loop.
   if (isDatatableMigrationPath(p)) {
     return;
   }
-  const isScript = exts.some((e) => p.endsWith(e)) && !isFileResource(p) && !isFilesetResource(p);
+  // Module files first, and whatever their extension: a dbt project authors
+  // `dbt_project.yml`, `packages.yml`, schema YAML and seed CSVs, none of which
+  // are Windmill script extensions — gated behind that test they never reached
+  // the tracker, so the top hash in `wmill-lock.yaml` (which covers the modules)
+  // stayed stale for exactly the files a dbt project is mostly made of.
+  if (isScriptModulePath(p)) {
+    await addModuleParentToChanged(p, tracker);
+    return;
+  }
+  const isScript =
+    hasScriptExt(p) &&
+    !isFileResource(p) &&
+    !isFilesetResource(p);
   if (isScript) {
     if (isFlowPath(p)) {
       const folder = extractFolderPath(p, "flow")!;
@@ -2667,37 +3026,6 @@ async function addToChangedIfNotExists(p: string, tracker: ChangeTracker) {
       if (!tracker.rawApps.includes(folder)) {
         tracker.rawApps.push(folder);
       }
-    } else if (isScriptModulePath(p)) {
-      if (isModuleEntryPoint(p)) {
-        // Entry point (e.g. __mod/script.ts) IS the parent script content file
-        if (!tracker.scripts.includes(p)) {
-          tracker.scripts.push(p);
-        }
-      } else {
-        // Module file changed — find the parent script content file
-        const moduleSuffix = getModuleFolderSuffix() + "/";
-        const idx = p.indexOf(moduleSuffix);
-        if (idx !== -1) {
-          const scriptBasePath = p.substring(0, idx);
-          // Try folder layout first: __mod/script.{ext}
-          try {
-            const contentPath = await findContentFile(scriptBasePath + getModuleFolderSuffix() + "/script.yaml");
-            if (contentPath && !tracker.scripts.includes(contentPath)) {
-              tracker.scripts.push(contentPath);
-            }
-          } catch {
-            // Fall back to flat layout: scriptBasePath.script.yaml
-            try {
-              const contentPath = await findContentFile(scriptBasePath + ".script.yaml");
-              if (contentPath && !tracker.scripts.includes(contentPath)) {
-                tracker.scripts.push(contentPath);
-              }
-            } catch {
-              // ignore — content file not found
-            }
-          }
-        }
-      }
     } else {
       if (!tracker.scripts.includes(p)) {
         tracker.scripts.push(p);
@@ -2715,7 +3043,7 @@ async function addToChangedIfNotExists(p: string, tracker: ChangeTracker) {
   }
 }
 
-async function buildTracker(changes: Change[]) {
+export async function buildTracker(changes: Change[]) {
   const tracker: ChangeTracker = {
     scripts: [],
     flows: [],
@@ -2734,7 +3062,7 @@ async function buildTracker(changes: Change[]) {
  * When a module file changes, find and push the parent script.
  * The parent script's handleFile will read the __mod/ folder and include all modules.
  */
-async function pushParentScriptForModule(
+export async function pushParentScriptForModule(
   modulePath: string,
   workspace: Workspace,
   alreadySynced: string[],
@@ -2743,11 +3071,82 @@ async function pushParentScriptForModule(
   rawWorkspaceDependencies: Record<string, string>,
   codebases: SyncCodebase[],
 ): Promise<void> {
-  const moduleSuffix = getModuleFolderSuffix() + "/";
-  const idx = modulePath.indexOf(moduleSuffix);
-  if (idx === -1) return;
-  const scriptBasePath = modulePath.substring(0, idx);
-  const moduleFolderPath = scriptBasePath + getModuleFolderSuffix();
+  const isDbt = isDbtModulePath(modulePath);
+  // Via the shared helper, which normalizes separators: a Windows path spells
+  // the folder `__dbt\\`, and searching the raw path for `__dbt/` would find
+  // nothing and silently return without deploying the parent — while the caller
+  // still records the file as synced.
+  const scriptBasePath = getScriptBasePathFromModulePath(modulePath);
+  if (scriptBasePath === undefined) return;
+  const moduleFolderPath =
+    scriptBasePath + getModuleFolderSuffix(isDbt ? "dbt" : undefined);
+
+  // A dbt project's descriptor sits INSIDE its folder (`__dbt/wm_dbt.yaml`) and
+  // is optional, so the project itself is what identifies the script.
+  if (isDbt) {
+    // Only the LOOKUP is tolerated: a module under no script's project is a
+    // stray file, not an error. Deploying it is not — swallowing that would let
+    // a module-only push report success while the remote project is unchanged.
+    // BEFORE the lookup, because the lookup succeeds whenever a descriptor is
+    // there: `dbt_project.yml` is what makes the bundle a project, and pushing
+    // without it replaces a healthy deployment with one whose dependency job
+    // fails for having no project at all.
+    const hasMetadata =
+      existsSync(scriptBasePath + ".script.yaml") ||
+      existsSync(scriptBasePath + ".script.json");
+    if (!existsSync(moduleFolderPath + "/dbt_project.yml")) {
+      if (hasMetadata) {
+        throw new Error(
+          `${moduleFolderPath} has no dbt_project.yml but ${scriptBasePath}.script.yaml ` +
+            `remains, so there is no dbt project left to push. Delete the metadata too to ` +
+            `archive the script, or restore the project.`
+        );
+      }
+      // Nothing local claims this script any more — neither project nor
+      // metadata — so it is archived like any other locally deleted item. The
+      // deletions arrive one file at a time, hence `alreadySynced`.
+      const remote = scriptBasePath.replaceAll(SEP, "/");
+      if (!alreadySynced.includes(remote)) {
+        alreadySynced.push(remote);
+        log.info(`Archiving script ${remote}`);
+        await wmill
+          .archiveScriptByPath({ workspace: workspace.workspaceId, path: remote })
+          .catch((e: any) => {
+            // Only "already gone" is the state we wanted. An auth, network or
+            // server failure must fail the push: swallowing it reports success
+            // while the project stays deployed, which is the thing this branch
+            // exists to prevent.
+            if (e?.status !== 404) throw e;
+            log.debug(`${remote} was already gone remotely`);
+          });
+      }
+      return;
+    }
+    let contentPath: string | undefined;
+    try {
+      contentPath = await findContentFile(scriptBasePath + ".script.yaml");
+    } catch (e) {
+      // A path claimed by two scripts is not a parent that cannot be found:
+      // swallowed here, `wmill sync push` reports success on a model edit that
+      // deployed nothing, and the collision stays invisible until the ordinary
+      // script overwrites the project.
+      if (e instanceof DbtPathCollisionError) throw e;
+      log.debug(`Could not find parent script for dbt module: ${modulePath}`);
+      return;
+    }
+    if (contentPath) {
+      await handleFile(
+        contentPath,
+        workspace,
+        alreadySynced,
+        message,
+        opts,
+        rawWorkspaceDependencies,
+        codebases,
+      );
+    }
+    return;
+  }
 
   // Try folder layout first: look for script.{ext} inside __mod/
   try {
@@ -2958,11 +3357,16 @@ export async function pull(
   let specificItems = getSpecificItemsForCurrentBranch(opts, wsNameForConfig);
 
   // Compute the workspace name for file naming (default to workspaceId)
-  let wsNameForFiles = wsNameForConfig ? resolveWsNameForFiles(opts, wsNameForConfig) : workspace.workspaceId;
+  let wsNameForFiles = wsNameForConfig
+    ? resolveWsNameForFiles(opts, wsNameForConfig)
+    : workspace.workspaceId;
 
   // Augment specificItems with server-side ws_specific entries
   const localSpecificItems = specificItems;
-  const wsSpecificMerge = await mergeWsSpecificFromServer(workspace.workspaceId, specificItems);
+  const wsSpecificMerge = await mergeWsSpecificFromServer(
+    workspace.workspaceId,
+    specificItems,
+  );
   specificItems = wsSpecificMerge.merged;
 
   // Merge CLI flags with resolved settings (CLI flags take precedence only for explicit overrides)
@@ -3003,7 +3407,9 @@ export async function pull(
     opts.includeSettings,
     opts.includeKey,
     opts.skipWorkspaceDependencies,
+    opts.skipDatatableMigrations,
     opts.defaultTs,
+    opts.syncBehavior,
   );
 
   const remote = ZipFSElement(
@@ -3108,7 +3514,8 @@ export async function pull(
     const conflicts = [];
 
     log.info(colors.gray(`Applying changes to files ...`));
-    for await (const change of changes) {
+    for await (const rawChange of changes) {
+      const change: Change = rawChange;
       // Determine if this file should be written to a workspace-specific path
       let targetPath = change.path;
       if (specificItems && isSpecificItem(change.path, specificItems)) {
@@ -3124,6 +3531,28 @@ export async function pull(
 
       const target = path.join(process.cwd(), targetPath);
       const stateTarget = path.join(process.cwd(), ".wmill", targetPath);
+      // An empty dbt descriptor is not a file: the remote spells "this project
+      // named no descriptor" as empty content, and writing that would put a
+      // Windmill file inside a project that has none. ABSENCE is the state to
+      // reach, so both copies are removed if present and their being missing —
+      // a project pulled for the first time — is the goal, not an error. The
+      // `.wmill` copy goes too, or the same change is reported on every pull.
+      //
+      // `force` covers the missing file and NOTHING else: a permission or
+      // read-only-filesystem failure has to surface, or the pull reports
+      // success while the old descriptor — its warehouse, its command, its
+      // arguments — is still what runs locally.
+      if (
+        isDbtDescriptorPath(change.path) &&
+        ((change.name === "added" && change.content === "") ||
+          (change.name === "edited" && change.after === ""))
+      ) {
+        await rm(target, { force: true });
+        if (opts.stateful) {
+          await rm(stateTarget, { force: true });
+        }
+        continue;
+      }
       if (change.name === "edited") {
         if (opts.stateful) {
           try {
@@ -3165,11 +3594,13 @@ export async function pull(
             // ignore
           }
         }
-        if (exts.some((e) => change.path.endsWith(e))) {
+        if (hasScriptExt(change.path)) {
           log.info(
             `Editing script content of ${targetPath}${
               targetPath !== change.path
-                ? colors.gray(` (workspace-specific override for ${change.path})`)
+                ? colors.gray(
+                    ` (workspace-specific override for ${change.path})`,
+                  )
                 : ""
             }`,
           );
@@ -3180,7 +3611,9 @@ export async function pull(
           log.info(
             `Editing ${changeTypeLabel(change.path)}${targetPath}${
               targetPath !== change.path
-                ? colors.gray(` (workspace-specific override for ${change.path})`)
+                ? colors.gray(
+                    ` (workspace-specific override for ${change.path})`,
+                  )
                 : ""
             }`,
           );
@@ -3198,7 +3631,9 @@ export async function pull(
           log.info(
             `Adding ${changeTypeLabel(change.path)}${targetPath}${
               targetPath !== change.path
-                ? colors.gray(` (workspace-specific override for ${change.path})`)
+                ? colors.gray(
+                    ` (workspace-specific override for ${change.path})`,
+                  )
                 : ""
             }`,
           );
@@ -3215,18 +3650,15 @@ export async function pull(
           await copyFile(target, stateTarget);
         }
       } else if (change.name === "deleted") {
-        try {
-          log.info(
-            `Deleting ${changeTypeLabel(change.path)}${change.path}`,
-          );
-          await rm(target);
-          if (opts.stateful) {
-            await rm(stateTarget);
-          }
-        } catch {
-          if (opts.stateful) {
-            await rm(stateTarget);
-          }
+        log.info(`Deleting ${changeTypeLabel(change.path)}${change.path}`);
+        // `force` on both: the goal is that neither copy exists, and a file
+        // already absent — a dbt project's optional descriptor is never written
+        // — is that goal, not an error. Anything else (permissions, a read-only
+        // mount) surfaces rather than leaving a file the sync believes is gone.
+        // The state copy goes too, or the same deletion replays on every sync.
+        await rm(target, { force: true });
+        if (opts.stateful) {
+          await rm(stateTarget, { force: true });
         }
       }
     }
@@ -3362,7 +3794,8 @@ export async function pull(
     try {
       // Dynamic import to avoid a circular dep between sync.ts and
       // generate-metadata.ts. Don't "clean up" to a static import.
-      const { rehashOnly } = await import("../generate-metadata/generate-metadata.ts");
+      const { rehashOnly } =
+        await import("../generate-metadata/generate-metadata.ts");
       // Reuse the local-side file list from the change-tracker so we don't
       // re-walk the filesystem. Apply the just-applied changes to derive the
       // post-pull state: localMap is pre-pull, but auto-fill needs to see
@@ -3381,7 +3814,7 @@ export async function pull(
         log.info(
           colors.gray(
             `Auto-filled ${total} missing lockfile entr${total === 1 ? "y" : "ies"} ` +
-            `(${filled.scripts} script, ${filled.flows} flow, ${filled.apps} app) from disk.`,
+              `(${filled.scripts} script, ${filled.flows} flow, ${filled.apps} app) from disk.`,
           ),
         );
       }
@@ -3469,17 +3902,14 @@ export async function gitDeploy(
   // the wm_deploy branch). Mirrors the hub script's `--promotion <branch>`.
   const promotion =
     useIndividualBranch && !opts.promotion
-      ? getCurrentGitBranch() ?? undefined
+      ? (getCurrentGitBranch() ?? undefined)
       : opts.promotion;
 
   await pull({
     ...opts,
     yes: true,
     skipBranchValidation: true,
-    extraIncludes: [
-      ...(opts.extraIncludes ?? []),
-      ...includes.extraIncludes,
-    ],
+    extraIncludes: [...(opts.extraIncludes ?? []), ...includes.extraIncludes],
     // Workspace-wide mode force-includes the deployed default-excluded kinds
     // (full mirror). Individual-branch/promotion mode forces nothing — these
     // keys stay ABSENT so pull resolves them from the promotion target's
@@ -3527,7 +3957,9 @@ function prettyChanges(
 
     const folderNote = folderDefaultAnnotations?.get(change.path);
     const extraNote = folderNote
-      ? colors.cyan(` (will be permissioned as ${folderNote} via folder default)`)
+      ? colors.cyan(
+          ` (will be permissioned as ${folderNote} via folder default)`,
+        )
       : "";
 
     if (change.name === "added") {
@@ -3672,14 +4104,12 @@ async function checkServerLockJobs(
     const pending = (queued as { script_path?: string }[]).filter((j) =>
       belongsToPush(j.script_path),
     ).length;
-    const failed = (
-      completed as { script_path?: string; result?: unknown }[]
-    )
+    const failed = (completed as { script_path?: string; result?: unknown }[])
       .filter((j) => belongsToPush(j.script_path))
       .map((j) => ({
         path: j.script_path!,
-        error: (j.result as { error?: { message?: string } } | undefined)
-          ?.error?.message,
+        error: (j.result as { error?: { message?: string } } | undefined)?.error
+          ?.message,
       }));
     return { pending, failed };
   } catch {
@@ -3689,9 +4119,15 @@ async function checkServerLockJobs(
 }
 
 export async function push(
-  opts: GlobalOptions & SyncOptions & { repository?: string; branch?: string; acceptOverridingPermissionedAsWithSelf?: boolean },
+  opts: GlobalOptions &
+    SyncOptions & {
+      repository?: string;
+      branch?: string;
+      acceptOverridingPermissionedAsWithSelf?: boolean;
+    },
 ) {
   if ((opts as any).jsonOutput) log.setSilent(true);
+  markRequestsAsSyncOrigin();
   // Save original CLI options before merging with config file
   const originalCliOpts = { ...opts };
 
@@ -3752,7 +4188,9 @@ export async function push(
   let specificItems = getSpecificItemsForCurrentBranch(opts, wsNameForConfig);
 
   // Compute the workspace name for file naming (default to workspaceId)
-  let wsNameForFiles = wsNameForConfig ? resolveWsNameForFiles(opts, wsNameForConfig) : workspace.workspaceId;
+  let wsNameForFiles = wsNameForConfig
+    ? resolveWsNameForFiles(opts, wsNameForConfig)
+    : workspace.workspaceId;
 
   // Keep the pre-merge specificItems so we can detect entries that are
   // flagged locally but not yet ws_specific on the server (post-merge would
@@ -3760,7 +4198,10 @@ export async function push(
   const localSpecificItems = specificItems;
 
   // Augment specificItems with server-side ws_specific entries
-  const wsSpecificMerge = await mergeWsSpecificFromServer(workspace.workspaceId, specificItems);
+  const wsSpecificMerge = await mergeWsSpecificFromServer(
+    workspace.workspaceId,
+    specificItems,
+  );
   specificItems = wsSpecificMerge.merged;
   const serverWsSpecificItems = wsSpecificMerge.serverItems;
 
@@ -3844,7 +4285,9 @@ export async function push(
       opts.includeSettings,
       opts.includeKey,
       opts.skipWorkspaceDependencies,
+      opts.skipDatatableMigrations,
       opts.defaultTs,
+      opts.syncBehavior,
     ))!,
     !opts.json,
     opts.defaultTs ?? "bun",
@@ -3854,7 +4297,11 @@ export async function push(
     parseSyncBehavior(opts.syncBehavior) >= 1,
   );
 
-  const local = await FSFSElement(path.join(process.cwd(), ""), codebases, false);
+  const local = await FSFSElement(
+    path.join(process.cwd(), ""),
+    codebases,
+    false,
+  );
   const { changes, localMap } = await compareDynFSElement(
     local,
     remote,
@@ -4120,14 +4567,20 @@ export async function push(
     let triggerCount = 0;
     for await (const entry of readDirRecursiveWithIgnore(() => false, local)) {
       if (entry.isDirectory) continue;
-      if (!opts.includeSchedules && entry.path.endsWith(".schedule.yaml")) scheduleCount++;
-      if (!opts.includeTriggers && entry.path.endsWith("_trigger.yaml")) triggerCount++;
+      if (!opts.includeSchedules && entry.path.endsWith(".schedule.yaml"))
+        scheduleCount++;
+      if (!opts.includeTriggers && entry.path.endsWith("_trigger.yaml"))
+        triggerCount++;
     }
     if (scheduleCount > 0) {
-      skippedWarnings.push(`Skipping ${scheduleCount} schedule file(s). Use --include-schedules or set includeSchedules: true in wmill.yaml`);
+      skippedWarnings.push(
+        `Skipping ${scheduleCount} schedule file(s). Use --include-schedules or set includeSchedules: true in wmill.yaml`,
+      );
     }
     if (triggerCount > 0) {
-      skippedWarnings.push(`Skipping ${triggerCount} trigger file(s). Use --include-triggers or set includeTriggers: true in wmill.yaml`);
+      skippedWarnings.push(
+        `Skipping ${triggerCount} trigger file(s). Use --include-triggers or set includeTriggers: true in wmill.yaml`,
+      );
     }
     for (const warning of skippedWarnings) {
       log.warn(warning);
@@ -4137,6 +4590,44 @@ export async function push(
 
   await fetchRemoteVersion(workspace);
 
+  const recordedMigrationPaths: RecordedMigrationPaths = changes.some(
+    (c) => c.name === "deleted" && isDatatableMigrationPath(c.path),
+  )
+    ? gitRecordedDatatableMigrationPaths()
+    : { kind: "known", paths: new Set() };
+  const ambiguousMigrationDeletions = untrackedDatatableMigrationDeletions(
+    changes,
+    recordedMigrationPaths,
+  );
+  const keepAmbiguousMigrationsOnRemote = () => {
+    log.info(
+      colors.yellow(
+        `Keeping ${countDatatableMigrationRecords(ambiguousMigrationDeletions)} data table migration(s) on the remote: ` +
+          (recordedMigrationPaths.kind === "known"
+            ? `this branch has never tracked them. Run 'wmill sync pull' to track them in git, or delete them from the workspace.`
+            : `${recordedMigrationPaths.reason}, so whether it ever tracked them cannot be established. ` +
+              `${recordedMigrationPaths.remedy} so a real deletion can be told apart, or delete them from the workspace.`),
+      ),
+    );
+    const kept = changes.filter(
+      (c) => !ambiguousMigrationDeletions.includes(c),
+    );
+    changes.length = 0;
+    changes.push(...kept);
+  };
+  // An unattended run never resolves this ambiguity destructively, and a dry-run
+  // preview has to show what a push would really do — settle both before the
+  // change list is printed or serialized. A TTY push asks instead, after the
+  // user has seen the list.
+  let ambiguousMigrationsResolved = false;
+  if (
+    ambiguousMigrationDeletions.length > 0 &&
+    (opts.dryRun || opts.yes || !process.stdin.isTTY)
+  ) {
+    keepAmbiguousMigrationsOnRemote();
+    ambiguousMigrationsResolved = true;
+  }
+
   // Shared UI (the ui/ folder) is pushed out-of-band via pushSharedUi on apply
   // and is excluded from the file diff (isNotWmillFile), so surface its diff in
   // the dry-run preview. Without this the "Pull from repo" preview reads "no
@@ -4218,7 +4709,18 @@ export async function push(
       `Run 'wmill folder add-missing' to create them locally, then push again.`;
     if (!userIsAdmin) {
       if (opts.jsonOutput) {
-        console.log(JSON.stringify({ success: false, error: "missing_folders", missing_folders: missingFolders, message: msg }, null, 2));
+        console.log(
+          JSON.stringify(
+            {
+              success: false,
+              error: "missing_folders",
+              missing_folders: missingFolders,
+              message: msg,
+            },
+            null,
+            2,
+          ),
+        );
       } else {
         log.error(msg);
       }
@@ -4251,9 +4753,7 @@ export async function push(
           : {}),
       })),
       total: changes.length,
-      ...(changes.length > 0
-        ? { warning: SYNC_PUSH_DESTRUCTIVE_WARNING }
-        : {}),
+      ...(changes.length > 0 ? { warning: SYNC_PUSH_DESTRUCTIVE_WARNING } : {}),
     };
     console.log(JSON.stringify(result, null, 2));
     return;
@@ -4264,7 +4764,10 @@ export async function push(
     let folderDefaultAnnotations: Map<string, string> | undefined;
     if (parseSyncBehavior(opts.syncBehavior) >= 1) {
       folderDefaultAnnotations = new Map();
-      const folderRulesCache = new Map<string, Array<{ path_glob: string; permissioned_as: string }>>();
+      const folderRulesCache = new Map<
+        string,
+        Array<{ path_glob: string; permissioned_as: string }>
+      >();
       for (const change of changes) {
         if (change.name !== "added") continue;
         const match = change.path.match(/^f\/([^/]+)\//);
@@ -4272,14 +4775,26 @@ export async function push(
         const folderName = match[1];
         if (!folderRulesCache.has(folderName)) {
           try {
-            const folder = await wmill.getFolder({ workspace: workspace.workspaceId, name: folderName });
-            folderRulesCache.set(folderName, (folder as any).default_permissioned_as ?? []);
+            const folder = await wmill.getFolder({
+              workspace: workspace.workspaceId,
+              name: folderName,
+            });
+            folderRulesCache.set(
+              folderName,
+              (folder as any).default_permissioned_as ?? [],
+            );
           } catch {
             folderRulesCache.set(folderName, []);
           }
         }
         const rules = folderRulesCache.get(folderName)!;
-        const remotePath = change.path.replace(/\.(script|schedule|http_trigger|websocket_trigger|kafka_trigger|nats_trigger|postgres_trigger|mqtt_trigger|amqp_trigger|sqs_trigger|gcp_trigger|azure_trigger|email_trigger)\.(yaml|json)$/, "").replace(/(\.flow|__flow)\/flow\.(yaml|json)$/, "").replace(/\.(app|raw_app)(\/app\.(yaml|json))?$/, "");
+        const remotePath = change.path
+          .replace(
+            /\.(script|schedule|http_trigger|websocket_trigger|kafka_trigger|nats_trigger|postgres_trigger|mqtt_trigger|amqp_trigger|sqs_trigger|gcp_trigger|azure_trigger|email_trigger)\.(yaml|json)$/,
+            "",
+          )
+          .replace(/(\.flow|__flow)\/flow\.(yaml|json)$/, "")
+          .replace(/\.(app|raw_app)(\/app\.(yaml|json))?$/, "");
         const relative = remotePath.slice(`f/${folderName}/`.length);
         if (!relative) continue;
         for (const rule of rules) {
@@ -4292,7 +4807,12 @@ export async function push(
     }
 
     if (!opts.jsonOutput) {
-      prettyChanges(changes, specificItems, wsNameForFiles, folderDefaultAnnotations);
+      prettyChanges(
+        changes,
+        specificItems,
+        wsNameForFiles,
+        folderDefaultAnnotations,
+      );
     }
 
     if (opts.dryRun) {
@@ -4306,7 +4826,9 @@ export async function push(
       const user = await wmill.whoami({ workspace: workspace.workspaceId });
       const userIsAdminOrDeployer =
         user.is_admin || (user.groups ?? []).includes("wm_deployers");
-      log.debug(`permissioned_as: user=${user.email}, is_admin=${user.is_admin}, groups=${JSON.stringify(user.groups)}, isAdminOrDeployer=${userIsAdminOrDeployer}`);
+      log.debug(
+        `permissioned_as: user=${user.email}, is_admin=${user.is_admin}, groups=${JSON.stringify(user.groups)}, isAdminOrDeployer=${userIsAdminOrDeployer}`,
+      );
       permissionedAsContext = {
         userCache: new Map(),
         userIsAdminOrDeployer,
@@ -4324,10 +4846,12 @@ export async function push(
         !!process.stdin.isTTY,
       );
     } else if (folderDefaultAnnotations && folderDefaultAnnotations.size > 0) {
-      log.warn(colors.yellow(
-        `This workspace has folder default_permissioned_as rules that affect ${folderDefaultAnnotations.size} item(s) being pushed, ` +
-        `but syncBehavior is not set in wmill.yaml. Add 'syncBehavior: v1' to enable ownership preservation on update and on_behalf_of stripping on pull.`
-      ));
+      log.warn(
+        colors.yellow(
+          `This workspace has folder default_permissioned_as rules that affect ${folderDefaultAnnotations.size} item(s) being pushed, ` +
+            `but syncBehavior is not set in wmill.yaml. Add 'syncBehavior: v1' to enable ownership preservation on update and on_behalf_of stripping on pull.`,
+        ),
+      );
     }
 
     // Reject malformed datatable migrations (duplicate timestamps, orphan downs)
@@ -4358,6 +4882,18 @@ export async function push(
       return;
     }
 
+    if (ambiguousMigrationDeletions.length > 0 && !ambiguousMigrationsResolved) {
+      const deleteThem = await Confirm.prompt({
+        message:
+          `Nothing in this repository's history accounts for ${countDatatableMigrationRecords(ambiguousMigrationDeletions)} migration definition(s), so it may simply never have synced them. ` +
+          `Delete them from the workspace anyway?`,
+        default: false,
+      });
+      if (!deleteThem) {
+        keepAmbiguousMigrationsOnRemote();
+      }
+    }
+
     const start = performance.now();
     const pushStartedAt = new Date().toISOString();
     log.info(colors.gray(`Applying changes to files ...`));
@@ -4374,7 +4910,14 @@ export async function push(
     // Group changes by base path (before first dot)
     const groupedChanges = new Map<string, typeof changes>();
     for (const change of changes) {
-      const basePath = change.path.split(".")[0];
+      // A module file is pushed by pushing its parent script, so it belongs in
+      // that script's group. Left in a group of its own it gets its own
+      // `alreadySynced`, and a push touching several files of one bundle then
+      // deploys the script once per file: several versions in a row, of which
+      // only the last is the one the asset graph ends up describing.
+      const basePath =
+        getScriptBasePathFromModulePath(change.path) ??
+        change.path.split(".")[0];
       if (!groupedChanges.has(basePath)) {
         groupedChanges.set(basePath, []);
       }
@@ -4422,7 +4965,8 @@ export async function push(
     const effectiveParallelism = () =>
       folderPhaseRemaining > 0 ? 1 : parallelizationFactor;
     // Cache git branch at the start to avoid repeated execSync calls per change
-    const cachedWsNameForPush = wsNameForFiles || (isGitRepository() ? getCurrentGitBranch() : null);
+    const cachedWsNameForPush =
+      wsNameForFiles || (isGitRepository() ? getCurrentGitBranch() : null);
 
     // Datatable migrations are two files (.up.sql/.down.sql) for one record, so
     // dedupe upsert/delete by (datatable, version) across the whole push.
@@ -4461,6 +5005,10 @@ export async function push(
             if (deleteRawApp) {
               changes = [deleteRawApp];
             } else {
+              // The app is one bundle, so a single change re-pushes all of it.
+              // That leaves the loop exactly one change: any skip it takes for
+              // a raw-app path drops the whole app from the push, and nothing
+              // downstream records that as a failure.
               changes.splice(1, changes.length - 1);
             }
           }
@@ -4562,13 +5110,19 @@ export async function push(
                   const currentBranch = cachedWsNameForPush;
                   let isFileResWsSpecific = false;
 
-                  if (currentBranch && isWorkspaceSpecificFile(resourceFilePath)) {
+                  if (
+                    currentBranch &&
+                    isWorkspaceSpecificFile(resourceFilePath)
+                  ) {
                     serverPath = fromWorkspaceSpecificPath(
                       resourceFilePath,
                       currentBranch,
                     );
                     isFileResWsSpecific = true;
-                  } else if (specificItems && isSpecificItem(change.path, specificItems)) {
+                  } else if (
+                    specificItems &&
+                    isSpecificItem(change.path, specificItems)
+                  ) {
                     isFileResWsSpecific = true;
                   }
 
@@ -4612,7 +5166,8 @@ export async function push(
 
               // Check if this is a branch-specific item and get the original workspace-specific path
               let originalWorkspaceSpecificPath: string | undefined;
-              const isWsSpecific = specificItems && isSpecificItem(change.path, specificItems);
+              const isWsSpecific =
+                specificItems && isSpecificItem(change.path, specificItems);
               if (isWsSpecific) {
                 originalWorkspaceSpecificPath = getWorkspaceSpecificPath(
                   change.path,
@@ -4628,13 +5183,17 @@ export async function push(
                 newObj,
                 opts.plainSecrets ?? false,
                 alreadySynced,
-                opts.message,
-                originalWorkspaceSpecificPath,
-                permissionedAsContext,
-                isWsSpecific ? true : undefined,
                 {
-                  noninteractive: (opts.yes ?? false) || !process.stdin.isTTY,
-                  skipReencrypt: opts.skipReencryptOnKeyChange,
+                  message: opts.message,
+                  originalLocalPath: originalWorkspaceSpecificPath,
+                  permissionedAsContext,
+                  wsSpecific: isWsSpecific ? true : undefined,
+                  keyPushOpts: {
+                    noninteractive:
+                      (opts.yes ?? false) || !process.stdin.isTTY,
+                    skipReencrypt: opts.skipReencryptOnKeyChange,
+                  },
+                  defaultTs: opts.defaultTs,
                 },
               );
 
@@ -4695,7 +5254,11 @@ export async function push(
                 !isRawAppFile(change.path) &&
                 (change.path.endsWith(".script.json") ||
                   change.path.endsWith(".script.yaml") ||
-                  change.path.endsWith(".lock") ||
+                  // A `.lock` is the script's generated lockfile — except inside
+                  // a dbt bundle, where the project may author one (`uv.lock`).
+                  // Skipping it there would report the add on every push and
+                  // never apply it, because no state file is written either.
+                  (change.path.endsWith(".lock") && !isDbtModulePath(change.path)) ||
                   isFileResource(change.path))
               ) {
                 continue;
@@ -4735,7 +5298,8 @@ export async function push(
               // Determine the actual local file path for this change
               // For branch-specific items, we read from workspace-specific files but push to base server paths
               let localFilePath = change.path;
-              const isAddedWsSpecific = specificItems && isSpecificItem(change.path, specificItems);
+              const isAddedWsSpecific =
+                specificItems && isSpecificItem(change.path, specificItems);
               if (isAddedWsSpecific) {
                 const workspaceSpecificPath = getWorkspaceSpecificPath(
                   change.path,
@@ -4754,13 +5318,17 @@ export async function push(
                 obj,
                 opts.plainSecrets ?? false,
                 [],
-                opts.message,
-                localFilePath, // Pass the actual local file path
-                permissionedAsContext,
-                isAddedWsSpecific ? true : undefined,
                 {
-                  noninteractive: (opts.yes ?? false) || !process.stdin.isTTY,
-                  skipReencrypt: opts.skipReencryptOnKeyChange,
+                  message: opts.message,
+                  originalLocalPath: localFilePath,
+                  permissionedAsContext,
+                  wsSpecific: isAddedWsSpecific ? true : undefined,
+                  keyPushOpts: {
+                    noninteractive:
+                      (opts.yes ?? false) || !process.stdin.isTTY,
+                    skipReencrypt: opts.skipReencryptOnKeyChange,
+                  },
+                  defaultTs: opts.defaultTs,
                 },
               );
 
@@ -4768,7 +5336,15 @@ export async function push(
                 await writeFile(stateTarget, change.content, "utf-8");
               }
             } else if (change.name === "deleted") {
-              if (change.path.endsWith(".lock")) {
+              // Same as the added branch: a dbt project's own `.lock` is one of
+              // its files, so deleting it has to reach the parent script. A raw
+              // app's `.lock` is part of its bundle, and a raw-app group is
+              // collapsed to one change, so skipping it drops the whole app.
+              if (
+                !isRawAppFile(change.path) &&
+                change.path.endsWith(".lock") &&
+                !isDbtModulePath(change.path)
+              ) {
                 continue;
               }
               if (isScriptModulePath(change.path)) {
@@ -4828,8 +5404,13 @@ export async function push(
                       path: resourcePath,
                     });
                   } catch (e: any) {
-                    if (e?.status === 404 && deletedVarsResPaths.includes(resourcePath)) {
-                      log.debug(`Resource ${resourcePath} already deleted by linked variable`);
+                    if (
+                      e?.status === 404 &&
+                      deletedVarsResPaths.includes(resourcePath)
+                    ) {
+                      log.debug(
+                        `Resource ${resourcePath} already deleted by linked variable`,
+                      );
                     } else {
                       throw e;
                     }
@@ -4848,7 +5429,10 @@ export async function push(
                     // Metadata file deleted — delete the entire flow
                     await wmill.deleteFlowByPath({
                       workspace: workspaceId,
-                      path: removeSuffix(target, getDeleteSuffix("flow", "json")),
+                      path: removeSuffix(
+                        target,
+                        getDeleteSuffix("flow", "json"),
+                      ),
                     });
                   } else {
                     // Inline script file deleted within flow folder
@@ -4871,7 +5455,7 @@ export async function push(
                         undefined,
                         opts.plainSecrets ?? false,
                         alreadySynced,
-                        opts.message,
+                        { message: opts.message },
                       );
                     } else {
                       // Flow folder doesn't exist locally — delete on server
@@ -4890,7 +5474,10 @@ export async function push(
                     // Metadata file deleted — delete the entire app
                     await wmill.deleteApp({
                       workspace: workspaceId,
-                      path: removeSuffix(target, getDeleteSuffix("app", "json")),
+                      path: removeSuffix(
+                        target,
+                        getDeleteSuffix("app", "json"),
+                      ),
                     });
                   } else {
                     // Inline script file deleted within app folder
@@ -4913,7 +5500,7 @@ export async function push(
                         undefined,
                         opts.plainSecrets ?? false,
                         alreadySynced,
-                        opts.message,
+                        { message: opts.message },
                       );
                     } else {
                       // App folder doesn't exist locally — delete on server
@@ -4932,7 +5519,10 @@ export async function push(
                     // Delete the entire raw app
                     await wmill.deleteApp({
                       workspace: workspaceId,
-                      path: removeSuffix(target, getDeleteSuffix("raw_app", "json")),
+                      path: removeSuffix(
+                        target,
+                        getDeleteSuffix("raw_app", "json"),
+                      ),
                     });
                   } else {
                     const rawAppFolder = extractFolderPath(target, "raw_app");
@@ -4956,7 +5546,7 @@ export async function push(
                         undefined,
                         opts.plainSecrets ?? false,
                         alreadySynced,
-                        opts.message,
+                        { message: opts.message, defaultTs: opts.defaultTs },
                       );
                     } else {
                       // The entire raw app folder was deleted locally,
@@ -5047,7 +5637,7 @@ export async function push(
                   const triggerInfo = extractNativeTriggerInfo(change.path);
                   if (!triggerInfo) {
                     throw new Error(
-                      `Invalid native trigger path: ${change.path}`
+                      `Invalid native trigger path: ${change.path}`,
                     );
                   }
                   await wmill.deleteNativeTrigger({
@@ -5065,8 +5655,13 @@ export async function push(
                       path: variablePath,
                     });
                   } catch (e: any) {
-                    if (e?.status === 404 && deletedVarsResPaths.includes(variablePath)) {
-                      log.debug(`Variable ${variablePath} already deleted by linked resource`);
+                    if (
+                      e?.status === 404 &&
+                      deletedVarsResPaths.includes(variablePath)
+                    ) {
+                      log.debug(
+                        `Variable ${variablePath} already deleted by linked resource`,
+                      );
                     } else {
                       throw e;
                     }
@@ -5177,10 +5772,14 @@ export async function push(
       log.warn(`Failed to push shared UI folder: ${e}`);
     }
     try {
-      await offerToRunNewMigrations(workspace.workspaceId, newDatatableMigrations, {
-        yes: opts.yes,
-        jsonOutput: opts.jsonOutput,
-      });
+      await offerToRunNewMigrations(
+        workspace.workspaceId,
+        newDatatableMigrations,
+        {
+          yes: opts.yes,
+          jsonOutput: opts.jsonOutput,
+        },
+      );
     } catch (e: any) {
       log.warn(
         `Failed to run new datatable migrations: ${e?.body ?? e?.message ?? e}`,
@@ -5314,7 +5913,10 @@ const command = new Command()
   .option("--json", "Use JSON instead of YAML")
   .option("--skip-variables", "Skip syncing variables (including secrets)")
   .option("--skip-secrets", "Skip syncing only secrets variables")
-  .option("--include-secrets", "Include secrets in sync (overrides skipSecrets in wmill.yaml)")
+  .option(
+    "--include-secrets",
+    "Include secrets in sync (overrides skipSecrets in wmill.yaml)",
+  )
   .option("--skip-resources", "Skip syncing  resources")
   .option("--skip-resource-types", "Skip syncing  resource types")
   .option("--skip-scripts", "Skip syncing scripts")
@@ -5370,7 +5972,10 @@ const command = new Command()
   .option("--json", "Use JSON instead of YAML")
   .option("--skip-variables", "Skip syncing variables (including secrets)")
   .option("--skip-secrets", "Skip syncing only secrets variables")
-  .option("--include-secrets", "Include secrets in sync (overrides skipSecrets in wmill.yaml)")
+  .option(
+    "--include-secrets",
+    "Include secrets in sync (overrides skipSecrets in wmill.yaml)",
+  )
   .option("--skip-resources", "Skip syncing  resources")
   .option("--skip-resource-types", "Skip syncing  resource types")
   .option("--skip-scripts", "Skip syncing scripts")
@@ -5424,7 +6029,10 @@ const command = new Command()
     "--locks-required",
     "Fail if scripts or flow inline scripts that need locks have no locks",
   )
-  .option("--auto-metadata", "Automatically regenerate stale metadata (locks and schemas) before pushing")
+  .option(
+    "--auto-metadata",
+    "Automatically regenerate stale metadata (locks and schemas) before pushing",
+  )
   .option(
     "--accept-overriding-permissioned-as-with-self",
     "Accept that items with a different permissioned_as will be updated with your own user",
@@ -5463,7 +6071,7 @@ const command = new Command()
   )
   .option(
     "--dev-workspace-label <label:string>",
-    "Environment label of a dev workspace (dev/staging); its deploys go to that branch",
+    "Environment label of a dev workspace (dev, staging, uat, ...); its deploys go to that branch",
   )
   .option(
     "--parent-dev-workspace-label <label:string>",
diff --git a/cli/src/commands/workspace/merge.ts b/cli/src/commands/workspace/merge.ts
index 585772a9d0..9f39bec52c 100644
--- a/cli/src/commands/workspace/merge.ts
+++ b/cli/src/commands/workspace/merge.ts
@@ -2,7 +2,7 @@ import { GlobalOptions } from "../../types.ts";
 import { colors } from "@cliffy/ansi/colors";
 import { Table } from "@cliffy/table";
 import * as log from "../../core/log.ts";
-import { setClient } from "../../core/client.ts";
+import { markRequestsAsSyncOrigin, setClient } from "../../core/client.ts";
 import { tryResolveBranchWorkspace } from "../../core/context.ts";
 import * as wmill from "../../../gen/services.gen.ts";
 import { OpenAPI } from "../../../gen/core/OpenAPI.ts";
@@ -534,6 +534,12 @@ async function mergeWorkspaces(
     direction === "to-parent" ? parentWorkspaceId : forkWorkspaceId;
 
   // 10. Deploy
+  // Updating the fork copies the parent's state in, so nothing it writes there —
+  // least of all a deletion — may be read as the fork's own decision. Merging the
+  // other way stays authored: someone chose those changes for the target.
+  if (direction === "to-fork") {
+    markRequestsAsSyncOrigin();
+  }
   let successCount = 0;
   let failCount = 0;
   // Datatable migrations deployed (not deleted) into the target. Deploying a
diff --git a/cli/src/core/client.ts b/cli/src/core/client.ts
index 4b0b98e30f..f7073fe501 100644
--- a/cli/src/core/client.ts
+++ b/cli/src/core/client.ts
@@ -1,5 +1,19 @@
 import { OpenAPI } from "../../gen/index.ts";
 
+/**
+ * Mark every subsequent request as applying a state computed elsewhere rather
+ * than authoring one in the target workspace (the fork tally reads the header to
+ * decide whether a removal was deliberate).
+ *
+ * Belongs to the commands that apply and nothing that authors: `sync push`
+ * (including the git-sync auto-pull, which runs it inside a job) and the
+ * parent-to-fork half of `workspace merge`.
+ */
+export function markRequestsAsSyncOrigin() {
+  const existing = typeof OpenAPI.HEADERS === "object" ? OpenAPI.HEADERS : {};
+  OpenAPI.HEADERS = { ...existing, "X-Windmill-Deploy-Origin": "sync" };
+}
+
 export function setClient(token?: string, baseUrl?: string) {
   if (baseUrl === undefined) {
     baseUrl = process.env["BASE_INTERNAL_URL"] ??
diff --git a/cli/src/core/conf.ts b/cli/src/core/conf.ts
index 0129a4fd18..ebad7bc51c 100644
--- a/cli/src/core/conf.ts
+++ b/cli/src/core/conf.ts
@@ -78,6 +78,7 @@ export interface SyncOptions {
   skipResourceTypes?: boolean;
   skipSecrets?: boolean;
   skipWorkspaceDependencies?: boolean;
+  skipDatatableMigrations?: boolean;
   skipScripts?: boolean;
   skipFlows?: boolean;
   skipApps?: boolean;
@@ -343,6 +344,7 @@ export const DEFAULT_SYNC_OPTIONS: Readonly<
       | "includeSchedules"
       | "includeTriggers"
       | "skipWorkspaceDependencies"
+      | "skipDatatableMigrations"
       | "skipScripts"
       | "skipFlows"
       | "skipApps"
@@ -375,6 +377,7 @@ export const DEFAULT_SYNC_OPTIONS: Readonly<
   includeSettings: false,
   includeKey: false,
   skipWorkspaceDependencies: false,
+  skipDatatableMigrations: false,
   nonDottedPaths: false,
   syncBehavior: "v1",
 } as const;
diff --git a/cli/src/core/constants.ts b/cli/src/core/constants.ts
index 59de21e2bf..ccfc78dbef 100644
--- a/cli/src/core/constants.ts
+++ b/cli/src/core/constants.ts
@@ -10,4 +10,4 @@ export const WM_FORK_PREFIX = "wm-fork";
 // (e.g. utils.ts) can read it without importing main.ts and creating a circular
 // dependency (main → workspace → utils → main) that triggers a TDZ.
 // Re-exported from main.ts for backwards compatibility.
-export const VERSION = "1.775.2";
+export const VERSION = "1.783.0";
diff --git a/cli/src/core/context.ts b/cli/src/core/context.ts
index 6440213d5c..502157f0a7 100644
--- a/cli/src/core/context.ts
+++ b/cli/src/core/context.ts
@@ -22,8 +22,11 @@ import {
   readConfigFile,
   findWorkspaceByGitBranch,
   getEffectiveWorkspaceId,
+  getWmillYamlPath,
   WorkspaceEntryConfig,
 } from "./conf.ts";
+import { existsSync, realpathSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import {
   getCurrentGitBranch,
   getOriginalBranchForWorkspaceForks,
@@ -743,6 +746,92 @@ export async function tryResolveVersion(
   }
 }
 
+/**
+ * Directory the local tree mirrors the workspace from: the one holding
+ * wmill.yaml. Not `process.cwd()` — that only lands there once a config read
+ * has chdir'd into it, which `--remote` and fully-flagged invocations skip.
+ */
+function syncRoot(): string {
+  const wmillYaml = getWmillYamlPath();
+  return wmillYaml ? dirname(wmillYaml) : process.cwd();
+}
+
+/**
+ * Re-express a user-supplied file or folder argument as a path relative to the
+ * sync root, so the Windmill path derived from it is the same whatever shape
+ * the argument had (`./f/a/b.ts`, `/abs/repo/f/a/b.ts`, `b.ts` from inside
+ * `f/a`).
+ *
+ * `cwdBeforeConfig` must be the working directory as it was *before* the
+ * command read wmill.yaml: reading it chdirs into the directory holding it, and
+ * a relative argument was written against the directory the user was in.
+ * Arguments are resolved against that directory first and the sync root second,
+ * so both readings work.
+ *
+ * Resolving the sync root leaves the process in it, which is what makes the
+ * returned path readable by the caller — keep that in step if this ever stops
+ * going through `getWmillYamlPath`.
+ */
+export function toSyncRootRelativePath(
+  arg: string,
+  cwdBeforeConfig: string
+): string {
+  const root = syncRoot();
+  const candidates = isAbsolute(arg)
+    ? [arg]
+    : [resolve(cwdBeforeConfig, arg), resolve(root, arg)];
+  // A descriptor-less dbt project is named by a file that is deliberately not
+  // there, so an argument existing under neither reading is still a real one if
+  // the directory holding it is; only a path whose directory is missing too
+  // falls through to the sync-root reading for the caller to reject.
+  const abs =
+    candidates.find((c) => existsSync(c)) ??
+    candidates.find((c) => existsSync(dirname(c))) ??
+    candidates.at(-1)!;
+  const rel = relative(root, abs);
+  if (rel === "") return ".";
+  if (!rel.startsWith("..")) return rel;
+  // `relative` is purely lexical, so a root reached through a symlink (macOS'
+  // /var -> /private/var, a symlinked checkout) makes an absolute argument look
+  // like it escapes the tree. Resolve links only then, so a symlinked file
+  // *inside* the tree keeps the path it is filed under.
+  try {
+    const resolved = relative(realpathSync(root), realpathOfNamed(abs));
+    return resolved === "" ? "." : resolved;
+  } catch {
+    return rel;
+  }
+}
+
+/**
+ * `realpathSync` needs its target to exist, and a dbt descriptor deliberately
+ * does not. The directory naming it does, so resolve that and reattach.
+ */
+function realpathOfNamed(p: string): string {
+  return existsSync(p)
+    ? realpathSync(p)
+    : join(realpathSync(dirname(p)), basename(p));
+}
+
+/** Windmill workspace path: `u|f|g` followed by at least a folder and a name. */
+const REMOTE_PATH_RE = /^[ufg](\/[^/]+){2,}$/;
+
+/**
+ * Guard the Windmill path a preview run is pushed under. A preview job carries
+ * no runnable of its own, so this path is the only identity it has: it is what
+ * `WM_JOB_PATH` reports, what the runs page links to, and what relative imports
+ * inside the previewed code resolve against.
+ */
+export function assertRemotePath(remotePath: string, arg: string): void {
+  if (REMOTE_PATH_RE.test(remotePath)) return;
+  throw new Error(
+    `Cannot derive a Windmill path from '${arg}'` +
+      (remotePath ? ` (it maps to '${remotePath}')` : "") +
+      `: a preview runs under the path of the file it previews, which must sit inside the ` +
+      `wmill.yaml root and be of the form <u|g|f>/<username|group|folder>/<name>.`
+  );
+}
+
 export function validatePath(path: string): boolean {
   if (!(path.startsWith("g") || path.startsWith("u") || path.startsWith("f"))) {
     log.infoStderr(
diff --git a/cli/src/guidance/skills.gen.ts b/cli/src/guidance/skills.gen.ts
index 50ac0abc9f..71047bbec5 100644
--- a/cli/src/guidance/skills.gen.ts
+++ b/cli/src/guidance/skills.gen.ts
@@ -547,6 +547,11 @@ const result: wmill.S3Object = await wmill.writeS3File(
 
 Import: import * as wmill from 'windmill-client'
 
+To know who is running the script, read the contextual variables rather than calling the API:
+\`process.env.WM_END_USER_EMAIL || process.env.WM_EMAIL\`. WM_END_USER_EMAIL is the app viewer when
+the run was triggered from an app and empty otherwise (both variables are always defined), WM_EMAIL
+is the user the job is permissioned as. WM_USERNAME is the matching username.
+
 workerHasInternalServer(): boolean
 
 /**
@@ -577,11 +582,6 @@ async getResource(path?: string, undefinedIfEmpty?: boolean): Promise<any>
  */
 async getRootJobId(jobId?: string): Promise<string>
 
-/**
- * @deprecated Use runScriptByPath or runScriptByHash instead
- */
-async runScript(path: string | null = null, hash_: string | null = null, args: Record<string, any> | null = null, verbose: boolean = false, tag: string | null = null): Promise<any>
-
 /**
  * Run a script synchronously by its path and wait for the result
  * @param path - Script path in Windmill
@@ -646,11 +646,6 @@ async getResult(jobId: string): Promise<any>
  */
 async getResultMaybe(jobId: string): Promise<any>
 
-/**
- * @deprecated Use runScriptByPathAsync or runScriptByHashAsync instead
- */
-async runScriptAsync(path: string | null, hash_: string | null, args: Record<string, any> | null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
-
 /**
  * Run a script asynchronously by its path
  * @param path - Script path in Windmill
@@ -703,13 +698,6 @@ getStatePath(): string
  */
 async setResource(value: any, path?: string, initializeToTypeIfNotExist?: string): Promise<void>
 
-/**
- * Set the state
- * @param state state to set
- * @deprecated use setState instead
- */
-async setInternalState(state: any): Promise<void>
-
 /**
  * Set the state
  * @param state state to set
@@ -745,12 +733,6 @@ async setFlowUserState(key: string, value: any, errorIfNotPossible?: boolean): P
  */
 async getFlowUserState(key: string, errorIfNotPossible?: boolean): Promise<any>
 
-/**
- * Get the internal state
- * @deprecated use getState instead
- */
-async getInternalState(): Promise<any>
-
 /**
  * Get the state shared across executions
  * @param path Optional state resource path override. Defaults to \`getStatePath()\`.
@@ -886,15 +868,6 @@ async getResumeUrls(approver?: string, flowLevel?: boolean): Promise<{
   cancel: string;
 }>
 
-/**
- * @deprecated use getResumeUrls instead
- */
-getResumeEndpoints(approver?: string): Promise<{
-  approvalPage: string;
-  resume: string;
-  cancel: string;
-}>
-
 /**
  * Get an OIDC jwt token for auth to external services (e.g: Vault, AWS) (ee only)
  * @param audience audience of the token
@@ -917,15 +890,6 @@ base64ToUint8Array(data: string): Uint8Array
  */
 uint8ArrayToBase64(arrayBuffer: Uint8Array): string
 
-/**
- * Get email from workspace username
- * This method is particularly useful for apps that require the email address of the viewer.
- * Indeed, in the viewer context, WM_USERNAME is set to the username of the viewer but WM_EMAIL is set to the email of the creator of the app.
- * @param username
- * @returns email address
- */
-async usernameToEmail(username: string): Promise<string>
-
 /**
  * Sends an interactive approval request via Slack, allowing optional customization of the message, approver, and form fields.
  * 
@@ -1347,6 +1311,11 @@ const result: wmill.S3Object = await wmill.writeS3File(
 
 Import: import * as wmill from 'windmill-client'
 
+To know who is running the script, read the contextual variables rather than calling the API:
+\`process.env.WM_END_USER_EMAIL || process.env.WM_EMAIL\`. WM_END_USER_EMAIL is the app viewer when
+the run was triggered from an app and empty otherwise (both variables are always defined), WM_EMAIL
+is the user the job is permissioned as. WM_USERNAME is the matching username.
+
 workerHasInternalServer(): boolean
 
 /**
@@ -1377,11 +1346,6 @@ async getResource(path?: string, undefinedIfEmpty?: boolean): Promise<any>
  */
 async getRootJobId(jobId?: string): Promise<string>
 
-/**
- * @deprecated Use runScriptByPath or runScriptByHash instead
- */
-async runScript(path: string | null = null, hash_: string | null = null, args: Record<string, any> | null = null, verbose: boolean = false, tag: string | null = null): Promise<any>
-
 /**
  * Run a script synchronously by its path and wait for the result
  * @param path - Script path in Windmill
@@ -1446,11 +1410,6 @@ async getResult(jobId: string): Promise<any>
  */
 async getResultMaybe(jobId: string): Promise<any>
 
-/**
- * @deprecated Use runScriptByPathAsync or runScriptByHashAsync instead
- */
-async runScriptAsync(path: string | null, hash_: string | null, args: Record<string, any> | null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
-
 /**
  * Run a script asynchronously by its path
  * @param path - Script path in Windmill
@@ -1503,13 +1462,6 @@ getStatePath(): string
  */
 async setResource(value: any, path?: string, initializeToTypeIfNotExist?: string): Promise<void>
 
-/**
- * Set the state
- * @param state state to set
- * @deprecated use setState instead
- */
-async setInternalState(state: any): Promise<void>
-
 /**
  * Set the state
  * @param state state to set
@@ -1545,12 +1497,6 @@ async setFlowUserState(key: string, value: any, errorIfNotPossible?: boolean): P
  */
 async getFlowUserState(key: string, errorIfNotPossible?: boolean): Promise<any>
 
-/**
- * Get the internal state
- * @deprecated use getState instead
- */
-async getInternalState(): Promise<any>
-
 /**
  * Get the state shared across executions
  * @param path Optional state resource path override. Defaults to \`getStatePath()\`.
@@ -1686,15 +1632,6 @@ async getResumeUrls(approver?: string, flowLevel?: boolean): Promise<{
   cancel: string;
 }>
 
-/**
- * @deprecated use getResumeUrls instead
- */
-getResumeEndpoints(approver?: string): Promise<{
-  approvalPage: string;
-  resume: string;
-  cancel: string;
-}>
-
 /**
  * Get an OIDC jwt token for auth to external services (e.g: Vault, AWS) (ee only)
  * @param audience audience of the token
@@ -1717,15 +1654,6 @@ base64ToUint8Array(data: string): Uint8Array
  */
 uint8ArrayToBase64(arrayBuffer: Uint8Array): string
 
-/**
- * Get email from workspace username
- * This method is particularly useful for apps that require the email address of the viewer.
- * Indeed, in the viewer context, WM_USERNAME is set to the username of the viewer but WM_EMAIL is set to the email of the creator of the app.
- * @param username
- * @returns email address
- */
-async usernameToEmail(username: string): Promise<string>
-
 /**
  * Sends an interactive approval request via Slack, allowing optional customization of the message, approver, and form fields.
  * 
@@ -2241,6 +2169,11 @@ const result: wmill.S3Object = await wmill.writeS3File(
 
 Import: import * as wmill from 'windmill-client'
 
+To know who is running the script, read the contextual variables rather than calling the API:
+\`process.env.WM_END_USER_EMAIL || process.env.WM_EMAIL\`. WM_END_USER_EMAIL is the app viewer when
+the run was triggered from an app and empty otherwise (both variables are always defined), WM_EMAIL
+is the user the job is permissioned as. WM_USERNAME is the matching username.
+
 workerHasInternalServer(): boolean
 
 /**
@@ -2271,11 +2204,6 @@ async getResource(path?: string, undefinedIfEmpty?: boolean): Promise<any>
  */
 async getRootJobId(jobId?: string): Promise<string>
 
-/**
- * @deprecated Use runScriptByPath or runScriptByHash instead
- */
-async runScript(path: string | null = null, hash_: string | null = null, args: Record<string, any> | null = null, verbose: boolean = false, tag: string | null = null): Promise<any>
-
 /**
  * Run a script synchronously by its path and wait for the result
  * @param path - Script path in Windmill
@@ -2340,11 +2268,6 @@ async getResult(jobId: string): Promise<any>
  */
 async getResultMaybe(jobId: string): Promise<any>
 
-/**
- * @deprecated Use runScriptByPathAsync or runScriptByHashAsync instead
- */
-async runScriptAsync(path: string | null, hash_: string | null, args: Record<string, any> | null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
-
 /**
  * Run a script asynchronously by its path
  * @param path - Script path in Windmill
@@ -2397,13 +2320,6 @@ getStatePath(): string
  */
 async setResource(value: any, path?: string, initializeToTypeIfNotExist?: string): Promise<void>
 
-/**
- * Set the state
- * @param state state to set
- * @deprecated use setState instead
- */
-async setInternalState(state: any): Promise<void>
-
 /**
  * Set the state
  * @param state state to set
@@ -2439,12 +2355,6 @@ async setFlowUserState(key: string, value: any, errorIfNotPossible?: boolean): P
  */
 async getFlowUserState(key: string, errorIfNotPossible?: boolean): Promise<any>
 
-/**
- * Get the internal state
- * @deprecated use getState instead
- */
-async getInternalState(): Promise<any>
-
 /**
  * Get the state shared across executions
  * @param path Optional state resource path override. Defaults to \`getStatePath()\`.
@@ -2580,15 +2490,6 @@ async getResumeUrls(approver?: string, flowLevel?: boolean): Promise<{
   cancel: string;
 }>
 
-/**
- * @deprecated use getResumeUrls instead
- */
-getResumeEndpoints(approver?: string): Promise<{
-  approvalPage: string;
-  resume: string;
-  cancel: string;
-}>
-
 /**
  * Get an OIDC jwt token for auth to external services (e.g: Vault, AWS) (ee only)
  * @param audience audience of the token
@@ -2611,15 +2512,6 @@ base64ToUint8Array(data: string): Uint8Array
  */
 uint8ArrayToBase64(arrayBuffer: Uint8Array): string
 
-/**
- * Get email from workspace username
- * This method is particularly useful for apps that require the email address of the viewer.
- * Indeed, in the viewer context, WM_USERNAME is set to the username of the viewer but WM_EMAIL is set to the email of the creator of the app.
- * @param username
- * @returns email address
- */
-async usernameToEmail(username: string): Promise<string>
-
 /**
  * Sends an interactive approval request via Slack, allowing optional customization of the message, approver, and form fields.
  * 
@@ -3965,6 +3857,11 @@ result: S3Object = wmill.write_s3_file(
 
 Import: import wmill
 
+To know who is running the script, read the contextual variables rather than calling the API:
+\`os.environ.get("WM_END_USER_EMAIL") or os.environ.get("WM_EMAIL")\`. WM_END_USER_EMAIL is the app
+viewer when the run was triggered from an app and empty otherwise (both variables are always
+defined), WM_EMAIL is the user the job is permissioned as. WM_USERNAME is the matching username.
+
 def worker_has_internal_server() -> bool
 
 def get_mocked_api() -> Optional[dict]
@@ -4006,11 +3903,6 @@ def post(endpoint, raise_for_status = True, **kwargs) -> httpx.Response
 #     New authentication token string
 def create_token(duration = dt.timedelta(days=1)) -> str
 
-# Create a script job and return its job id.
-# 
-# .. deprecated:: Use run_script_by_path_async or run_script_by_hash_async instead.
-def run_script_async(path: str = None, hash_: str = None, args: dict = None, scheduled_in_secs: int = None, tag: str = None) -> str
-
 # Create a script job by path and return its job id.
 def run_script_by_path_async(path: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None) -> str
 
@@ -4020,11 +3912,6 @@ def run_script_by_hash_async(hash_: str, args: dict = None, scheduled_in_secs: i
 # Create a flow job and return its job id.
 def run_flow_async(path: str, args: dict = None, scheduled_in_secs: int = None, do_not_track_in_parent: bool = True, tag: str = None) -> str
 
-# Run script synchronously and return its result.
-# 
-# .. deprecated:: Use run_script_by_path or run_script_by_hash instead.
-def run_script(path: str = None, hash_: str = None, args: dict = None, timeout: dt.timedelta | int | float | None = None, verbose: bool = False, cleanup: bool = True, assert_result_is_not_none: bool = False, tag: str = None) -> Any
-
 # Run script by path synchronously and return its result.
 def run_script_by_path(path: str, args: dict = None, timeout: dt.timedelta | int | float | None = None, verbose: bool = False, cleanup: bool = True, assert_result_is_not_none: bool = False, tag: str = None) -> Any
 
@@ -4411,11 +4298,6 @@ def get_approval_urls(step_key: str = 'approval', approver: str = None) -> dict
 # - The function checks for required environment variables (\`WM_FLOW_JOB_ID\`, \`WM_FLOW_STEP_ID\`) to ensure it is run in the appropriate context.
 def request_interactive_slack_approval(slack_resource_path: str, channel_id: str, message: str = None, approver: str = None, default_args_json: dict = None, dynamic_enums_json: dict = None) -> None
 
-# Get email from workspace username
-# This method is particularly useful for apps that require the email address of the viewer.
-# Indeed, in the viewer context WM_USERNAME is set to the username of the viewer but WM_EMAIL is set to the email of the creator of the app.
-def username_to_email(username: str) -> str
-
 # Send a message to a Microsoft Teams conversation with conversation_id, where success is used to style the message
 def send_teams_message(conversation_id: str, text: str, success: bool = True, card_block: dict = None)
 
@@ -4449,6 +4331,18 @@ def get_workspace() -> str
 
 def get_version() -> str
 
+# Create a script job and return its job ID.
+# 
+# Args:
+#     hash_or_path: Script hash or path (determined by presence of '/')
+#     args: Script arguments
+#     scheduled_in_secs: Delay before execution in seconds
+#     tag: Override the worker tag the job runs on
+# 
+# Returns:
+#     Job ID string
+def run_script_async(hash_or_path: str, args: Dict[str, Any] = None, scheduled_in_secs: int = None, tag: str = None) -> str
+
 # Run a script synchronously by hash and return its result.
 # 
 # Args:
@@ -5486,7 +5380,7 @@ Reference a specific resource using \`$res:\` prefix:
 
 ## OpenFlow Schema
 
-{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"The flow will be run with the permissions of the user with this email."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"preserve_step_tags":{"type":"boolean","description":"If true and the flow runs on a custom worker tag, steps that declare their own non-empty tag run on it instead of inheriting the flow tag. Steps without their own tag still inherit the flow tag."},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff (delay doubles each time)","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Initial delay in seconds"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note (e.g., \\"yellow\\", \\"#ffff00\\")"},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes, 'group' for notes that group other nodes"},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \\u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor"}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."},"error_include_result":{"type":"boolean","description":"When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"},"reasoning_effort":{"type":"string","description":"Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default."}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryAuto":{"type":"object","description":"Automatic context management","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","description":"Explicit message history","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Conversation memory configuration","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"Short description of what this tool does (shown to the AI)"},"description":{"type":"string","description":"Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script."},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\\nValid values: 'text' (default) - plain text response, 'image' - image generation\\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with flow.input syntax."},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\\nFormat: Array<{ bucket: string, key: string }> - S3 object references\\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\\nRange: 0.0 to 2.0 (provider-dependent)\\n- 0.0 = deterministic, focused responses\\n- 0.7 = balanced (common default)\\n- 1.0+ = more creative/random\\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\\nRange: 1-1000.\\n"}},"required":["user_message"]},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default \`flow\`)"},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"agent":{"type":"string","description":"Path of a reusable \`ai_agent\` resource (hybrid linking). When set, the agent brain\\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\\nthat resource; the module's input_transforms then only carry the flow-local inputs\\n(user_message/user_attachments).\\n"},"tool_inputs":{"type":"object","description":"Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\\nshared resource; overlaid onto the tools' input_transforms at runtime \\u2014 including when\\n\`agent\` is unset, since a step forked for editing keeps these overrides until it is saved\\nback or unlinked.\\n","additionalProperties":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}}},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}`,
+{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"Address of the account the flow runs on behalf of. Derived from on_behalf_of on read; accepted on write, where it is resolved to the account it names."},"on_behalf_of":{"type":"string","description":"The flow runs with the permissions of this identity: u/{username}, g/{group}, or a bare email when the username is itself email-shaped. The only stored half of the identity; on_behalf_of_email is derived from it. Omit it when writing and it is resolved from that address instead."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"preserve_step_tags":{"type":"boolean","description":"If true and the flow runs on a custom worker tag, steps that declare their own non-empty tag run on it instead of inheriting the flow tag. Steps without their own tag still inherit the flow tag."},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff (delay doubles each time)","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Initial delay in seconds"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note (e.g., \\"yellow\\", \\"#ffff00\\")"},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes, 'group' for notes that group other nodes"},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \\u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor"}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."},"error_include_result":{"type":"boolean","description":"When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"},"reasoning_effort":{"type":"string","description":"Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default."}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryAuto":{"type":"object","description":"Automatic context management","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","description":"Explicit message history","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Conversation memory configuration","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume","dbt"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"Short description of what this tool does (shown to the AI)"},"description":{"type":"string","description":"Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script."},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\\nValid values: 'text' (default) - plain text response, 'image' - image generation\\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with flow.input syntax."},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\\nFormat: Array<{ bucket: string, key: string }> - S3 object references\\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\\nRange: 0.0 to 2.0 (provider-dependent)\\n- 0.0 = deterministic, focused responses\\n- 0.7 = balanced (common default)\\n- 1.0+ = more creative/random\\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\\nRange: 1-1000.\\n"}},"required":["user_message"]},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default \`flow\`)"},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"agent":{"type":"string","description":"Path of a reusable \`ai_agent\` resource (hybrid linking). When set, the agent brain\\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\\nthat resource; the module's input_transforms then only carry the flow-local inputs\\n(user_message/user_attachments).\\n"},"tool_inputs":{"type":"object","description":"Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\\nshared resource; overlaid onto the tools' input_transforms at runtime \\u2014 including when\\n\`agent\` is unset, since a step forked for editing keeps these overrides until it is saved\\nback or unlinked.\\n","additionalProperties":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}}},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}`,
   "raw-app": `---
 name: raw-app
 description: MUST use when creating raw apps.
@@ -6840,8 +6734,12 @@ app related commands
   - \`--host <host:string>\` - Host to bind the dev server to
   - \`--entry <entry:string>\` - Entry point file (default: index.ts for Svelte/Vue, index.tsx otherwise)
   - \`--no-open\` - Don't automatically open the browser
+  - \`--recording\` - Frame the app in a shell with a Record button, to capture a replayable session recording of the app under development
 - \`app lint [app_folder:string]\` - Lint a raw app folder to validate structure and buildability
   - \`--fix\` - Attempt to fix common issues (not implemented yet)
+- \`app bundle [app_folder:string]\` - Bundle a raw app folder to js/css without deploying it
+  - \`--out <dir:string>\` - Directory to write bundle.js and bundle.css into (default: <app_folder>/dist)
+  - \`--no-minify\` - Skip minification
 - \`app new\` - create a new raw app from a template
   - \`--summary <summary:string>\` - App summary (short description). Skips the prompt when provided. Triggers non-interactive mode.
   - \`--path <path:string>\` - App path (e.g., f/folder/my_app or u/username/my_app). Skips the prompt when provided. Triggers non-interactive mode.
diff --git a/cli/src/types.ts b/cli/src/types.ts
index f0cd58abbb..6dd2e6ff77 100644
--- a/cli/src/types.ts
+++ b/cli/src/types.ts
@@ -5,6 +5,7 @@ import * as path from "node:path";
 import { sep as SEP } from "node:path";
 import { stringify as yamlStringify } from "yaml";
 import { yamlParseContent } from "./utils/yaml.ts";
+import { isDbtDescriptorPath } from "./utils/resource_folders.ts";
 import { pushApp } from "./commands/app/app.ts";
 import { pushFolder } from "./commands/folder/folder.ts";
 import { pushFlow } from "./commands/flow/flow.ts";
@@ -174,6 +175,21 @@ function redactString(s: string): string {
   return s.slice(0, 5) + "*".repeat(s.length - 5);
 }
 
+export interface PushObjOptions {
+  /** Optional commit/update message */
+  message?: string;
+  /** The original local file path (used for branch-specific resource file resolution) */
+  originalLocalPath?: string;
+  /** Identity to attribute the push to, for the types that carry one */
+  permissionedAsContext?: PermissionedAsContext;
+  /** Whether the item is workspace-specific */
+  wsSpecific?: boolean;
+  /** encryption_key push: non-interactive flag and explicit re-encryption choice */
+  keyPushOpts?: PushWorkspaceKeyOptions;
+  /** TypeScript runtime a bare `.ts` denotes, for raw-app runnables */
+  defaultTs?: "bun" | "deno";
+}
+
 /**
  * Pushes an object to the workspace server based on its type
  * @param workspace - The workspace ID to push to
@@ -182,9 +198,7 @@ function redactString(s: string): string {
  * @param newObj - The new object state to push
  * @param plainSecrets - Whether to store secrets in plain text
  * @param alreadySynced - Array to track already synced items
- * @param message - Optional commit/update message
- * @param originalLocalPath - The original local file path (used for branch-specific resource file resolution)
- * @param keyPushOpts - Options for the encryption_key push: non-interactive flag and explicit re-encryption choice
+ * @param opts - Per-type extras; see PushObjOptions
  */
 export async function pushObj(
   workspace: string,
@@ -193,12 +207,16 @@ export async function pushObj(
   newObj: any,
   plainSecrets: boolean,
   alreadySynced: string[],
-  message?: string,
-  originalLocalPath?: string,
-  permissionedAsContext?: PermissionedAsContext,
-  wsSpecific?: boolean,
-  keyPushOpts?: PushWorkspaceKeyOptions,
+  opts: PushObjOptions = {},
 ) {
+  const {
+    message,
+    originalLocalPath,
+    permissionedAsContext,
+    wsSpecific,
+    keyPushOpts,
+    defaultTs,
+  } = opts;
   const typeEnding = getTypeStrFromPath(p);
 
   if (typeEnding === "app") {
@@ -212,7 +230,7 @@ export async function pushObj(
     if (!rawAppName) {
       throw new Error(`Could not extract raw app name from path: ${p}`);
     }
-    await pushRawApp(workspace, rawAppName, buildFolderPath(rawAppName, "raw_app"), message);
+    await pushRawApp(workspace, rawAppName, buildFolderPath(rawAppName, "raw_app"), message, defaultTs);
   } else if (typeEnding === "folder") {
     await pushFolder(workspace, p, befObj, newObj);
   } else if (typeEnding === "variable") {
@@ -388,7 +406,11 @@ export function getTypeStrFromPath(
     parsed.ext == ".rb" ||
     parsed.ext == ".r" ||
     // for related places search: ADD_NEW_LANG
-    (parsed.ext == ".yml" && parsed.name.split(".").pop() == "playbook")
+    (parsed.ext == ".yml" && parsed.name.split(".").pop() == "playbook") ||
+    // A dbt descriptor is `<project>__dbt/wm_dbt.yaml`. Without this it reads
+    // as one of the CLI's own `.yaml` metadata files and a pull writes the
+    // script's metadata and lock but never its content.
+    isDbtDescriptorPath(p)
   ) {
     return "script";
   }
diff --git a/cli/src/utils/git.ts b/cli/src/utils/git.ts
index da1ac14414..5ca06f427a 100644
--- a/cli/src/utils/git.ts
+++ b/cli/src/utils/git.ts
@@ -75,6 +75,114 @@ export function getWorkspaceIdForWorkspaceForkFromBranchName(branchName: string)
 
   return `${WM_FORK_PREFIX}-${branchName.slice(start)}`
 }
+/**
+ * Whether this checkout can vouch for what it once held under `migrations/datatable/**`.
+ *
+ * `known` lists every such path recorded on the current branch (paths stay listed after
+ * the commit that removed them, so a real deletion is still recognisable). `unknown`
+ * means a file's absence from the working tree proves nothing, either because the
+ * history can't be read — no repository, a shallow clone's truncated history, an
+ * unresolvable root, a failing git — or because the working tree deliberately doesn't
+ * mirror it, as in a sparse checkout. Both shapes carry the same obligation on the
+ * caller: trust nothing, rather than read absence as evidence.
+ */
+export type RecordedMigrationPaths =
+  | { kind: "known"; paths: Set<string> }
+  | { kind: "unknown"; reason: string; remedy: string };
+
+/**
+ * Resolve [`RecordedMigrationPaths`] for the checkout at the current directory.
+ *
+ * This is the durable answer to "did this checkout ever track that migration?", which
+ * the working tree cannot give: an absent `migrations/datatable/` is equally a clone
+ * that never pulled migrations and one where the last was deleted, and creating a
+ * migration locally (`wmill datatable migrate new`) makes the directory appear without
+ * anything having been tracked.
+ *
+ * Scoped to `HEAD`, not `--all`: a migration that only ever existed on some other
+ * branch is not evidence that *this* branch ever tracked it, and using it as such would
+ * authorize deleting it. Output paths are repo-root-relative, so the `--show-prefix` of
+ * the working directory is stripped to match the cwd-relative paths a sync diff uses.
+ */
+export function gitRecordedDatatableMigrationPaths(): RecordedMigrationPaths {
+  if (!isGitRepository()) {
+    return {
+      kind: "unknown",
+      reason: "this directory is not a git repository",
+      remedy: "Run the push from a git checkout of the synced repository",
+    };
+  }
+  const shallow = spawnSync("git", ["rev-parse", "--is-shallow-repository"], {
+    encoding: "utf8",
+    stdio: "pipe",
+  });
+  if ((shallow.stdout ?? "").trim() === "true") {
+    return {
+      kind: "unknown",
+      reason: "this is a shallow clone, so its history is truncated",
+      remedy:
+        "Fetch the full history (for actions/checkout, fetch-depth: 0)",
+    };
+  }
+  // A sparse checkout can record migrations in history while never materialising
+  // them in the working tree, so their absence there says nothing about whether the
+  // user deleted them. Over-protective for a sparse cone that does include
+  // migrations/, which the interactive prompt can still override.
+  // `--type=bool` normalises git's booleans (1, yes, on, …) to true/false; a raw
+  // `--get` would let `core.sparseCheckout = 1` walk straight past this.
+  const sparse = spawnSync(
+    "git",
+    ["config", "--type=bool", "--get", "core.sparseCheckout"],
+    { encoding: "utf8", stdio: "pipe" },
+  );
+  if ((sparse.stdout ?? "").trim() === "true") {
+    return {
+      kind: "unknown",
+      reason:
+        "this is a sparse checkout, so its working tree may not hold every tracked file",
+      remedy: "Run the push from a full (non-sparse) checkout",
+    };
+  }
+  const prefixOut = spawnSync("git", ["rev-parse", "--show-prefix"], {
+    encoding: "utf8",
+    stdio: "pipe",
+  });
+  if ((prefixOut.status ?? 1) !== 0) {
+    return {
+      kind: "unknown",
+      reason: "the repository root could not be resolved",
+      remedy: "Check that git runs correctly in this directory",
+    };
+  }
+  const prefix = (prefixOut.stdout ?? "").trim();
+
+  const r = spawnSync(
+    "git",
+    ["log", "HEAD", "--format=", "--name-only", "--", "migrations/datatable"],
+    { encoding: "utf8", stdio: "pipe", maxBuffer: 64 * 1024 * 1024 },
+  );
+  if ((r.status ?? 1) !== 0) {
+    log.debug(`Could not read git history for migrations: ${r.stderr ?? ""}`);
+    return {
+      kind: "unknown",
+      reason: "its history could not be read",
+      remedy: "Check that git runs correctly in this directory",
+    };
+  }
+  const paths = new Set<string>();
+  for (const line of (r.stdout ?? "").split("\n")) {
+    const p = line.trim();
+    if (p.length === 0) continue;
+    if (prefix.length > 0) {
+      if (!p.startsWith(prefix)) continue;
+      paths.add(p.slice(prefix.length));
+    } else {
+      paths.add(p);
+    }
+  }
+  return { kind: "known", paths };
+}
+
 export function isGitRepository(): boolean {
   try {
     execSync("git rev-parse --git-dir", {
@@ -319,6 +427,10 @@ export function gitSyncIncludePattern(
       return `${path}.azure_trigger.*`;
     case "emailtrigger":
       return `${path}.email_trigger.*`;
+    case "datatable_migration":
+      // One migration is two files under `migrations/datatable/<dt>/`; the
+      // backend already sends the repo-relative base path.
+      return `${path}.up.sql,${path}.down.sql`;
     default:
       // Scripts: `${path}.*` matches the dotted layout
       // (`${path}.script.yaml` etc.), `${path}__mod/**` matches the folder
diff --git a/cli/src/utils/metadata.ts b/cli/src/utils/metadata.ts
index ebb35e9d33..1905121c3a 100644
--- a/cli/src/utils/metadata.ts
+++ b/cli/src/utils/metadata.ts
@@ -19,9 +19,10 @@ import {
   languageNeedsLock,
 } from "./script_common.ts";
 import { inferContentTypeFromFilePath } from "./script_common.ts";
-import { getModuleFolderSuffix, isModuleEntryPoint, scriptPathToRemotePath } from "./resource_folders.ts";
+import { dbtGeneratedDirs, isUnderGeneratedDir, isBundledModuleFile, getModuleFolderSuffix, isModuleEntryPoint, scriptPathToRemotePath } from "./resource_folders.ts";
 import { findCodebase, yamlOptions } from "../commands/sync/sync.ts";
 import { generateHash, readInlinePathSync, getHeaders, readTextFile, readTextFileSync } from "./utils.ts";
+import { DBT_DESCRIPTOR_NAME, isMissingDbtDescriptor } from "./resource_folders.ts";
 import { detectAuthGatewayChallenge } from "./http_guards.ts";
 
 import { SyncCodebase } from "./codebase.ts";
@@ -218,6 +219,13 @@ export async function generateScriptMetadataInternal(
 
   const language = inferContentTypeFromFilePath(scriptPath, opts.defaultTs);
 
+  // Whether the metadata and lock live INSIDE that folder. They do for a `__mod`
+  // bundle, whose folder is Windmill's. A dbt project's folder is dbt's, taken
+  // verbatim, so its companions stay beside it — writing them in would leave
+  // stray `script.yaml`/`script.lock` files in the deployed project and leave
+  // the metadata sync actually reads untouched.
+  const metadataInFolder = isFolderLayout && language !== "dbt";
+
   // For folder layout, parseMetadataFile is called with remotePath which
   // will find __mod/script.yaml via the folder layout fallback
   const metadataWithType = await parseMetadataFile(
@@ -225,8 +233,12 @@ export async function generateScriptMetadataInternal(
     undefined,
   );
 
-  // read script content
-  const scriptContent = await readTextFile(scriptPath);
+  // read script content — a dbt project's descriptor is optional, and absent
+  // means an empty descriptor rather than a script that cannot be pushed.
+  const scriptContent = await readTextFile(scriptPath).catch((e) => {
+    if (isMissingDbtDescriptor(scriptPath, e)) return "";
+    throw e;
+  });
   const metadataContent = await readTextFile(metadataWithType.path);
 
   const filteredRawWorkspaceDependencies = filterWorkspaceDependencies(
@@ -238,7 +250,8 @@ export async function generateScriptMetadataInternal(
   // Compute the module folder path early so we can include module hashes in stale check
   const moduleFolderPath = isFolderLayout
     ? path.dirname(scriptPath)
-    : scriptPath.substring(0, scriptPath.indexOf(".")) + getModuleFolderSuffix();
+    : scriptPath.substring(0, scriptPath.indexOf(".")) +
+      getModuleFolderSuffix(language);
 
   const hasModules = existsSync(moduleFolderPath) && statSync(moduleFolderPath).isDirectory();
 
@@ -250,7 +263,8 @@ export async function generateScriptMetadataInternal(
   let moduleHashes: Record<string, string> = {};
   if (hasModules) {
     moduleHashes = await computeModuleHashes(
-      moduleFolderPath, opts.defaultTs, tree ? {} : rawWorkspaceDependencies, isFolderLayout
+      moduleFolderPath, opts.defaultTs, tree ? {} : rawWorkspaceDependencies, isFolderLayout,
+      language === "dbt",
     );
   }
   const hasModuleHashes = Object.keys(moduleHashes).length > 0;
@@ -349,7 +363,7 @@ export async function generateScriptMetadataInternal(
 
     if (!hasCodebase) {
       const tempScriptRefs = tree?.getTempScriptRefs(remotePath);
-      const lockPathOverride = isFolderLayout
+      const lockPathOverride = metadataInFolder
         ? path.dirname(scriptPath) + "/script.lock"
         : undefined;
       await updateScriptLock(
@@ -366,8 +380,13 @@ export async function generateScriptMetadataInternal(
       metadataParsedContent.lock = "";
     }
 
-    // Generate locks for modules in __mod/ folder
-    if (hasModules) {
+    // Generate locks for modules in __mod/ folder.
+    //
+    // Never for a dbt bundle: its files are the project's own SQL and YAML, none
+    // of which is a Windmill script needing a lockfile, and writing `foo.lock`
+    // beside `foo.sql` puts our artifacts inside a tree we promise to round-trip
+    // byte-for-byte.
+    if (hasModules && language !== "dbt") {
       // Identify which modules changed by comparing per-module hashes
       let changedModules: string[] | undefined;
       if (hasModuleHashes) {
@@ -387,7 +406,7 @@ export async function generateScriptMetadataInternal(
       );
     }
   } else {
-    if (isFolderLayout) {
+    if (metadataInFolder) {
       metadataParsedContent.lock =
         "!inline " + remotePath.replaceAll(SEP, "/") + getModuleFolderSuffix() + "/script.lock";
     } else {
@@ -399,7 +418,7 @@ export async function generateScriptMetadataInternal(
   // Write metadata back to the correct path
   let metaPath: string;
   let newMetadataContent: string;
-  if (isFolderLayout) {
+  if (metadataInFolder) {
     if (metadataWithType.isJson) {
       metaPath = path.dirname(scriptPath) + "/script.json";
       newMetadataContent = JSON.stringify(metadataParsedContent);
@@ -765,15 +784,18 @@ async function updateScriptLock(
   tempScriptRefs?: Record<string, string>,
   lockPathOverride?: string,
 ): Promise<void> {
-  if (
-    !(
-      (workspaceDependenciesLanguages.some((l) => l.language == language) &&
-        language !== "powershell") ||
-      language == "deno" ||
-      language == "rust" ||
-      language == "ansible"
-    )
-  ) {
+  if (!languageNeedsLock(language)) {
+    // A dbt lock is written by the dependency job on a worker, from a real
+    // `dbt deps`/`dbt parse`, so there is nothing to generate here. Restore the
+    // reference to the file `wmill sync pull` wrote: the caller has already
+    // resolved it into the metadata, and leaving it resolved inlines the lock
+    // into the yaml on every run.
+    if (language === "dbt") {
+      const lockPath = lockPathOverride ?? remotePath + ".script.lock";
+      if (existsSync(lockPath)) {
+        metadataContent.lock = "!inline " + lockPath.replaceAll(SEP, "/");
+      }
+    }
     return;
   }
 
@@ -995,6 +1017,9 @@ export async function inferSchema(
   } else if (language === "rlang") {
     const { parse_r } = await loadParser("windmill-parser-wasm-r");
     inferedSchema = JSON.parse(parse_r(content));
+  } else if (language === "dbt") {
+    const { parse_dbt } = await loadParser("windmill-parser-wasm-yaml");
+    inferedSchema = JSON.parse(parse_dbt(content));
     // for related places search: ADD_NEW_LANG
   } else {
     throw new Error("Invalid language: " + language);
@@ -1368,8 +1393,15 @@ async function computeModuleHashes(
   defaultTs: "bun" | "deno" | undefined,
   rawWorkspaceDependencies: Record<string, string>,
   isFolderLayout: boolean,
+  // A dbt project's files are taken verbatim, so hash them the same way the
+  // push reads them: a `.sql` model has no inferable language, and dropping it
+  // here would leave an edited model looking up to date.
+  verbatim: boolean = false,
 ): Promise<Record<string, string>> {
   const hashes: Record<string, string> = {};
+  const skipDirs = verbatim
+    ? dbtGeneratedDirs(moduleFolderPath)
+    : new Set<string>();
 
   async function readDir(dirPath: string, relPrefix: string) {
     const entries = readdirSync(dirPath, { withFileTypes: true });
@@ -1379,15 +1411,31 @@ async function computeModuleHashes(
       const isTopLevel = relPrefix === "";
 
       if (entry.isDirectory()) {
+        // A configured `target-path` may be nested (`build/target`), so the
+        // comparison is on the project-relative path, not the entry name.
+        if (skipDirs.size > 0 && isUnderGeneratedDir(relPath, skipDirs)) continue;
         await readDir(fullPath, relPath);
+        // See the bundle builder: a verbatim (dbt) bundle carries a `.lock` the
+        // project authored, so the hash has to see it or a change to it would
+        // never be detected as a change.
       } else if (
         entry.isFile() &&
-        !entry.name.endsWith(".lock") &&
-        !(isFolderLayout && isTopLevel && entry.name.startsWith("script."))
+        (verbatim || !entry.name.endsWith(".lock")) &&
+        !(isFolderLayout && isTopLevel && entry.name.startsWith("script.")) &&
+        // The descriptor is the script's CONTENT, hashed as such: counting it
+        // here too would make one edit look like two changes.
+        !(verbatim && isTopLevel && entry.name === DBT_DESCRIPTOR_NAME)
       ) {
-        try {
-          inferContentTypeFromFilePath(entry.name, defaultTs);
-        } catch {
+        if (!verbatim) {
+          try {
+            inferContentTypeFromFilePath(entry.name, defaultTs);
+          } catch {
+            continue;
+          }
+        } else if (!isBundledModuleFile(fullPath)) {
+          // Hash only what the push actually sends. Hashing a file the bundle
+          // drops would make the script permanently stale: every check would
+          // see a change no push can ever resolve.
           continue;
         }
         const content = readTextFileSync(fullPath);
diff --git a/cli/src/utils/resource_folders.ts b/cli/src/utils/resource_folders.ts
index 653c443935..04ed260f07 100644
--- a/cli/src/utils/resource_folders.ts
+++ b/cli/src/utils/resource_folders.ts
@@ -8,6 +8,7 @@
  * (.flow, .app, .raw_app) or dunder-prefixed names (__flow, __app, __raw_app).
  */
 
+import { existsSync } from "node:fs";
 import * as log from "../core/log.ts";
 import { sep as SEP } from "node:path";
 import { yamlParseFile } from "./yaml.ts";
@@ -503,28 +504,323 @@ export function isFlowFolderMetadataFile(p: string): boolean {
  * to avoid confusion with file extensions.
  */
 const MODULE_SUFFIX = "__mod";
+/** dbt scripts carry a whole dbt project, not helper code. The folder says so,
+ *  and it is what a dbt developer points `--project-dir` at. */
+export const DBT_MODULE_SUFFIX = "__dbt";
+const MODULE_SUFFIXES = [MODULE_SUFFIX, DBT_MODULE_SUFFIX];
+
+/** A dbt project's descriptor, inside the project it configures and OPTIONAL:
+ *  an unmodified dbt project is already a complete Windmill script, and this
+ *  file only appears when one needs something Windmill-specific (run arguments,
+ *  a named warehouse, an engine pin). Its absence is an empty descriptor, never
+ *  a missing script. */
+export const DBT_DESCRIPTOR_NAME = "wm_dbt.yaml";
+
+/** Where a dbt script's descriptor lives, given its base path. */
+export function dbtDescriptorPath(scriptBasePath: string): string {
+  return scriptBasePath + DBT_MODULE_SUFFIX + "/" + DBT_DESCRIPTOR_NAME;
+}
+
+/** Whether an error is a dbt descriptor that simply is not there. */
+export function isMissingDbtDescriptor(filePath: string, e: unknown): boolean {
+  if ((e as { code?: string })?.code !== "ENOENT") return false;
+  const norm = filePath.replaceAll("\\", "/");
+  if (!isDbtDescriptorPath(norm)) return false;
+  // And the PROJECT is there. Absent both, this is not a descriptor-less
+  // project but a path that does not exist — a typo, or a project someone
+  // deleted — and treating it as an empty descriptor pushes `modules:
+  // undefined` over a deployed bundle, dropping it while reporting success.
+  return existsSync(
+    norm.slice(0, -DBT_DESCRIPTOR_NAME.length) + "dbt_project.yml"
+  );
+}
+
+/** Whether a path is a dbt descriptor, i.e. a dbt script's content file. */
+export function isDbtDescriptorPath(p: string): boolean {
+  const norm = normalizeSep(p);
+  const base = getScriptBasePathFromModulePath(norm);
+  return base !== undefined && norm === dbtDescriptorPath(base);
+}
 
 /**
- * Get the module folder suffix (always "__mod")
+ * Module folder suffix for a script: `__dbt` for a dbt project, `__mod`
+ * otherwise.
  */
-export function getModuleFolderSuffix(): string {
-  return MODULE_SUFFIX;
+export function getModuleFolderSuffix(language?: string): string {
+  return language === "dbt" ? DBT_MODULE_SUFFIX : MODULE_SUFFIX;
 }
 
 /**
  * Check if a path is inside a script module folder.
- * Matches patterns like: .../my_script__mod/...
+ * Matches patterns like: .../my_script__mod/... or .../my_project__dbt/...
  */
 export function isScriptModulePath(p: string): boolean {
-  return normalizeSep(p).includes(MODULE_SUFFIX + "/");
+  const n = normalizeSep(p);
+  return MODULE_SUFFIXES.some((suffix) => n.includes(suffix + "/"));
+}
+
+/** Per-file ceiling for a dbt project's bundle. Real dbt code is small (about
+ *  500 bytes median, 1.9 KB at p90 measured across dbt_utils), so this only
+ *  ever catches a committed dataset, which belongs in the warehouse rather than
+ *  in every version of the script. */
+export const MAX_MODULE_BYTES = 5 * 1024 * 1024;
+
+/**
+ * Whether a dbt project file is one the bundle carries.
+ *
+ * A dbt project's authored files are text. A binary one -- an image under
+ * `docs/`, a `.DS_Store`, a parquet seed -- would be read as mojibake and, if
+ * it carries a NUL, rejected by Postgres with an opaque `unsupported Unicode
+ * escape sequence`. Binary is detected the way `git` does it, by a NUL in the
+ * first 8000 bytes, rather than by extension, which `docs/` and stray dotfiles
+ * do not follow.
+ *
+ * The push, the staleness hash and the sync diff all ask this same question: a
+ * file one drops and another keeps is a change no push can ever resolve.
+ */
+export function isBundledModuleFile(fullPath: string): boolean {
+  return moduleFileExclusion(fullPath) === undefined;
+}
+
+/**
+ * WHY the bundle does not carry a file, when it does not.
+ *
+ * The two reasons are not interchangeable. `binary` is dbt's own leftovers and
+ * stray archives: nothing to say, so sync hides them. `oversized` is a file the
+ * project authored and dbt WOULD read — a large seed CSV — so it has to stay
+ * visible in the diff, or the push that reports the actionable size error never
+ * runs and the remote project is silently left incomplete.
+ */
+export function moduleFileExclusion(
+  fullPath: string,
+): "binary" | "oversized" | undefined {
+  // Size from `stat` and only the first 8 KB read: a project may sit next to a
+  // multi-gigabyte parquet seed or a stray archive, and reading one whole just
+  // to classify it would stall the sync or exhaust the CLI.
+  let size: number;
+  let fd: number;
+  try {
+    size = fs.statSync(fullPath).size;
+    fd = fs.openSync(fullPath, "r");
+  } catch {
+    // Unreadable is not the same as excluded. A pull asks this about files that
+    // do not exist locally yet, and answering "not carried" there would make
+    // sync ignore the whole incoming project and write nothing.
+    return undefined;
+  }
+  let binary: boolean;
+  try {
+    const head = Buffer.alloc(8000);
+    const read = fs.readSync(fd, head, 0, 8000, 0);
+    binary = head.subarray(0, read).includes(0);
+  } catch {
+    return undefined;
+  } finally {
+    fs.closeSync(fd);
+  }
+  if (binary) return "binary";
+  return size > MAX_MODULE_BYTES ? "oversized" : undefined;
+}
+
+/**
+ * The refusal an oversized dbt project file earns, raised WITHOUT reading it.
+ *
+ * dbt would have read the file, so deploying the project without it ships
+ * something that compiles here and fails at run time with a missing relation —
+ * hence an error rather than a skip. Every path that would otherwise load the
+ * body (the sync map, the push) asks first: a multi-gigabyte seed must not be
+ * buffered just to be refused.
+ */
+export function oversizedModuleFileError(relPath: string, size: number): Error {
+  return new Error(
+    `${relPath} is ${Math.ceil(size / 1024 / 1024)} MB, over the ` +
+      `${MAX_MODULE_BYTES / 1024 / 1024} MB per-file limit for a dbt project file. ` +
+      `Deploying without it would leave the project incomplete — shrink the file, or ` +
+      `keep it out of the project folder.`,
+  );
+}
+
+/**
+ * Refuse an oversized dbt project file before its content is read. `undefined`
+ * for everything else, including binary files the bundle merely drops.
+ */
+export function oversizedDbtFileError(
+  fullPath: string,
+  relPath: string,
+): Error | undefined {
+  if (!isDbtModulePath(relPath)) return undefined;
+  if (moduleFileExclusion(fullPath) !== "oversized") return undefined;
+  let size = 0;
+  try {
+    size = fs.statSync(fullPath).size;
+  } catch {
+    return undefined;
+  }
+  return oversizedModuleFileError(relPath, size);
+}
+
+/** Whether a path is inside a dbt project's module folder specifically: those
+ *  files are taken verbatim, with no language inference. */
+export function isDbtModulePath(p: string): boolean {
+  // The OUTERMOST boundary decides, like `getScriptBasePathFromModulePath`.
+  // Scanning anywhere in the path would call `foo__mod/vendor/x__dbt/a.ts` a dbt
+  // project file, and the push would then look for `foo.script.yaml` instead of
+  // the ordinary module entry point and skip the edit.
+  const norm = normalizeSep(p);
+  const base = getScriptBasePathFromModulePath(norm);
+  return base !== undefined && norm.startsWith(base + DBT_MODULE_SUFFIX + "/");
+}
+
+/** dbt writes these; a project authors them nowhere. Importing a stale
+ *  `target/` would ship a manifest this runtime then reads as the graph, and
+ *  `dbt_packages/` is a vendored copy the worker restores from its own cache. */
+const DBT_GENERATED_DIRS = ["target", "dbt_packages", "logs", ".git", ".venv", "__pycache__"];
+
+const dbtGeneratedDirsCache = new Map<
+  string,
+  { stamp: string; dirs: Set<string> }
+>();
+
+/** `{{ env_var('NAME') }}` / `{{ env_var("NAME", "default") }}`. */
+const DBT_ENV_VAR_CALL =
+  /\{\{\s*env_var\(\s*['"]([^'"]+)['"]\s*(?:,\s*['"]([^'"]*)['"]\s*)?\)\s*\}\}/g;
+
+/**
+ * Render `dbt_project.yml`'s own `env_var()` calls, which dbt allows there too.
+ * A directory setting left as its template names no directory on disk, so the
+ * generated tree it points at would be bundled as project source.
+ *
+ * Against `process.env`, because the CLI runs where the project was built: that
+ * is the environment dbt used to produce the tree being read.
+ */
+export function renderDbtEnvVars(value: string): string {
+  return value.replace(
+    DBT_ENV_VAR_CALL,
+    (whole, name: string, fallback: string | undefined) =>
+      process.env[name] ?? fallback ?? whole,
+  );
+}
+
+/**
+ * Files that keep a project's secrets next to it rather than in it: dbt reads
+ * none of them (`env_var()` takes the process environment), and the documented
+ * way into a bundle is `cp -r my-project/.`, which copies whatever the checkout
+ * holds — including the `.env` a `.gitignore` was keeping out of the repo.
+ */
+export function isLocalSecretFile(name: string): boolean {
+  return name === ".env" || name.startsWith(".env.") || name === ".envrc";
+}
+
+/**
+ * Directories to leave out of a dbt project's module bundle, as project-relative
+ * paths — `target-path` and friends may be nested (`build/target`).
+ *
+ * `target-path`, `packages-install-path` and `clean-targets` are configurable,
+ * so they are read from the project rather than assumed. Cached per project
+ * folder: this is called once per file of a sync.
+ */
+export function dbtGeneratedDirs(moduleFolderPath: string): Set<string> {
+  const projectFile = path.join(moduleFolderPath, "dbt_project.yml");
+  // Cached against the project file's identity, not merely its folder: `wmill
+  // dev` is a long-running process, so a `target-path` edited mid-session would
+  // otherwise keep excluding the old directory and start bundling the new one
+  // as project source. One entry per folder, replaced when the file changes.
+  let stamp = "";
+  try {
+    const st = fs.statSync(projectFile);
+    stamp = `${st.mtimeMs}:${st.size}`;
+  } catch {
+    // No project file yet: the defaults apply, and "absent" is its own stamp.
+  }
+  const cached = dbtGeneratedDirsCache.get(moduleFolderPath);
+  if (cached && cached.stamp === stamp) return cached.dirs;
+  const dirs = new Set<string>(DBT_GENERATED_DIRS);
+  const add = (raw: string) => {
+    const v = normalizeSep(renderDbtEnvVars(raw).trim().replace(/^["']|["']$/g, ""))
+      .replace(/^\.\//, "")
+      .replace(/\/+$/, "");
+    // A configured path that escapes the project is dbt's problem, not ours;
+    // ignoring it here just means those files stay in the bundle.
+    if (v && !v.startsWith("/") && !v.split("/").includes("..")) dirs.add(v);
+  };
+  try {
+    const projectYml = fs.readFileSync(projectFile, "utf-8");
+    for (const m of projectYml.matchAll(
+      /^\s*(?:target-path|packages-install-path)\s*:\s*([^\n#]+)/gm,
+    )) {
+      add(m[1]);
+    }
+    // `clean-targets` in either of dbt's two spellings: inline `[a, b]`, and the
+    // block form, whose entries are on the lines that follow.
+    const lines = projectYml.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i++) {
+      const head = lines[i].match(/^\s*clean-targets\s*:\s*(.*)$/);
+      if (!head) continue;
+      const inline = head[1].match(/^\[([^\]]*)\]/);
+      if (inline) {
+        inline[1].split(",").forEach(add);
+        continue;
+      }
+      for (let j = i + 1; j < lines.length; j++) {
+        const item = lines[j].match(/^\s+-\s*([^\n#]+)$/);
+        if (!item) break;
+        add(item[1]);
+      }
+    }
+  } catch {
+    // No dbt_project.yml yet (a descriptor pushed before its project): the
+    // defaults still apply.
+  }
+  dbtGeneratedDirsCache.set(moduleFolderPath, { stamp, dirs });
+  return dirs;
+}
+
+/**
+ * Whether a project-relative path sits inside one of `dirs`. Compared segment
+ * by segment: `targetx/a` must not match a configured `target`.
+ */
+export function isUnderGeneratedDir(rel: string, dirs: Set<string>): boolean {
+  const n = normalizeSep(rel);
+  for (const d of dirs) {
+    if (n === d || n.startsWith(d + "/")) return true;
+  }
+  return false;
+}
+
+/**
+ * Whether a path under a `__dbt/` folder is one dbt generated rather than one
+ * the project authors. Those never belong to the bundle, so sync must not offer
+ * them as items of their own either.
+ */
+export function isDbtGeneratedPath(p: string): boolean {
+  const n = normalizeSep(p);
+  // Anchored on the outermost boundary, like every other helper here. Matching
+  // `__dbt/` anywhere would call `foo__mod/vendor/x__dbt/target/a.ts` generated
+  // dbt output, and `ignoreF` would then exclude an ordinary module file so a
+  // module-only edit never deploys its parent script.
+  if (!isDbtModulePath(n)) return false;
+  const base = getScriptBasePathFromModulePath(n)!;
+  const projectRoot = base + DBT_MODULE_SUFFIX;
+  const rel = n.slice(projectRoot.length + 1);
+  if (isUnderGeneratedDir(rel, dbtGeneratedDirs(projectRoot))) {
+    return true;
+  }
+  // Not generated, but not carried either: the bundle drops it, so the diff
+  // must not keep offering it as a pending change. An OVERSIZED one is the
+  // exception — see `moduleFileExclusion`: hiding it here is what would make an
+  // edit to a large seed report no change at all.
+  return (
+    isLocalSecretFile(n.slice(n.lastIndexOf("/") + 1)) ||
+    moduleFileExclusion(p) === "binary"
+  );
 }
 
 /**
  * Build the module folder path from a script's base path (without extension).
- * e.g., "f/my_script" -> "f/my_script__mod"
+ * e.g., "f/my_script" -> "f/my_script__mod", or "__dbt" for a dbt project.
  */
-export function buildModuleFolderPath(scriptBasePath: string): string {
-  return scriptBasePath + MODULE_SUFFIX;
+export function buildModuleFolderPath(scriptBasePath: string, language?: string): string {
+  return scriptBasePath + getModuleFolderSuffix(language);
 }
 
 /**
@@ -533,10 +829,21 @@ export function buildModuleFolderPath(scriptBasePath: string): string {
  */
 export function isModuleEntryPoint(p: string): boolean {
   const norm = normalizeSep(p);
+  // Anchored on the OUTERMOST module boundary, like
+  // `getScriptBasePathFromModulePath`. Scanning for `__mod/` alone would match a
+  // `legacy__mod/` directory nested inside a dbt project — dbt owns those names
+  // verbatim — and call its `script.ts` this script's entry point.
+  const base = getScriptBasePathFromModulePath(norm);
+  if (base === undefined) return false;
+  // A dbt project's entry point is its descriptor, which sits INSIDE the
+  // project so that an author writes nothing outside the directory dbt itself
+  // reads.
+  if (norm.startsWith(base + DBT_MODULE_SUFFIX + "/")) {
+    return norm === dbtDescriptorPath(base);
+  }
   const suffix = MODULE_SUFFIX + "/";
-  const idx = norm.indexOf(suffix);
-  if (idx === -1) return false;
-  const rest = norm.slice(idx + suffix.length);
+  if (!norm.startsWith(base + suffix)) return false;
+  const rest = norm.slice(base.length + suffix.length);
   return rest.startsWith("script.") && !rest.includes("/");
 }
 
@@ -544,13 +851,21 @@ export function isModuleEntryPoint(p: string): boolean {
  * Extract the script base path from a module folder entry.
  * e.g., "u/admin/my_script__mod/script.ts" -> "u/admin/my_script"
  * e.g., "u/admin/my_script__mod/helper.ts" -> "u/admin/my_script"
+ * e.g., "f/x/proj__dbt/models/a.sql" -> "f/x/proj"
  */
 export function getScriptBasePathFromModulePath(p: string): string | undefined {
   const norm = normalizeSep(p);
-  const suffix = MODULE_SUFFIX + "/";
-  const idx = norm.indexOf(suffix);
-  if (idx === -1) return undefined;
-  return norm.slice(0, idx);
+  // The OUTERMOST boundary, not the first suffix that happens to match. A dbt
+  // project's directories are the author's verbatim, so `foo__dbt/models/
+  // legacy__mod/a.sql` is legal — taking `__mod` first would call
+  // `foo__dbt/models/legacy` the script and look for a descriptor that is not
+  // there, silently skipping the deploy.
+  let best: number | undefined;
+  for (const suffix of MODULE_SUFFIXES) {
+    const idx = norm.indexOf(suffix + "/");
+    if (idx !== -1 && (best === undefined || idx < best)) best = idx;
+  }
+  return best === undefined ? undefined : norm.slice(0, best);
 }
 
 /**
diff --git a/cli/src/utils/script_common.ts b/cli/src/utils/script_common.ts
index a713e41782..318f84b7c9 100644
--- a/cli/src/utils/script_common.ts
+++ b/cli/src/utils/script_common.ts
@@ -1,3 +1,4 @@
+import { isDbtDescriptorPath } from "./resource_folders.ts";
 export type ScriptLanguage =
   | "python3"
   | "deno"
@@ -21,6 +22,7 @@ export type ScriptLanguage =
   | "ansible"
   | "ruby"
   | "rlang"
+  | "dbt"
   | "java";
 // for related places search: ADD_NEW_LANG
 
@@ -106,6 +108,8 @@ export function inferContentTypeFromFilePath(
     return "java";
   } else if (contentPath.endsWith(".rb")) {
     return "ruby";
+  } else if (isDbtDescriptorPath(contentPath)) {
+    return "dbt";
   } else if (contentPath.endsWith(".r")) {
     return "rlang";
 	// for related places search: ADD_NEW_LANG
@@ -119,7 +123,7 @@ export function inferContentTypeFromFilePath(
     throw new Error(
       `Cannot infer script language from extension '${ext}' (file ${contentPath}).` +
         hint +
-        "\nSupported extensions: .ts (bun/deno), .py, .go, .sh, .ps1, .php, .rs, .cs, .nu, .java, .rb, .r, .gql, .playbook.yml, .pg.sql, .my.sql, .bq.sql, .sf.sql, .ms.sql, .odb.sql, .duckdb.sql"
+        "\nSupported extensions: .ts (bun/deno), .py, .go, .sh, .ps1, .php, .rs, .cs, .nu, .java, .rb, .r, .gql, .playbook.yml, .pg.sql, .my.sql, .bq.sql, .sf.sql, .ms.sql, .odb.sql, .duckdb.sql, and a dbt project folder `<name>__dbt/`"
     );
   }
 }
diff --git a/cli/test/datatable_migrations_unit.test.ts b/cli/test/datatable_migrations_unit.test.ts
index 09af49f890..2db9371629 100644
--- a/cli/test/datatable_migrations_unit.test.ts
+++ b/cli/test/datatable_migrations_unit.test.ts
@@ -15,6 +15,7 @@ import * as path from "node:path";
 import * as os from "node:os";
 import { parseDatatableMigrationPath } from "../src/types.ts";
 import { validateLocalMigrations } from "../src/commands/datatable_migrations.ts";
+import { untrackedDatatableMigrationDeletions } from "../src/commands/sync/sync.ts";
 
 describe("parseDatatableMigrationPath", () => {
   test("parses up and down files of the new layout", () => {
@@ -120,3 +121,61 @@ describe("validateLocalMigrations", () => {
     expect(validateLocalMigrations()).toEqual([]);
   });
 });
+
+// =============================================================================
+// untrackedDatatableMigrationDeletions — the push-side safety net.
+//
+// Migrations bypass the repo's path filters, so a clone made before they were
+// synced sees every server-side migration as remote-only, and
+// `pushMigrationFromDisk` reads a missing `.up.sql` as "delete it". What the repo
+// has ever committed under migrations/datatable/ is the durable answer to "did we
+// track this?" — the working tree is not, because creating a migration locally
+// makes the directory appear without anything having been tracked.
+// =============================================================================
+
+describe("untrackedDatatableMigrationDeletions", () => {
+  const A_UP = "migrations/datatable/mydb/20260101000000_a.up.sql";
+  const A_DOWN = "migrations/datatable/mydb/20260101000000_a.down.sql";
+  const changes = [
+    { name: "deleted", path: A_UP },
+    { name: "deleted", path: A_DOWN },
+    { name: "deleted", path: "f/foo/bar.script.yaml" },
+    { name: "added", path: "migrations/datatable/mydb/20260102000000_b.up.sql" },
+  ];
+
+  test("trusts a deletion the repository has committed before", () => {
+    expect(
+      untrackedDatatableMigrationDeletions(changes, { kind: "known", paths: new Set([A_UP, A_DOWN]) }),
+    ).toEqual([]);
+  });
+
+  test("flags migrations this repository has never recorded", () => {
+    expect(
+      untrackedDatatableMigrationDeletions(changes, { kind: "known", paths: new Set() }).map((c) => c.path),
+    ).toEqual([A_UP, A_DOWN]);
+  });
+
+  test("a locally created migration does not vouch for unrelated ones", () => {
+    // `wmill datatable migrate new` makes migrations/datatable/ exist without the
+    // checkout having tracked anything, so only the recorded paths count.
+    const recorded = {
+      kind: "known" as const,
+      paths: new Set(["migrations/datatable/mydb/20260102000000_b.up.sql"]),
+    };
+    expect(
+      untrackedDatatableMigrationDeletions(changes, recorded).map((c) => c.path),
+    ).toEqual([A_UP, A_DOWN]);
+  });
+
+  test("trusts nothing when the history cannot be consulted", () => {
+    // A shallow clone or a non-repository can't prove a path was never tracked,
+    // so absence is not read as permission to delete.
+    expect(
+      untrackedDatatableMigrationDeletions(changes, {
+        kind: "unknown",
+        reason: "this is a shallow clone, so its history is truncated",
+        remedy: "Fetch the full history (for actions/checkout, fetch-depth: 0)",
+      }).map((c) => c.path),
+    ).toEqual([A_UP, A_DOWN]);
+  });
+});
diff --git a/cli/test/dbt_module_tracker_unit.test.ts b/cli/test/dbt_module_tracker_unit.test.ts
new file mode 100644
index 0000000000..90abee18ae
--- /dev/null
+++ b/cli/test/dbt_module_tracker_unit.test.ts
@@ -0,0 +1,145 @@
+/**
+ * `buildTracker` decides whose top hash `wmill-lock.yaml` refreshes. A dbt
+ * project is mostly files that are not Windmill script extensions — the project
+ * file, `packages.yml`, schema YAML, seed CSVs — and its folder is spelled
+ * `__dbt\` on Windows, so both the extension gate and a raw-path search for
+ * `__dbt/` left the descriptor untracked and its hash stale.
+ */
+import { expect, test, describe, beforeEach, afterEach } from "bun:test";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import * as os from "node:os";
+import { buildTracker, elementsToMap } from "../src/commands/sync/sync.ts";
+import { isDbtGeneratedPath } from "../src/utils/resource_folders.ts";
+import { readModulesFromDisk } from "../src/commands/script/script.ts";
+
+describe("buildTracker with a dbt project", () => {
+  let dir: string;
+  let cwd: string;
+
+  beforeEach(() => {
+    dir = fs.mkdtempSync(path.join(os.tmpdir(), "wmill-dbt-tracker-"));
+    cwd = process.cwd();
+    process.chdir(dir);
+    fs.mkdirSync(path.join(dir, "f/analytics/analytics__dbt/models"), {
+      recursive: true,
+    });
+    fs.mkdirSync(path.join(dir, "f/analytics/analytics__dbt/seeds"), {
+      recursive: true,
+    });
+    // The descriptor sits INSIDE the project folder, and `findContentFile`
+    // resolves the metadata path to it.
+    fs.writeFileSync(path.join(dir, "f/analytics/analytics.script.yaml"), "{}");
+    fs.writeFileSync(
+      path.join(dir, "f/analytics/analytics__dbt/dbt_project.yml"),
+      "name: analytics\n",
+    );
+    fs.writeFileSync(
+      path.join(dir, "f/analytics/analytics__dbt/wm_dbt.yaml"),
+      "profile: {}\n",
+    );
+  });
+
+  afterEach(() => {
+    process.chdir(cwd);
+    fs.rmSync(dir, { recursive: true, force: true });
+  });
+
+  const tracked = async (p: string) =>
+    (await buildTracker([{ name: "edited", path: p, before: "", after: "" }]))
+      .scripts;
+
+  test("a model edit selects the descriptor", async () => {
+    expect(
+      await tracked("f/analytics/analytics__dbt/models/stg_orders.sql"),
+    ).toEqual(["f/analytics/analytics__dbt/wm_dbt.yaml"]);
+  });
+
+  test("so do the files that are not script extensions", async () => {
+    for (const p of [
+      "f/analytics/analytics__dbt/dbt_project.yml",
+      "f/analytics/analytics__dbt/packages.yml",
+      "f/analytics/analytics__dbt/models/_models.yml",
+      "f/analytics/analytics__dbt/seeds/country_codes.csv",
+    ]) {
+      expect(await tracked(p)).toEqual(
+        ["f/analytics/analytics__dbt/wm_dbt.yaml"],
+        `${p} left the descriptor untracked`,
+      );
+    }
+  });
+
+  // Regression: hoisting the module check above the extension gate made
+  // `<base>__mod/script.yaml` — a folder-layout script's METADATA, which is an
+  // entry-point path — look like its own content file. Pushed as one, the
+  // metadata pass asks for the language of `.yaml` and aborts the command. Not a
+  // dbt shape at all; reached by editing the summary of any modular script.
+  test("a modular script's own metadata resolves to its content file", async () => {
+    fs.mkdirSync(path.join(dir, "f/helpers/util__mod"), { recursive: true });
+    fs.writeFileSync(path.join(dir, "f/helpers/util__mod/script.yaml"), "{}");
+    fs.writeFileSync(
+      path.join(dir, "f/helpers/util__mod/script.ts"),
+      "export function main() {}\n",
+    );
+    expect(await tracked("f/helpers/util__mod/script.yaml")).toEqual([
+      "f/helpers/util__mod/script.ts",
+    ]);
+  });
+
+  test("and a Windows-separated path", async () => {
+    expect(
+      await tracked("f\\analytics\\analytics__dbt\\models\\stg_orders.sql"),
+    ).toEqual(["f/analytics/analytics__dbt/wm_dbt.yaml"]);
+  });
+
+  // A dbt descriptor is the script's CONTENT and is a `.yaml` inside the
+  // project folder. `--json` drops every metadata `.yaml` as the twin it does
+  // not read — dropping this one too leaves a workspace whose dbt scripts have
+  // metadata, a lock and a project bundle, but nothing to run.
+  test("--json keeps the descriptor while dropping metadata yaml", async () => {
+    const file = (path: string) => ({
+      path,
+      isDirectory: false,
+      getChildren: async function* () {},
+      getContentText: async () => "x",
+    });
+    const root = {
+      path: "",
+      isDirectory: true,
+      getChildren: async function* () {
+        yield file("f/analytics/analytics__dbt/wm_dbt.yaml");
+        yield file("f/analytics/analytics.script.yaml");
+        yield file("f/analytics/analytics.script.json");
+      },
+      getContentText: async () => "",
+    };
+    const map = await elementsToMap(root as any, () => false, true, {});
+    expect(Object.keys(map).sort()).toEqual([
+      "f/analytics/analytics.script.json",
+      "f/analytics/analytics__dbt/wm_dbt.yaml",
+    ]);
+  });
+
+  // `cp -r my-dbt-project/.` copies whatever the checkout holds, and what a
+  // `.gitignore` was keeping out of the repo is exactly the file that must not
+  // become a script version. Both halves: bundled, it is uploaded; offered by
+  // the diff, every push asks to upload it again.
+  test("a local .env is neither bundled nor offered as a change", async () => {
+    const project = path.join(dir, "f/analytics/analytics__dbt");
+    fs.writeFileSync(path.join(project, ".env"), "DBT_PASSWORD=hunter2\n");
+    fs.writeFileSync(path.join(project, "models/stg.sql"), "select 1");
+
+    const modules = await readModulesFromDisk(project, undefined, false, true);
+    // Sorted: the bundle is a set of paths, and the walk follows `readdirSync`,
+    // whose order is the filesystem's.
+    expect(Object.keys(modules ?? {}).sort()).toEqual([
+      "dbt_project.yml",
+      "models/stg.sql",
+    ]);
+
+    // The predicate the sync's ignore filter asks, so the file is not offered
+    // as an item of its own either.
+    expect(isDbtGeneratedPath("f/analytics/analytics__dbt/.env")).toBe(true);
+    expect(isDbtGeneratedPath("f/analytics/analytics__dbt/models/stg.sql")).toBe(false);
+  });
+});
diff --git a/cli/test/dbt_optional_descriptor_unit.test.ts b/cli/test/dbt_optional_descriptor_unit.test.ts
new file mode 100644
index 0000000000..f44bdc6103
--- /dev/null
+++ b/cli/test/dbt_optional_descriptor_unit.test.ts
@@ -0,0 +1,323 @@
+/**
+ * An unmodified dbt project is already a complete Windmill script: the
+ * descriptor is optional, and a project that never names one must push, diff
+ * and pull without ever growing a Windmill file inside it.
+ */
+import { expect, test, describe, beforeEach, afterEach } from "bun:test";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import * as os from "node:os";
+import { FSFSElement, elementsToMap } from "../src/commands/sync/sync.ts";
+import { listWorkspacePaths } from "../src/commands/dev/dev.ts";
+import {
+  DbtPathCollisionError,
+  findContentFile,
+  handleFile,
+  hasScriptExt,
+  removeExtensionToPath,
+} from "../src/commands/script/script.ts";
+import { pushParentScriptForModule } from "../src/commands/sync/sync.ts";
+
+/** The local map's keys are the walk's own — `path.join`, so `__dbt\\` on
+ *  Windows — while a remote's are the API's. The synthesized descriptor follows
+ *  the spelling of the `dbt_project.yml` it was derived from, like every other
+ *  key in that map, so an assertion on one platform's separator tests the
+ *  platform and not the synthesis. */
+const normalized = (m: Record<string, string>) =>
+  Object.fromEntries(
+    Object.entries(m).map(([k, v]) => [k.replaceAll("\\", "/"), v]),
+  );
+
+describe("a dbt project without a descriptor", () => {
+  let dir: string;
+
+  beforeEach(() => {
+    dir = fs.mkdtempSync(path.join(os.tmpdir(), "wmill-dbt-nodesc-"));
+    fs.mkdirSync(path.join(dir, "f/analytics/analytics__dbt/models"), {
+      recursive: true,
+    });
+    fs.writeFileSync(
+      path.join(dir, "f/analytics/analytics__dbt/dbt_project.yml"),
+      "name: analytics\n",
+    );
+    fs.writeFileSync(
+      path.join(dir, "f/analytics/analytics__dbt/models/stg_orders.sql"),
+      "select 1",
+    );
+    fs.writeFileSync(path.join(dir, "f/analytics/analytics.script.yaml"), "{}");
+  });
+
+  afterEach(() => {
+    fs.rmSync(dir, { recursive: true, force: true });
+  });
+
+  // Without this the project has no content file, so nothing identifies it as a
+  // script and the whole project silently never deploys.
+  test("is still discovered, as an empty descriptor", async () => {
+    const root = await FSFSElement(dir, [], true);
+    const map = await elementsToMap(root, () => false, false, {});
+    expect(normalized(map)["f/analytics/analytics__dbt/wm_dbt.yaml"]).toBe("");
+  });
+
+  // The metadata has to resolve to a content path that is not on disk, or every
+  // caller that goes metadata -> content aborts the push.
+  test("resolves from its metadata to the absent descriptor", async () => {
+    const cwd = process.cwd();
+    process.chdir(dir);
+    try {
+      expect(await findContentFile("f/analytics/analytics.script.yaml")).toBe(
+        "f/analytics/analytics__dbt/wm_dbt.yaml",
+      );
+    } finally {
+      process.chdir(cwd);
+    }
+  });
+
+  // The descriptor is the one "extension" that contains a separator, so on
+  // Windows it is spelled `__dbt\wm_dbt.yaml` and a forward-slash suffix test
+  // matches nothing — every dbt project skipped, with no error.
+  test("is recognized when the path is spelled with backslashes", () => {
+    const win = "f\\analytics\\analytics__dbt\\wm_dbt.yaml";
+    expect(hasScriptExt(win)).toBe(true);
+    expect(removeExtensionToPath(win)).toBe("f\\analytics\\analytics");
+  });
+
+  // Both `<base>.py` and `<base>__dbt/` deploy to the SAME remote path, and the
+  // descriptor is optional — so the project is invisible to the candidate list
+  // while being perfectly real. Resolved to the ordinary file, a model edit
+  // deploys the Python script over the dbt one.
+  test("refuses to resolve when an ordinary script shares its path", async () => {
+    const cwd = process.cwd();
+    process.chdir(dir);
+    try {
+      fs.writeFileSync(path.join(dir, "f/analytics/analytics.py"), "def main(): ...");
+      const err = await findContentFile("f/analytics/analytics.script.yaml").then(
+        () => undefined,
+        (e) => e as Error,
+      );
+      expect(err?.message).toContain("f/analytics/analytics__dbt/dbt_project.yml");
+      expect(err?.message).toContain("f/analytics/analytics.py");
+    } finally {
+      process.chdir(cwd);
+    }
+  });
+
+  // The guard has to sit on the push paths themselves, not only on the
+  // metadata->content resolution: an ordinary file goes straight to
+  // `handleFile`, and a module edit reaches its parent through a call whose
+  // errors were swallowed — so each path could still overwrite the other's
+  // script while reporting success.
+  test("both push paths refuse the collision", async () => {
+    const cwd = process.cwd();
+    process.chdir(dir);
+    try {
+      fs.writeFileSync(path.join(dir, "f/analytics/analytics.py"), "def main(): ...");
+      const ordinary = await handleFile(
+        "f/analytics/analytics.py",
+        { workspaceId: "w", remote: "http://localhost", name: "w", token: "t" } as any,
+        [],
+        undefined,
+        undefined,
+        {},
+        [],
+      ).then(
+        () => undefined,
+        (e) => e as Error,
+      );
+      expect(ordinary).toBeInstanceOf(DbtPathCollisionError);
+      expect(ordinary?.message).toContain("f/analytics/analytics.py");
+
+      const model = await pushParentScriptForModule(
+        "f/analytics/analytics__dbt/models/stg_orders.sql",
+        { workspaceId: "w", remote: "http://localhost", name: "w", token: "t" } as any,
+        [],
+        undefined,
+        undefined,
+        {},
+        [],
+      ).then(
+        () => undefined,
+        (e) => e as Error,
+      );
+      expect(model).toBeInstanceOf(DbtPathCollisionError);
+    } finally {
+      process.chdir(cwd);
+    }
+  });
+
+  // The guard above must not fire on the project's OWN descriptor: that file is
+  // the dbt script's content, and its base resolves to the same
+  // `<base>__dbt/dbt_project.yml` — so a naive check finds the project
+  // colliding with itself and every dbt push fails before deploying anything.
+  test("a project does not collide with itself", async () => {
+    const cwd = process.cwd();
+    process.chdir(dir);
+    const remote = { workspaceId: "w", remote: "http://127.0.0.1:1", name: "w", token: "t" };
+    const push = (p: string) =>
+      handleFile(p, remote as any, [], undefined, undefined, {}, []).then(
+        () => undefined,
+        (e) => e as Error,
+      );
+    try {
+      // Descriptor-less: the fixture's project, pushed through the module path.
+      const nodesc = await pushParentScriptForModule(
+        "f/analytics/analytics__dbt/models/stg_orders.sql",
+        remote as any,
+        [],
+        undefined,
+        undefined,
+        {},
+        [],
+      ).then(
+        () => undefined,
+        (e) => e as Error,
+      );
+      expect(nodesc).not.toBeInstanceOf(DbtPathCollisionError);
+
+      // Descriptor present, pushed directly. Both reach the network — which is
+      // unreachable here on purpose — so anything BUT the collision is a pass.
+      fs.writeFileSync(
+        path.join(dir, "f/analytics/analytics__dbt/wm_dbt.yaml"),
+        "profile: {}\n",
+      );
+      expect(await push("f/analytics/analytics__dbt/wm_dbt.yaml")).not.toBeInstanceOf(
+        DbtPathCollisionError,
+      );
+    } finally {
+      process.chdir(cwd);
+    }
+  });
+
+  // The exemption above is only for the project's OWN marker. A descriptor
+  // pushed DIRECTLY never passes through the metadata resolution that catches
+  // the collision, so without this it would deploy over the ordinary script
+  // sitting at the same remote path.
+  test("but a descriptor still refuses an ordinary script at its path", async () => {
+    const cwd = process.cwd();
+    process.chdir(dir);
+    try {
+      fs.writeFileSync(
+        path.join(dir, "f/analytics/analytics__dbt/wm_dbt.yaml"),
+        "profile: {}\n",
+      );
+      fs.writeFileSync(path.join(dir, "f/analytics/analytics.py"), "def main(): ...");
+      const err = await handleFile(
+        "f/analytics/analytics__dbt/wm_dbt.yaml",
+        { workspaceId: "w", remote: "http://127.0.0.1:1", name: "w", token: "t" } as any,
+        [],
+        undefined,
+        undefined,
+        {},
+        [],
+      ).then(
+        () => undefined,
+        (e) => e as Error,
+      );
+      expect(err).toBeInstanceOf(DbtPathCollisionError);
+      expect(err?.message).toContain("f/analytics/analytics.py");
+    } finally {
+      process.chdir(cwd);
+    }
+  });
+
+  // Both layouts deploy to the same remote path, and the folder layout is the
+  // one whose base is NOT its filename: `<base>__mod/script.ts` deploys to
+  // `<base>`, exactly where the dbt project goes.
+  test("the collision holds for a folder-layout script too", async () => {
+    const cwd = process.cwd();
+    process.chdir(dir);
+    const remote = { workspaceId: "w", remote: "http://127.0.0.1:1", name: "w", token: "t" };
+    const push = (p: string) =>
+      handleFile(p, remote as any, [], undefined, undefined, {}, []).then(
+        () => undefined,
+        (e) => e as Error,
+      );
+    try {
+      fs.mkdirSync(path.join(dir, "f/analytics/analytics__mod"), { recursive: true });
+      fs.writeFileSync(
+        path.join(dir, "f/analytics/analytics__mod/script.ts"),
+        "export async function main() {}",
+      );
+      fs.writeFileSync(
+        path.join(dir, "f/analytics/analytics__dbt/wm_dbt.yaml"),
+        "profile: {}\n",
+      );
+
+      // From the dbt side: the descriptor must find the `__mod` entry point.
+      const fromDbt = await push("f/analytics/analytics__dbt/wm_dbt.yaml");
+      expect(fromDbt).toBeInstanceOf(DbtPathCollisionError);
+      expect(fromDbt?.message).toContain("analytics__mod/script.ts");
+
+      // And from the ordinary side, whose base is not its filename.
+      const fromMod = await push("f/analytics/analytics__mod/script.ts");
+      expect(fromMod).toBeInstanceOf(DbtPathCollisionError);
+      expect(fromMod?.message).toContain("analytics__dbt/dbt_project.yml");
+    } finally {
+      process.chdir(cwd);
+    }
+  });
+
+  // The two sides spell "absent" differently — nothing on disk, nothing in the
+  // export — so without one normalization a descriptor-less project reads as an
+  // addition on every push and a deletion on every pull, forever.
+  test("compares equal to a remote that carries no descriptor either", async () => {
+    const remote = {
+      path: "",
+      isDirectory: true,
+      getChildren: async function* () {
+        for (const p of [
+          "f/analytics/analytics__dbt/dbt_project.yml",
+          "f/analytics/analytics__dbt/models/stg_orders.sql",
+          "f/analytics/analytics.script.yaml",
+        ]) {
+          yield {
+            path: p,
+            isDirectory: false,
+            getChildren: async function* () {},
+            getContentText: async () => "x",
+          };
+        }
+      },
+      getContentText: async () => "",
+    };
+    const local = await elementsToMap(
+      await FSFSElement(dir, [], true),
+      () => false,
+      false,
+      {},
+    );
+    const remoteMap = await elementsToMap(remote as any, () => false, false, {});
+    const key = "f/analytics/analytics__dbt/wm_dbt.yaml";
+    expect(normalized(local)[key]).toBe("");
+    expect(normalized(remoteMap)[key]).toBe("");
+  });
+});
+
+// `wmill dev` walks basenames, and a dbt script is a DIRECTORY whose descriptor
+// may not exist — so it is recognized by the project folder or not at all. The
+// walk must also stop there: the project's own `.sql` models match the script
+// extensions and would each be listed as a script of their own.
+describe("dev-mode discovery of a dbt project", () => {
+	let dir: string
+	let cwd: string
+
+	beforeEach(() => {
+		dir = fs.mkdtempSync(path.join(os.tmpdir(), 'wmill-dbt-dev-'))
+		fs.mkdirSync(path.join(dir, 'f/analytics/analytics__dbt/models'), { recursive: true })
+		fs.writeFileSync(path.join(dir, 'f/analytics/analytics__dbt/dbt_project.yml'), 'name: a\n')
+		fs.writeFileSync(path.join(dir, 'f/analytics/analytics__dbt/models/stg.sql'), 'select 1')
+		cwd = process.cwd()
+		process.chdir(dir)
+	})
+
+	afterEach(() => {
+		process.chdir(cwd)
+		fs.rmSync(dir, { recursive: true, force: true })
+	})
+
+	test('lists the project itself and nothing inside it', async () => {
+		const items = await listWorkspacePaths()
+		const paths = items.map((i) => i.path).sort()
+		expect(paths).toEqual(['f/analytics/analytics'])
+	})
+})
diff --git a/cli/test/deploy_on_behalf_of_unit.test.ts b/cli/test/deploy_on_behalf_of_unit.test.ts
new file mode 100644
index 0000000000..2214c0dc37
--- /dev/null
+++ b/cli/test/deploy_on_behalf_of_unit.test.ts
@@ -0,0 +1,83 @@
+import { expect, test } from "bun:test";
+import { deployItem } from "../windmill-utils-internal/src/deploy.ts";
+
+// `deployItem` spreads the source item into the request body, and a script's/flow's
+// on_behalf_of names a username that only exists in the source
+// workspace. Sending it to the target pairs one workspace's principal with the other's
+// email, which the backend rejects. Deleting the spread is an easy regression, so pin
+// that the key never reaches the wire.
+function recordingProvider(captured: [string, any][], flowExists: boolean) {
+  const source = {
+    on_behalf_of_email: "alice@corp",
+    on_behalf_of: "u/alice",
+  };
+  return {
+    existsFlowByPath: async () => flowExists,
+    existsScriptByPath: async () => true,
+    getFlowByPath: async () => ({
+      path: "f/x/f",
+      summary: "",
+      value: { modules: [] },
+      ...source,
+    }),
+    createFlow: async (p: any) => void captured.push(["createFlow", p.requestBody]),
+    updateFlow: async (p: any) => void captured.push(["updateFlow", p.requestBody]),
+    getScriptByPath: async () => ({
+      path: "f/x/s",
+      summary: "",
+      content: "x",
+      language: "bun",
+      hash: "abc",
+      ...source,
+    }),
+    createScript: async (p: any) =>
+      void captured.push(["createScript", p.requestBody]),
+  } as any;
+}
+
+test("deployItem: never sends the source workspace's on_behalf_of", async () => {
+  const captured: [string, any][] = [];
+
+  // The clear is written out once per branch, so exercise all three: a flow that
+  // does not exist in the target (create), one that does (update — the branch
+  // `wmill workspace merge` takes for anything already deployed), and a script.
+  await deployItem(
+    recordingProvider(captured, false),
+    "flow" as any,
+    "f/x/f",
+    "src",
+    "dst",
+    "alice@corp",
+  );
+  await deployItem(
+    recordingProvider(captured, true),
+    "flow" as any,
+    "f/x/f",
+    "src",
+    "dst",
+    "alice@corp",
+  );
+  await deployItem(
+    recordingProvider(captured, false),
+    "script" as any,
+    "f/x/s",
+    "src",
+    "dst",
+    "alice@corp",
+  );
+
+  expect(captured.map(([fn]) => fn)).toEqual([
+    "createFlow",
+    "updateFlow",
+    "createScript",
+  ]);
+  for (const [, body] of captured) {
+    // The email is still overridden with the caller's choice...
+    expect(body.on_behalf_of_email).toBe("alice@corp");
+    expect(body.preserve_on_behalf_of).toBe(true);
+    // ...while the principal is dropped, so the backend derives the target's own.
+    expect(
+      "on_behalf_of" in JSON.parse(JSON.stringify(body)),
+    ).toBe(false);
+  }
+});
diff --git a/cli/test/dev_recorder_bundle_unit.test.ts b/cli/test/dev_recorder_bundle_unit.test.ts
new file mode 100644
index 0000000000..2c7a35f696
--- /dev/null
+++ b/cli/test/dev_recorder_bundle_unit.test.ts
@@ -0,0 +1,42 @@
+/**
+ * The recorder `wmill app dev --recording` serves is generated from the
+ * frontend's raw-app recorder, not written here, so it can silently ship a stale
+ * event model after that recorder changes. The committed bundle records the
+ * sources it was built from and their hash; this fails when they no longer
+ * agree.
+ *
+ * Fix a failure with `bun run gen:dev-recorder` from cli/.
+ */
+
+import { describe, expect, test } from "bun:test";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { hashRecorderSources } from "../generate-dev-recorder.ts";
+import {
+  DEV_RECORDER_BUNDLE,
+  DEV_RECORDER_SOURCE_HASH,
+  DEV_RECORDER_SOURCES,
+} from "../src/commands/app/devRecorderBundle.gen.ts";
+
+const REPO_ROOT = path.join(import.meta.dir, "..", "..");
+
+describe("dev recorder bundle", () => {
+  test("exposes the recorder factory as a global", () => {
+    expect(DEV_RECORDER_BUNDLE).toContain("__wmillRecorder");
+    expect(DEV_RECORDER_BUNDLE).toContain("createRawAppRecording");
+    // Runes are stripped at generation; one left in would throw at load time.
+    expect(DEV_RECORDER_BUNDLE).not.toContain("$state");
+  });
+
+  test("is up to date with the frontend recorder", () => {
+    expect(DEV_RECORDER_SOURCES.length).toBeGreaterThan(0);
+    const present = DEV_RECORDER_SOURCES.every((f) =>
+      fs.existsSync(path.join(REPO_ROOT, f))
+    );
+    // The published CLI package ships without the frontend sources.
+    if (!present) return;
+    expect(hashRecorderSources(DEV_RECORDER_SOURCES, REPO_ROOT)).toBe(
+      DEV_RECORDER_SOURCE_HASH,
+    );
+  });
+});
diff --git a/cli/test/dev_recorder_routes_unit.test.ts b/cli/test/dev_recorder_routes_unit.test.ts
new file mode 100644
index 0000000000..29ad71c983
--- /dev/null
+++ b/cli/test/dev_recorder_routes_unit.test.ts
@@ -0,0 +1,43 @@
+/**
+ * Guards on the routes `wmill app dev --recording` adds: what may write a
+ * recording, what a recording may be named, and that two saves never collide.
+ */
+
+import { expect, test } from "bun:test";
+import {
+  isOwnOrigin,
+  isRecordingFileName,
+  recordingFileName,
+} from "../src/commands/app/devRecorder.ts";
+
+test("only the shell's own origin may save a recording", () => {
+  expect(isOwnOrigin("http://localhost:4000", "localhost:4000")).toBe(true);
+  expect(isOwnOrigin("http://127.0.0.1:4000", "127.0.0.1:4000")).toBe(true);
+  // A cross-site POST carrying JSON under a simple content type needs no
+  // preflight, so a foreign origin sharing the port must still be refused.
+  expect(isOwnOrigin("http://attacker.example:4000", "localhost:4000")).toBe(
+    false,
+  );
+  expect(isOwnOrigin("null", "localhost:4000")).toBe(false);
+  // No Origin at all is a non-browser client, not a cross-site page.
+  expect(isOwnOrigin(undefined, "localhost:4000")).toBe(true);
+});
+
+test("recording names stay inside the recordings folder", () => {
+  expect(isRecordingFileName("recording-2026-01-01-00-00-00-000.json")).toBe(
+    true,
+  );
+  expect(isRecordingFileName("../../../etc/passwd")).toBe(false);
+  expect(isRecordingFileName("..%2Fx.json")).toBe(false);
+  expect(isRecordingFileName("sub/dir.json")).toBe(false);
+  expect(isRecordingFileName("recording.txt")).toBe(false);
+});
+
+test("two saves in the same millisecond get distinct names", () => {
+  const now = new Date("2026-01-01T00:00:00.123Z");
+  const first = recordingFileName(now, 0);
+  const second = recordingFileName(now, 1);
+  expect(first).toBe("recording-2026-01-01-00-00-00-123.json");
+  expect(second).not.toBe(first);
+  expect(isRecordingFileName(second)).toBe(true);
+});
diff --git a/cli/test/elements_to_map_branch_specific_unit.test.ts b/cli/test/elements_to_map_branch_specific_unit.test.ts
index b9abaa8dd1..ebab7ef929 100644
--- a/cli/test/elements_to_map_branch_specific_unit.test.ts
+++ b/cli/test/elements_to_map_branch_specific_unit.test.ts
@@ -423,3 +423,45 @@ test("elementsToMap: isRemote undefined behaves like local (backward compatible)
   // Base file should be skipped (same behavior as isRemote=false)
   expect(Object.keys(result).includes("f/test.variable.yaml")).toEqual(false);
 });
+
+// =============================================================================
+// REGRESSION TEST: --skip-scripts covers a script's module files
+// A module is deployed as part of its parent script, and the module shortcut
+// runs before every skip filter — so a changed model under a dbt project's
+// `__dbt/` folder pushed the script `--skip-scripts` asked to leave alone.
+// =============================================================================
+
+test("elementsToMap: script modules are excluded when skipScripts is set", async () => {
+  const files: MockFile[] = [
+    { path: "f/analytics/analytics.dbt.yaml", content: "profile: {}\n" },
+    {
+      path: "f/analytics/analytics__dbt/models/stg_orders.sql",
+      content: "select 1",
+    },
+    { path: "f/Shared/Variable/TestVar.variable.yaml", content: "value: test" },
+  ];
+
+  const kept = await elementsToMap(
+    createMockDynFSElement(files),
+    noIgnore,
+    false,
+    defaultSkips,
+  );
+  expect(
+    Object.keys(kept).includes("f/analytics/analytics__dbt/models/stg_orders.sql"),
+  ).toEqual(true);
+
+  const skipped = await elementsToMap(
+    createMockDynFSElement(files),
+    noIgnore,
+    false,
+    { skipScripts: true },
+  );
+  expect(
+    Object.keys(skipped).includes("f/analytics/analytics__dbt/models/stg_orders.sql"),
+  ).toEqual(false);
+  // Everything else is unaffected.
+  expect(
+    Object.keys(skipped).includes("f/Shared/Variable/TestVar.variable.yaml"),
+  ).toEqual(true);
+});
diff --git a/cli/test/git_unit.test.ts b/cli/test/git_unit.test.ts
index 9665b8581a..92d44e09d9 100644
--- a/cli/test/git_unit.test.ts
+++ b/cli/test/git_unit.test.ts
@@ -182,6 +182,30 @@ describe("computeGitSyncDeployBranch", () => {
     ).toBe("wm_deploy/prod/f__team_a");
   });
 
+  test("datatable migration branches off its repo-relative migrations/ path", () => {
+    const items = [
+      {
+        path_type: "datatable_migration",
+        path: "migrations/datatable/mydb/20260101000000_add_users",
+      },
+    ];
+    expect(
+      computeGitSyncDeployBranch({ ...base, useIndividualBranch: true, items })
+    ).toBe(
+      "wm_deploy/prod/datatable_migration/migrations__datatable__mydb__20260101000000_add_users"
+    );
+    // group_by_folder collapses every data table's migrations onto one branch —
+    // the backend's debounce key takes the same two segments.
+    expect(
+      computeGitSyncDeployBranch({
+        ...base,
+        useIndividualBranch: true,
+        groupByFolder: true,
+        items,
+      })
+    ).toBe("wm_deploy/prod/migrations__datatable");
+  });
+
   test("falls back to parent_path when path is absent", () => {
     expect(
       computeGitSyncDeployBranch({
@@ -357,6 +381,17 @@ describe("gitSyncIncludePattern", () => {
       "f/t.amqp_trigger.*"
     );
   });
+  test("datatable migration expands to its two repo-relative .sql files", () => {
+    expect(
+      gitSyncIncludePattern(
+        "datatable_migration",
+        "migrations/datatable/mydb/20260101000000_add_users"
+      )
+    ).toBe(
+      "migrations/datatable/mydb/20260101000000_add_users.up.sql," +
+        "migrations/datatable/mydb/20260101000000_add_users.down.sql"
+    );
+  });
 });
 
 describe("deriveGitSyncDeployIncludes", () => {
diff --git a/cli/test/gitsync_converter_unit.test.ts b/cli/test/gitsync_converter_unit.test.ts
index e84c2ffa11..628b6dd161 100644
--- a/cli/test/gitsync_converter_unit.test.ts
+++ b/cli/test/gitsync_converter_unit.test.ts
@@ -21,6 +21,24 @@ describe("GitSyncSettingsConverter.fromBackendFormat", () => {
     expect(result.skipWorkspaceDependencies).toBe(false);
   });
 
+  test("converts datatablemigration in include_type to skipDatatableMigrations: false", () => {
+    const backend = {
+      include_path: ["f/**"],
+      include_type: ["script", "flow", "datatablemigration"],
+    };
+    const result = GitSyncSettingsConverter.fromBackendFormat(backend);
+    expect(result.skipDatatableMigrations).toBe(false);
+  });
+
+  test("sets skipDatatableMigrations: true when datatablemigration is absent", () => {
+    const backend = {
+      include_path: ["f/**"],
+      include_type: ["script", "flow"],
+    };
+    const result = GitSyncSettingsConverter.fromBackendFormat(backend);
+    expect(result.skipDatatableMigrations).toBe(true);
+  });
+
   test("sets skipWorkspaceDependencies: true when workspacedependencies is absent", () => {
     const backend = {
       include_path: ["f/**"],
@@ -71,6 +89,21 @@ describe("GitSyncSettingsConverter.fromBackendFormat", () => {
 // =============================================================================
 
 describe("GitSyncSettingsConverter.toBackendFormat", () => {
+  test("adds datatablemigration when skipDatatableMigrations is false", () => {
+    expect(
+      GitSyncSettingsConverter.toBackendFormat({
+        includes: ["f/**"],
+        skipDatatableMigrations: false,
+      }).include_type,
+    ).toContain("datatablemigration");
+    expect(
+      GitSyncSettingsConverter.toBackendFormat({
+        includes: ["f/**"],
+        skipDatatableMigrations: true,
+      }).include_type,
+    ).not.toContain("datatablemigration");
+  });
+
   test("adds workspacedependencies when skipWorkspaceDependencies is false", () => {
     const opts = {
       includes: ["f/**"],
diff --git a/cli/test/pipeline_local_graph_unit.test.ts b/cli/test/pipeline_local_graph_unit.test.ts
index 7b8b8b0dc5..29d016857c 100644
--- a/cli/test/pipeline_local_graph_unit.test.ts
+++ b/cli/test/pipeline_local_graph_unit.test.ts
@@ -5,6 +5,7 @@ import { join } from "node:path";
 
 import {
   buildLocalPipelineGraph,
+  hideDbtRunnables,
   parseMuteAnnotations,
 } from "../src/commands/pipeline/localGraph.ts";
 
@@ -915,3 +916,96 @@ test("pipeline docs renders a `Macro libraries` section (call + `// use`)", asyn
     },
   );
 });
+
+test("a dbt script is not a pipeline node — a dbt-only folder has no graph", async () => {
+  await withFolder(
+    {
+      "warehouse.dbt.yaml": `engine: dbt-core-1x\nprofile:\n  resource: $res:u/admin/wh\n`,
+    },
+    async (root, folder) => {
+      const { graph, scripts } = await buildLocalPipelineGraph({
+        root,
+        folder,
+        defaultTs: "bun",
+      });
+      // A dbt project is authored and run as itself, never as a pipeline member;
+      // the deploy leaves its `auto_kind` unset, so the local graph must agree.
+      expect(graph.runnables).toEqual([]);
+      expect(scripts).toEqual([]);
+    },
+  );
+});
+
+test("a folder mixing dbt and a pipeline keeps only the pipeline member", async () => {
+  await withFolder(
+    {
+      "warehouse.dbt.yaml": `engine: dbt-core-1x\nprofile:\n  resource: $res:u/admin/wh\n`,
+      "report.bun.ts": `// pipeline\nexport async function main() {}\n`,
+    },
+    async (root, folder) => {
+      const { graph } = await buildLocalPipelineGraph({
+        root,
+        folder,
+        defaultTs: "bun",
+      });
+      expect(graph.runnables.map((r) => r.path)).toEqual(["f/mypipe/report"]);
+    },
+  );
+});
+
+test("hideDbtRunnables drops the dbt node from a deployed graph, keeping its relations", () => {
+  // `/assets/graph` is asset-usage driven, so it returns the dbt script as a
+  // producer. The CLI's deployed views must not render it as a pipeline script.
+  const deployed = {
+    runnables: [
+      { path: "f/x/dbtproj", usage_kind: "script" as const, dbt: { model_count: 2 } },
+      { path: "f/x/report", usage_kind: "script" as const, in_pipeline: true },
+    ],
+    assets: [
+      { kind: "table", path: "u/a/wh/s/stg_orders" },
+      { kind: "table", path: "u/a/wh/s/fct_orders" },
+    ],
+    edges: [
+      { runnable_kind: "script", runnable_path: "f/x/dbtproj", asset_kind: "table", asset_path: "u/a/wh/s/stg_orders", access_type: "w" as const },
+      { runnable_kind: "script", runnable_path: "f/x/dbtproj", asset_kind: "table", asset_path: "u/a/wh/s/fct_orders", access_type: "w" as const },
+      { runnable_kind: "script", runnable_path: "f/x/report", asset_kind: "table", asset_path: "u/a/wh/s/fct_orders", access_type: "r" as const },
+    ],
+    triggers: [
+      { trigger_kind: "asset" as const, asset_kind: "table", asset_path: "u/a/wh/s/fct_orders", runnable_kind: "script", runnable_path: "f/x/report" },
+    ],
+  };
+  const g = hideDbtRunnables(deployed);
+  expect(g.runnables.map((r) => r.path)).toEqual(["f/x/report"]);
+  expect(g.edges.map((e) => e.runnable_path)).toEqual(["f/x/report"]);
+  // The relations stay: they are what the downstream pipeline script reads.
+  expect(g.assets).toHaveLength(2);
+  expect(g.triggers).toHaveLength(1);
+});
+
+test("hideDbtRunnables keeps a flow sharing a path with the dbt script", () => {
+  // Runnable identity in the graph is `(usage_kind, path)`; a script and a flow
+  // may share a path, so only the dbt script may be removed.
+  const g = hideDbtRunnables({
+    runnables: [
+      { path: "f/x/proj", usage_kind: "script", dbt: { model_count: 1 } },
+      { path: "f/x/proj", usage_kind: "flow" },
+    ],
+    edges: [
+      { runnable_kind: "flow", runnable_path: "f/x/proj" },
+      { runnable_kind: "script", runnable_path: "f/x/proj" },
+    ],
+    triggers: [{ runnable_kind: "flow", runnable_path: "f/x/proj" }],
+  });
+  expect(g.runnables.map((r) => r.usage_kind)).toEqual(["flow"]);
+  expect(g.edges.map((e) => e.runnable_kind)).toEqual(["flow"]);
+  expect(g.triggers).toHaveLength(1);
+});
+
+test("hideDbtRunnables is a no-op when the folder has no dbt project", () => {
+  const g = {
+    runnables: [{ path: "f/x/a", usage_kind: "script" }],
+    edges: [],
+    triggers: [],
+  };
+  expect(hideDbtRunnables(g)).toBe(g);
+});
diff --git a/cli/test/preview.test.ts b/cli/test/preview.test.ts
index 4ead0a06c9..ffa900c8f7 100644
--- a/cli/test/preview.test.ts
+++ b/cli/test/preview.test.ts
@@ -185,6 +185,60 @@ test("script preview: regular script (non-codebase)", async () => {
   });
 });
 
+test("script preview: job path is the script's Windmill path for every argument shape", async () => {
+  await withTestBackend(async (backend, tempDir) => {
+    await createWmillConfig(tempDir, { defaultTs: "bun" });
+    await createScript(
+      tempDir,
+      "f/test/job_path_script.ts",
+      `export function main() {
+  return process.env.WM_JOB_PATH;
+}`
+    );
+
+    const invocations: Array<[string, string]> = [
+      ["f/test/job_path_script.ts", tempDir],
+      ["./f/test/job_path_script.ts", tempDir],
+      [`${tempDir}/f/test/job_path_script.ts`, tempDir],
+      ["job_path_script.ts", `${tempDir}/f/test`],
+    ];
+
+    for (const [arg, workingDir] of invocations) {
+      const result = await backend.runCLICommand(
+        ["script", "preview", arg, "--silent"],
+        workingDir
+      );
+
+      expect(result.code).toEqual(0);
+      expect(result.stdout.trim()).toEqual(`"f/test/job_path_script"`);
+    }
+
+    // Folder layout: the job runs under the script's path, not the entry file's.
+    await createScript(
+      tempDir,
+      "f/test/job_path_module__mod/script.ts",
+      `export function main() {
+  return process.env.WM_JOB_PATH;
+}`
+    );
+    const moduleResult = await backend.runCLICommand(
+      ["script", "preview", "f/test/job_path_module__mod/script.ts", "--silent"],
+      tempDir
+    );
+    expect(moduleResult.code).toEqual(0);
+    expect(moduleResult.stdout.trim()).toEqual(`"f/test/job_path_module"`);
+
+    // A file outside the workspace tree has no Windmill path to run under, so
+    // the run is refused rather than pushed with a made-up one.
+    await writeFile(`${tempDir}/stray.ts`, `export function main() {}`, "utf-8");
+    const strayResult = await backend.runCLICommand(
+      ["script", "preview", "stray.ts", "--silent"],
+      tempDir
+    );
+    expect(strayResult.code).toEqual(1);
+  });
+});
+
 test("script preview: codebase script (CJS)", async () => {
   await withTestBackend(async (backend, tempDir) => {
     await createWmillConfig(tempDir, {
@@ -529,6 +583,37 @@ test("flow preview: simple flow", async () => {
   });
 });
 
+test("flow preview: step job path is anchored on the flow's Windmill path", async () => {
+  await withTestBackend(async (backend, tempDir) => {
+    await createWmillConfig(tempDir, { defaultTs: "bun" });
+    await createFlow(tempDir, "f/test/job_path_flow.flow", {
+      summary: "Test flow",
+      scriptContent: `export function main() { return process.env.WM_JOB_PATH; }`,
+    });
+
+    // The last one is `--remote` from a subdirectory: that combination reads
+    // no config of its own, so it is the one shape where nothing but the path
+    // resolution can put the process in the sync root.
+    const invocations: Array<[string[], string]> = [
+      [["f/test/job_path_flow.flow"], tempDir],
+      [["./f/test/job_path_flow.flow"], tempDir],
+      [[`${tempDir}/f/test/job_path_flow.flow`], tempDir],
+      [["job_path_flow.flow"], `${tempDir}/f/test`],
+      [["--remote", "job_path_flow.flow"], `${tempDir}/f/test`],
+    ];
+
+    for (const [args, workingDir] of invocations) {
+      const result = await backend.runCLICommand(
+        ["flow", "preview", ...args, "--silent"],
+        workingDir
+      );
+
+      expect(result.code).toEqual(0);
+      expect(result.stdout.trim()).toEqual(`"f/test/job_path_flow/a"`);
+    }
+  });
+});
+
 test("flow preview: uses local PathScript by default and remote PathScript with --remote", async () => {
   await withTestBackend(async (backend, tempDir) => {
     await createWmillConfig(tempDir, { defaultTs: "bun" });
diff --git a/cli/test/preview_path_unit.test.ts b/cli/test/preview_path_unit.test.ts
new file mode 100644
index 0000000000..4bf9e8632c
--- /dev/null
+++ b/cli/test/preview_path_unit.test.ts
@@ -0,0 +1,112 @@
+/**
+ * A preview job carries no runnable, so the path derived from the file
+ * argument is the whole of its identity — it has to come out the same
+ * whatever shape the argument had, and be refused rather than guessed when
+ * the file has no place in the workspace tree.
+ */
+import { expect, test, describe, beforeEach, afterEach } from "bun:test";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import * as os from "node:os";
+import {
+  assertRemotePath,
+  toSyncRootRelativePath,
+} from "../src/core/context.ts";
+
+describe("toSyncRootRelativePath", () => {
+  let root: string;
+  let previousCwd: string;
+  let temps: string[];
+
+  beforeEach(() => {
+    previousCwd = process.cwd();
+    temps = [];
+    // realpath: macOS' tmpdir is /var -> /private/var, and the assertions
+    // compare against what the process reports as its own directory.
+    root = fs.realpathSync(
+      fs.mkdtempSync(path.join(os.tmpdir(), "wmill_preview_path_")),
+    );
+    temps.push(root);
+    fs.writeFileSync(path.join(root, "wmill.yaml"), "defaultTs: bun\n");
+    fs.mkdirSync(path.join(root, "f", "test"), { recursive: true });
+    fs.writeFileSync(path.join(root, "f", "test", "script.ts"), "");
+    process.chdir(root);
+  });
+
+  afterEach(() => {
+    process.chdir(previousCwd);
+    for (const dir of temps) fs.rmSync(dir, { recursive: true, force: true });
+  });
+
+  const normalized = (p: string) => p.replaceAll("\\", "/");
+
+  /** A dbt project whose descriptor is deliberately not written. */
+  function dbtProject(): string {
+    const project = path.join(root, "f", "test", "proj__dbt");
+    fs.mkdirSync(project, { recursive: true });
+    fs.writeFileSync(path.join(project, "dbt_project.yml"), "name: proj\n");
+    return project;
+  }
+
+  test("every spelling of the same file lands on the same path", () => {
+    const fromRoot = ["f/test/script.ts", "./f/test/script.ts"].map((arg) =>
+      normalized(toSyncRootRelativePath(arg, root)),
+    );
+    const absolute = normalized(
+      toSyncRootRelativePath(path.join(root, "f", "test", "script.ts"), root),
+    );
+    // As typed from the directory the file is in: the config read has already
+    // moved the process to the root by the time the argument is resolved.
+    const fromSubdir = normalized(
+      toSyncRootRelativePath("script.ts", path.join(root, "f", "test")),
+    );
+
+    expect(fromRoot).toEqual(["f/test/script.ts", "f/test/script.ts"]);
+    expect(absolute).toEqual("f/test/script.ts");
+    expect(fromSubdir).toEqual("f/test/script.ts");
+  });
+
+  test("a file that is deliberately absent keeps the directory it was named in", () => {
+    // A dbt project's descriptor is optional; `wmill script preview
+    // wm_dbt.yaml` from inside the project must still resolve to the project.
+    const project = dbtProject();
+
+    expect(normalized(toSyncRootRelativePath("wm_dbt.yaml", project))).toEqual(
+      "f/test/proj__dbt/wm_dbt.yaml",
+    );
+  });
+
+  // Windows only creates symlinks for a privileged process.
+  test.skipIf(process.platform === "win32")(
+    "an absent file reached through a symlinked root still lands in the tree",
+    () => {
+      dbtProject();
+      const aliasDir = fs.mkdtempSync(path.join(os.tmpdir(), "wmill_alias_"));
+      temps.push(aliasDir);
+      const alias = path.join(aliasDir, "link");
+      fs.symlinkSync(root, alias, "dir");
+
+      const arg = path.join(alias, "f", "test", "proj__dbt", "wm_dbt.yaml");
+      expect(normalized(toSyncRootRelativePath(arg, root))).toEqual(
+        "f/test/proj__dbt/wm_dbt.yaml",
+      );
+    },
+  );
+
+  test("a file outside the tree stays outside it", () => {
+    const outside = path.join(root, "..", "elsewhere.ts");
+    expect(toSyncRootRelativePath(outside, root).startsWith("..")).toBe(true);
+  });
+});
+
+describe("assertRemotePath", () => {
+  test("accepts a workspace path and refuses anything else", () => {
+    expect(() => assertRemotePath("f/test/script", "f/test/script.ts")).not.toThrow();
+    expect(() => assertRemotePath("u/admin/script", "script.ts")).not.toThrow();
+    for (const bad of ["", "script", "f/script", "../elsewhere"]) {
+      expect(() => assertRemotePath(bad, "arg.ts")).toThrow(
+        /Cannot derive a Windmill path/,
+      );
+    }
+  });
+});
diff --git a/cli/test/raw_app_recordings_skip_unit.test.ts b/cli/test/raw_app_recordings_skip_unit.test.ts
new file mode 100644
index 0000000000..408671cfe3
--- /dev/null
+++ b/cli/test/raw_app_recordings_skip_unit.test.ts
@@ -0,0 +1,63 @@
+/**
+ * `wmill app dev --recording` writes multi-MB session recordings into
+ * `<app>.raw_app/recordings/`. They are local artifacts: the sync differ must
+ * not offer them as app source (the push itself drops them in
+ * `collectAppFiles`, so a differ that still sees them reports a change that
+ * pushing can never settle).
+ */
+
+import { expect, test } from "bun:test";
+import { sep as SEP } from "node:path";
+import { elementsToMap } from "../src/commands/sync/sync.ts";
+
+type MockFile = { path: string; content: string };
+
+// FSFSElement joins with the platform separator, and the exclusion has to hold
+// on Windows too.
+const p = (...parts: string[]) => parts.join(SEP);
+
+function mockElement(files: MockFile[]) {
+  return {
+    isDirectory: true,
+    path: "",
+    async getContentText() {
+      return "";
+    },
+    async *getChildren() {
+      for (const file of files) {
+        yield {
+          isDirectory: false,
+          path: file.path,
+          async getContentText() {
+            return file.content;
+          },
+          async *getChildren() {},
+        };
+      }
+    },
+  };
+}
+
+test("elementsToMap skips recordings/ at the root of a raw app folder only", async () => {
+  const app = p("f", "demo", "myapp.raw_app");
+  const files: MockFile[] = [
+    { path: p(app, "index.tsx"), content: "export {}" },
+    {
+      path: p(app, "recordings", "recording-2026-01-01-00-00-00.json"),
+      content: '{"version":1}',
+    },
+    // The dev server never writes here, so this is the app's own source.
+    { path: p(app, "src", "recordings", "fixture.json"), content: "{}" },
+  ];
+
+  const result = await elementsToMap(
+    mockElement(files) as any,
+    () => false,
+    false,
+    {},
+  );
+
+  expect(Object.keys(result).sort()).toEqual(
+    [p(app, "index.tsx"), p(app, "src", "recordings", "fixture.json")].sort(),
+  );
+});
diff --git a/cli/test/raw_app_sync.test.ts b/cli/test/raw_app_sync.test.ts
index 3cc7026430..315b274d80 100644
--- a/cli/test/raw_app_sync.test.ts
+++ b/cli/test/raw_app_sync.test.ts
@@ -464,6 +464,74 @@ excludes: []`, "utf-8");
     });
 });
 
+test("Raw App: deleted .lock sorting first does not short-circuit the app push", async () => {
+    // Regression: raw-app changes collapse to one representative change and
+    // deletes sort first, so removing a backend runnable makes its `.lock` the
+    // representative. Skipping a `.lock` there drops the whole app while the
+    // push still reports success.
+    await withTestBackend(async (backend, tempDir) => {
+      const testWorkspace = {
+        remote: backend.baseUrl,
+        workspaceId: backend.workspace,
+        name: "raw_app_lock_first_test",
+        token: backend.token
+      };
+      await addWorkspace(testWorkspace, { force: true, configDir: backend.testConfigDir });
+
+      await writeFile(`${tempDir}/wmill.yaml`, `defaultTs: bun
+includes:
+  - "**"
+excludes: []`, "utf-8");
+
+      const appDir = path.join(tempDir, "f", "test", "lock_first_app.raw_app");
+      await mkdir(path.join(tempDir, "f", "test"), { recursive: true });
+      await createRawAppOnDisk(appDir, true);
+
+      // A backend runnable's lockfile. Among the app's files it sorts first,
+      // so once deleted it becomes changes[0] for the whole group.
+      const queryLockPath = path.join(appDir, "backend", "query.lock");
+      await writeFile(queryLockPath, INLINE_SCRIPT_A_LOCK, "utf-8");
+
+      const pushResult1 = await backend.runCLICommand(
+        ['sync', 'push', '--yes'],
+        tempDir, "raw_app_lock_first_test"
+      );
+      expect(pushResult1.code).toEqual(0);
+      await waitForDeploymentJobs(backend);
+
+      // Remove the backend runnable (lock included) and edit a frontend file.
+      await rm(queryLockPath);
+      await rm(path.join(appDir, "backend", "query.ts"));
+      await rm(path.join(appDir, "backend", "query.yaml"));
+      const appTsxPath = path.join(appDir, "App.tsx");
+      const appTsxContent = await readFileContent(appTsxPath);
+      await writeFile(
+        appTsxPath,
+        appTsxContent.replace("hello world", "REGRESSION MARKER"),
+        "utf-8"
+      );
+
+      const pushResult2 = await backend.runCLICommand(
+        ['sync', 'push', '--yes'],
+        tempDir, "raw_app_lock_first_test"
+      );
+      expect(pushResult2.code).toEqual(0);
+      await waitForDeploymentJobs(backend);
+
+      // The edit must have reached the remote bundle, and the removed runnable
+      // must be gone from it.
+      const appResp = await backend.apiRequest!(
+        `/api/w/${backend.workspace}/apps/get/p/f/test/lock_first_app`
+      );
+      expect(appResp.status).toEqual(200);
+      const appJson = await appResp.json();
+      const files = appJson?.value?.files ?? {};
+      expect(files["/App.tsx"]).toContain("REGRESSION MARKER");
+      // Backend runnables live in value.runnables, not in the bundled files.
+      expect(appJson?.value?.runnables?.query).toBeUndefined();
+    });
+});
+
 test("Raw App: delete file and push", async () => {
     await withTestBackend(async (backend, tempDir) => {
       // Set up workspace
diff --git a/cli/test/raw_app_workspace_deps_unit.test.ts b/cli/test/raw_app_workspace_deps_unit.test.ts
new file mode 100644
index 0000000000..a76064e8b9
--- /dev/null
+++ b/cli/test/raw_app_workspace_deps_unit.test.ts
@@ -0,0 +1,84 @@
+/**
+ * Raw app workspace dependencies
+ *
+ * A raw app keeps its runnables in `backend/`, not in `raw_app.yaml`. The
+ * workspace dependency filtering must resolve those files, otherwise the
+ * default `dependencies/package.json` is dropped and locks are regenerated
+ * against unpinned versions.
+ *
+ * Exercised through the legacy (tree-less) path: tree mode sources its deps
+ * from `getMismatchedWorkspaceDeps()`, which is only populated by an
+ * `uploadScripts` round-trip, so it cannot run offline. Both paths filter the
+ * same `appValue`, so resolving it correctly is what this pins.
+ */
+
+import { expect, test } from "bun:test";
+import * as path from "node:path";
+import os from "node:os";
+import { mkdtemp, mkdir, rm, writeFile } from "node:fs/promises";
+import { generateAppLocksInternal } from "../src/commands/app/app_metadata.ts";
+import { Workspace } from "../src/commands/workspace/workspace.ts";
+
+const stubWorkspace: Workspace = {
+  remote: "http://localhost:0/",
+  workspaceId: "test",
+  name: "test",
+  token: "test",
+};
+
+const APP_FOLDER = path.join("f", "example.raw_app");
+
+async function withTempDir(fn: (tempDir: string) => Promise<void>): Promise<void> {
+  const tempDir = await mkdtemp(path.join(os.tmpdir(), "wmill_raw_app_deps_"));
+  const originalCwd = process.cwd();
+  try {
+    process.chdir(tempDir);
+    await fn(tempDir);
+  } finally {
+    process.chdir(originalCwd);
+    await rm(tempDir, { recursive: true, force: true });
+  }
+}
+
+test("raw app: default workspace deps are picked up from backend runnables", async () => {
+  await withTempDir(async () => {
+    await mkdir(path.join(APP_FOLDER, "backend"), { recursive: true });
+    await writeFile(
+      path.join(APP_FOLDER, "raw_app.yaml"),
+      `summary: "example raw app"\npolicy:\n  execution_mode: publisher\n  triggerables: {}\n`,
+      "utf-8",
+    );
+    await writeFile(
+      path.join(APP_FOLDER, "backend", "test.ts"),
+      `import * as wmill from "windmill-client"\n\nexport async function main() {\n  return wmill.getVariable("example")\n}\n`,
+      "utf-8",
+    );
+
+    await generateAppLocksInternal(
+      APP_FOLDER,
+      true,
+      false,
+      stubWorkspace,
+      { defaultTs: "bun" },
+      true, // justUpdateMetadataLock — no backend round-trip
+      true,
+    );
+
+    expect(
+      await generateAppLocksInternal(APP_FOLDER, true, true, stubWorkspace, { defaultTs: "bun" }, false, true),
+    ).toBeUndefined();
+
+    // The runnable has no `package_json` annotation, so it uses the default
+    // manifest — adding it must invalidate the app.
+    await mkdir("dependencies", { recursive: true });
+    await writeFile(
+      path.join("dependencies", "package.json"),
+      `{"dependencies": {"windmill-client": "1.742.0"}}`,
+      "utf-8",
+    );
+
+    expect(
+      await generateAppLocksInternal(APP_FOLDER, true, true, stubWorkspace, { defaultTs: "bun" }, false, true),
+    ).toEqual("f/example.raw_app");
+  });
+});
diff --git a/cli/test/resource_folders_unit.test.ts b/cli/test/resource_folders_unit.test.ts
index 0d07812124..de3daa18cd 100644
--- a/cli/test/resource_folders_unit.test.ts
+++ b/cli/test/resource_folders_unit.test.ts
@@ -3,7 +3,7 @@
  * Tests both dotted (.flow, .app, .raw_app) and non-dotted (__flow, __app, __raw_app) modes.
  */
 
-import { expect, test, describe, beforeEach } from "bun:test";
+import { expect, test, describe, beforeEach, afterEach } from "bun:test";
 import {
   setNonDottedPaths,
   getNonDottedPaths,
@@ -37,6 +37,13 @@ import {
   transformJsonPathToDir,
   isModuleEntryPoint,
   getScriptBasePathFromModulePath,
+  isDbtGeneratedPath,
+  dbtGeneratedDirs,
+  isUnderGeneratedDir,
+  isDbtModulePath,
+  isBundledModuleFile,
+  moduleFileExclusion,
+  MAX_MODULE_BYTES,
 } from "../src/utils/resource_folders.ts";
 import { removeWorkerPrefix } from "../src/commands/worker-groups/worker-groups.ts";
 
@@ -657,3 +664,194 @@ describe("removeWorkerPrefix", () => {
     expect(removeWorkerPrefix("worker__")).toBe("");
   });
 });
+
+// A dbt project's generated directories never belong to the bundle: hashing and
+// uploading a local `target/` would make every local `dbt run` look like a
+// project change, and a stale manifest in it is what the runtime reads as the
+// graph. They are configurable, so they are read from the project.
+describe("dbtGeneratedDirs", () => {
+  const fs = require("node:fs");
+  const os = require("node:os");
+  const nodePath = require("node:path");
+  let dir: string;
+  // Every temp directory this block makes, so none outlives the run: the helper
+  // below mints one per call by design.
+  let made: string[] = [];
+
+  beforeEach(() => {
+    dir = fs.mkdtempSync(nodePath.join(os.tmpdir(), "dbtgen-"));
+    made = [dir];
+  });
+
+  afterEach(() => {
+    for (const d of made) fs.rmSync(d, { recursive: true, force: true });
+  });
+
+  // A fresh directory per call: `dbtGeneratedDirs` memoizes per project folder,
+  // since within one sync the project file does not change under it.
+  const write = (yml: string) => {
+    const d = fs.mkdtempSync(nodePath.join(os.tmpdir(), "dbtgen-"));
+    made.push(d);
+    fs.writeFileSync(nodePath.join(d, "dbt_project.yml"), yml);
+    return dbtGeneratedDirs(d);
+  };
+
+  test("defaults apply with no project file", () => {
+    const dirs = dbtGeneratedDirs(dir);
+    expect(dirs.has("target")).toBe(true);
+    expect(dirs.has("dbt_packages")).toBe(true);
+  });
+
+  test("reads nested target-path and packages-install-path", () => {
+    const dirs = write(
+      'name: p\ntarget-path: "build/target"\npackages-install-path: ./vendor/pkgs\n',
+    );
+    expect(dirs.has("build/target")).toBe(true);
+    expect(dirs.has("vendor/pkgs")).toBe(true);
+  });
+
+  test("reads clean-targets in both of dbt's spellings", () => {
+    expect(write('name: p\nclean-targets: ["a", b]\n').has("a")).toBe(true);
+    const block = write("name: p\nclean-targets:\n  - out/one\n  - two\nmodels: {}\n");
+    expect(block.has("out/one")).toBe(true);
+    expect(block.has("two")).toBe(true);
+    expect(block.has("models")).toBe(false);
+  });
+
+  test("ignores a configured path that escapes the project", () => {
+    const dirs = write('name: p\ntarget-path: "../../etc"\n');
+    expect([...dirs].some((d) => d.includes(".."))).toBe(false);
+  });
+});
+
+describe("isUnderGeneratedDir", () => {
+  const dirs = new Set(["target", "build/target"]);
+
+  test("matches the directory and everything under it", () => {
+    expect(isUnderGeneratedDir("target", dirs)).toBe(true);
+    expect(isUnderGeneratedDir("target/manifest.json", dirs)).toBe(true);
+    expect(isUnderGeneratedDir("build/target/run_results.json", dirs)).toBe(true);
+  });
+
+  test("does not match a sibling sharing the prefix", () => {
+    expect(isUnderGeneratedDir("targetx/a.sql", dirs)).toBe(false);
+    expect(isUnderGeneratedDir("models/target_helper.sql", dirs)).toBe(false);
+    expect(isUnderGeneratedDir("build/targeted/a.sql", dirs)).toBe(false);
+  });
+});
+
+// A Windows path spells the folder `__dbt\\`. A lookup that searched the raw
+// path for `__dbt/` would find nothing, so a module-only edit would return
+// without deploying its parent while the file was still recorded as synced.
+describe("dbt module paths on either separator", () => {
+  test("isDbtModulePath and getScriptBasePathFromModulePath accept backslashes", () => {
+    expect(isDbtModulePath("f\\x\\proj__dbt\\models\\a.sql")).toBe(true);
+    expect(getScriptBasePathFromModulePath("f\\x\\proj__dbt\\models\\a.sql")).toBe(
+      "f/x/proj",
+    );
+    expect(getScriptBasePathFromModulePath("f/x/proj__dbt/models/a.sql")).toBe(
+      "f/x/proj",
+    );
+  });
+
+  test("a path with no module folder has no base path", () => {
+    expect(getScriptBasePathFromModulePath("f/x/proj.dbt.yaml")).toBeUndefined();
+  });
+});
+
+// The push, the staleness hash and the sync diff all ask this question. They
+// must agree: a file one drops and another keeps is a change no push resolves.
+describe("isBundledModuleFile", () => {
+  const fs = require("node:fs");
+  const os = require("node:os");
+  const nodePath = require("node:path");
+  let dir: string;
+
+  beforeEach(() => {
+    dir = fs.mkdtempSync(nodePath.join(os.tmpdir(), "bundled-"));
+  });
+
+  afterEach(() => {
+    fs.rmSync(dir, { recursive: true, force: true });
+  });
+
+  const write = (name: string, data: Buffer | string) => {
+    const p = nodePath.join(dir, name);
+    fs.writeFileSync(p, data);
+    return p;
+  };
+
+  test("keeps text, including empty and unicode", () => {
+    expect(isBundledModuleFile(write("a.sql", "select 1\n"))).toBe(true);
+    expect(isBundledModuleFile(write("empty.sql", ""))).toBe(true);
+    expect(isBundledModuleFile(write("u.sql", "select 'café'\n"))).toBe(true);
+  });
+
+  test("drops a binary file, which a NUL identifies", () => {
+    expect(isBundledModuleFile(write("x.png", Buffer.from([0x89, 0x50, 0x00, 0x1a])))).toBe(
+      false,
+    );
+  });
+
+  test("drops a file over the per-file limit", () => {
+    expect(isBundledModuleFile(write("huge.csv", "x".repeat(MAX_MODULE_BYTES + 1)))).toBe(
+      false,
+    );
+  });
+
+  // The two reasons a file is not carried are not interchangeable: sync hides
+  // dbt's binary leftovers, but an oversized seed the project authored has to
+  // stay in the diff, or the push that reports the size error never runs and the
+  // remote project is left incomplete without saying so.
+  test("says WHY a file is not carried", () => {
+    expect(moduleFileExclusion(write("a.sql", "select 1\n"))).toBe(undefined);
+    expect(moduleFileExclusion(write("x.png", Buffer.from([0x89, 0x50, 0x00, 0x1a])))).toBe(
+      "binary",
+    );
+    expect(moduleFileExclusion(write("seed.csv", "x".repeat(MAX_MODULE_BYTES + 1)))).toBe(
+      "oversized",
+    );
+  });
+
+  // A pull asks this about files that do not exist locally yet. Answering "not
+  // carried" there made sync ignore the whole incoming project and write
+  // nothing — the bundle silently vanished on every fresh checkout.
+  test("treats a missing file as carried, not as excluded", () => {
+    expect(isBundledModuleFile(nodePath.join(dir, "does-not-exist.sql"))).toBe(true);
+  });
+});
+
+test("a nested __mod inside a dbt project does not steal the script boundary", () => {
+  // dbt owns its directory names verbatim, so a folder ending `__mod` is legal
+  // inside a project. The script is the OUTER module boundary.
+  expect(
+    getScriptBasePathFromModulePath("f/x/proj__dbt/models/legacy__mod/a.sql"),
+  ).toBe("f/x/proj");
+  expect(getScriptBasePathFromModulePath("f/x/proj__dbt/models/a.sql")).toBe(
+    "f/x/proj",
+  );
+  expect(getScriptBasePathFromModulePath("f/x/s__mod/inner.ts")).toBe("f/x/s");
+});
+
+test("a nested __mod inside a dbt project is not a module entry point", () => {
+  expect(isModuleEntryPoint("f/x/s__mod/script.ts")).toBe(true);
+  // `legacy__mod` is a legal dbt directory; its script.ts belongs to the dbt
+  // project, not to a module folder of its own.
+  expect(isModuleEntryPoint("f/x/proj__dbt/models/legacy__mod/script.ts")).toBe(
+    false,
+  );
+  expect(isModuleEntryPoint("f/x/proj__dbt/models/a.sql")).toBe(false);
+});
+
+test("a __dbt directory nested inside an ordinary module is not a dbt project file", () => {
+  expect(isDbtModulePath("f/x/proj__dbt/models/a.sql")).toBe(true);
+  // `vendor/x__dbt/` belongs to the `foo__mod` script, not to a dbt project.
+  expect(isDbtModulePath("f/x/foo__mod/vendor/x__dbt/a.ts")).toBe(false);
+  expect(isDbtModulePath("f/x/foo__mod/helper.ts")).toBe(false);
+});
+
+test("a __dbt/target nested in an ordinary module is not generated dbt output", () => {
+  expect(isDbtGeneratedPath("f/x/proj__dbt/target/manifest.json")).toBe(true);
+  // Belongs to the `foo__mod` script; excluding it would drop a real edit.
+  expect(isDbtGeneratedPath("f/x/foo__mod/vendor/x__dbt/target/a.ts")).toBe(false);
+});
diff --git a/cli/windmill-utils-internal/src/deploy.ts b/cli/windmill-utils-internal/src/deploy.ts
index 42874fda97..047d50ee78 100644
--- a/cli/windmill-utils-internal/src/deploy.ts
+++ b/cli/windmill-utils-internal/src/deploy.ts
@@ -460,6 +460,10 @@ export async function deployItem(
             ...flow,
             preserve_on_behalf_of: preserveOnBehalfOf,
             on_behalf_of_email: onBehalfOf,
+            // Usernames are per-workspace, so the source's principal names nobody in
+            // the target (or names a different person). Clearing it lets the backend
+            // derive the target's own principal from the email above.
+            on_behalf_of: undefined,
           },
         });
       } else {
@@ -469,6 +473,10 @@ export async function deployItem(
             ...flow,
             preserve_on_behalf_of: preserveOnBehalfOf,
             on_behalf_of_email: onBehalfOf,
+            // Usernames are per-workspace, so the source's principal names nobody in
+            // the target (or names a different person). Clearing it lets the backend
+            // derive the target's own principal from the email above.
+            on_behalf_of: undefined,
           },
         });
       }
@@ -493,6 +501,8 @@ export async function deployItem(
           parent_hash: parentHash,
           preserve_on_behalf_of: preserveOnBehalfOf,
           on_behalf_of_email: onBehalfOf,
+          // See the flow branch: a source-workspace principal is never valid here.
+          on_behalf_of: undefined,
         },
       });
     } else if (kind === "app" || kind === "raw_app") {
diff --git a/cli/windmill-utils-internal/src/path-utils/path-assigner.ts b/cli/windmill-utils-internal/src/path-utils/path-assigner.ts
index 94d9085b94..6aaeea4db1 100644
--- a/cli/windmill-utils-internal/src/path-utils/path-assigner.ts
+++ b/cli/windmill-utils-internal/src/path-utils/path-assigner.ts
@@ -36,6 +36,7 @@ export const LANGUAGE_EXTENSIONS: Record<SupportedLanguage, string> = {
   bunnative: "ts",
   ruby: "rb",
   rlang: "r",
+  dbt: "dbt.yaml",
   // for related places search: ADD_NEW_LANG
 };
 
@@ -84,6 +85,7 @@ export const EXTENSION_TO_LANGUAGE: Record<string, SupportedLanguage> = {
   "playbook.yml": "ansible",
   "java": "java",
   "duckdb.sql": "duckdb",
+  "dbt.yaml": "dbt",
   "rb": "ruby",
   // Plain .ts defaults to bun (will be overridden by defaultTs setting)
   "ts": "bun",
diff --git a/debugger/Dockerfile b/debugger/Dockerfile
index 51e993746a..a80643e823 100644
--- a/debugger/Dockerfile
+++ b/debugger/Dockerfile
@@ -46,7 +46,9 @@ WORKDIR /app
 # Copy the debug service files
 COPY dap_debug_service.ts .
 COPY dap_websocket_server_bun.ts .
+COPY env_passthrough.ts .
 COPY dap_websocket_server.py .
+COPY registry_config.ts .
 
 # Expose the default port
 EXPOSE 5679
diff --git a/debugger/README.md b/debugger/README.md
index dbeb213351..1dba49d977 100644
--- a/debugger/README.md
+++ b/debugger/README.md
@@ -75,6 +75,122 @@ Options:
 | `DAP_NSJAIL_PATH` | nsjail binary path | nsjail |
 | `DAP_NSJAIL_CONFIG` | nsjail config file path | - |
 
+### Dependency preparation
+
+Before debugging a script, its imports are installed through `windmill prepare-deps`, which runs
+`uv` (Python) or `bun install` (TypeScript) without a database connection. The install runs in the
+service rather than in the session because the registry configuration usually embeds credentials
+and a debug server executes the submitted script inside a process the script can read; the Python
+server is handed only the resulting venv, with `--venv-path`, and a Bun session only the resulting
+`node_modules`.
+
+`DAP_PREPARE_DEPS_TIMEOUT_MS` bounds the install (default 120000); past it the session starts
+without its dependencies. When the install fails, the CLI answers `success: false` and carries the
+installer's stderr in both `error` and `install_stderr`; the service reports it to the client as an
+`output` event, so the reason (unreachable mirror, untrusted certificate, unknown package) reaches
+the user instead of a bare `ModuleNotFoundError` at the first import.
+
+### Registry configuration
+
+Because `prepare-deps` has no database, the service reads the instance settings for it from
+`GET /api/debug/registry_config` on `WINDMILL_BASE_URL` and passes them down over the CLI's stdin
+request. It is authorized by the launch token of the session being started, and serves only the
+settings that session's own installer runs on, so a TypeScript session's token cannot be used to
+read the Python index credentials.
+
+The token also reaches the browser, so what it can fetch is what a workspace member can fetch.
+Sessions started by an operator are refused outright, since an operator cannot run a preview job
+either; for a member who can, the npm settings are already exposed by a preview (a worker leaves
+the same `.npmrc` / `bunfig.toml` in the directory the previewed script runs in), while the Python
+index URL, which otherwise only appears as uv's argv, becomes readable where it was not before.
+
+These settings are Enterprise-only, exactly as they are for jobs, and a CE instance reports that in
+the session's output rather than applying them:
+
+| Setting | Applies to |
+|---------|------------|
+| `npm_config_registry` | `bun install` registry and its `:_authToken=` |
+| `npmrc` | written verbatim as `.npmrc`, taking precedence over `npm_config_registry` |
+| `bunfig_install_scopes` | `[install.scopes]` in the generated `bunfig.toml` |
+| `pip_index_url` | `uv --index-url` |
+| `pip_extra_index_url` | `uv --extra-index-url`, comma-separated |
+
+`uv_index_strategy` is served on any edition, like it is to a worker. An index URL holding the
+`EPHEMERAL_TOKEN` placeholder is not served at all: only a worker can run the command that
+substitutes it.
+
+The credential-bearing files (`.npmrc`, `bunfig.toml`) are written under
+`/var/tmp/windmill-debug-registry`, not into the directory the install runs in, and are deleted
+when the install ends. That directory is not private to the install: a session resolves its
+`node_modules` symlink back into it, and `nsjail.debug.config.proto` bind-mounts the whole of
+`/tmp` into every session, so credentials left there would be readable by a concurrent session.
+`/var/tmp` is a tmpfs in that same config, one instance per jail, so a session sees an empty one
+and a jailed install's credentials go away with the jail even when it is killed (the service kills
+an install with SIGKILL, which no cleanup in the installer can survive). An install running
+unjailed writes to the host's `/var/tmp` instead, where a directory a kill left behind is removed
+by the next install; a session running unjailed is unconfined anyway and sees the whole filesystem,
+as it already does the rest of the service's state.
+
+The rest of the registry configuration has no instance setting and is read from the environment of
+the debug service. Where two names are listed the first wins; a worker reads the same names:
+
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `PY_TRUSTED_HOST` / `PIP_TRUSTED_HOST` | Hosts to trust, whitespace-separated (`--trusted-host`) | - |
+| `PY_INDEX_CERT` / `PIP_INDEX_CERT` | CA bundle for the index, passed to uv as `SSL_CERT_FILE`. Falls back to `SSL_CERT_FILE`, then `REQUESTS_CA_BUNDLE`, then `CURL_CA_BUNDLE`, so a host that configures its CA under any of those names is picked up. Whichever is used **replaces** uv's own roots rather than adding to them, so it has to be a complete bundle: one holding only a private CA leaves every public index untrusted. `bun install` gets the same bundle as `NODE_EXTRA_CA_CERTS`, the only spelling Bun reads | - |
+| `SSL_CERT_DIR` | Directory of certificates, forwarded to uv as-is. Replaces uv's roots the same way the bundle does, so a directory holding only a private CA leaves public indexes untrusted | - |
+| `PY_NATIVE_CERT` / `UV_NATIVE_TLS` | `true` to also trust the platform certificate store (`--native-tls`) | false |
+| `UV_HTTP_TIMEOUT` | uv HTTP request timeout, in seconds | uv's own default |
+| `DAP_REGISTRY_CONFIG_TIMEOUT_MS` | How long to wait on the settings fetch before installing without it | 10000 |
+
+`PY_INDEX_URL` / `PIP_INDEX_URL` and `PY_EXTRA_INDEX_URL` / `PIP_EXTRA_INDEX_URL`, along with
+`UV_INDEX_STRATEGY`, are still read from the same environment whenever the fetch yields no index:
+because the instance has none set, because this is a CE instance, or because the session was not
+allowed the settings. A Python debug service configured that way therefore keeps working, but setting
+them is an instance-wide decision to install Python dependencies from that index, independent of who
+opened the session; leave them unset to let the instance settings alone decide. The npm settings have
+no such fallback: the instance settings are the only source.
+
+Proxy variables (`HTTP_PROXY` / `HTTPS_PROXY` / `NO_PROXY`, in either case) are forwarded from the
+service into each session, since the debugged script needs them for its own outbound calls, exactly
+as a job's script does on a worker. When a proxy is set without a bypass list, `NO_PROXY` defaults
+to `localhost,127.0.0.1` so calls to `BASE_INTERNAL_URL` are not proxied.
+
+Trust roots are forwarded alongside them: `SSL_CERT_FILE`, `SSL_CERT_DIR`, `REQUESTS_CA_BUNDLE`,
+`CURL_CA_BUNDLE` and `NODE_EXTRA_CA_CERTS`. Behind a TLS-intercepting proxy these are what let the
+debugged script's own HTTPS calls verify, and installing the CA in the container's system store is
+not enough on its own, since `requests` carries its own bundle and Node reads only
+`NODE_EXTRA_CA_CERTS`. Registry settings are deliberately not forwarded: they carry credentials and
+only the service needs them.
+
+Registering that CA in the container's system store happens on its own: mount it into
+`/usr/local/share/ca-certificates/` **named `*.crt`**, the only extension `update-ca-certificates`
+reads, and `windmill_extra` runs it before starting any service. `RUN_UPDATE_CA_CERTIFICATE_AT_START=true` forces the same thing whether or not
+certificates are mounted there, and `RUN_UPDATE_CA_CERTIFICATE_PATH` overrides the tool, matching
+the server and worker. Both are best-effort: a UID that cannot write `/etc/ssl/certs` logs a warning
+and the container still boots. `INIT_SCRIPT` remains the hook for anything more involved, and unlike
+the CA update it aborts startup when it fails.
+
+Note what the system store does *not* cover, which is most of what a debug session installs with:
+uv trusts its own bundled roots unless `PY_NATIVE_CERT`/`UV_NATIVE_TLS` is `true`, Bun and Node read
+only `NODE_EXTRA_CA_CERTS`, and `requests` carries certifi. Registering the CA fixes Python's stdlib
+`ssl`, `curl` and `git`; the rest still needs the variables above.
+
+Keeping the settings out of the session's environment only bounds what the debugged script can read
+from itself. An unsandboxed session runs under the same user as the service and can still read the
+service's environment through `/proc`, the same way a job can read a worker's when the worker runs
+unsandboxed. Isolating sessions from the service takes `--nsjail --nsjail-config
+nsjail.debug.config.proto`: it is that config's PID namespace and `mount_proc` that put the service
+out of reach, not the flag on its own.
+
+The installer is jailed on the same terms, in both languages: `uv pip install` builds source
+distributions and `bun install` runs postinstall scripts, so a package's own code executes there
+too. It keeps the service's environment across that boundary — the config sets `keep_env`, which is
+how the settings above reach it — so replacing that with an allowlist would have to carry the
+registry and CA variables in explicitly. It also runs in its own process group, because `uv` and
+`bun` are grandchildren: signalling only the installer reparents them to init and they keep
+downloading, which would make the timeout and the cancel-on-disconnect half-measures.
+
 ### Frontend Integration
 
 ```svelte
diff --git a/debugger/dap_debug_service.ts b/debugger/dap_debug_service.ts
index 2b9ce46272..11616f7b11 100644
--- a/debugger/dap_debug_service.ts
+++ b/debugger/dap_debug_service.ts
@@ -40,7 +40,14 @@ import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 
 // Import the working Bun debug session from the standalone server
-import { DebugSession as BunDebugSessionWorking, type NsjailConfig } from './dap_websocket_server_bun'
+import {
+	DebugSession as BunDebugSessionWorking,
+	killProcessTree,
+	nsjailWrap,
+	type NsjailConfig
+} from './dap_websocket_server_bun'
+import { sessionEnv } from './env_passthrough'
+import { fetchRegistryConfig, type RegistryConfig } from './registry_config'
 
 // ============================================================================
 // Configuration
@@ -348,39 +355,35 @@ interface SpawnOptions {
 	cmd: string[]
 	cwd?: string
 	env?: Record<string, string>
+	stdin?: Blob
+	/**
+	 * Hand the child this process's whole environment rather than the minimal set below. Only
+	 * the dependency installer wants it: the registry credentials and CA settings it reads are
+	 * precisely what the minimal set exists to keep away from a debugged script.
+	 */
+	inheritEnv?: boolean
+	/**
+	 * Start the child in its own process group, so killProcessTree can signal what it spawns.
+	 */
+	detached?: boolean
 	stdout?: 'pipe' | 'inherit'
 	stderr?: 'pipe' | 'inherit'
 }
 
+/**
+ * How long `windmill prepare-deps` may take before the session gives up on it and starts without
+ * the dependencies. Raise it for slow private mirrors, where a large install can outlast the default.
+ */
+const PREPARE_DEPS_TIMEOUT_MS = Number(process.env.DAP_PREPARE_DEPS_TIMEOUT_MS) || 120_000
+
 /**
  * Spawn a process, optionally wrapped with nsjail.
  * This is the key function for sandboxed execution.
  */
 function spawnProcess(options: SpawnOptions): Subprocess {
-	let cmd = options.cmd
+	const cmd = nsjailWrap(options.cmd, config.nsjail, options.cwd)
 
 	if (config.nsjail.enabled) {
-		// Build nsjail command
-		const nsjailCmd = [config.nsjail.binaryPath]
-
-		// Add config file if specified
-		if (config.nsjail.configPath) {
-			nsjailCmd.push('--config', config.nsjail.configPath)
-		}
-
-		// Add any extra nsjail arguments
-		nsjailCmd.push(...config.nsjail.extraArgs)
-
-		// Add working directory if specified
-		if (options.cwd) {
-			nsjailCmd.push('--cwd', options.cwd)
-		}
-
-		// Separator and actual command
-		nsjailCmd.push('--')
-		nsjailCmd.push(...cmd)
-
-		cmd = nsjailCmd
 		logger.info(`Spawning with nsjail: ${cmd.join(' ')}`)
 	} else {
 		logger.info(`Spawning: ${cmd.join(' ')}`)
@@ -391,9 +394,12 @@ function spawnProcess(options: SpawnOptions): Subprocess {
 	return spawn({
 		cmd,
 		cwd: options.cwd || process.cwd(),
+		...(options.stdin ? { stdin: options.stdin } : {}),
+		...(options.detached ? { detached: true } : {}),
 		stdout: options.stdout || 'pipe',
 		stderr: options.stderr || 'pipe',
 		env: {
+			...(options.inheritEnv ? process.env : {}),
 			// Essential system vars
 			PATH: process.env.PATH || '/usr/bin:/bin',
 			HOME: process.env.HOME,
@@ -489,6 +495,15 @@ abstract class BaseDebugSession {
 // Python Debug Session
 // ============================================================================
 
+const DEFAULT_DEBUGPY_TIMEOUT_MS = 10_000
+
+// `launch` waits on dependency preparation in the Python server, which allows `windmill
+// prepare-deps` up to 120s; anything shorter here reports a timeout while the install is
+// still legitimately running.
+const DEBUGPY_TIMEOUT_MS_BY_COMMAND: Record<string, number> = {
+	launch: 180_000
+}
+
 class PythonDebugSession extends BaseDebugSession {
 	private debugpyWs: WebSocket | null = null
 	private debugpySeq = 1
@@ -502,6 +517,9 @@ class PythonDebugSession extends BaseDebugSession {
 	private scriptResult: unknown = undefined
 	private envVars: Record<string, string> = {}
 	private windmillPath?: string
+	private venvPath?: string
+	private prepareDepsProcess: Subprocess | null = null
+	private disposed = false
 	private debugMode: boolean
 
 	constructor(ws: { send: (data: string) => void; close: () => void }, windmillPath?: string, debugMode = false) {
@@ -531,11 +549,13 @@ class PythonDebugSession extends BaseDebugSession {
 			arguments: args
 		}
 
+		const timeoutMs = DEBUGPY_TIMEOUT_MS_BY_COMMAND[command] ?? DEFAULT_DEBUGPY_TIMEOUT_MS
+
 		return new Promise((resolve, reject) => {
 			const timeout = setTimeout(() => {
 				this.pendingDebugpyRequests.delete(seq)
-				reject(new Error(`Debugpy command timeout: ${command}`))
-			}, 10000)
+				reject(new Error(`Debugpy command timeout: ${command} (after ${timeoutMs}ms)`))
+			}, timeoutMs)
 
 			this.pendingDebugpyRequests.set(seq, {
 				resolve: (value) => {
@@ -627,6 +647,110 @@ class PythonDebugSession extends BaseDebugSession {
 		}
 	}
 
+	/**
+	 * Install the script's imports through `windmill prepare-deps` and return the venv to add to
+	 * the debugged script's sys.path.
+	 *
+	 * This runs here rather than in the Python server because the registry settings the CLI is
+	 * given routinely embed private-registry credentials, and the Python server executes the
+	 * submitted script inside its own interpreter: anything in that process is recoverable by the
+	 * script. The service never executes user code, so the credentials stop here.
+	 *
+	 * It still goes through spawnProcess so nsjail confines it on the same terms as the debuggee:
+	 * `uv pip install` builds source distributions, which executes their build backend's arbitrary
+	 * Python. Those same credentials are what `inheritEnv` is for — the jail config keeps the
+	 * environment across the boundary, so nothing else has to carry them in.
+	 */
+	private async prepareDependencies(code: string, registry: RegistryConfig): Promise<string | null> {
+		if (!this.windmillPath) {
+			logger.info('No windmill binary path configured, skipping dependency preparation')
+			return null
+		}
+
+		const warn = (reason: string): null => {
+			// cleanup() kills the installer, which ends the read with nothing to parse. Reporting
+			// that as an install failure blames the user for their own disconnect, on a websocket
+			// that is being torn down anyway.
+			if (this.disposed) {
+				return null
+			}
+			logger.error(`prepare-deps failed: ${reason}`)
+			this.sendEvent('output', {
+				category: 'stderr',
+				output: `Failed to prepare dependencies: ${reason}\n`
+			})
+			return null
+		}
+
+		try {
+			const proc = spawnProcess({
+				cmd: [this.windmillPath, 'prepare-deps'],
+				// The venv has to be built against the interpreter that will run the script: its
+				// site-packages goes on that interpreter's sys.path, and uv otherwise picks its
+				// own, which silently leaves compiled extensions unimportable.
+				stdin: new Blob([
+					JSON.stringify({
+						code,
+						language: 'python3',
+						python_path: config.pythonPath,
+						registry
+					}) + '\n'
+				]),
+				inheritEnv: true,
+				detached: true
+			})
+			this.prepareDepsProcess = proc
+
+			// The launch response is already sent, so an install that never returns would leave the
+			// client waiting on a session that never starts, with nothing on screen. The deadline
+			// races the read rather than only killing the child: a grandchild holding the pipe open
+			// keeps the read pending long after the child itself is gone.
+			let timer: ReturnType<typeof setTimeout> | undefined
+			// spawnProcess's return type does not carry the piped stdio through
+			const read = (async () => ({
+				output: await new Response(proc.stdout as ReadableStream).text(),
+				stderr: await new Response(proc.stderr as ReadableStream).text()
+			}))()
+			const result = await Promise.race([
+				read,
+				new Promise<null>((resolve) => {
+					timer = setTimeout(() => resolve(null), PREPARE_DEPS_TIMEOUT_MS)
+				})
+			])
+			clearTimeout(timer)
+			this.prepareDepsProcess = null
+
+			if (!result) {
+				killProcessTree(proc)
+				return warn(
+					`dependency installation timed out after ${PREPARE_DEPS_TIMEOUT_MS / 1000}s`
+				)
+			}
+			const { output, stderr } = result
+
+			const lastLine = output.trim().split('\n').pop() || ''
+			if (!lastLine.startsWith('{')) {
+				return warn(stderr.trim() || 'windmill binary produced no response')
+			}
+
+			const response = JSON.parse(lastLine)
+			if (!response.success) {
+				// install_stderr is the installer's raw output; `error` already contains it, so
+				// prefer whichever the CLI version at hand provides.
+				return warn(response.install_stderr || response.error || 'unknown error')
+			}
+
+			if (response.venv_path) {
+				logger.info(`Dependencies installed at: ${response.venv_path}`)
+			} else {
+				logger.info('No external dependencies to install')
+			}
+			return response.venv_path || null
+		} catch (error) {
+			return warn(String(error))
+		}
+	}
+
 	private async startPythonProcess(cwd: string): Promise<void> {
 		if (!this.scriptPath) {
 			throw new Error('No script path')
@@ -648,10 +772,11 @@ class PythonDebugSession extends BaseDebugSession {
 			'--host', '127.0.0.1'
 		]
 
-		// Pass windmill path for dependency auto-installation if configured
-		if (this.windmillPath) {
-			cmd.push('--windmill', this.windmillPath)
-			logger.info(`Python session: autoinstall enabled with windmill at ${this.windmillPath}`)
+		// Dependencies are installed by the service (see prepareDependencies), so the server is
+		// handed the resulting venv instead of the windmill binary it would install with.
+		if (this.venvPath) {
+			cmd.push('--venv-path', this.venvPath)
+			logger.info(`Python session: using dependencies at ${this.venvPath}`)
 		}
 
 		// Pass debug flag to Python subprocess
@@ -662,7 +787,7 @@ class PythonDebugSession extends BaseDebugSession {
 		this.process = spawnProcess({
 			cmd,
 			cwd,
-			env: { PYTHONUNBUFFERED: '1', ...this.envVars }
+			env: { PYTHONUNBUFFERED: '1', ...sessionEnv(), ...this.envVars }
 		})
 
 		// Read stderr to capture startup messages
@@ -794,6 +919,13 @@ class PythonDebugSession extends BaseDebugSession {
 			this.debugpyWs.onclose = () => {
 				logger.info('Debugpy WebSocket closed')
 				this.debugpyWs = null
+				// A Python server that dies mid-request must fail it now; otherwise the caller
+				// waits out the command timeout, which for `launch` is minutes.
+				const aborted = Array.from(this.pendingDebugpyRequests.values())
+				this.pendingDebugpyRequests.clear()
+				for (const pending of aborted) {
+					pending.reject(new Error('Debugpy connection closed'))
+				}
 			}
 		})
 	}
@@ -905,6 +1037,10 @@ class PythonDebugSession extends BaseDebugSession {
 	}
 
 	private async handleLaunch(request: DAPMessage): Promise<void> {
+		// Per launch, not per session: cleanup() also runs when a program finishes normally, and
+		// the flag must only mean "torn down while this launch was still preparing".
+		this.disposed = false
+
 		const args = request.arguments || {}
 		let code = args.code as string | undefined
 		this.scriptPath = args.program as string | undefined
@@ -912,6 +1048,8 @@ class PythonDebugSession extends BaseDebugSession {
 		this.callMain = (args.callMain as boolean) || false
 		this.mainArgs = (args.args as Record<string, unknown>) || {}
 		this.envVars = (args.env as Record<string, string>) || {}
+		// Also what authorizes the registry configuration fetch below.
+		const token = args.token as string | undefined
 
 		// Enforce signing on every launch. The token is passed in the launch
 		// arguments and is verified against the inline `code` (see windmill-api-debug).
@@ -925,7 +1063,6 @@ class PythonDebugSession extends BaseDebugSession {
 				return
 			}
 
-			const token = args.token as string | undefined
 			if (!token) {
 				logger.error('No debug token provided but signed requests are required')
 				this.sendResponse(request, false, {}, 'Debug token required. Ensure the debug session was signed by the backend.')
@@ -987,6 +1124,32 @@ sys.stdout.flush()
 		this.sendResponse(request)
 
 		try {
+			if (code) {
+				const registry = await fetchRegistryConfig(token, logger)
+				// A round trip of its own, during which the client can give up: the installer runs
+				// a source distribution's build backend, so starting one for a session that is
+				// already gone executes package code nobody is waiting for.
+				if (this.disposed) {
+					logger.info('Session torn down during the registry configuration fetch, not installing')
+					await this.cleanup()
+					return
+				}
+				if (registry.message) {
+					this.sendEvent('output', { category: 'console', output: `${registry.message}\n` })
+				}
+				this.venvPath = (await this.prepareDependencies(code, registry)) ?? undefined
+			}
+
+			// Installing takes long enough for the client to give up meanwhile, and cleanup() has
+			// then already run: starting the debuggee now would leave a process nothing owns
+			// executing the script for a session that is gone. Clean up again on the way out,
+			// since a teardown that landed before the script was written left it behind.
+			if (this.disposed) {
+				logger.info('Session torn down during dependency preparation, not starting Python')
+				await this.cleanup()
+				return
+			}
+
 			await this.startPythonProcess(cwd)
 
 			// Re-apply breakpoints to the Python server using the actual script path
@@ -1012,7 +1175,13 @@ sys.stdout.flush()
 			})
 		} catch (error) {
 			this.sendEvent('output', { category: 'stderr', output: `Failed to start Python: ${error}\n` })
+			// Claim the terminated event before cleanup kills the process, otherwise the
+			// `exited` handler sends a second one whose empty body erases this error.
+			this.terminatedSent = true
 			this.sendEvent('terminated', { error: String(error) })
+			// A Python server that refused the launch stays in its connection loop, so
+			// nothing else ever reaps it, its websocket or the temp dir.
+			await this.cleanup()
 		}
 	}
 
@@ -1036,6 +1205,14 @@ sys.stdout.flush()
 	}
 
 	async cleanup(): Promise<void> {
+		this.disposed = true
+
+		// A client that gives up mid-install must not leave the package manager running
+		if (this.prepareDepsProcess) {
+			killProcessTree(this.prepareDepsProcess)
+			this.prepareDepsProcess = null
+		}
+
 		if (this.debugpyWs) {
 			this.debugpyWs.close()
 			this.debugpyWs = null
diff --git a/debugger/dap_websocket_server.py b/debugger/dap_websocket_server.py
index 624b339894..33937d9617 100644
--- a/debugger/dap_websocket_server.py
+++ b/debugger/dap_websocket_server.py
@@ -277,12 +277,55 @@ class WindmillDebugger(bdb.Bdb):
         return {}
 
 
+PREPARE_DEPS_TIMEOUT_SECONDS = 120
+PREPARE_DEPS_PROGRESS_INTERVAL_SECONDS = 5
+
+
+@dataclass
+class PrepareResult:
+    """
+    Outcome of dependency preparation.
+
+    `error` holds anything worth telling the user, including a problem reported by an
+    otherwise successful preparation. Only `fatal` means the packages are known to be
+    missing: failing to reach the CLI at all says nothing about the script's imports and
+    must not block a session that would otherwise run.
+    """
+
+    venv_path: str | None = None
+    error: str | None = None
+    fatal: bool = False
+
+
+def _prepare_error_detail(response: dict) -> str:
+    """
+    Build the failure reason from a prepare-deps response.
+
+    `error` is the installer's own output prefixed with the step that failed, and
+    `install_stderr` is that same output unprefixed, so take one rather than both: joining
+    them prints the installer's output twice, and the prefix is what tells a reader whether
+    the venv or the install was what went wrong.
+    """
+    for key in ("error", "install_stderr"):
+        detail = str(response.get(key) or "").strip()
+        if detail:
+            return detail
+    return "unknown error"
+
+
+def _first_line(detail: str, limit: int = 300) -> str:
+    """Condense a multi-line failure into the single line a DAP response message allows."""
+    line = next((s.strip() for s in detail.splitlines() if s.strip()), detail.strip())
+    return line[:limit]
+
+
 class DebugSession:
     """Manages a single debug session."""
 
-    def __init__(self, websocket, windmill_path: str | None = None):
+    def __init__(self, websocket, windmill_path: str | None = None, prepared_venv_path: str | None = None):
         self.websocket = websocket
         self.windmill_path = windmill_path
+        self._prepared_venv_path = prepared_venv_path
         self.seq = 1
         self.initialized = False
         self.configured = False
@@ -304,14 +347,22 @@ class DebugSession:
         self.seq += 1
         return seq
 
-    def prepare_dependencies(self, code: str) -> str | None:
+    def prepare_dependencies(self, code: str) -> PrepareResult:
         """
         Prepare Python dependencies by calling the windmill CLI.
-        Returns the path to the venv's site-packages directory, or None if no dependencies needed.
+
+        Blocks for as long as the install takes, so it must run off the event loop; use
+        `_prepare_dependencies_with_progress` instead of calling this directly.
         """
+        if self._prepared_venv_path:
+            # The debug service installs dependencies itself so that the registry credentials
+            # the CLI needs never enter this interpreter, which executes the debugged script.
+            logger.info(f"Using dependencies prepared by the debug service: {self._prepared_venv_path}")
+            return PrepareResult(venv_path=self._prepared_venv_path)
+
         if not self.windmill_path:
             logger.info("No windmill binary path configured, skipping dependency preparation")
-            return None
+            return PrepareResult()
 
         logger.info(f"Preparing dependencies using {self.windmill_path}")
 
@@ -328,7 +379,7 @@ class DebugSession:
                 input=input_data,
                 capture_output=True,
                 text=True,
-                timeout=120,  # 2 minute timeout for dependency installation
+                timeout=PREPARE_DEPS_TIMEOUT_SECONDS,
             )
 
             elapsed = time.time() - start_time
@@ -337,7 +388,11 @@ class DebugSession:
             if result.returncode != 0:
                 logger.error(f"prepare-deps failed (stderr): {result.stderr}")
                 logger.error(f"prepare-deps failed (stdout): {result.stdout}")
-                return None
+                detail = (result.stderr or "").strip() or (result.stdout or "").strip()
+                return PrepareResult(
+                    error=detail or f"windmill prepare-deps exited with code {result.returncode}",
+                    fatal=True,
+                )
 
             # Log raw output for debugging
             logger.debug(f"prepare-deps stdout: {result.stdout[:500] if result.stdout else '(empty)'}")
@@ -350,15 +405,18 @@ class DebugSession:
             json_start = output.find('{')
             if json_start == -1:
                 logger.error(f"No JSON in prepare-deps output: {output}")
-                return None
+                return PrepareResult(
+                    error=f"No JSON in prepare-deps output: {output[:500] or '(empty)'}"
+                )
 
             json_str = output[json_start:]
             response = json.loads(json_str)
             logger.debug(f"prepare-deps response: {response}")
 
             if not response.get("success"):
-                logger.error(f"prepare-deps error: {response.get('error')}")
-                return None
+                detail = _prepare_error_detail(response)
+                logger.error(f"prepare-deps error: {detail}")
+                return PrepareResult(error=detail, fatal=True)
 
             venv_path = response.get("venv_path")
             cached = response.get("cached", False)
@@ -371,18 +429,50 @@ class DebugSession:
             else:
                 logger.info("No external dependencies detected in code")
 
-            return venv_path
+            return PrepareResult(venv_path=venv_path)
 
         except subprocess.TimeoutExpired:
-            logger.error("prepare-deps timed out after 120s")
-            return None
+            message = f"prepare-deps timed out after {PREPARE_DEPS_TIMEOUT_SECONDS}s"
+            logger.error(message)
+            return PrepareResult(error=message, fatal=True)
         except json.JSONDecodeError as e:
+            raw = output[:500] if 'output' in dir() else '(not available)'
             logger.error(f"Failed to parse prepare-deps JSON output: {e}")
-            logger.error(f"Raw output was: {output[:500] if 'output' in dir() else '(not available)'}")
-            return None
+            logger.error(f"Raw output was: {raw}")
+            return PrepareResult(error=f"Failed to parse prepare-deps output: {e}\n{raw}")
         except Exception as e:
             logger.exception(f"Error preparing dependencies: {e}")
-            return None
+            return PrepareResult(error=f"Error preparing dependencies: {e}")
+
+    async def _prepare_dependencies_with_progress(self, code: str) -> PrepareResult:
+        """
+        Run dependency preparation on a worker thread, reporting progress while it runs.
+
+        The install can take minutes on a cold cache; on the event loop it would stall
+        websocket keepalive until it returns and block the progress events below.
+        """
+        await self.send_event(
+            "output", {"category": "stdout", "output": "Preparing dependencies...\n"}
+        )
+
+        task = asyncio.create_task(asyncio.to_thread(self.prepare_dependencies, code))
+        waited = 0
+        while True:
+            done, _ = await asyncio.wait(
+                {task}, timeout=PREPARE_DEPS_PROGRESS_INTERVAL_SECONDS
+            )
+            if done:
+                break
+            waited += PREPARE_DEPS_PROGRESS_INTERVAL_SECONDS
+            await self.send_event(
+                "output",
+                {
+                    "category": "stdout",
+                    "output": f"Still preparing dependencies... ({waited}s)\n",
+                },
+            )
+
+        return task.result()
 
     def _next_var_ref(self) -> int:
         ref = self._variables_ref_counter
@@ -521,7 +611,25 @@ class DebugSession:
 
         # Prepare dependencies before modifying the code
         if code:
-            self._venv_path = self.prepare_dependencies(code)
+            prepared = await self._prepare_dependencies_with_progress(code)
+            if prepared.error:
+                prefix = (
+                    "Failed to prepare dependencies"
+                    if prepared.fatal
+                    else "Warning: dependency preparation reported a problem, running anyway"
+                )
+                await self.send_event(
+                    "output",
+                    {"category": "stderr", "output": f"{prefix}:\n{prepared.error}\n"},
+                )
+                if prepared.fatal:
+                    await self.send_response(
+                        request,
+                        success=False,
+                        message=f"Failed to prepare dependencies: {_first_line(prepared.error)}",
+                    )
+                    return
+            self._venv_path = prepared.venv_path
 
         # If callMain is True, append a call to main() with the provided args
         if self._call_main and code:
@@ -894,13 +1002,17 @@ class DebugSession:
             )
 
 
-# Module-level variable to store windmill binary path
+# Module-level variables to store the windmill binary path and, when the debug service
+# already installed the script's dependencies, the venv to use instead of installing here.
 _windmill_path: str | None = None
+_prepared_venv_path: str | None = None
 
 
 async def handle_connection(websocket) -> None:
     """Handle a WebSocket connection."""
-    session = DebugSession(websocket, windmill_path=_windmill_path)
+    session = DebugSession(
+        websocket, windmill_path=_windmill_path, prepared_venv_path=_prepared_venv_path
+    )
     logger.info(f"New connection from {websocket.remote_address}")
 
     try:
@@ -924,13 +1036,21 @@ async def handle_connection(websocket) -> None:
         session._cleanup_temp_file()
 
 
-async def main(host: str = "localhost", port: int = 5679, windmill_path: str | None = None) -> None:
+async def main(
+    host: str = "localhost",
+    port: int = 5679,
+    windmill_path: str | None = None,
+    prepared_venv_path: str | None = None,
+) -> None:
     """Start the DAP WebSocket server."""
-    global _windmill_path
+    global _windmill_path, _prepared_venv_path
     _windmill_path = windmill_path
+    _prepared_venv_path = prepared_venv_path
 
     if windmill_path:
         logger.info(f"Windmill binary path: {windmill_path}")
+    if prepared_venv_path:
+        logger.info(f"Dependencies prepared by the debug service: {prepared_venv_path}")
     logger.info(f"Starting DAP WebSocket server on ws://{host}:{port}")
 
     async with serve(handle_connection, host, port):
@@ -944,6 +1064,7 @@ if __name__ == "__main__":
     parser.add_argument("--host", default="localhost", help="Host to bind to")
     parser.add_argument("--port", type=int, default=5679, help="Port to listen on")
     parser.add_argument("--windmill", help="Path to windmill binary for dependency preparation (or set WINDMILL_PATH env var)")
+    parser.add_argument("--venv-path", help="Site-packages directory of a venv the caller already prepared; skips dependency installation")
     parser.add_argument("--debug", action="store_true", help="Enable debug logging")
     args = parser.parse_args()
 
@@ -957,6 +1078,6 @@ if __name__ == "__main__":
     windmill_path = args.windmill or os.environ.get("WINDMILL_PATH")
 
     try:
-        asyncio.run(main(args.host, args.port, windmill_path))
+        asyncio.run(main(args.host, args.port, windmill_path, args.venv_path))
     except KeyboardInterrupt:
         logger.info("Server stopped")
diff --git a/debugger/dap_websocket_server_bun.ts b/debugger/dap_websocket_server_bun.ts
index d6ed8967ad..3b5072b1e6 100644
--- a/debugger/dap_websocket_server_bun.ts
+++ b/debugger/dap_websocket_server_bun.ts
@@ -22,9 +22,12 @@
  */
 
 import { spawn, type Subprocess } from 'bun'
+import { readFileSync } from 'node:fs'
 import { mkdtemp, writeFile, unlink, rmdir, symlink } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
+import { sessionEnv } from './env_passthrough'
+import { fetchRegistryConfig, type RegistryConfig } from './registry_config'
 
 // Types for V8 Inspector Protocol
 interface V8Message {
@@ -222,6 +225,8 @@ function generateMainCallArgs(code: string, args: Record<string, unknown>): stri
 const WINDMILL_BASE_URL = process.env.WINDMILL_BASE_URL || process.env.BASE_INTERNAL_URL // e.g., http://localhost:8000
 const REQUIRE_SIGNED_REQUESTS = process.env.REQUIRE_SIGNED_DEBUG_REQUESTS !== 'false'
 
+const PREPARE_DEPS_TIMEOUT_MS = 120_000
+
 // Opt-in cross-origin protection (CSWSH defense-in-depth); see
 // dap_debug_service.ts for the rationale. Only enforced for this file's
 // standalone Bun.serve entrypoint (the windmill-extra runtime imports the
@@ -554,6 +559,63 @@ export interface NsjailConfig {
 	extraArgs?: string[]
 }
 
+/**
+ * Wrap a command so nsjail runs it, or return it unchanged when sandboxing is off.
+ * The environment is not filtered here: the config sets `keep_env`, so the jailed process
+ * receives whatever the spawning call gives it.
+ */
+export function nsjailWrap(cmd: string[], nsjail: NsjailConfig | undefined, cwd?: string): string[] {
+	if (!nsjail?.enabled) {
+		return cmd
+	}
+	const wrapped = [nsjail.binaryPath]
+	if (nsjail.configPath) {
+		wrapped.push('--config', nsjail.configPath)
+	}
+	if (nsjail.extraArgs) {
+		wrapped.push(...nsjail.extraArgs)
+	}
+	if (cwd) {
+		wrapped.push('--cwd', cwd)
+	}
+	wrapped.push('--', ...cmd)
+	return wrapped
+}
+
+/**
+ * SIGKILL a subprocess along with everything it spawned.
+ *
+ * SIGKILL because `windmill prepare-deps` does not act on SIGTERM while uv is running. The
+ * whole group because uv is a grandchild: signalling the child alone reparents uv to init and
+ * it keeps downloading. The group id is read back from /proc instead of assumed, since a group
+ * kill aimed at this service's own group would take down every service in the container; a
+ * child spawned without `detached` therefore only gets the plain kill.
+ */
+export function killProcessTree(proc: Subprocess): void {
+	if (proc.exitCode !== null || proc.signalCode !== null) {
+		// Nothing left to signal, and the pid may already have been handed to someone else
+		return
+	}
+
+	let ownsGroup = false
+	try {
+		const stat = readFileSync(`/proc/${proc.pid}/stat`, 'utf8')
+		// The comm field can hold spaces and parentheses, so read the fields after its closing one
+		ownsGroup = Number(stat.slice(stat.lastIndexOf(')') + 2).split(' ')[2]) === proc.pid
+	} catch {
+		// Already reaped, or not Linux: fall back to killing the process alone
+	}
+	try {
+		if (ownsGroup) {
+			process.kill(-proc.pid, 'SIGKILL')
+		} else {
+			proc.kill('SIGKILL')
+		}
+	} catch (error) {
+		logger.error('Failed to kill process:', error)
+	}
+}
+
 /**
  * VLQ (Variable-Length Quantity) decoder for source maps.
  * Returns array of decoded integers from VLQ string.
@@ -751,6 +813,11 @@ export class DebugSession {
 	// Path to installed node_modules (set after prepare-deps runs)
 	private nodeModulesPath?: string
 
+	// Running dependency installer, so a teardown mid-install can stop it
+	private prepareDepsProcess: Subprocess | null = null
+
+	private disposed = false
+
 	constructor(ws: WebSocket, options?: { nsjailConfig?: NsjailConfig; bunPath?: string; windmillPath?: string }) {
 		this.ws = ws
 		this.nsjailConfig = options?.nsjailConfig
@@ -1435,6 +1502,10 @@ export class DebugSession {
 	 * Handle the 'launch' request.
 	 */
 	async handleLaunch(request: DAPMessage): Promise<void> {
+		// Per launch, not per session: cleanup() also runs when a program finishes normally, and
+		// the flag must only mean "torn down while this launch was still preparing".
+		this.disposed = false
+
 		const args = request.arguments || {}
 		let code = args.code as string | undefined
 		this.scriptPath = args.program as string | undefined
@@ -1442,6 +1513,8 @@ export class DebugSession {
 		this.callMain = (args.callMain as boolean) || false
 		this.mainArgs = (args.args as Record<string, unknown>) || {}
 		this.envVars = (args.env as Record<string, string>) || {}
+		// Also what authorizes the registry configuration fetch below.
+		const token = args.token as string | undefined
 
 		// Enforce signing on every launch. The token is passed in the launch
 		// arguments and is verified against the inline `code` (see windmill-api-debug).
@@ -1455,7 +1528,6 @@ export class DebugSession {
 				return
 			}
 
-			const token = args.token as string | undefined
 			if (!token) {
 				logger.error('No debug token provided but signed requests are required')
 				this.sendResponse(request, false, {}, 'Debug token required. Ensure the debug session was signed by the backend.')
@@ -1487,7 +1559,29 @@ export class DebugSession {
 		// Prepare dependencies using the original code (before any modifications)
 		// This analyzes imports and installs required npm packages
 		if (code) {
-			this.nodeModulesPath = await this.prepareDependencies(code) || undefined
+			const registry = await fetchRegistryConfig(token, logger)
+			// A round trip of its own, during which the client can give up: the installer runs the
+			// packages' postinstall scripts, so starting one for a session that is already gone
+			// executes package code nobody is waiting for.
+			if (this.disposed) {
+				logger.info('Session was torn down during the registry configuration fetch, not installing')
+				this.sendResponse(request, false, {}, 'Session terminated during dependency preparation')
+				return
+			}
+			if (registry.message) {
+				this.sendEvent('output', { category: 'console', output: `${registry.message}\n` })
+			}
+			this.nodeModulesPath = await this.prepareDependencies(code, registry) || undefined
+
+			// Installing takes long enough for the client to give up meanwhile, and cleanup() has
+			// then already run: starting the debuggee now would leak a process nothing owns.
+			// The response still goes out, since a client that terminated without closing the
+			// socket is otherwise left waiting out its own launch timeout.
+			if (this.disposed) {
+				logger.info('Session was torn down during dependency preparation, not starting Bun')
+				this.sendResponse(request, false, {}, 'Session terminated during dependency preparation')
+				return
+			}
 
 			// Remove version specifiers from imports (e.g., "lodash@4" -> "lodash")
 			// This must happen AFTER prepareDependencies (which needs the versions)
@@ -1570,8 +1664,21 @@ export class DebugSession {
 	 * Prepare dependencies by calling the windmill CLI's prepare-deps command.
 	 * This analyzes imports in the code and installs required npm packages.
 	 * Returns the path to node_modules if any were installed.
+	 *
+	 * Jailed on the same terms as the debuggee: `bun install` runs the packages' postinstall
+	 * scripts, which is user-supplied code executing next to the other services in the container.
+	 * Its environment is inherited rather than filtered, which is what carries the CA settings
+	 * into the installer (the jail keeps the environment across the boundary).
+	 *
+	 * The CLI has no database, so `registry` carries the instance's registry settings down to it
+	 * instead. They configure `bun install` and nothing else: the debugged script never gets
+	 * them, since it could read them back out of the process it runs in.
 	 */
-	private async prepareDependencies(code: string, language: string = 'bun'): Promise<string | null> {
+	private async prepareDependencies(
+		code: string,
+		registry: RegistryConfig,
+		language: string = 'bun'
+	): Promise<string | null> {
 		if (!this.windmillPath) {
 			logger.info('No windmill binary path configured, skipping dependency preparation')
 			return null
@@ -1579,21 +1686,67 @@ export class DebugSession {
 
 		logger.info(`Preparing dependencies using ${this.windmillPath}`)
 
+		// The launch response is only sent once this returns, so without progress a cold
+		// cache looks like a frozen debugger for as long as the install takes.
+		this.sendEvent('output', { category: 'console', output: 'Preparing dependencies...\n' })
+		let waited = 0
+		const progress = setInterval(() => {
+			waited += 5
+			this.sendEvent('output', {
+				category: 'console',
+				output: `Still preparing dependencies... (${waited}s)\n`
+			})
+		}, 5000)
+		let killTimer: ReturnType<typeof setTimeout> | undefined
+		let timedOut = false
+
 		try {
-			const input = JSON.stringify({ code, language }) + '\n'
+			const input = JSON.stringify({ code, language, registry }) + '\n'
 			logger.info(`prepare-deps input length: ${input.length}`)
 
-			// Spawn the windmill binary with prepare-deps command
+			// Spawn the windmill binary with prepare-deps command. Its environment is inherited
+			// rather than filtered, which is what gives prepare-deps the container's index and
+			// certificate settings; the allowlist above is what keeps them from the debugged
+			// script, and the jail keeps them across its own boundary.
+			const cmd = nsjailWrap([this.windmillPath, 'prepare-deps'], this.nsjailConfig)
+			logger.info(`Spawning${this.nsjailConfig?.enabled ? ' with nsjail' : ''}: ${cmd.join(' ')}`)
 			const proc = spawn({
-				cmd: [this.windmillPath, 'prepare-deps'],
+				cmd,
 				stdin: new Blob([input]),  // Use Blob for complete stdin data
 				stdout: 'pipe',
-				stderr: 'pipe'
+				stderr: 'pipe',
+				// So the installer and the bun it spawns can be killed as one group
+				detached: true
 			})
+			this.prepareDepsProcess = proc
+
+			// Bound the wait: the only other ceiling is the DAP client's launch timeout,
+			// which is minutes, so a wedged installer would hang the session that long.
+			killTimer = setTimeout(() => {
+				timedOut = true
+				logger.error(`prepare-deps timed out after ${PREPARE_DEPS_TIMEOUT_MS}ms`)
+				killProcessTree(proc)
+			}, PREPARE_DEPS_TIMEOUT_MS)
 
 			// Wait for completion
 			const output = await new Response(proc.stdout).text()
 			const stderr = await new Response(proc.stderr).text()
+
+			// The read also ends when cleanup() kills the installer, which leaves no output to
+			// parse. Reporting that as an install failure blames the user for their own Stop.
+			if (this.disposed) {
+				return null
+			}
+
+			if (timedOut) {
+				const errorMsg = `prepare-deps timed out after ${PREPARE_DEPS_TIMEOUT_MS / 1000}s`
+				this.sendEvent('output', {
+					category: 'console',
+					output: `Warning: Failed to prepare dependencies: ${errorMsg}\n`
+				})
+				return null
+			}
+
 			logger.info(`prepare-deps output: ${output.substring(0, 200)}`)
 			logger.info(`prepare-deps stderr: ${stderr.substring(0, 200)}`)
 
@@ -1642,12 +1795,19 @@ export class DebugSession {
 			logger.info('No external dependencies to install')
 			return null
 		} catch (error) {
+			if (this.disposed) {
+				return null
+			}
 			logger.error(`Failed to prepare dependencies: ${error}`)
 			this.sendEvent('output', {
 				category: 'console',
 				output: `Warning: Failed to prepare dependencies: ${error}\n`
 			})
 			return null
+		} finally {
+			clearInterval(progress)
+			clearTimeout(killTimer)
+			this.prepareDepsProcess = null
 		}
 	}
 
@@ -1663,24 +1823,13 @@ export class DebugSession {
 		const inspectUrl = `127.0.0.1:${inspectPort}`
 
 		// Build the command - optionally wrapped with nsjail
-		let cmd: string[] = [this.bunPath, `--inspect-wait=${inspectUrl}`, this.scriptPath]
+		const cmd = nsjailWrap(
+			[this.bunPath, `--inspect-wait=${inspectUrl}`, this.scriptPath],
+			this.nsjailConfig,
+			cwd
+		)
 
 		if (this.nsjailConfig?.enabled) {
-			const nsjailCmd = [this.nsjailConfig.binaryPath]
-
-			if (this.nsjailConfig.configPath) {
-				nsjailCmd.push('--config', this.nsjailConfig.configPath)
-			}
-
-			if (this.nsjailConfig.extraArgs) {
-				nsjailCmd.push(...this.nsjailConfig.extraArgs)
-			}
-
-			nsjailCmd.push('--cwd', cwd)
-			nsjailCmd.push('--')
-			nsjailCmd.push(...cmd)
-
-			cmd = nsjailCmd
 			logger.info(`Starting Bun with nsjail: ${cmd.join(' ')}`)
 		} else {
 			logger.info(`Starting Bun with --inspect-wait=${inspectUrl}`)
@@ -1698,12 +1847,16 @@ export class DebugSession {
 			}, 10000)
 		})
 
-		// Only include essential env vars + client-provided ones
+		// Only include essential env vars + the network-config allowlist + client-provided ones.
 		// Don't inherit all of process.env to keep debugger environment clean
 		const envVars: Record<string, string | undefined> = {
 			// Essential system vars
 			PATH: process.env.PATH || '/usr/bin:/bin',
 			HOME: process.env.HOME,
+			// Proxy / TLS settings inherited from the container, before the client's env so an
+			// explicit override still wins. Package-index settings are deliberately absent: this
+			// runs user-supplied code and index URLs carry registry credentials.
+			...sessionEnv(),
 			// Client-provided env vars (WM_WORKSPACE, WM_TOKEN, etc.)
 			// Note: WM_BASE_URL is already overridden by BASE_INTERNAL_URL if set
 			...this.envVars
@@ -2453,15 +2606,23 @@ export class DebugSession {
 	}
 
 	/**
-	 * Clean up resources.
+	 * Clean up resources. Public because both servers call it when a client goes away.
 	 */
-	private async cleanup(): Promise<void> {
+	async cleanup(): Promise<void> {
+		this.disposed = true
+
 		// Close inspector connection
 		if (this.inspectorWs) {
 			this.inspectorWs.close()
 			this.inspectorWs = null
 		}
 
+		// A disconnect during dependency installation must not leave bun install running
+		if (this.prepareDepsProcess) {
+			killProcessTree(this.prepareDepsProcess)
+			this.prepareDepsProcess = null
+		}
+
 		// Kill process
 		if (this.process) {
 			this.process.kill()
@@ -2601,9 +2762,14 @@ if (import.meta.main) {
 					logger.error('Error handling message:', error)
 				}
 			},
-			close(ws) {
+			async close(ws) {
 				logger.info('Client disconnected')
-				sessions.delete(ws)
+				const session = sessions.get(ws)
+				if (session) {
+					// Dropping the session without this leaves its installer and debuggee running
+					await session.cleanup()
+					sessions.delete(ws)
+				}
 			}
 		}
 	})
diff --git a/debugger/env_passthrough.ts b/debugger/env_passthrough.ts
new file mode 100644
index 0000000000..f713483d05
--- /dev/null
+++ b/debugger/env_passthrough.ts
@@ -0,0 +1,43 @@
+/**
+ * Container network configuration forwarded to a debug session, matching what a worker gives a
+ * job's script. The session environment is built from an allowlist rather than inherited, so an
+ * outbound proxy or a private CA is unreachable from a session unless these are passed
+ * explicitly. Registry settings are deliberately absent: they carry credentials and are consumed
+ * by the service itself (see PythonDebugSession.prepareDependencies).
+ *
+ * Lives in its own module because both session kinds build their own environment, and
+ * dap_debug_service.ts already imports from dap_websocket_server_bun.ts.
+ */
+export const SESSION_ENV_VARS = [
+	'HTTP_PROXY',
+	'HTTPS_PROXY',
+	'NO_PROXY',
+	// The lowercase spellings take precedence in the worker, so forward both.
+	'http_proxy',
+	'https_proxy',
+	'no_proxy',
+	// Trust roots for a TLS-intercepting proxy. Installing the CA in the container's system
+	// store is not enough on its own: requests carries its own bundle and Node reads only
+	// NODE_EXTRA_CA_CERTS, so a debugged script's own HTTPS calls fail without these.
+	'SSL_CERT_FILE',
+	'SSL_CERT_DIR',
+	'REQUESTS_CA_BUNDLE',
+	'CURL_CA_BUNDLE',
+	'NODE_EXTRA_CA_CERTS'
+]
+
+export function sessionEnv(): Record<string, string> {
+	const env: Record<string, string> = {}
+	for (const key of SESSION_ENV_VARS) {
+		const value = process.env[key]
+		if (value) {
+			env[key] = value
+		}
+	}
+	// A proxy without a bypass list would send the script's calls to BASE_INTERNAL_URL through it;
+	// the worker defaults the same way (PROXY_ENVS in windmill-worker).
+	if (!env.NO_PROXY && !env.no_proxy && (env.HTTP_PROXY || env.http_proxy || env.HTTPS_PROXY || env.https_proxy)) {
+		env.NO_PROXY = 'localhost,127.0.0.1'
+	}
+	return env
+}
diff --git a/debugger/nsjail.debug.config.proto b/debugger/nsjail.debug.config.proto
index 5e538e6002..65ea3456cf 100644
--- a/debugger/nsjail.debug.config.proto
+++ b/debugger/nsjail.debug.config.proto
@@ -63,6 +63,15 @@ mount {
     rw: true
 }
 
+# Private scratch, one instance per jail. `windmill prepare-deps` writes the registry
+# credentials here rather than into its install directory under the shared /tmp above, so no
+# other session can read them, and they go away with the jail even when it is killed.
+mount {
+    dst: "/var/tmp"
+    fstype: "tmpfs"
+    rw: true
+}
+
 # Debugger scripts directory (for Python debugger server)
 mount {
     src: "/debugger"
diff --git a/debugger/registry_config.ts b/debugger/registry_config.ts
new file mode 100644
index 0000000000..b7cb0451e5
--- /dev/null
+++ b/debugger/registry_config.ts
@@ -0,0 +1,84 @@
+/**
+ * Dependency-registry settings for a debug session's install.
+ *
+ * `windmill prepare-deps` installs a session's imports with no database connection, so the
+ * instance settings that point at a private npm or pip registry cannot be read there. They
+ * are fetched here instead, from the backend that signed the session's launch token, and
+ * passed down to the CLI over its stdin request.
+ *
+ * They stop at the installer. A registry URL usually embeds credentials and a debugged
+ * script can read whatever the process running it holds, so none of these values are ever
+ * put in a session's environment (see README.md, "Registry configuration").
+ */
+
+export interface RegistryConfig {
+	npm_config_registry?: string
+	npmrc?: string
+	bunfig_install_scopes?: string
+	pip_index_url?: string
+	pip_extra_index_url?: string
+	uv_index_strategy?: string
+	/** Why the instance's settings are not in this response, for the user to see. */
+	message?: string
+}
+
+const WINDMILL_BASE_URL = process.env.WINDMILL_BASE_URL || process.env.BASE_INTERNAL_URL
+
+/**
+ * Bounds how long a launch waits on the backend. The session can still start without the
+ * settings, it just installs from the public registries, so an unreachable backend must
+ * not hold it up for longer than the install itself would take.
+ */
+const FETCH_TIMEOUT_MS = Number(process.env.DAP_REGISTRY_CONFIG_TIMEOUT_MS) || 10_000
+
+/**
+ * Fetch the registry settings for a session, authorized by its launch token.
+ *
+ * Never throws and never blocks a launch: on any failure it returns a config carrying only
+ * a `message`, so the session starts against the public registries and the user is told why
+ * instead of being left with an unexplained "package not found".
+ */
+export async function fetchRegistryConfig(
+	token: string | undefined,
+	logger: { info: (...args: unknown[]) => void; warn: (...args: unknown[]) => void }
+): Promise<RegistryConfig> {
+	if (!token || !WINDMILL_BASE_URL) {
+		return {}
+	}
+
+	const url = `${WINDMILL_BASE_URL.replace(/\/$/, '')}/api/debug/registry_config`
+	try {
+		const response = await fetch(url, {
+			headers: { authorization: `Bearer ${token}` },
+			signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+		})
+		if (response.status === 401 || response.status === 403 || response.status === 404) {
+			// Expected answers, not something the user can act on: a session that may not read
+			// the settings (an operator's) is refused, and a backend older than this image has
+			// no such route at all. Both install from the public registries.
+			logger.info(`Registry configuration not served for this session (${response.status})`)
+			return {}
+		}
+		if (!response.ok) {
+			const detail = (await response.text().catch(() => '')).trim()
+			return {
+				message: `Could not read the registry configuration (${response.status}): ${detail || response.statusText}`
+			}
+		}
+
+		const config: RegistryConfig = await response.json()
+		// The values carry registry credentials, so only their names are logged.
+		const configured = Object.entries(config)
+			.filter(([key, value]) => key !== 'message' && value)
+			.map(([key]) => key)
+		logger.info(
+			configured.length > 0
+				? `Registry configuration from instance settings: ${configured.join(', ')}`
+				: 'No registry configuration set on the instance'
+		)
+		return config
+	} catch (error) {
+		logger.warn(`Failed to fetch registry configuration: ${error}`)
+		return { message: `Could not read the registry configuration: ${error}` }
+	}
+}
diff --git a/debugger/test_dap_server.py b/debugger/test_dap_server.py
index 45e138f2a3..17430ea25f 100644
--- a/debugger/test_dap_server.py
+++ b/debugger/test_dap_server.py
@@ -45,6 +45,10 @@ def main(x: str, count: int = 1):
 # Breakpoints for the main() test: lines 3 and 4 (inside main function)
 MAIN_BREAKPOINT_LINES = [3, 4]
 
+# `launch` waits on dependency installation, so the import test below needs far more than
+# the default budget on a cold cache.
+REQUEST_TIMEOUTS = {"launch": 180.0}
+
 
 class DAPTestClient:
     def __init__(self, url: str = "ws://localhost:5679"):
@@ -103,7 +107,7 @@ class DAPTestClient:
 
         # Wait for response with timeout
         try:
-            response = await asyncio.wait_for(future, timeout=10.0)
+            response = await asyncio.wait_for(future, timeout=REQUEST_TIMEOUTS.get(command, 10.0))
             return response
         except asyncio.TimeoutError:
             print(f"Timeout waiting for response to {command}")
diff --git a/docker-compose.yml b/docker-compose.yml
index 93fbf28e8d..a801a0ce7c 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -187,6 +187,10 @@ services:
       # - DEBUG_ALLOWED_ORIGINS=https://your-windmill-host # Optional CSWSH hardening: comma-separated allowlist of browser Origins permitted to open debug WebSockets
     volumes:
       - lsp_cache:/pyls/.cache
+      # Behind a TLS-intercepting proxy, mount its CA here (as .crt) and it is registered in the
+      # system trust store before any service starts. That alone does not cover dependency
+      # installation — see debugger/README.md for the variables it also needs
+      # - ./corp-ca.crt:/usr/local/share/ca-certificates/corp-ca.crt:ro
     logging: *default-logging
 
   caddy:
diff --git a/docker/DockerfileExtra b/docker/DockerfileExtra
index 808bc6ed2a..9eb2a987f2 100644
--- a/docker/DockerfileExtra
+++ b/docker/DockerfileExtra
@@ -94,7 +94,9 @@ WORKDIR /debugger
 # Copy debugger files
 COPY debugger/dap_debug_service.ts .
 COPY debugger/dap_websocket_server_bun.ts .
+COPY debugger/env_passthrough.ts .
 COPY debugger/dap_websocket_server.py .
+COPY debugger/registry_config.ts .
 COPY debugger/nsjail.debug.config.proto .
 
 # Install Python debugger dependencies using uv
diff --git a/docker/DockerfileFull b/docker/DockerfileFull
index 6e3f218fd6..b827208c1d 100644
--- a/docker/DockerfileFull
+++ b/docker/DockerfileFull
@@ -45,6 +45,19 @@ RUN apt-get install -y ruby ruby-bundler
 RUN apt-get install -y r-base-dev \
     && Rscript -e 'install.packages("renv", lib="/usr/lib/R/library", repos="https://cloud.r-project.org")'
 
+# dbt
+# NO dbt engine is baked in. Fusion may not be: its license grants only a
+# non-transferable, non-sublicensable redistribution right. dbt-core 1.x cannot
+# be, because its adapter is a Python package chosen per project. dbt-core 2.x
+# could be — one adapter-agnostic binary — but shipping a pre-release nobody is
+# defaulted onto costs a layer in every image and a version pinned in two places
+# that nothing keeps in step. The worker fetches whichever engine a project asks
+# for on first use and caches it (docs/dbt-runtime.md, decision 1).
+#
+# An operator who wants one pre-staged — an air-gapped instance, or a fleet that
+# should not fetch per worker — populates `DBT_BUNDLED_DIR` (default
+# /usr/local/dbt) with `core2x-<version>/dbt-sa-cli` in their own image layer.
+
 # Fix UV cache permissions for non-root user support (uid 1000, etc.)
 # The uv tool install ansible command populates the UV cache with root-owned files
 RUN chmod -R a+rw /tmp/windmill/cache/uv && \
diff --git a/docker/DockerfileFullEe b/docker/DockerfileFullEe
index 14bfceca50..5b5347558a 100644
--- a/docker/DockerfileFullEe
+++ b/docker/DockerfileFullEe
@@ -78,6 +78,19 @@ RUN apt-get install -y iptables
 # Kerberos runtime
 RUN apt-get install -y libsasl2-modules-gssapi-mit krb5-user
 
+# dbt
+# NO dbt engine is baked in. Fusion may not be: its license grants only a
+# non-transferable, non-sublicensable redistribution right. dbt-core 1.x cannot
+# be, because its adapter is a Python package chosen per project. dbt-core 2.x
+# could be — one adapter-agnostic binary — but shipping a pre-release nobody is
+# defaulted onto costs a layer in every image and a version pinned in two places
+# that nothing keeps in step. The worker fetches whichever engine a project asks
+# for on first use and caches it (docs/dbt-runtime.md, decision 1).
+#
+# An operator who wants one pre-staged — an air-gapped instance, or a fleet that
+# should not fetch per worker — populates `DBT_BUNDLED_DIR` (default
+# /usr/local/dbt) with `core2x-<version>/dbt-sa-cli` in their own image layer.
+
 # Fix UV cache permissions for non-root user support (uid 1000, etc.)
 # The uv tool install ansible command populates the UV cache with root-owned files
 RUN chmod -R a+rw /tmp/windmill/cache/uv && \
diff --git a/docker/entrypoint-extra.sh b/docker/entrypoint-extra.sh
index a06901e25c..b32ad2dd94 100644
--- a/docker/entrypoint-extra.sh
+++ b/docker/entrypoint-extra.sh
@@ -33,6 +33,58 @@ if [ ! -w "$HOME" ]; then
 fi
 export HOME
 
+# Register CA certificates mounted into the image before anything opens a TLS connection.
+# Best-effort on purpose, unlike INIT_SCRIPT below: a non-root UID cannot write /etc/ssl/certs, and
+# a deployment that never needed a custom CA must still boot. Env var names and the default-off
+# behavior match the server/worker binary, so one setting covers every container. What the system
+# trust store does and does not reach is documented in debugger/README.md.
+CA_CERT_DIR=/usr/local/share/ca-certificates
+
+update_ca_certificates() {
+    local reason="$1"
+    local tool="${RUN_UPDATE_CA_CERTIFICATE_PATH:-/usr/sbin/update-ca-certificates}"
+    local output
+    if [ ! -x "$tool" ]; then
+        echo "[entrypoint] $reason but $tool is not executable, skipping CA update"
+        return
+    fi
+    echo "[entrypoint] $reason, running $tool"
+    if output=$("$tool" 2>&1); then
+        echo "[entrypoint] CA certificates updated"
+    else
+        # Carry the tool's own message: the usual cause is an unwritable /etc/ssl/certs under a
+        # non-root UID, but guessing that in place of the real error hides everything else.
+        echo "[entrypoint] WARNING: $tool failed (UID $(id -u)): ${output:-no output}; continuing" >&2
+    fi
+}
+
+if [ "$(echo "${RUN_UPDATE_CA_CERTIFICATE_AT_START:-false}" | tr '[:upper:]' '[:lower:]')" = "true" ]; then
+    update_ca_certificates "RUN_UPDATE_CA_CERTIFICATE_AT_START=true"
+elif [ -n "$(find -L "$CA_CERT_DIR" -type f -name '*.crt' -print -quit 2>/dev/null)" ]; then
+    # Certificates mounted there are unambiguous intent, and they do nothing until registered, so
+    # take the same action without making the operator also find the env var.
+    update_ca_certificates "Found certificates in $CA_CERT_DIR"
+elif [ -n "$(ls -A "$CA_CERT_DIR" 2>/dev/null)" ]; then
+    # Reporting success over a mount update-ca-certificates ignores would be worse than saying
+    # nothing: .pem is the spelling people reach for, and only .crt is read.
+    echo "[entrypoint] WARNING: $CA_CERT_DIR has files but none named *.crt, the only extension" \
+        "update-ca-certificates reads; they will be ignored" >&2
+fi
+
+# INIT_SCRIPT is the documented hook for preparing the host before anything reaches the network
+# (CA certificates, proxies, mounts), matching the worker's INIT_SCRIPT. It must therefore complete
+# before any service starts, and a failure has to abort: services that come up with an unprepared
+# trust store fail every TLS handshake instead, which is far harder to diagnose.
+if [ -n "$INIT_SCRIPT" ]; then
+    echo "[entrypoint] Running INIT_SCRIPT..."
+    bash -c "$INIT_SCRIPT" || {
+        code=$?
+        echo "[entrypoint] ERROR: INIT_SCRIPT failed with exit code $code, aborting" >&2
+        exit "$code"
+    }
+    echo "[entrypoint] INIT_SCRIPT completed"
+fi
+
 # Setup NETRC if provided (for LSP)
 if [ -n "$NETRC" ]; then
     echo "$NETRC" > "$HOME/.netrc"
diff --git a/docs/agent-worker-e2e.md b/docs/agent-worker-e2e.md
new file mode 100644
index 0000000000..e1fd122b98
--- /dev/null
+++ b/docs/agent-worker-e2e.md
@@ -0,0 +1,131 @@
+# Running an agent worker locally, for e2e
+
+An agent worker reaches the database only through the API, so whole code paths
+(`Connection::Http`) are never taken by a normal `cargo run`. Exercising them
+needs a real one. Every step below has a failure mode that looks like something
+else; they are listed with the error each produces.
+
+## 1. Build with the right features
+
+Four features, and the agent's own mode gate is the one that is easy to miss:
+
+```bash
+cd backend
+cargo build --features quickjs,private,enterprise,license,agent_worker_server
+```
+
+- `agent_worker_server` mounts `/api/agent_workers/*` on the SERVER. Without it,
+  `create_agent_token` returns **404** with an empty body.
+- `enterprise` + `license` compile the agent MODE into the binary. Without them
+  the worker exits immediately with `Agent mode is only available in the EE`,
+  even though the server side works and mints tokens happily.
+
+Verify before spending time on the handshake — the panic string must be absent:
+
+```bash
+strings target/debug/windmill | grep -c "Agent mode is only available in the EE"   # want 0
+```
+
+**Pin this feature set for the whole session.** `target/debug/windmill` is one
+path shared by every feature combination, and cargo swaps the cached artifact in
+and out as the set changes — a `cargo build --features quickjs` (or any build
+with a different set) in another pane silently replaces the binary the server and
+agent are about to run, and the swap back "completes" in under a second, so it
+does not look like a rebuild happened. The symptom is the agent 401ing again
+after it had been working, or the EE panic reappearing. Re-run the `strings`
+check above whenever anything unexpected regresses, and start the server and the
+agent from the SAME build.
+
+## 2. Run the server without a local worker
+
+`MODE=server` so nothing else drains the queue and the agent is provably the one
+that ran the job:
+
+```bash
+DATABASE_URL=<this worktree's db> PORT=8420 MODE=server ./target/debug/windmill
+```
+
+## 3. Mint a token — with an expiry, and unquoted
+
+```bash
+TOK=$(curl -s -X POST localhost:8420/api/auth/login -H 'Content-Type: application/json' \
+  -d '{"email":"admin@windmill.dev","password":"changeme"}')
+
+AT=$(curl -s -X POST localhost:8420/api/agent_workers/create_agent_token \
+  -H "Authorization: Bearer $TOK" -H 'Content-Type: application/json' \
+  -d '{"worker_group":"agentgrp","tags":["dbt"],"exp":1900000000}' | tr -d '"')
+```
+
+Two traps, both of which surface as a bare `401` on the agent and a decoded
+reason only in the SERVER log:
+
+- **`exp` must be a real timestamp.** `"exp": null` mints a token the validator
+  rejects with `Missing required claim: exp`.
+- **The response is JSON, so it arrives quoted.** Keeping the `"` gives
+  `Base64 error: Invalid byte 34, offset 0` — hence the `tr -d '"'`.
+
+Pass the token **exactly as minted**. It looks like `jwt_agent_<jwt>` and the
+client appends its own hostname-derived suffix to form `jwt_agent_<suffix>_<jwt>`,
+which is what the server splits on. Adding a suffix yourself yields
+`Base64 error: Encoded text cannot have a 6-bit remainder`.
+
+## 4. Start the agent
+
+`WORKER_TAGS` must contain the tag the JOBS carry, not a tag you invent — a job
+whose tag nothing serves sits in `v2_job_queue` forever and looks like a hang.
+dbt scripts default to the `dbt` tag.
+
+```bash
+AGENT_TOKEN="$AT" BASE_INTERNAL_URL=http://localhost:8420 MODE=agent \
+  WINDMILL_DIR=/home/$USER/wmagent \
+  WORKER_GROUP=agentgrp WORKER_TAGS=dbt PORT=8499 ./target/debug/windmill
+```
+
+`WINDMILL_DIR` off `/tmp` matters on a dev box. Jobs fail with `IoErr: Disk quota
+exceeded (os error 122)` while writing the project's files, and `df` looks
+healthy — free space and free inodes both. `/tmp` is a tmpfs and Linux supports
+per-user quotas on it, so the limit is the user's, not the filesystem's; several
+agent sessions' caches under `/tmp` are enough to reach it. Point the worker at a
+real disk instead of trying to clean up under the quota.
+
+Confirm it registered rather than trusting a quiet log:
+
+```sql
+SELECT worker FROM worker_ping
+ WHERE worker_group = 'agentgrp' AND ping_at > now() - interval '2 min';
+-- ag-agentgrp-<host>-<rand>
+```
+
+## Reading failures
+
+The agent only ever prints `Agent worker cannot connect to server. Please check
+AGENT_TOKEN and BASE_INTERNAL_URL`. The actual reason is in the server log, from
+`windmill-api-agent-workers/src/ee.rs` — grep it for `JWT_AGENT auth error`.
+
+## Confirming the agent is what ran the job
+
+`worker` on the completed job starts with `ag-`:
+
+```bash
+curl -s -H "Authorization: Bearer $TOK" \
+  "localhost:8420/api/w/<ws>/jobs_u/completed/get/<job>" | jq -r .worker
+```
+
+## What dbt does on an agent worker
+
+Runs, retries, and publishes its graph — including a per-run snapshot for a
+dynamic descriptor, which it POSTs to `/api/agent_workers/dbt_graph/{workspace}`
+rather than writing itself.
+
+What it does not get is LIVE progress: the reporter tails a JSON event log and
+needs a SQL connection, so per-model state is settled from `run_results.json`
+when the run ends. Retry state lives only in the worker-local generation, since
+there is no database row to arbitrate against — which is why `state_dir` is keyed
+by principal.
+
+Confirming a run really exercised that path:
+
+```sql
+SELECT job_id, count(*) FROM dbt_node WHERE script_path = '<path>' GROUP BY job_id;
+-- a row keyed to the JOB id (not the zero UUID) means the agent published a snapshot
+```
diff --git a/docs/dbt-runtime.md b/docs/dbt-runtime.md
new file mode 100644
index 0000000000..dc06a22fa0
--- /dev/null
+++ b/docs/dbt-runtime.md
@@ -0,0 +1,1232 @@
+# Windmill as a dbt runtime
+
+Implementation spec for running an existing dbt project on Windmill with no
+changes to the project itself. Companion to [`pipelines-vs-dbt.md`](./pipelines-vs-dbt.md),
+which covers the opposite direction (native pipeline features that replace dbt).
+The two are complementary: this is the adoption ramp, that is the long game.
+
+Benchmark to beat is Airflow + [astronomer-cosmos](https://astronomer.github.io/astronomer-cosmos/),
+the dominant way dbt is orchestrated today.
+
+## Scope
+
+- **In**: run an unmodified dbt project synced into Windmill, one Windmill job per
+  invocation, live per-model observability, dbt models as first-class assets in
+  the existing asset graph.
+- **Out**: one Windmill job per dbt model, `state:modified` / slim CI,
+  `dbt docs` hosting, semantic layer, dbt platform integration.
+- **CE**: the runtime, the manifest ingest, the asset graph and every piece of
+  UI ship in CE, as do all adapters except two. Only the `mssql` and `oracle`
+  adapters are EE, mirroring the native `ScriptLang` boundary (decision 21).
+
+## Decision log
+
+| # | Decision | Resolution |
+|---|---|---|
+| 1 | dbt engine | Three-way toggle (`dbt-core-1x` \| `dbt-core-2x` \| `fusion`); shipped default `dbt-core-1x`, instance-configurable. See below |
+| 2 | Artifact shape | `ScriptLang::Dbt` |
+| 3 | Graph in v0 | Yes, both runtime and graph |
+| 4 | Execution granularity | One job per invocation |
+| 5 | Project storage | The project is the script's module bundle; nothing is cloned. See "Where the dbt project lives" |
+| 6 | Multiple run configs | Per-run `select` on one script; N scripts means N projects |
+| 7 | Run-time `select` | Descriptor default plus run-arg override |
+| 8 | Credentials | Workspace warehouses, plus `profiles.yml` passthrough. A descriptor never names a resource. See below |
+| 9 | Adapter mappings | postgres, redshift, mysql, snowflake, bigquery, databricks translate from their Windmill resource; **every** adapter dbt has is reachable from a `dbt_profile` resource, or the project's own `profiles.yml` |
+| 10 | Private repo auth | Not applicable: the project is synced, not fetched |
+| 11 | Asset kind | `dbt://<warehouse>/<schema>/<name>` — keyed on the relation, not on dbt's node id. See below |
+| 12 | Graph refresh | Deploy-time, re-ingested per run only when the descriptor is dynamic, plus an explicit `parse` of the editor's buffer. See below |
+| 13 | Manifest storage | Sidecar table for nodes/edges. Full manifest **not** stored — see below |
+| 14 | Metadata depth | Tests, strategy, tags, freshness, column descriptions. Column **lineage** is not in the manifest — see below |
+| 15 | Node rendering | Asset nodes per model plus one runnable node for the script |
+| 16 | Progress | Live, from the JSON event stream |
+| 17 | Test failures | Honor dbt's own `severity` |
+| 18 | Retry | Automatic node-level retry in-job, plus `dbt retry` as a run argument. See below |
+| 19 | Caching | Worker-local global cache, keyed by the project digest and the resolution the deploy pinned |
+| 20 | Images | Full images only |
+| 21 | Licensing | CE except the `mssql` / `oracle` adapters. See below |
+| 22 | Naming | Match Cosmos field names; importer deferred |
+| 23 | Descriptor | `wm_dbt.yaml` inside the project, OPTIONAL. See below |
+| 24 | Warehouse | Configured on the workspace by name, `main` by default. See below |
+
+## Decision 1: engine toggle, and why the shipped default is not Fusion yet
+
+`engine: dbt-core-1x | dbt-core-2x | fusion` in the descriptor. Omitted, it is
+`dbt-core-1x`, which runs today's projects untouched.
+
+No engine is baked into any image. Each is fetched or built on first use and
+cached, for a different reason in each case.
+
+| Engine | Distribution | Cold start | License |
+|---|---|---|---|
+| `dbt-core-1x` (default) | A uv venv resolved per adapter on first use, then cached. **Cannot** be baked: the adapter is a Python package chosen per project | One venv build per (core range, adapter) | Apache 2.0 |
+| `dbt-core-2x` | One adapter-agnostic Rust binary, fetched from GitHub releases on first use, cached | One download | Apache 2.0 |
+| `fusion` | **Never bundled.** Fetched from dbt Labs on first use, cached | One download (~290MB) | dbt Fusion engine license agreement |
+
+2.x is the one that *could* be baked, and deliberately is not: it is a
+pre-release (`2.0.0-alpha.5`) that nothing is defaulted onto, so baking it costs
+a layer in every image and a version pinned in two places with nothing keeping
+them in step. An operator who wants an engine pre-staged — an air-gapped
+instance, or a fleet that should not fetch per worker — populates
+`DBT_BUNDLED_DIR` (default `/usr/local/dbt`) with `core2x-<version>/dbt-sa-cli`
+in a derived image; the worker prefers it over its own cache.
+
+Two things to know before choosing 2.x: it is a pre-release, and it does not
+emit the per-node events the run page animates (see "Live per-model progress"),
+so a run on it reports its models only at the end.
+
+The 1.x venv resolves `dbt-core>=1.8,<2.0.0` *together with* the adapter rather
+than pinning a core version, because several adapters cap below the newest core
+(dbt-oracle and dbt-databricks below 1.12) and an independent pin makes those
+projects unprovisionable. The lockfile records whichever version the resolver
+actually chose. Both bounds and each engine version are env-overridable
+(`DBT_CORE_1X_FLOOR`, `DBT_CORE_1X_CEILING`, `DBT_CORE_2X_VERSION`).
+
+Fusion is the fastest option and the toggle exists so users can choose it. Two
+things block making it the *shipped* default, both verifiable rather than matters
+of taste:
+
+1. **Redistribution terms.** The Fusion license grants only a "limited,
+   non-exclusive, non-transferable, non-sublicensable" redistribution right, and
+   4.1 forbids introducing "obstacles or delays that have the effect of hampering
+   or interfering with (a) communication between Provider and End User, (b)
+   User's ability to view, access, or use the Product and/or any Account
+   Features." A sandboxed non-interactive job runner sits squarely in that
+   clause's path, and "may not share, pool, or relay its own login credentials to
+   any End User" reads directly onto putting one dbt platform token in a
+   workspace secret. That needs counsel, not an engineering judgment.
+   **Fetch-at-runtime is the mitigation**: the user's own instance pulls the
+   binary from dbt Labs directly, so Windmill never redistributes and never
+   interposes. Do not bake Fusion into any image.
+2. **Fusion is v2 semantics, and v2 drops all deprecated functionality.** Every
+   deprecation warning, including historic ones and those added in 1.10, must be
+   resolved before a project runs on it. An arbitrary existing dbt 1.x project
+   therefore may not run unchanged, which is this feature's entire premise. dbt
+   ships an autofix tool and Fusion/Core interoperate side by side, so it is a
+   migration users can do, but not one Windmill should silently require of them.
+
+Consequence: ship with `dbt-core-1x`, which runs today's projects untouched, and
+flip the instance default to `fusion` once counsel clears the runtime-fetch model
+and a real project is verified end to end on it. Both dbt-core engines are
+exercised by the e2e suite, so the flip is a config change, not a port.
+
+## Decision 21: mirror the native warehouse boundary, do not invent one
+
+Everything structural is CE: the executor, all three engines, the manifest
+ingest, the `dbt://` asset graph, live progress, the editor. The only gate is
+on two adapters, and it is not a dbt-specific policy — it is the same boundary
+the native script languages already draw. Since `bigquery` and `snowflake`
+became CE, the only warehouse `ScriptLang`s still behind a license are `mssql`
+and `oracledb`, so those two dbt adapters are EE and every other one (postgres,
+mysql, duckdb, snowflake, bigquery, databricks, redshift, clickhouse,
+salesforce) is CE. Gating any of the others would make reaching a warehouse
+through dbt stricter than reaching it natively, which is backwards.
+
+Those two are *recognized* (for the gate and for the pip package the 1.x
+engine's venv needs), but no Windmill connection resource translates into them:
+an `oracledb` resource is `{user, password, database}` with no
+host/protocol/service, and dbt-sqlserver needs an ODBC `driver` the images do not
+install. They reach their warehouse through a `dbt_profile` resource or the
+project's own `profiles.yml`, which is also how duckdb, clickhouse and salesforce
+work.
+
+Recognition is what the gate keys on, and it survives the open adapter set: a
+`dbt_profile` stating `sqlserver`, `mssql` or `oracle` resolves to the same
+`KnownAdapter` a resource type would, so it is gated identically. An adapter
+Windmill has never heard of is never enterprise — the boundary mirrors the two
+native warehouse languages, and an adapter with no Windmill runtime behind it is
+not one of them.
+
+The gate almost never fires in practice: `dbt-core-2x` supports neither adapter,
+so it can only apply to `dbt-core-1x` with one of those two.
+
+**The mechanism differs from the native languages.** They gate at compile time,
+so a CE binary simply lacks the executor. That is not available here: there is
+one dbt executor and the adapter is only known once the profile resolves. So it
+is a runtime check on the resolved adapter, at both deploy and run, and it must
+say what is wrong — a silent degradation that surfaces later as a connection
+error is worse than no gate at all.
+
+One trap: `ee_oss::LICENSE_KEY_VALID` is initialized to `true` in the OSS
+variant, so reading it alone passes on a CE build. The check is
+`cfg!(feature = "enterprise") && LICENSE_KEY_VALID`, which rejects both a CE
+build and an enterprise build whose key did not verify.
+
+## Decision 11: `dbt://`, keyed on the relation and not on the dbt node
+
+`dbt://<warehouse>/<schema>/<name>`, one `AssetKind`, where `<warehouse>` is the
+workspace warehouse's NAME, so two scripts running against the same warehouse
+agree on identity.
+
+The SCHEME names the producer, because dbt is the only thing that creates one of
+these: no other language derives warehouse relations, `// materialize` takes
+DuckLake targets only, and a dbt run does not dispatch. Calling the kind
+something generic promised a parity with native Snowflake and BigQuery scripts
+that does not exist.
+
+The PATH is the physical relation, and that is the load-bearing half. dbt-core
+has no cross-project `ref()`: two projects meet when one materializes a mart and
+the next declares it a `source`. Their dbt identities differ there —
+`model.a_pkg.orders` against `source.b_pkg.analytics.orders` — while the relation
+does not, so keying on `unique_id` would make every project an island and turn
+the handoff into two unconnected nodes. `unique_id` also embeds the package name
+from `dbt_project.yml`, which two unrelated projects may both call `analytics`,
+collapsing two different tables onto one node. The relation cannot collide that
+way. It is also what a DuckDB, Python, TS or Ansible script can name in a
+`// on dbt://…` annotation to join the lineage — those four are the languages
+with a body-asset parser; the native SQL ones cannot declare assets at all.
+
+A dbt run does **not** trigger those readers. See "no cascade from dbt" below.
+
+An ephemeral model (an inlined CTE, never written), an exposure, or a source that
+is not separately modelled has no physical relation and therefore no place in
+this namespace. If those ever prove worth rendering they need a key of their own
+— `unique_id` suits them, precisely because nothing else can refer to them.
+
+Two traps, both of which quietly defeat the point if handled wrong.
+
+**Identifier canonicalization.** `manifest.json` gives `relation_name`
+pre-quoted (`"windmill"."Analytics"."Orders"`), an annotation is written by hand,
+and the warehouses disagree on case: Snowflake folds unquoted identifiers up,
+Postgres folds them down, DuckDB compares case-insensitively. Two spellings of
+one table produce two nodes, no edge, and nothing looks broken in isolation. So
+one rule is applied in exactly one place — `parse_asset_syntax`, the single
+point where an asset URI becomes a graph key: strip the quote characters
+(`"`, backtick, `[`/`]`) from the schema and name, then ASCII-lowercase them,
+matching the case-insensitive identifier comparison the DuckDB paths already
+use. The warehouse-name prefix is spelled as the workspace configures it and
+stays case-sensitive.
+
+**Warehouse identity is the workspace warehouse's name**, exactly as
+`ducklake://main.orders` keys on the workspace lake's name — never the host,
+account or database. A descriptor cannot name a resource at all (Decision 24), so
+there is exactly one spelling per warehouse and the ambiguity a per-project
+resource would create does not arise. The warehouse names the default database
+too, so it stays out of the key; a model that *overrides*
+its database (Snowflake `database`, BigQuery `project`) is genuinely elsewhere and
+qualifies its schema segment as `<database>.<schema>`, so two same-named relations
+in different databases cannot collapse onto one node. A project that brings its own
+`profiles.yml` reports its target's database from that file, read with the same
+keys the renderer writes, so it spells a relation exactly as a workspace-warehouse
+project does and the two meet on one node. Only where the target leaves its
+database implicit does every relation qualify, because assuming they share one
+database is exactly what would collapse them.
+
+Three call sites derive this key: the manifest ingest that creates the node, and
+the live-progress and end-of-run paths that record status against it. They share
+one function, because a site that derives it differently records progress against
+a path no node has — the run still succeeds and the graph simply never moves. The same
+warehouse is reachable under several hostnames, and credential material has no
+business in an asset key. Accepted limitation, worth knowing before it is
+filed as a bug: **two workspace warehouses pointing at the same physical
+warehouse do not unify**, so assets under one will not share edges with assets
+under the other. Point both projects at one warehouse to link them.
+
+## Decision 24: the warehouse is a workspace setting, named, and the only one
+
+A descriptor names a warehouse by NAME (`profile.warehouse`, `main` when it names
+none) and cannot name a resource. Admins configure the warehouses under Settings
+→ dbt, where each entry points at a resource, exactly as `large_file_storage`
+points at the object-storage resource and a DuckLake names its catalog.
+
+**What a warehouse may point at.** Either a Windmill connection resource whose
+type `render_profile` translates (`postgresql`, `redshift`, `mysql`, `snowflake`,
+`snowflake_oauth`, `bigquery`, `gcp_service_account`, `databricks`), or a
+**`dbt_profile`** resource, whose VALUE IS one entry of that file's `outputs`
+map — `type` included, nothing lifted out or renamed. A block is copied from a
+working `profiles.yml` and pasted in, which is the whole point: a type that asked
+the user to restructure their block first would be doing the translation this
+exists to avoid. Its schema declares no properties, so the resource form renders
+one JSON editor over the value (`ResourceForm.svelte`). The picker is
+constrained to exactly these (`WAREHOUSE_RESOURCE_TYPES`); anything else has no
+way to become a target at all, which is why an unconstrained picker was a trap:
+it offered slack and github resources for a field that can only be a warehouse.
+
+The two exist for different reasons. A Windmill resource is the ergonomic path
+and is shared with everything else that connects to that warehouse, but it is
+*not* a dbt target: each adapter arm translates the fields Windmill's resource
+happens to carry into the keys dbt reads, so only what an arm covers can be
+expressed, and an adapter with no arm cannot be reached from one at all.
+`dbt_profile` inverts that — nothing is translated, so any adapter and any key it
+documents works.
+
+Which of the two a value is cannot be read off the value: both are objects with a
+`type`, and Windmill's bigquery resource is a service-account JSON that says
+`type: service_account`. So the warehouse carries its resource's TYPE
+(`DbtWarehouseConnection.resource_type`), and that is also what finally makes
+decision 9's "the resource type name is the authority" true at runtime rather
+than aspirational — the translated path resolved its adapter by sniffing
+connection fields until it had the name.
+
+**`dbt_profile` is open, deliberately.** Its `type` is not checked against a list:
+`DbtAdapter` carries an optional `KnownAdapter` beside the name, so the eleven
+adapters Windmill has facts about (a field mapping, a pip package, the license
+gate) keep them, and every other adapter dbt has — `trino`, `athena`, `spark`,
+whatever ships next — is carried by name and rendered, licensed and identified
+without Windmill knowing anything about it. A closed list would have made
+"whatever dbt supports" mean "whatever this enum lists", and each new adapter a
+Windmill release. The name is constrained to `[a-z0-9_-]` starting alphanumeric
+*because* it is open: it reaches a pip requirement and a venv path on the host,
+where a leading `-` is a flag and a `/` is a path segment.
+
+**Installing one is a separate question from using one.** `dbt-core-1x` fetches
+`dbt-<name>` from PyPI, `dbt-` is not a reserved prefix there, and that install
+runs through `run_tool` — outside the nsjail ordinary Python dependency
+installation uses, with uv executing a source distribution's PEP 517 backend. An
+unbounded name would therefore let a script author publish `dbt-<x>` and run code
+as the worker, on the one dependency path that is not sandboxed. So
+`ensure_adapter_installable` gates that install on `PUBLISHED_ADAPTERS` plus
+whatever an operator lists in `DBT_EXTRA_ADAPTERS`: the author chooses which
+adapter to use, the admin decides which packages this instance trusts. Nothing
+else is gated — a profile still renders for any adapter, and `dbt-core-2x` and
+`fusion` carry their adapters in the binary, install nothing, and take any
+`type` at all.
+
+Two keys are not passed through: `type` (Windmill writes the adapter's own dbt
+spelling) and `root_certificate_pem`, which is a PEM body rather than the path
+dbt hands the driver — it is written beside `profiles.yml` and pointed at by
+`sslrootcert`, as it is for a translated postgres resource. `profile.schema` and
+`threads` from the descriptor override their block keys rather than joining them.
+
+Three things follow, and they are the reason for the rule rather than
+consequences to work around.
+
+**A dbt project carries no connection.** The same project runs locally against a
+developer's own `~/.dbt/profiles.yml` and on Windmill against the workspace
+warehouse, with no Windmill-specific file in between and nothing to strip before
+committing it to a repository. This is what makes Decision 23 possible at all: if
+a project had to name its own resource, the descriptor could never be optional.
+
+**Asset identity has exactly one spelling.** Keying on a name is only sound
+because a name is all there is. Had both `profile.resource` and
+`profile.warehouse` existed, one physical warehouse would be reachable under two
+spellings and two projects on it would silently fail to share nodes — the exact
+failure Decision 11 exists to prevent.
+
+**dbt is unpermissioned, and the blast radius is bounded by construction
+instead.** The warehouse resource is read with NO permission check on the runner,
+exactly as `s3://` reaches the workspace bucket without the caller being granted
+the storage resource: configuring a warehouse is what makes it available, and
+anyone who may run a dbt script may build with it and read its models. What is
+reachable stays bounded because only an admin writes the setting and a descriptor
+cannot name a resource, only one of the names an admin configured.
+
+Per-relation rules were considered and rejected. `s3://` can enforce a path glob
+because Windmill mediates every object operation through its proxy; dbt has no
+such chokepoint — Windmill renders `profiles.yml` and dbt opens its own
+connection. A rule could only be a pre-run check against the manifest, and a
+`pre-hook`, a macro or `dbt run-operation` issues arbitrary SQL on the same
+connection, so it would stop the ordinary case while implying a guarantee it
+cannot keep.
+
+A project that brings its own `profiles.yml` still connects with it, and then
+names a warehouse only to say where its assets belong. The name must still match
+a configured warehouse — a typo is not identity, it strands the project's models
+on a node nothing else reaches — but it grants nothing, since nothing here is
+granted. It gets no identity by default, because defaulting to `main` would key a
+self-hosted profile's tables onto a workspace warehouse it never connected to.
+
+That label is worth having only because such a project spells its relations the
+same way: Windmill reads the target's database out of the project's own file
+(Decision 11), so a mart it builds and a workspace-warehouse project's `source`
+on the same relation land on ONE node. Without that the label would name a
+namespace and still share nothing, which is the failure it exists to prevent.
+
+An agent worker cannot read the database, so it resolves the name through a
+job-scoped API route. That route returns the resolved connection, which is why it
+requires a job token: a running job already holds those credentials in its
+rendered `profiles.yml`, and a browsable route would hand them to anyone. The
+same worker posts its per-model outcomes to a second job-scoped route, since the
+live reporter tails a log straight into the database and cannot run there. An
+agent's run page therefore fills in when the run ends rather than during it.
+Both routes are posted with the JOB's token: an agent's own credential
+authenticates only against the agent surface.
+
+## Decision 23: the descriptor is optional, and lives inside the project
+
+`<script>__dbt/wm_dbt.yaml`. An unmodified dbt project — one `cp -r` away from a
+developer's working copy, or a repository cloned as-is — is already a complete
+Windmill script: it runs the whole project against the workspace's default
+warehouse. The descriptor appears only when the project wants something
+Windmill-specific: run arguments, a named warehouse, an engine pin, a test
+policy.
+
+It lives INSIDE the project rather than beside it so that an author writes
+nothing outside the directory dbt itself reads. A dbt developer's working copy
+and a Windmill bundle are then the same directory, which is the whole bargain of
+Decision 5.
+
+Absent means an empty descriptor, never a missing script. `dbt_project.yml` is
+what identifies a project — the descriptor cannot, being optional — and three
+rules keep "absent" from reading as a change: the export omits an empty
+descriptor, the sync map gives BOTH sides the empty descriptor an absence means
+(so neither reads as an addition), and a pull deletes rather than writes one.
+Without all three a descriptor-less project either diffs forever or grows the
+very file this decision exists to avoid.
+
+## Decision 12: the graph refreshes with the deploy
+
+The project's files are the script's, so a deploy already sees exactly what will
+run: it parses the bundle and stores the graph. "Refresh" is just "redeploy". No
+manual button, no webhook, no separate mechanism.
+
+The one case that cannot be settled at deploy is a descriptor that is dynamic by
+construction: a `vars` value spelled with a `{{ placeholder }}`, or an `env`
+value spelled `$var:` (re-resolved every run). dbt vars can steer `enabled`,
+aliases, schemas, databases and materializations, so for those the deploy cannot
+know what will run and the graph is re-ingested from every run's own manifest,
+under that run's job id. A run that cannot refresh those rows fails rather than
+showing a stale graph. What the SCRIPT owns stays the deploy's — see "Which
+run's graph becomes what the script owns" for why the two cannot diverge.
+
+An agent worker reaches the database only through the API, so it POSTs the graph
+it parsed to `/api/agent_workers/dbt_graph/{workspace}` instead of writing it —
+which is why it needs no way to READ the stored relation root: it re-ingests
+every run, so its own run page shows the profile it actually used. What it
+publishes is that per-run snapshot alone — the path-keyed ownership rows are
+written by the deploy and by database-connected workers. Dynamic descriptors and
+Windmill-resolved profiles therefore both run there. What an agent does not get is LIVE progress —
+that is a per-model event stream, and a round trip per node is the wrong trade —
+so its per-model state is settled from `run_results.json` when the run ends, and
+its retry state lives only in the worker-local generation. See
+[agent-worker-e2e.md](./agent-worker-e2e.md).
+
+The refresh happens **before** the build, from a `dbt parse` with this run's own
+vars and env, so a run in flight is already showing the models it is building.
+
+A dynamic descriptor's graph is a property of the RUN, not of the deployed
+version, so it is stored per job — see "The graph belongs to a script version"
+below. Two concurrent runs of one such script therefore keep their own, and each
+run page shows the models that run built.
+
+Re-ingesting is nearly free: the run parses the project (about a second) before
+building it and ingests that manifest.
+
+The parse is what makes a newly added model appear in the same run that builds
+it, rather than one run late: the graph is written before the build, so the run
+page shows the model while it is being built.
+
+## What a share-link viewer sees
+
+A share link is not anonymous access: the token is HMAC'd with the workspace key
+and scoped to one job and its descendants. It is an extra grant for a **logged-in
+user who lacks access to that job** — which is normally why someone was sent a
+link.
+
+Both halves of a dbt run page go through one gate: `/jobs/run_progress/{id}` and
+`/jobs/dbt_graph/{id}`, each behind `require_job_read_access`, which validates
+the token. The graph then has a second, independent filter — RLS on the `script`
+row — and a viewer sent a link usually has no grant there. Deciding the graph's
+SHAPE under that filter is wrong: it would answer for the caller's access to the
+project rather than for the run they were given, and the Models panel would come
+back blank beneath working progress rows.
+
+So a pinned run resolves its version from the JOB ROW, not from `script`: the
+`live` CTE takes the path and hash the handler read after authorizing the job.
+Two things make that safe rather than a widening:
+
+- **It leaks nothing new.** `v2_job_completed.result` already carries every
+  node's `unique_id` and `relation_name`, and this viewer can read it — the
+  model set and its relations are already visible to them.
+- **`raw_code` is gated separately**, on an `EXISTS` against `script` in the
+  authed transaction. The body of a model is the project's source code and stays
+  behind access to the project, whatever the shape query resolved.
+
+The path and hash coming from the job row rather than the query also means a
+caller cannot pin one project's version while naming another's run.
+
+## What a dbt job returns, and which half of it is a contract
+
+The result is `{engine, engine_version, command, totals, nodes, invocation_args}`,
+and each node carries both `status` and `outcome`.
+
+`invocation_args` is the arguments the run used, as SUBMITTED — a `$var:` stays a
+reference, so no resolved value is published — and it is omitted when empty. It
+exists because a `dbt retry` restores the failed run's arguments inside the
+worker and never writes them back to the retry job, whose own args are just
+`{"command": {"label": "retry", "dbt_retry_job": "<id>"}}`: the row preview, which
+is a `dbt show` of the same project, has nowhere else to get them. On a retry it is therefore ANOTHER
+invocation's arguments, which is why a hidden run saves no state at all (see the
+retry section).
+
+`status` is dbt's own word, verbatim — `success`, `error`, `partial success`,
+`no-op`. It is what the log says and what dbt's docs describe, so it belongs in
+the result, but it is dbt's vocabulary and dbt may change it: 1.x and 2.x
+already differ on casing, and `no-op` arrived in a minor release.
+
+`outcome` is the same result in Windmill's terms — `passed`, `failed`, `warned`,
+`skipped`, `no_op`, `unknown` — and it is the half a downstream script should
+branch on. A dbt release that renames a status moves `status` and leaves
+`outcome` where it is. Publishing only dbt's word would have made every such
+release either a break for users or a lie in our mapping.
+
+## The graph belongs to a script version
+
+`dbt_node` / `dbt_edge` are keyed `(workspace_id, script_path, script_hash,
+job_id, unique_id)`. Each deployed version keeps its own graph, and a job records
+the version it ran (`v2_job.runnable_id`), so a run page asks for that one:
+`/assets/graph?dbt_script_hash=<hex>` renders the project as it was — its models,
+its SQL, its `ref()` lineage — instead of whatever is deployed today.
+
+`job_id` is the second half, and it exists for dynamic descriptors only. A
+`{{ }}` placeholder in `vars` can enable a different set of models per run, so
+those runs re-ingest; keyed by version alone, each re-ingest overwrote the last
+and reopening an older run showed the newer run's project, with any model only
+the older run built simply gone. A run of a dynamic descriptor therefore writes
+its own snapshot under its job id, and its page reads the graph through
+`GET /w/{w_id}/jobs/dbt_graph/{id}`, passing the version hash.
+
+A static descriptor writes nothing per run: its graph is the version's, under
+the zero-UUID `DEPLOYED_GRAPH` sentinel, and every run of it reads that. The
+sentinel is a value rather than NULL because `job_id` is in the primary key and
+Postgres does not treat two NULLs as one key, so a re-ingest would accumulate row
+sets instead of replacing one. The route falls back to it whenever the job has no
+snapshot, which is why a run page can use it unconditionally rather than having
+to know whether its descriptor was dynamic.
+
+Pinning to a run is job-scoped, so it is a job route and not a parameter on
+`/assets/graph`: it needs the whole job-read contract, which is
+`require_job_read_access`. That helper lives in `windmill-api`, which depends on
+`windmill-api-assets`, so the read moved to the check rather than the check to
+the read. The route charges `assets:read` on top of the `jobs:read` its URL
+implies, since the body it returns is asset data.
+
+A snapshot is only written when it DIFFERS from the version's graph, compared by
+a digest of the nodes, edges and relation root. Marking a descriptor dynamic is
+conservative — a `{{ }}` in `vars` says the arguments reach dbt, not that they
+change which models exist — so the usual dynamic run (a date var) resolves to
+exactly the graph the deploy stored, and storing that per run would duplicate an
+unchanging picture. Those runs write nothing and read the version's graph
+through the fallback; only a run whose model set really differs pays.
+
+### Which run's graph becomes what the script owns
+
+Re-ingesting has several causes and they do not want the same thing, so the
+reason is carried rather than a bool (`GraphRefresh`):
+
+| Cause | Graph written | Path-keyed `asset` ownership |
+|---|---|---|
+| Descriptor is dynamic (`{{ }}` in `vars`, `$var:` in `env`) | under the job id | untouched |
+| The run overrode `vars` | under the job id | untouched |
+| The run narrowed `select`/`exclude` | nothing, unless another cause already made it ingest — then under the job id | untouched |
+| The profile moved since the last publish | the **version's** graph | republished |
+
+Ownership follows the version's graph exactly, which is what the first three
+rows have in common: the workspace graph takes an asset's relations from the
+`asset` rows and its models, SQL, tests and `ref()` lineage from that version's
+`dbt_node`/`dbt_edge`, so publishing relations the version's graph does not name
+leaves those assets with no model behind them — a placeholder that moves an
+alias would empty the current graph of everything dbt contributes to it. A run
+storing a snapshot of its own therefore publishes nothing, and an override's
+schemas and aliases do not stand as the script's until the next deploy, which is
+what a snapshot is for.
+
+The consequence for a dynamic descriptor is that its ownership stays the
+deploy's, and a profile that moves under one is settled by a redeploy rather than
+by a run: every run of it already shows its own models and re-parses regardless,
+so the drift it keeps re-detecting costs it nothing it was not already paying.
+
+The last row is the one that has to publish. The drift check compares the
+resolved root against `relation_root_at_last_ingest`, so a run that saw a move and
+did not republish leaves the next run seeing the same move — forever, with the
+asset rows still naming the old schema and every run paying a `dbt parse` for a
+snapshot nobody reads. It rewrites the VERSION's graph rather than a per-run
+snapshot for the same reason: once the root is republished no later run detects
+the move, so a snapshot would leave those runs reading the pre-move rows.
+
+A snapshot wins where they meet: a drifted run that also overrode its arguments,
+or whose descriptor is dynamic, snapshots under its job id and publishes
+nothing, and the drift is settled by an ordinary run of a static descriptor or
+by a redeploy — a wasted parse per overriding run, where the alternative is one
+caller's subset standing as the script's own, or replacing the version's graph
+with a picture missing every model that run did not select.
+
+Both halves have a retention story, and they differ because their readers do. A
+run's snapshot expires on a clock — 30 days — because the run page that reads it
+is transient. A VERSION's graph cannot: its reader is every finished run of that
+version, and a run page is as old as its job. So version graphs are bounded by
+deploy COUNT instead — the newest 50 per path keep theirs — which makes growth
+`versions x models` rather than unbounded in time. Without it a CI deploying on
+every commit adds a full model set per commit and nothing ever reclaims it. The
+bound is generous on purpose: reaching it empties that version's run pages, so
+it exists to stop unbounded growth rather than to be hit in normal use.
+
+Both are pruned by every dbt run, so no background sweep has to know about the
+tables. The prune is
+deliberately not hung off the progress reporter, which exists only for engines
+that emit node events: retention that stops working because an instance chose
+Fusion is not retention. A version's own graph lives as long as the version.
+
+### The third provenance: a parse of the editor's buffer
+
+The dbt editor draws a graph of the project **as it is in the editor**, refreshed
+on demand by a `dbt_command: "parse"` job over the buffer — the deploy's own
+deps → parse → ingest path, with no build. That graph is neither of the two
+above: the buffer differs from what is deployed, which is the point of
+refreshing it, and a project being written may have no deployed version at all.
+
+So it is keyed to its own PREVIEW JOB with **no version** — `script_hash IS
+NULL` — and readable only back through that job id
+(`GET /jobs/dbt_graph/{id}`), never through the path. That is what keeps the
+property `GraphPublisher::Unversioned` exists for: a parse publishes no
+path-keyed `asset` usages and no relation root, so a principal who needs only
+`jobs:run` still cannot restate what a deployed project's graph says.
+
+Three consequences of the version being absent:
+
+* **`script_hash` is nullable**, so the primary keys of `dbt_node`, `dbt_edge`
+  and `dbt_graph_snapshot` became two partial unique indexes each — versioned
+  rows keyed by their version, editor rows by their job alone. The composite
+  foreign key to `script` is unchanged: `MATCH SIMPLE` is satisfied by a NULL,
+  so a versioned row still cascades with its version and a version-less one is
+  outside its reach. A partial arbiter also has to be named, so the marker's
+  `ON CONFLICT` repeats `WHERE script_hash IS NOT NULL`.
+* **Being outside that cascade, they need clearing by hand.** A route that
+  deletes the `script` rows outright reclaims the versioned graph through
+  `ON DELETE CASCADE` and deliberately locks nothing ahead of the script row;
+  a version-less row references nothing, so it would survive its own script.
+  The delete-by-path and bulk-delete routes therefore call
+  `clear_dbt_editor_graphs` — AFTER the delete, beside the retry state, since
+  every dbt writer takes the script row first and a sidecar taken ahead of it
+  deadlocks one of the pair. Archiving clears neither: it leaves the `script`
+  row, and both graphs still answer for finished runs.
+* **No digest suppression.** A run's snapshot that matches the version's stores
+  nothing and reads the version's back; an editor parse always stores, because
+  the editor pins to its own job and a suppressed write leaves it nothing to pin
+  to — and its provenance label would then claim a parse that is not on screen.
+* **Bounded per (path, PRINCIPAL), not by age**: the newest
+  `DBT_EDITOR_GRAPHS_KEPT` parses of one script by one identity keep their
+  graph, dropped as each refresh lands, since the ones before it are dead the
+  moment a newer parse arrives. The principal is load-bearing rather than
+  incidental — a preview's PATH is chosen by a caller who needs only `jobs:run`,
+  so a count bounded per path alone is a way to retire the graphs of whoever is
+  actually editing that script. `permissioned_as` is the execution principal the
+  queue derived, which is why `dbt_run_state` keys on it too. The instance-wide
+  age sweep every dbt run performs still catches one refreshed once and left.
+
+A `parse` of a job that DOES name a deployed version — the scriptable form, from
+a flow or the CLI — writes an ordinary per-run snapshot of that version instead,
+suppressed when it agrees with the deploy. Either way it publishes no ownership:
+a parse answers for the arguments it was given, so it can no more stand as what
+the script owns than an overriding run can.
+
+Which graph is on screen is stated rather than left to be inferred — "parsed
+from the editor at 14:32" against "as of last deploy" — from
+`dbt_graph_ingested_at` on the graph response. The two are drawn identically, so
+without the label the ambiguity the explicit refresh removes would just move
+into the editor.
+
+A parse renders `profiles.yml` before dbt runs, so it needs a resolvable
+warehouse and a misconfigured project fails a refresh the way it would fail a
+run. That is useful early feedback, and the empty state says so.
+
+Per DEPLOY, not per run: ten thousand runs of one version share one graph. The
+rows carry a composite foreign key to `script (workspace_id, hash)` with
+`ON DELETE CASCADE`, so a version's graph dies with the version and nothing has
+to sweep it.
+
+The routes that hard-delete a script rely on exactly that for the VERSIONED
+rows and clear none of them. Clearing them first would lock the sidecars ahead
+of the `script` rows, the reverse of the order a publication takes — `script`
+row `FOR UPDATE`, then the sidecars — and Postgres would abort one of the two
+for deadlock. So anything the cascade cannot reach is cleared explicitly and
+AFTER the delete, which keeps that order: `dbt_run_state` (keyed by path, no
+script key), and the version-less editor graphs, whose NULL `script_hash`
+satisfies the composite key without referencing anything (see "The third
+provenance" above). `dbt_run_progress` (keyed by job, no key to either) is
+reclaimed only by its age sweep.
+
+Two consequences worth knowing:
+
+* **Concurrent deploys no longer race for the graph.** Two versions write
+  disjoint rows, so neither can lose. `claim_graph_publication` survives only for
+  what is still keyed by PATH — the `asset` usage rows, of which there is one set
+  per script — and an older deploy finishing late now records its own graph
+  before declining to touch those.
+* **A pinned request is scoped differently.** Unpinned, the endpoint scopes by
+  the relations in view, using `asset`. Pinned, `asset` is the wrong scope: it
+  describes the current deploy, so a model that version had and a later one
+  dropped would be filtered out of its own run's graph. The pinned version's
+  nodes are the scope instead.
+
+## No cascade from dbt, and no pipeline membership
+
+A finished dbt run does not trigger anything. Its models are recorded, drawn and
+tracked; they do not fan out.
+
+A dbt script is also not a pipeline member (`in_pipeline` is forced false for
+`ScriptLang::Dbt` at deploy). It materializes warehouse tables, so it looks like
+one, but that membership carries an editor whose premise is that you author the
+transforms in it — and a dbt project is authored in a local `dbt run` / `dbt
+test` loop, with Windmill as the runner and the viewer. Enrolling it put a dbt
+project inside the pipeline editor and blurred which of the two a folder holds.
+Its models are `dbt://` assets in the shared graph regardless: that is what
+puts a native script reading one of them on the same node, and it is independent
+of pipeline membership.
+
+dbt already orders its own DAG, so a cascade would only ever add one thing:
+waking a Windmill script that reads a mart. That edge is real but narrow, and
+only half of it exists — nothing outside dbt can declare a `dbt://` write
+(`// materialize` accepts DuckLake targets only), so the reverse direction, an
+ingestion script waking a dbt project, cannot be expressed at all.
+
+Against that, dispatching correctly from dbt is not cheap. A run's `select` can
+build any subset of the project, so the deploy-time write set is not what ran;
+using it wakes consumers of relations the run never touched, and narrowing it
+needs a per-job record of what was built, which the per-relation state table
+cannot supply (it keeps one row per relation, stamped with the last writer).
+
+So dbt materializes and reports, and `asset_dispatch` returns early for
+`ScriptLang::Dbt`. A `# on dbt://<mart>` subscription is refused outright at
+deploy rather than accepted and left dormant — an edge drawn on the canvas that
+can never fire is worse than an error saying so.
+
+A plain READ still renders the consumer beside the model, which is what makes
+the lineage one graph — but it is written in the script's own code, not in a
+comment: the body parsers resolve an asset URI from a string literal
+(`parse_asset_syntax`), so `"dbt://<resource>/<schema>/<name>"` appearing in a
+Python, TS/Bun/Deno, DuckDB or Ansible script is the read. Those four are the
+languages with a body-asset parser; the native warehouse ones (snowflake,
+bigquery, postgresql, mysql, mssql) declare no assets at all today, so a mart
+they consume joins the graph only once that inference exists. Wiring the trigger up later means deciding what a
+selective run should notify — that decision is the work, not the plumbing.
+
+## Live per-model progress, and why only dbt-core 1.x has it
+
+`DbtEngine::emits_node_events()` is true for `dbt-core-1x` alone, so only 1.x
+moves nodes on the run-page graph while it builds. The other two engines settle
+every relation at the end instead.
+
+That is a statement about **where** the engines put their events, not about
+whether they produce them. Both Rust engines emit exactly the structured node
+events the tailer parses:
+
+```
+$ dbt-sa-cli build --log-format json   # and likewise the fusion binary
+{"info":{"name":"NodeStart"},"data":{"node_info":{
+  "node_status":"started","unique_id":"model.probe.m3",
+  "node_relation":{"relation_name":"windmill_dbt_runtime.probe_sch.m3", ...}}}}
+```
+
+Measured on 2.0.0-alpha.5 and fusion 2.0.0-preview.202, a three-model project:
+15 node events each on the console, 0 in the file log. `--log-format-file json`
+is accepted by both — `json` is a listed value — and ignored: the file is text
+either way.
+
+The events are therefore only on stdout, which is the human-readable job log.
+Taking them would mean setting `--log-format json` and rendering the log
+ourselves from each event's `info.msg`, so the run's log stays readable. That
+buys live progress on two pre-release engines at the price of permanently owning
+log presentation, to work around something upstream has already declared it
+intends to support. Not worth it: when either engine honours
+`--log-format-file json`, flipping `emits_node_events()` is the whole change,
+and the existing tailer starts working untouched.
+
+A finished run is unaffected on every engine — it is coloured from the run's own
+result, not from these events (decision 11's note on `run_progress`).
+
+## Where the dbt project lives
+
+**In Windmill.** One dbt project is one Windmill script: the script's content is
+the descriptor, and the project's files ride with it as its module bundle, a
+path-keyed map the worker materialises into the job directory before invoking
+dbt. There is one way to do this. Nothing is cloned, so there is no repository
+resource, no ref, no commit and no clone cache.
+
+A team whose repository must stay canonical keeps it: git-sync points at that
+repository and pushes it into the workspace, so the repository still holds the
+truth and Windmill receives the project. A team with no repository at all pushes
+straight from a working copy.
+
+### On disk, the project is a canonical dbt project
+
+`wmill sync pull` writes the bundle verbatim, so the tree under the module folder
+is exactly what dbt expects, with the extensions dbt expects:
+
+```
+f/analytics/
+└── analytics__dbt/                 the module bundle: the project, unmodified
+    ├── wm_dbt.yaml                 the descriptor (the script's content) — OPTIONAL
+    ├── dbt_project.yml
+    ├── packages.yml
+    ├── models/staging/stg_orders.sql
+    ├── models/marts/_marts__models.yml
+    ├── macros/cents_to_dollars.sql
+    ├── seeds/country_codes.csv
+    └── snapshots/orders_snapshot.sql
+```
+
+Import is therefore a copy, never a transformation:
+
+```
+cp -r my-dbt-project/. f/analytics/analytics__dbt/
+wmill sync push
+```
+
+The descriptor is optional, and nothing above it is authored: an unmodified dbt
+project is already a complete Windmill script, running the whole project against
+the workspace's default warehouse. `wm_dbt.yaml` appears only when the project
+needs something Windmill-specific — run arguments, a named warehouse, an engine
+pin — and it lives inside the project so that a dbt developer's working copy and
+a Windmill bundle are the same directory.
+
+Locally, dbt runs against the bundle with `--project-dir analytics__dbt` (or a
+`cd`), which is what a monorepo holding several dbt projects already does, and
+what dbt Cloud exposes as its "project subdirectory" setting.
+
+**Why a module bundle rather than one script per model.** Models as scripts was
+considered and rejected on three counts. A Windmill path admits no dots, and the
+CLI rejects bare `.sql` as ambiguous (`.pg.sql`, `.duckdb.sql`, … are the
+convention), so a model could only be typed by its location inside the project,
+which breaks the rule that extension determines language. dbt resolves `ref()`
+project-wide and cannot run a model alone, so each model job would reassemble
+and reparse the whole project anyway. And `schema.yml` describes many models at
+once, so splitting models into objects while their tests and docs stay in shared
+YAML puts a model's contract in a different object. The bundle keeps the project
+whole, and per-model execution is offered as an action on the graph node
+(`--select <model>+`) rather than as a separate object.
+
+What that costs, stated plainly: a model has no permissions or version history of
+its own. The unit of both is the project.
+
+### Consequences
+
+**The version is the script version.** Deploying the script deploys the project
+atomically; rollback is redeploying a previous version. The lockfile keeps the
+resolved engine and adapter versions and the manifest digest.
+
+**Windmill holds the files, so the graph can show them.** A model's compiled SQL
+is readable from its node in the asset graph. A dbt project has its own editor —
+the file tree, the descriptor, the run arguments and the model graph, which is
+the artifact's actual shape — but it is not where a dbt project is developed:
+that is a CLI loop against a local warehouse (`dbt run --select`, `dbt test`).
+Windmill is the runner, the viewer and the place a project is corrected.
+
+**Two scripts against one project means two copies.** Splitting a project across
+scripts, so an upstream selection and a downstream one compose, assumed a shared
+repository. With bundles they would duplicate the project and drift. Prefer one
+script per project with per-run `select`, and treat two scripts as two projects
+(decision 6).
+
+**Seeds are the only thing that can bloat a version.** Measured on real dbt code,
+`.sql` files run about 500 bytes median and 1.9 KB at p90, so even a 5000-model
+project is a few MB before compression. A single committed CSV can exceed all of
+it, so the CLI drops any file over 5 MB from the bundle and says which, rather
+than counting models.
+
+**Only text is carried.** A dbt project's authored files are text; a binary one
+(an image under `docs/`, a stray `.DS_Store`, a parquet seed) is skipped with
+the reason. Left in, it would be read as mojibake and, if it carried a NUL,
+rejected by Postgres with an opaque `unsupported Unicode escape sequence`.
+Binary is detected the way `git` does it, by a NUL in the first 8000 bytes,
+because `docs/` and dotfiles do not follow extensions. The push, the staleness
+hash and the sync diff share one predicate: a file one drops and another keeps
+is a change no push can resolve.
+
+**Secrets are not carried.** `.env`, `.env.*` and `.envrc` are skipped with the
+reason. The import above copies whatever the checkout holds, and what a
+`.gitignore` was keeping out of the repo is exactly the file that must not
+become a script version, readable by anyone who can read the script and handed
+back on every pull. dbt does not read them either — `env_var()` takes the
+process environment, which Windmill fills from the descriptor's `env` and the
+script's environment variables.
+
+**`dbt_project.yml` is rendered before it is read.** dbt allows `env_var()` in
+that file, so a project may name its profile or its packages directory through
+one. Windmill renders those two settings against the environment the run gives
+dbt before acting on them: reading the template instead leaves a rendered
+`profiles.yml` keyed under a name dbt never looks up, and a package cache
+watching a directory `dbt deps` never fills.
+
+## The script artifact
+
+New `ScriptLang::Dbt`. Content is a YAML descriptor whose field names track dbt's
+and Cosmos's vocabulary so the mental model ports without translation:
+
+```yaml
+engine: dbt-core-1x               # or dbt-core-2x | fusion
+profile:
+  warehouse: main                 # a warehouse configured on the workspace, by
+                                  # name; omitted takes `main`
+  target: prod
+  # schema: marts                 # target schema; REQUIRED for BigQuery, whose
+                                  # resource is a service-account JSON with no
+                                  # dataset in it
+  # profiles_yml: profiles.yml    # alternative: keep your own file; it then
+                                  # names a warehouse only to say where its
+                                  # assets belong (see below)
+select: ["tag:nightly+"]
+exclude: []
+test_behavior: build              # build | after_all | none
+vars:                             # typed: numbers/bools/lists keep their type,
+  run_date: "{{ run_date }}"      # and string leaves take job arguments
+  strict: false
+threads: 8
+full_refresh: false
+env:                              # for the project's own `{{ env_var() }}`
+  DBT_PASSWORD: $var:u/rf/wh_password
+```
+
+`env` values spelled `$var:<path>` are resolved to that Windmill variable, so a
+project keeping its own `profiles.yml` never needs a credential written into the
+descriptor — which is versioned script content. Both this map and the script's
+own environment variables apply to the deploy-time parse as well as the run, so
+an `env_var()` feeding a schema, alias or `enabled` produces the same relation
+in the stored graph and in the build either way. Prefer the descriptor's `env`
+when the value belongs to the project rather than to one deployment of it: it is
+versioned with the descriptor, so a redeploy from git carries it.
+
+`select`/`exclude`/`selector` are passed **verbatim** to dbt. Do not reimplement
+the selector grammar; Cosmos's manifest path had to, and it is a recurring source
+of divergence. One thing is decided before dbt sees them: a run that spells out
+`select` or `exclude` drops the descriptor's `selector`, because dbt resolves
+`--selector` *instead of* `--select` and passing both would silently build the
+descriptor's nodes rather than the ones the run asked for. "Spells out" means
+DIFFERS from the descriptor's own value, not merely "was submitted": the
+generated run form posts a default back for every field left untouched, and a
+selector descriptor's `select` default is `[]`, so reading a submitted `[]` as
+an override dropped `--selector` from every run started from the UI, a schedule
+or a webhook and built the whole project. A run that wants the whole project
+despite the selector asks for it with a selection that differs — `["*"]`.
+`select` and `vars` are overridable per run via job args. The **graph** stays the
+deployed descriptor's: asset rows are written at deploy, like every other
+language's, so a run-arg override changes what gets built without changing what
+the graph says the script owns. Split the project into several scripts
+(decision 6) when the graph itself should differ.
+
+A `vars` override does re-ingest — vars steer `enabled`, aliases, schemas and
+materializations, so the deployed graph would name another run's relations — but
+under the job id alone, never as what the script owns: publishing an override's
+relations would leave them recorded for the next default run, which then builds
+the descriptor's while the graph shows the override's. See "Which run's graph
+becomes what the script owns" for the whole table, including the profile move
+that is the one cause a run publishes.
+
+`vars` interpolates from job args with `interpolate_template` (`common.rs`,
+shared with the Ansible executor). The syntax is `{{ arg_name }}`.
+
+`select`/`exclude` also scope **what the script owns in the graph**, resolved by
+asking dbt (`dbt ls --output json`) rather than by interpreting the selector
+string. Without that a narrowly-selected script registers as the producer of
+every model in the project, and two scripts splitting one project would each
+claim all of it. Running several scripts with different selections only composes
+because of this.
+
+## Deploy path
+
+New `ScriptLang::Dbt` arm in `worker_lockfiles.rs` (near the `ScriptLang::Ansible`
+arm at :2758), producing:
+
+```rust
+struct DbtDependencyLocks {
+    manifest_digest: String,
+    engine: String,
+    engine_version: String,
+    adapter_version: Option<String>,
+    package_lock_digest: Option<String>,
+    profile_relation_root: Option<String>,
+}
+```
+
+Steps: write the script's modules into the job directory, `dbt deps`, `dbt parse`
+for the manifest, then ingest.
+
+Ingestion writes the rows the native parser writes, via
+`replace_static_asset_usage` (`windmill-common/src/assets.rs:254`) into
+`asset (workspace_id, path, kind, usage_access_type, usage_path, usage_kind, columns)`.
+The language dispatch point is `parse_assets_for_lang`
+(`windmill-api-scripts/src/asset_inference.rs:33`).
+
+**The one architectural wrinkle.** Every other language's asset parsing there is a
+pure function of script content. dbt's needs the bundle on disk and a dbt
+invocation, so it cannot run inline: it runs as a deploy-time job, persists the manifest, and
+`parse_assets_for_lang` reads the persisted result. **Prototype this first**, it
+is the assumption most likely to reshape the phasing.
+
+### Dependencies resolve at deploy, and are pinned for every run
+
+A project declaring `packages.yml` ranges or a mutable git revision asks dbt to
+*resolve* them, and dbt re-resolves on every `dbt deps`. Windmill resolves once, at
+deploy, and pins the result — the same contract every other language's lockfile
+gets here.
+
+The deploy records the digest of the `package-lock.yml` dbt produced into
+`DbtDependencyLocks`. That digest keys the worker-local package cache and joins the
+run identity that gates `dbt retry`. A run restores the tree under that key; a worker
+that resolves anything else is refused rather than run, because accepting it would let
+one resolution's `run_results.json` decide what a retry rebuilds.
+
+Only a run has a resolution to be held to. The deploy establishes one and accepts
+whatever dbt returns — including a `package-lock.yml` dbt rewrites itself, which it
+does whenever the `sha1_hash` it stored for `packages.yml` no longer matches. Holding
+the deploy to a committed lock would refuse the first deploy after a package is added,
+with no way out, since redeploying resolves the same way again.
+
+Consequences worth knowing before choosing whether to commit a lockfile:
+
+- **To pick up a newer version of a ranged dependency, deploy a CHANGE.** Only a
+  deploy re-resolves, and an unchanged push is skipped as a no-op — the lock and the
+  schema are both derived, so they are compared as they would be stored rather than
+  as they arrive. Editing `packages.yml`, or committing the `package-lock.yml` you
+  want, is what moves a pinned resolution.
+- **A committed `package-lock.yml` lets a deploy hit the cache**, since it is the
+  digest the lookup is keyed on before `dbt deps` has run. A project without one, or
+  whose committed lock is not what dbt resolves, pays a real `dbt deps` per deploy.
+  This is dbt's own recommendation for the same reason.
+- **The refusal is per worker, not per script.** `dbt deps` writes its lock into the
+  job directory, so a project with a range and no committed lock reproduces its
+  resolution only from a cache hit. Once upstream publishes a new version, that
+  script keeps running on every worker already holding its tree and fails on the
+  first cold one — same commit, same arguments, different outcome by worker. A
+  deploy that changes something re-pins and clears it; committing the lock avoids it
+  entirely.
+
+Nothing evicts these worker-local caches — package trees, engine installs and retry
+state alike — and `cache_clear` does not reach them either: it removes
+`$WINDMILL_DIR/cache/`, while all three live under `$WINDMILL_DIR/cache_nomount/`,
+as bun's cache does. An operator reclaims them by deleting that directory. Engine
+installs dominate the space by two orders of magnitude (~270–290 MB each, bounded
+by engine version) and package trees grow one tree per edit of a project that
+declares packages. Sweeping either on an age or a size bound is follow-up work.
+
+## Run path
+
+One `dbt build` per job, the shape Cosmos arrived at with `ExecutionMode.WATCHER`
+after per-model Airflow tasks proved roughly 6x slower (about 5.5 minutes for one
+`dbt run` versus about 32 minutes for 184 per-model invocations on
+google/fhir-dbt-analytics). dbt's own threading provides parallelism; Windmill
+provides observability.
+
+### The run's arguments are one command block
+
+A run takes a single `command` argument, plus one argument per `{{ placeholder }}`
+the descriptor interpolates. `command` is a `oneOf` whose variant IS the command,
+so it carries exactly the overrides that command takes:
+
+```jsonc
+{"command": {"label": "build", "select": [], "exclude": [], "vars": {}, "full_refresh": false}}
+{"command": {"label": "retry", "dbt_retry_job": "019fb410-8ea9-…"}}
+{"command": {"label": "show",  "model": "stg_orders", "vars": {}, "limit": 100}}
+{"command": {"label": "parse", "vars": {}}}
+```
+
+`show` and `parse` are accepted by the worker but are not run-form variants:
+each is a thing to do to the project in front of you rather than a job to fill a
+form in for, and the graph, the assets list and the dbt editor are where they
+live. Both stay reachable from a flow, the CLI and the API, which is what makes
+the editor's refresh scriptable and testable rather than a UI-only affordance.
+
+The union is the point: `dbt_retry_job` is required where it means something and
+absent everywhere else, `show` takes the ONE model it previews rather than the
+`select`/`exclude` pair that narrows a build, `full_refresh` cannot reach a
+command that ignores it, and
+the run form renders a toggle over the variants rather than a list of fields that
+quietly do nothing. The worker spreads the block over the run's arguments to read
+them — `label` becomes `dbt_command` — which is why a `{{ placeholder }}` may not
+take one of those names (`RESERVED_ARG_NAMES`). What a run SUBMITTED keeps the
+block, since that is what `dbt_run_state` saves and `invocation_args` publishes.
+
+1. Materialise the script's modules into the job directory, restore
+   `dbt_packages/` from cache.
+2. Render `profiles.yml` from the resource, or use the project's own file with
+   Windmill secrets injected as env vars for `{{ env_var() }}`.
+3. `dbt build --log-format json` plus `select`/`exclude`/`vars`/`threads`.
+4. Stream events: each `NodeFinished` updates per-model status live and emits
+   `RecordMaterializationRequest` (`windmill-common/src/materialization.rs:53`),
+   which already carries `asset_kind`, `asset_path`, `partition`, `status`,
+   `row_count`, `job_id`, `error`, `schema`. `run_results.json` supplies all of it.
+5. Structured job result (per-model status, timing, rows, failed tests), not just
+   an exit code. Partial failure is dbt's normal case and must be legible without
+   reading logs.
+6. **Node-level retry.** `retry_failed_nodes: {attempts, delay_seconds}` in the
+   descriptor rebuilds only what a failed build left failed or skipped, in the
+   same job, before reporting failure. dbt confines a failure to its own
+   subtree, so a transient warehouse error costs those nodes rather than the
+   project. In-job is what keeps the state question out of it: the previous
+   attempt's `run_results.json` is still in the job directory, so there is
+   nothing to persist and no worker to land back on. This is the granularity
+   astronomer-cosmos gets from one Airflow task per model, without the ~6x that
+   per-model tasks measured (decision 4).
+
+   A retry's `run_results.json` names only the nodes it redid, so it overlays
+   the accumulated results rather than replacing them: the job's result must be
+   every node the job touched, or the nodes that succeeded before the retry
+   settle no materializations.
+
+7. `dbt retry` resumes from the failure point using `run_results.json`, which is
+   what makes one-job-per-invocation defensible. It is saved twice: to the
+   worker's local cache, and to `dbt_run_state` in the database, so a retry
+   works from any worker with a database connection. An agent worker reaches
+   the database only through the API, which does not expose this, so it keeps
+   only its own local copy; the automatic node retry is refused there for the
+   same reason, since its wait could not observe a cancellation. Only `run_results.json` is stored there.
+   `dbt retry` also needs `manifest.json`, roughly sixty times larger and
+   growing with the project (732 KB against 12 KB on a six-node fixture), but
+   the manifest is a pure function of the project files, vars and env — all of
+   which the stored identity already pins — so a worker restoring from the
+   database re-derives it with a `dbt parse` of about a second. It is a run
+   argument (the `retry` command variant) rather than the automatic behavior of
+   Windmill's generic retry, which has no per-language hook to change the invoked
+   command.
+   Each attempt gets a fresh job dir, so the previous run's `target/` is cached
+   per (workspace, script) on the worker and restored for a retry.
+
+   **Naming the run.** The `retry` variant requires `dbt_retry_job`, the id of
+   the run to resume, and the worker refuses one that is not the run it holds —
+   naming both ids, since "that is not the one" is otherwise indistinguishable
+   from "nothing is saved". Only the latest failure of a script is kept, so an
+   unnamed retry would mean "whatever failed last" and would quietly resume a
+   different run than the caller was looking at. The run page's `Resume this run`
+   and `Run again → dbt retry with same args` both fill it in; on the run form,
+   choosing `retry` prefills it with the run that caller's own retry would land
+   on. It is not a selector: naming a run other than the saved one is refused,
+   not resumed.
+
+   **Concurrency is the script's, not the retry's.** A retry that starts while
+   another run of the same script is in flight rebuilds nodes that run may also
+   be rebuilding — appending an incremental model twice. That is what two
+   concurrent `build`s of one project do as well: dbt takes no cross-process
+   lock, so a project that must not run twice at once sets the script's
+   concurrency limit, which covers its retries with it. A lock held across a
+   dbt execution instead would outlive worker deaths and cancellations.
+
+   **Who may resume it.** The state is keyed `(workspace, script_path,
+   permissioned_as)` — one saved run per script per identity it executes as — so
+   anyone entitled to run the script as that principal may resume its last
+   failure, which is the same capability as re-running that job: running the
+   script requires read access on it, and that access shows them the run and its
+   arguments already. Naming the run neither widens nor narrows that; the id is
+   checked against what the state holds, not against the caller.
+
+   For an `on_behalf_of` script that means every caller shares one saved run,
+   since they all execute as the owner — deliberately, since the state describes
+   the script's last run under the owner's identity rather than any one caller's.
+
+   **What a retry actually adds, and where that crosses a line.** Resuming grants
+   no capability a caller lacks: they may already run the script as that principal,
+   and a plain run builds everything the descriptor selects, of which a retry
+   rebuilds a subset. The one thing it adds is information — the result carries
+   `invocation_args`, the resumed run's arguments as SUBMITTED, because a retry
+   job's own args are just the command and the run it names, and the row preview
+   needs the real ones.
+
+   For almost every shape the caller could already read that run, so nothing
+   crosses: under `f/`, `see_folder_extra_perms_user` makes a job readable to
+   everyone with read on the folder, which is also what grants execution; an
+   ordinary script's runs are `permissioned_as` the caller, and another user's runs
+   are keyed under their own principal and unreachable. It takes all three of a
+   `u/<owner>` path, `extra_perms` sharing and `on_behalf_of` for "may run as this
+   principal" to be broader than "may read this principal's jobs" — and there a
+   grantee learns the literal argument values of another's run. References stay
+   references, so no resolved secret is among them.
+
+   That residual is accepted rather than gated. A gate needs the caller's identity,
+   and a worker has only `created_by` — `display_username()`, which a token LABEL
+   supplies. Resolving it as a username denies every labelled token (a CI token
+   becomes `label-<name>`, which is no workspace member) and still trusts a name;
+   authorizing where the caller is real means the submitting path, not the worker.
+   The exposure did not justify either.
+
+   That equivalence holds only while the run is READABLE, so the one run that
+   breaks it saves nothing: a job pushed `invisible_to_owner` is hidden from the
+   script's owners, and a retry publishes the arguments it restored, which would
+   make that retry the one way to see them. A hidden run therefore keeps no
+   retry state at all — it cannot be resumed by anyone, including whoever
+   launched it, which is the cheaper half of the trade. Keying by the initiating
+   caller would not have worked instead: `created_by` is `display_username()`,
+   which a token LABEL supplies, so two callers can share one value and one can
+   name a third person (GHSA-8x8x-88qc-qp4r, whose fix was to stop trusting that
+   name for authorization). A retry does name the run it resumes, but that name is
+   checked against the saved state rather than authorized as a job read — doing
+   the latter, which is what would let a hidden run be resumed by its own author,
+   needs the submitting path, where the caller is real.
+8. Test failures honor dbt's `severity`: `error` fails the job, `warn` surfaces
+   without failing. Overriding this would make the same project behave differently
+   on Windmill than locally, breaking the core promise.
+
+## Two decisions the implementation narrowed
+
+**Decision 13 — no S3 copy of the manifest.** The sidecar holds every field the
+graph renders; nothing reads a stored `manifest.json`, so writing one to S3
+would be an unread copy of data that is already reproducible by redeploying (or,
+for a dynamic descriptor, by the next run). Worth adding the day something needs the
+parts the sidecar drops — compiled SQL, macro definitions — and not before.
+
+**Decision 14 — column lineage is not available.** The decision assumed
+`manifest.json` carries column-to-column edges; it does not, in either core
+engine. What it does carry is declared column *descriptions*, which are
+ingested. Real column lineage would need Fusion (which does static analysis) or
+a SQL-AST pass of our own, so `columnLineageGraph.ts` is not wired up for dbt.
+
+## Concept mapping
+
+| dbt | Windmill | Mechanism |
+|---|---|---|
+| model relation | `dbt://` asset | new `AssetKind` |
+| `ref()` graph | lineage edges | `replace_static_asset_usage` |
+| `materialized: table` | `materialize_strategy: replace` | `AssetGraphRunnableNode` |
+| `materialized: incremental` | `append` or `merge` (by `unique_key`) | same |
+| `{% snapshot %}` | `scd2` | same, incl. `<dim>_current` handling |
+| `unique`/`not_null`/`accepted_values`/`relationships` | `data_tests` | exact 1:1 with the four `// data_test` kinds |
+| declared column metadata | `columns` on the asset node | descriptions only; see the note below |
+| model `tags` | node badge | `tag` |
+| source freshness | `freshness` | `last_success_at` chip |
+| `run_results.json` | materialization records | `record_materialization` |
+| `dbt_packages/` | worker-local cache | keyed by `packages.yml`, the project digest and the `package-lock.yml` the deploy resolved |
+
+## Phases
+
+**Phase 1: run it.** `ScriptLang::Dbt` across the 41 `ADD_NEW_LANG` sites (mostly
+one-liners in `EditorBar.svelte`, `scripts.ts`, `script_helpers.ts`,
+`LanguageIcon.svelte`, `script_common.ts`). Engine provisioning for all three
+options in `Dockerfile` and `docker/DockerfileFull*` (bundle 1x and 2x, fetch
+Fusion at runtime). New `backend/windmill-worker/src/dbt_executor.rs`: descriptor
+parse, bundle materialisation, `profiles.yml` render, `dbt build`, log
+passthrough, structured result, retry.
+
+**Phase 2: graph.** `DbtDependencyLocks` and the deploy arm. Migration via
+`cargo sqlx migrate add -r dbt_runtime`. New `dbt://` `AssetKind` with
+its `canonical_prefix`. Manifest ingest. Deploy-time ingest plus the per-run
+re-ingest for dynamic descriptors. Extend `AssetGraphRunnableNode`/`AssetGraphAssetNode` in
+`frontend/src/lib/components/assets/AssetGraph/types.ts` with dbt provenance and
+render through the existing `RunnableNode.svelte` / `AssetNode.svelte` /
+`DataTestNode.svelte`.
+
+**Phase 3: live progress and ergonomics.** JSON event stream to per-model status
+on the canvas mid-run. `record_materialization` per model. Profile and select
+pickers in the editor. Per-model failure triage in the run view.
+
+**Phase 4 (not in this PR).** `--defer` and `state:modified`. Partition and
+backfill integration so `BackfillRangeDialog.svelte` works on dbt models.
+`wmill dbt import <dag.py>` reading `DbtDag(...)` kwargs.
+
+## E2E test requirements
+
+Against a real dbt project (jaffle_shop shape) and the local Postgres:
+
+1. **Happy path**: deploy a dbt script, run it, assert models exist in the
+   warehouse and the job succeeds with a structured per-model result.
+2. **Engine parity**: the same project passes on `dbt-core-1x` and `dbt-core-2x`.
+   Fusion covered by a manually-run test, not CI (runtime fetch).
+3. **Test severity**: a failing `error`-severity test fails the job; a failing
+   `warn`-severity test does not.
+4. **Retry**: a run failing midway, retried, resumes via `dbt retry` and does not
+   rebuild already-successful models.
+5. **Graph ingest**: after deploy, model assets and `ref()` edges exist; a native
+   script reading one of the marts gets an edge to it.
+6. **Shared node**: a native script that READS a mart renders as a reader of the
+   same node the dbt model writes — one node, not two islands. Declared with a
+   plain read (`# dbt://<mart>`), never `# on`: a `dbt://` subscription is
+   refused at deploy, because nothing but dbt writes a warehouse relation and a
+   dbt run does not dispatch (see "no cascade from dbt").
+7. **Selection**: descriptor `select`/`exclude`, and a run-arg override, each
+   build only the expected subset.
+8. **Dynamic descriptors**: a `{{ }}` placeholder in `vars` re-ingests the graph
+   from the run's own manifest, so a model that placeholder enables appears in
+   the same run that builds it.
+9. **Both credential paths**: resource-rendered `profiles.yml`, and the project's
+   own `profiles.yml` with env-var injection.
+10. **Caching**: a second run reuses the cached `dbt_packages/` with no network
+    fetch.
+
+Keep only tests that pin behavior a future change could break. Per AGENTS.md,
+delete development scaffolding before marking the PR ready.
diff --git a/docs/docker-v2-runtime.md b/docs/docker-v2-runtime.md
index f38d17d5e6..b0916843ca 100644
--- a/docs/docker-v2-runtime.md
+++ b/docs/docker-v2-runtime.md
@@ -34,6 +34,29 @@ python3 -c "import sys; print('hello', sys.argv[1])" "$name"
 - The image's `Env`, `WorkingDir` are applied; the windmill reserved variables
   (`WM_TOKEN`, `BASE_INTERNAL_URL`, …) are injected so `wmill`/API calls work.
 
+## Result
+
+Same conventions as a plain bash script, in this order:
+
+1. `./result.json` (relative to the image's `WorkingDir`) if non-empty → returned as
+   the JSON result; malformed JSON fails the job. It is a host file bind-mounted into
+   the container, so it works for `WorkingDir: ""` (→ `/`) too, which otherwise lands in
+   nsjail's ephemeral root and never reaches the job. Being a bind-mount point, it must
+   be written in place (`> ./result.json`); a write-temp-then-`rename` fails.
+
+   The bind is skipped, with a warning in the job logs, when the destination can't be
+   proven to stay inside the container: a `WorkingDir` with `..`, one whose path in the
+   extracted rootfs crosses a symlink, or one under `/tmp`, `/proc`, `/dev` or `/sys`
+   (mounted after this bind, so a result there would be shadowed anyway). nsjail resolves
+   a mount destination *before* `pivot_root`, so an unverified path would have it create
+   a file on the **host**. For the same reason the bind is applied directly after the
+   rootfs binds — a `# volume` mounted over the `WorkingDir` therefore hides it, and the
+   result falls through to the stdout rule below.
+2. Otherwise the last non-empty line of **stdout**, returned as a string. stderr is
+   excluded on purpose: the two pipes are merged by a fair `select`, so a diagnostic
+   on stderr could otherwise beat a block-buffered stdout result.
+3. Otherwise a completion message.
+
 ## How it works
 
 1. **Pull/extract** ([`crane`](https://github.com/google/go-containerregistry), no
@@ -101,7 +124,6 @@ the container inherits exactly the job's confinement:
 - Images that drop to a non-root uid or chown to arbitrary uids inside need a
   subuid **range** in the jail (single-uid only today — follow-up: `newuidmap`
   range mapping).
-- The script result is a completion message; capture output via stdout/logs.
 
 ## Follow-ups
 
diff --git a/docs/frontend-import-cycles.md b/docs/frontend-import-cycles.md
new file mode 100644
index 0000000000..b7be98975f
--- /dev/null
+++ b/docs/frontend-import-cycles.md
@@ -0,0 +1,111 @@
+# Frontend chunk cycles
+
+If the emitted chunks import each other in a cycle, the app crashes on load with errors
+like `TypeError: be is not a constructor` or `Cannot read properties of undefined
+(reading 'PREPROCESSOR')`, and the user sees SvelteKit's default **"500 / Internal
+Error"** page with nothing in the server log.
+
+The build fails on this now (`assertAcyclicChunks` in `frontend/vite.config.js`), so you
+should never hit it in production again. This document explains the error if you do hit
+it at build time.
+
+## Why a chunk cycle crashes
+
+A chunk's imports are all evaluated before its own body. When chunk A and chunk B import
+each other, entering at A evaluates B's body while **none** of A's body has run. Every
+binding B reads from A is still in its pre-initialization state:
+
+- `function f() {}` — hoisted, so calling it *works*
+- `var X = class {}` / `const X = {...}` — **`undefined`**
+
+So B's module-scope code calls a working function that reaches for an uninitialized class
+and dies. Which member evaluates first depends on which route pulled the chunks in, which
+is why the symptom is route-dependent, looks random, and often disappears on a second page
+load. It is **not** a stale-asset or cache problem — new asset hashes do not change the
+graph.
+
+Anything a module does at evaluation time is exposed:
+
+```ts
+const toolDef = createToolDef(schema, 'x', '...') // calls z.toJSONSchema -> new JSONSchemaGenerator
+const ids = { a: SPECIAL_MODULE_IDS.PREPROCESSOR } // reads an imported const
+```
+
+Making those lazy one at a time does not work — every module-scope read across the cycle
+is a separate landmine, and a new one appears with the next refactor. Break the cycle.
+
+## An acyclic module graph is not enough
+
+This is the part that is easy to get wrong. Chunk *grouping* alone can create a cycle
+where no import cycle exists between modules.
+
+That is exactly what happened on vite 8.2.0 (#10468). `src/lib/gen` is a generated client
+that imports nothing outside itself — a leaf. But the bundler split it: `index.ts` and
+`core/*` landed in one chunk, while the 12k-line `schemas.gen.ts` was grouped into a
+chunk with 53 unrelated copilot/app modules. Since `index.ts` does
+`export * from './schemas.gen'`, the otherwise-pure gen chunk gained an edge into that app
+chunk, which imports back into the copilot core chunk. One split produced **40 chunk
+cycles**, and the copilot tool modules — which call `createToolDef` at module scope — began
+evaluating against an uninitialized zod `JSONSchemaGenerator`.
+
+The fix is to keep that leaf whole, in `frontend/vite.config.js`:
+
+```js
+build: { rollupOptions: { output: {
+  advancedChunks: { groups: [{ name: 'gen', test: /[\\/]src[\\/]lib[\\/]gen[\\/]/ }] }
+} } }
+```
+
+A barrel file (`export * from ...`) over a large generated module is the shape to watch:
+it gives every importer of the barrel an edge to the re-exported module, wherever the
+bundler decides to put it.
+
+## When the build fails
+
+`assertAcyclicChunks` prints the cycle with each chunk's source modules:
+
+```
+Cyclic chunk imports — this ships a runtime crash:
+  _app/immutable/chunks/BdWm9WXx.js
+      lib/gen/core/ApiError.ts, ..., lib/gen/index.ts
+   ->
+  _app/immutable/chunks/BUOJL1Np.js
+      lib/gen/schemas.gen.ts, lib/components/copilot/chat/workspaceTools.ts, +42 more
+   ->
+  ...
+```
+
+Read it as: some module in chunk 1 imports some module in chunk 2, and so on back around.
+To find the offending source edge, look for a module in one chunk that imports a module in
+the next. Then, in order of preference:
+
+1. **Make the import type-only** if only types are used — `import type` is erased and
+   creates no runtime edge (so does a named import where every binding is `type`-prefixed,
+   and `await import()` defers to a separate evaluation).
+2. **Keep a self-contained leaf together** with an `advancedChunks` group, as above.
+3. **Move the offending function to a new module** so the low-level module stops importing
+   the high-level one. `lib/aiStore.ts` (AI model state) imported
+   `components/copilot/lib.ts` (the AI client) for one call in `loadCopilot`, and the
+   client imports the chat modules, which import `aiStore` back; extracting `loadCopilot`
+   into `components/copilot/loadCopilot.ts` left `aiStore` a leaf.
+
+## Reproducing a crash without the right route
+
+Because the crash depends on which route enters the cycle first, it can be hard to trigger
+by clicking. Force the bad entry order instead: build, serve `build/`, and dynamically
+import the chunk that owns the shared bindings. If it is in a cycle, the import throws the
+same error the user reports.
+
+```html
+<script type="module">
+	try {
+		await import('/_app/immutable/chunks/<shared-chunk>.js')
+		document.title = 'OK'
+	} catch (e) {
+		document.title = 'THREW: ' + e.message
+	}
+</script>
+```
+
+Find the chunk by a preserved string literal — minification keeps them, e.g. zod's
+`Error converting schema to JSON.` locates the chunk holding `JSONSchemaGenerator`.
diff --git a/docs/reusable-ai-agents.md b/docs/reusable-ai-agents.md
index 728b883109..8fa9facd74 100644
--- a/docs/reusable-ai-agents.md
+++ b/docs/reusable-ai-agents.md
@@ -50,6 +50,26 @@ tool starting can run the changed definition, or fail if the tool was removed. P
 carrying the resolved definition into the child job rather than its id. Inline (unlinked) agents are
 unaffected: their tools live in the flow value, which is snapshotted with the run.
 
+## Version history
+
+Editing a resource appends a row to `resource_version` (all types except `state` and `cache`,
+which the platform rewrites on every job), so an agent's prompt, model and tool set can be
+diffed and restored from the resource editor's History drawer. Restoring writes the old value
+forward as a new version rather than rewinding, keeping the history append-only.
+
+History captures the resource, not its transitive closure. A `$var:`/`$res:` reference is stored
+as the reference, so two versions can be byte-identical while the agent behaves differently
+because the referenced variable changed underneath them. Anything comparing agent runs across
+versions has to account for that.
+
+A superseded value is retained for up to 100 versions. Values written through the UI keep their
+secrets in linked variables, but one pushed by `wmill` or written by `setResource` can hold an
+inline credential, and overwriting it no longer removes it from the database — anyone who can
+read the resource can read it from the history. Rotating such a credential therefore does not
+erase the old one on its own — follow the rotation with **Clear past versions** in the History
+drawer, which drops every version but the current value for that one resource. Secret *variables*
+are deliberately not versioned at all for the same reason.
+
 ## Dependencies and locks
 
 A linked step carries `tools: []`, and no dependency job ever visits the `ai_agent` resource, so the
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 4ab6621c30..7113b74147 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.775.2",
+	"version": "1.783.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@windmill-labs/components",
-			"version": "1.775.2",
+			"version": "1.783.0",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
@@ -94,7 +94,7 @@
 				"windmill-parser-wasm-rust": "1.647.1",
 				"windmill-parser-wasm-ts": "1.695.0",
 				"windmill-parser-wasm-wac": "1.668.6",
-				"windmill-parser-wasm-yaml": "1.593.0",
+				"windmill-parser-wasm-yaml": "1.770.0",
 				"windmill-sql-datatype-parser-wasm": "1.512.0",
 				"windmill-utils-internal": "1.8.2",
 				"xterm": "^5.3.0",
@@ -157,13 +157,12 @@
 				"tar": "^7.5.4",
 				"tslib": "^2.6.1",
 				"typescript": "^5.5.0",
-				"vite": "^8.0.13",
+				"vite": "^8.2.0",
 				"vite-plugin-mkcert": "^2.0.0",
 				"vitest": "^4.1.0",
 				"vitest-browser-svelte": "^2.0.1"
 			},
 			"optionalDependencies": {
-				"@rollup/rollup-linux-x64-gnu": "^4.35.0",
 				"fsevents": "^2.3.3"
 			},
 			"peerDependencies": {
@@ -1098,40 +1097,6 @@
 				"@csstools/css-tokenizer": "^2.4.1"
 			}
 		},
-		"node_modules/@emnapi/core": {
-			"version": "1.11.2",
-			"resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.2.tgz",
-			"integrity": "sha512-TC8MkTuZUtcTSiFeuC0ksCh9QIJ5+F21MvZ4Wn4ORfYaFJ/0dsiudv5tVkejgwZlwQ39jL9WWDe2lz8x0WglOA==",
-			"dev": true,
-			"license": "MIT",
-			"optional": true,
-			"dependencies": {
-				"@emnapi/wasi-threads": "1.2.2",
-				"tslib": "^2.4.0"
-			}
-		},
-		"node_modules/@emnapi/runtime": {
-			"version": "1.11.2",
-			"resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.2.tgz",
-			"integrity": "sha512-kyOl3X0DuTiT1h2ft8r2fYO8JYtU9a9Xis/zBSiGArNaagCOWx90N1k2wxp18czFDH+OgcWGb5ZP/XMt3dcyPA==",
-			"dev": true,
-			"license": "MIT",
-			"optional": true,
-			"dependencies": {
-				"tslib": "^2.4.0"
-			}
-		},
-		"node_modules/@emnapi/wasi-threads": {
-			"version": "1.2.2",
-			"resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.2.tgz",
-			"integrity": "sha512-c95qOXkHdydNKhscBTebqEC1CVAZpyqOfVfBzQ1qgzyl3gfeldUjIggDbIZgDKsHLgnsM+igH7TJ/eAasaVuMA==",
-			"dev": true,
-			"license": "MIT",
-			"optional": true,
-			"dependencies": {
-				"tslib": "^2.4.0"
-			}
-		},
 		"node_modules/@eslint-community/eslint-utils": {
 			"version": "4.9.0",
 			"resolved": "https://registry.npmjs.org/@eslint-community/eslint-utils/-/eslint-utils-4.9.0.tgz",
@@ -1655,25 +1620,6 @@
 				"@chevrotain/types": "~11.1.1"
 			}
 		},
-		"node_modules/@napi-rs/wasm-runtime": {
-			"version": "1.1.4",
-			"resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.4.tgz",
-			"integrity": "sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow==",
-			"dev": true,
-			"license": "MIT",
-			"optional": true,
-			"dependencies": {
-				"@tybys/wasm-util": "^0.10.1"
-			},
-			"funding": {
-				"type": "github",
-				"url": "https://github.com/sponsors/Brooooooklyn"
-			},
-			"peerDependencies": {
-				"@emnapi/core": "^1.7.1",
-				"@emnapi/runtime": "^1.7.1"
-			}
-		},
 		"node_modules/@noble/hashes": {
 			"version": "1.8.0",
 			"resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-1.8.0.tgz",
@@ -1726,9 +1672,9 @@
 			}
 		},
 		"node_modules/@oxc-project/types": {
-			"version": "0.130.0",
-			"resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.130.0.tgz",
-			"integrity": "sha512-ibD2usx9JRu7f5pu2tMKMI4cpA4NgXJQoYRP4pQ7Pxmn1l6k/53qWtQWZayhYy3X4QZkt90Ot+mJEaeXouio6Q==",
+			"version": "0.142.0",
+			"resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.142.0.tgz",
+			"integrity": "sha512-7W+2q5AKQVU36fkaryontrHn3YDt1RyUYXatw9i5H8ocYe2sPKSFB6eS8WNPeRKiN1qAWWZUPm7gwFzJGrccqQ==",
 			"devOptional": true,
 			"license": "MIT",
 			"funding": {
@@ -1802,9 +1748,9 @@
 			"license": "SEE LICENSE IN LICENSE"
 		},
 		"node_modules/@rolldown/binding-android-arm64": {
-			"version": "1.0.1",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.0.1.tgz",
-			"integrity": "sha512-fJI3I0r3C3Oj/zdBCpaCmBRZYf07xpaq4yCfDDoSFm+beWNzbIl26puW8RraUdugoJw/95zerNOn6jasAhzSmg==",
+			"version": "1.2.2",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.2.2.tgz",
+			"integrity": "sha512-l7x215OGvo1s52JWmR8U/DAVzEDWBCIbTm28aeJV/WDTSHgcKXaZTuBT0hJMs5NggilfJTW3clZVvd24yfKJxA==",
 			"cpu": [
 				"arm64"
 			],
@@ -1819,9 +1765,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-darwin-arm64": {
-			"version": "1.0.1",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.0.1.tgz",
-			"integrity": "sha512-cKnAhWEsV7TPcA/5EAteDp6KcJZBQ2G+BqE7zayMMi7kMvwRsbv7WT9aOnn0WNl4SKEIf43vjS31iUPu80nzXg==",
+			"version": "1.2.2",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.2.2.tgz",
+			"integrity": "sha512-9u9Xv6c1AJZT0FfwH5vrMG5Jjcwhc1MlyrPu0XfTqkzsmqfks2M6W/o5XwAJgVVN/jHpqqngC1WevHKKTIUtIA==",
 			"cpu": [
 				"arm64"
 			],
@@ -1836,9 +1782,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-darwin-x64": {
-			"version": "1.0.1",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.0.1.tgz",
-			"integrity": "sha512-YKrVwQjIRBPo+5G/u03wGjbdy4q7pyzCe93DK9VJ7zkVmeg8LJ7GbgsiHWdR4xSoe4CAXRD7Bcjgbtr64bkXNg==",
+			"version": "1.2.2",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.2.2.tgz",
+			"integrity": "sha512-9W1mbGZAfW3oqd85bhBkmpyHCCzL1TeG/zFFP3vg7b0rlly8cxOcre5nXwz+LHazCwac2MNWgPdPCHndABjpWQ==",
 			"cpu": [
 				"x64"
 			],
@@ -1853,9 +1799,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-freebsd-x64": {
-			"version": "1.0.1",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.0.1.tgz",
-			"integrity": "sha512-z/oBsREo46SsFqBwYtFe0kpJeBijAT48O/WXLI4suiCLBkr03RTtTJMCzSdDd2znlh8VJizL09XVkQgk8IZonw==",
+			"version": "1.2.2",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.2.2.tgz",
+			"integrity": "sha512-0p1lhiCSCyaerFwtrdZQUx7NqGk6LQnaRKWX7tFQqwQgvX0rjM15cIkm3pax1UpEakK14C4mOxx/jSqCBdBRqQ==",
 			"cpu": [
 				"x64"
 			],
@@ -1870,9 +1816,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-linux-arm-gnueabihf": {
-			"version": "1.0.1",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.0.1.tgz",
-			"integrity": "sha512-ik8q7GM11zxvYxFc2PeDcT6TBvhCQMaUxfph/M5l9sKuTs/Sjg3L+Byw0F7w0ZVLBZmx30P+gG0ECzzN+MFcmQ==",
+			"version": "1.2.2",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.2.2.tgz",
+			"integrity": "sha512-e+cOJXrJ2L3zx6YzqPg+f6Wbk3V1cKB8bOhbaYdVYN3DdquzNdRAmrbETz1qnt5yp/c7JNlNjmITiA2cVneQ7w==",
 			"cpu": [
 				"arm"
 			],
@@ -1887,9 +1833,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-linux-arm64-gnu": {
-			"version": "1.0.1",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.0.1.tgz",
-			"integrity": "sha512-QoSx2EkyrrdZ6kcyE8stqZ62t0Yra8Fs5ia9lOxJrh6TMQJK7gQKmscdTHf7pOXKREKrVwOtJcQG3qVSfc866A==",
+			"version": "1.2.2",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.2.2.tgz",
+			"integrity": "sha512-JsSMsj6sNat/MuhG5fnBD7QgbtpHKVe30x5/bAVirDHdhoQRXJkF6xc0Jqk8O4fiCUQAzMOoH9wZi3m60c8wtg==",
 			"cpu": [
 				"arm64"
 			],
@@ -1904,9 +1850,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-linux-arm64-musl": {
-			"version": "1.0.1",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.0.1.tgz",
-			"integrity": "sha512-uwNwFpwKeNiZawfAWBgg0VIztPTV3ihhh1vV334h9ivnNLorxnQMU6Fz8wG1Zb4Qh9LC1/MkcyT3YlDXG3Rsgg==",
+			"version": "1.2.2",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.2.2.tgz",
+			"integrity": "sha512-B5G/zJdHaoJn9vD50eGHWkiWfmq8Uhi3IiLPJTzmZTrAalk1bztUikSXo0qga18ibE0IXboyeMUnhPjhAJ45wQ==",
 			"cpu": [
 				"arm64"
 			],
@@ -1921,9 +1867,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-linux-ppc64-gnu": {
-			"version": "1.0.1",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.0.1.tgz",
-			"integrity": "sha512-zY1bul7OWr7DFBiJ++wofXvnr8B45ce3QsQUhKrIhXsygAh7bTkwyeM1bi1a2g5C/yC/N8TZyGDEoMfm/l9mpg==",
+			"version": "1.2.2",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.2.2.tgz",
+			"integrity": "sha512-6mC/awzKka8W6EoekjegpfGkjz8jXWDX63pqu/HYVpyKtZfu65Jsh4QAH3Kej3CAv/c1oGX7psTmFEbr0mDxLA==",
 			"cpu": [
 				"ppc64"
 			],
@@ -1938,9 +1884,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-linux-s390x-gnu": {
-			"version": "1.0.1",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.0.1.tgz",
-			"integrity": "sha512-0frlsT/f4Ft6I7SMESTKnF3cZsdicQn1dCMkF/jT9wDLE+gGoiQfv1nmT9e+s7s/fekvvy6tZM2jHvI2tkbJDQ==",
+			"version": "1.2.2",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.2.2.tgz",
+			"integrity": "sha512-412MX9fJLdA1IK28EZnc8jYv2HRTleOZgfLQumJ5zy7OeJLZlg/CETwFaXjNmGVxG51cFHpKLqb5LKvBC+HsHA==",
 			"cpu": [
 				"s390x"
 			],
@@ -1955,9 +1901,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-linux-x64-gnu": {
-			"version": "1.0.1",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.0.1.tgz",
-			"integrity": "sha512-XABVmGp9Tg0WspTVvwduTc4fpqy6JnAUrSQe6OuyqD/03nI7r0O9OWUkMIwFrjKAIqolvqoA4ZrJppgwE0Gxmw==",
+			"version": "1.2.2",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.2.2.tgz",
+			"integrity": "sha512-Q/+HI/ToJafZ1iCqGgVQXUEkIjufHCTF0gBQ2a5o3cg7GJ2h0qyq3nvvSmU+bGda2/7ygXpTY4TM6gO9OhQ0ZA==",
 			"cpu": [
 				"x64"
 			],
@@ -1972,9 +1918,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-linux-x64-musl": {
-			"version": "1.0.1",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.0.1.tgz",
-			"integrity": "sha512-bV4fzswuzVcKD90o/VM6QqKxnxlDq0g2BISDLNVmxrnhpv1DDbyPhCIjYfvzYLV+MvkKKnQt2Q6AO86SEBULUQ==",
+			"version": "1.2.2",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.2.2.tgz",
+			"integrity": "sha512-ZKp/w41n6wCvxzxQHtQSbuphfX3Y4cCvbjkKHusrLx4lh+JWLTU7StSltO/DKARISzbj368d+qUaCjI8K2wzXw==",
 			"cpu": [
 				"x64"
 			],
@@ -1989,9 +1935,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-openharmony-arm64": {
-			"version": "1.0.1",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.0.1.tgz",
-			"integrity": "sha512-/Mh0Zhq3OP7fVs0kcQHZP6lZEthMGTaSf8UBQYSFEZDWGXXlEC+nJ6EqenaK2t4LBXMe3A+K/G2BVXXdtOr4PQ==",
+			"version": "1.2.2",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.2.2.tgz",
+			"integrity": "sha512-pxE6xD4KS3eAROkKK5yrhB9/3+vhlhVGMvlQLbdpzrBGDbKrnzx3RLwPaHvasLo6jgaiBLn7e04Df9C4tYhjmA==",
 			"cpu": [
 				"arm64"
 			],
@@ -2005,29 +1951,10 @@
 				"node": "^20.19.0 || >=22.12.0"
 			}
 		},
-		"node_modules/@rolldown/binding-wasm32-wasi": {
-			"version": "1.0.1",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.0.1.tgz",
-			"integrity": "sha512-+1xc9X45l8ufsBAm6Gjvx2qDRIY9lTVt0cgWNcJ+1gdhXvkbxePA60yRTwSTuXL09CMhyJmjpV7E3NoyxbqFQQ==",
-			"cpu": [
-				"wasm32"
-			],
-			"dev": true,
-			"license": "MIT",
-			"optional": true,
-			"dependencies": {
-				"@emnapi/core": "1.11.2",
-				"@emnapi/runtime": "1.11.2",
-				"@napi-rs/wasm-runtime": "^1.1.4"
-			},
-			"engines": {
-				"node": "^20.19.0 || >=22.12.0"
-			}
-		},
 		"node_modules/@rolldown/binding-win32-arm64-msvc": {
-			"version": "1.0.1",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.0.1.tgz",
-			"integrity": "sha512-1D+UqZdfnuR+Jy1GgMJwi85bD40H21uNmOPRWQhw4oRSuolZ/B5rixZ45DK2KXOTCvmVCecauWgEhbw8bI7tOw==",
+			"version": "1.2.2",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.2.2.tgz",
+			"integrity": "sha512-4MqEue5re+xIZzAWsB8sj0P1kqZySWqIuN4t6QaIO/YA6SFwySOLruvWQFzfmqk8LBK2P30KCSJwf6mJCZZ5/A==",
 			"cpu": [
 				"arm64"
 			],
@@ -2042,9 +1969,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-win32-x64-msvc": {
-			"version": "1.0.1",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.0.1.tgz",
-			"integrity": "sha512-INAycaWuhlOK3wk4mRHGsdgwYWmd9cChdPdE9bwWmy6rn9VqVNYNFGhOdXrofXUxwHIncSiPNb8tNm8knDVIeQ==",
+			"version": "1.2.2",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.2.2.tgz",
+			"integrity": "sha512-NweNxxD0Nf9t8v7kodun45Ijp3EIwYY+uydPP6qBEYvfBqhIjN6dZMzlQja3tqX/aLs3F3Uz+AxDpKgRhpOZQg==",
 			"cpu": [
 				"x64"
 			],
@@ -2065,19 +1992,6 @@
 			"devOptional": true,
 			"license": "MIT"
 		},
-		"node_modules/@rollup/rollup-linux-x64-gnu": {
-			"version": "4.54.0",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.54.0.tgz",
-			"integrity": "sha512-WGt5J8Ij/rvyqpFexxk3ffKqqbLf9AqrTBbWDk7ApGUzaIs6V+s2s84kAxklFwmMF/vBNGrVdYgbblCOFFezMQ==",
-			"cpu": [
-				"x64"
-			],
-			"license": "MIT",
-			"optional": true,
-			"os": [
-				"linux"
-			]
-		},
 		"node_modules/@scalar/openapi-parser": {
 			"version": "0.15.0",
 			"resolved": "https://registry.npmjs.org/@scalar/openapi-parser/-/openapi-parser-0.15.0.tgz",
@@ -2350,17 +2264,6 @@
 				"svelte": "^5.0.0"
 			}
 		},
-		"node_modules/@tybys/wasm-util": {
-			"version": "0.10.2",
-			"resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.2.tgz",
-			"integrity": "sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg==",
-			"dev": true,
-			"license": "MIT",
-			"optional": true,
-			"dependencies": {
-				"tslib": "^2.4.0"
-			}
-		},
 		"node_modules/@types/chai": {
 			"version": "5.2.3",
 			"resolved": "https://registry.npmjs.org/@types/chai/-/chai-5.2.3.tgz",
@@ -8339,9 +8242,9 @@
 			"license": "MIT"
 		},
 		"node_modules/lightningcss": {
-			"version": "1.32.0",
-			"resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.32.0.tgz",
-			"integrity": "sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ==",
+			"version": "1.33.0",
+			"resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.33.0.tgz",
+			"integrity": "sha512-WkUDrojuJs0xkgGf2udWxa3yGBRxPtxUkB79i6aCZLRgc7PM8fZe9TosfPDcvEpQZbuFASnHYmRLBLUbmLOIIA==",
 			"devOptional": true,
 			"license": "MPL-2.0",
 			"dependencies": {
@@ -8355,23 +8258,23 @@
 				"url": "https://opencollective.com/parcel"
 			},
 			"optionalDependencies": {
-				"lightningcss-android-arm64": "1.32.0",
-				"lightningcss-darwin-arm64": "1.32.0",
-				"lightningcss-darwin-x64": "1.32.0",
-				"lightningcss-freebsd-x64": "1.32.0",
-				"lightningcss-linux-arm-gnueabihf": "1.32.0",
-				"lightningcss-linux-arm64-gnu": "1.32.0",
-				"lightningcss-linux-arm64-musl": "1.32.0",
-				"lightningcss-linux-x64-gnu": "1.32.0",
-				"lightningcss-linux-x64-musl": "1.32.0",
-				"lightningcss-win32-arm64-msvc": "1.32.0",
-				"lightningcss-win32-x64-msvc": "1.32.0"
+				"lightningcss-android-arm64": "1.33.0",
+				"lightningcss-darwin-arm64": "1.33.0",
+				"lightningcss-darwin-x64": "1.33.0",
+				"lightningcss-freebsd-x64": "1.33.0",
+				"lightningcss-linux-arm-gnueabihf": "1.33.0",
+				"lightningcss-linux-arm64-gnu": "1.33.0",
+				"lightningcss-linux-arm64-musl": "1.33.0",
+				"lightningcss-linux-x64-gnu": "1.33.0",
+				"lightningcss-linux-x64-musl": "1.33.0",
+				"lightningcss-win32-arm64-msvc": "1.33.0",
+				"lightningcss-win32-x64-msvc": "1.33.0"
 			}
 		},
 		"node_modules/lightningcss-android-arm64": {
-			"version": "1.32.0",
-			"resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.32.0.tgz",
-			"integrity": "sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg==",
+			"version": "1.33.0",
+			"resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.33.0.tgz",
+			"integrity": "sha512-gEpRTalKdosp4Bb8qWtc2iOgE5SeIHlpS1up9bFq2wAyYhl1UdTObYiHe98zEM9SQvSoqQZ1IQD0JNpg3Ml5pg==",
 			"cpu": [
 				"arm64"
 			],
@@ -8390,9 +8293,9 @@
 			}
 		},
 		"node_modules/lightningcss-darwin-arm64": {
-			"version": "1.32.0",
-			"resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.32.0.tgz",
-			"integrity": "sha512-RzeG9Ju5bag2Bv1/lwlVJvBE3q6TtXskdZLLCyfg5pt+HLz9BqlICO7LZM7VHNTTn/5PRhHFBSjk5lc4cmscPQ==",
+			"version": "1.33.0",
+			"resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.33.0.tgz",
+			"integrity": "sha512-Sciaz8eenNTKn9b3t7+xr0ipTp9YxKQY4npwQ3mrRuL0BAVHBLyZxofhaKBAVtzmtRZ/zTyo0/to4B1uWG/Djg==",
 			"cpu": [
 				"arm64"
 			],
@@ -8411,9 +8314,9 @@
 			}
 		},
 		"node_modules/lightningcss-darwin-x64": {
-			"version": "1.32.0",
-			"resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.32.0.tgz",
-			"integrity": "sha512-U+QsBp2m/s2wqpUYT/6wnlagdZbtZdndSmut/NJqlCcMLTWp5muCrID+K5UJ6jqD2BFshejCYXniPDbNh73V8w==",
+			"version": "1.33.0",
+			"resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.33.0.tgz",
+			"integrity": "sha512-Z5UPAxzrjlWNNyGy6i65cJzzvgJ5D3T6wMvs+gWpY9d7qRhANrxqAp6LhxIgZhWEw18RfJTGcRxjuLIBr+m8XQ==",
 			"cpu": [
 				"x64"
 			],
@@ -8432,9 +8335,9 @@
 			}
 		},
 		"node_modules/lightningcss-freebsd-x64": {
-			"version": "1.32.0",
-			"resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.32.0.tgz",
-			"integrity": "sha512-JCTigedEksZk3tHTTthnMdVfGf61Fky8Ji2E4YjUTEQX14xiy/lTzXnu1vwiZe3bYe0q+SpsSH/CTeDXK6WHig==",
+			"version": "1.33.0",
+			"resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.33.0.tgz",
+			"integrity": "sha512-QQM/Ti/hQajJwCY+RiWuCZ9sdtI/XQk7nDK5vC8kkdwixezOlDgvDx7+RT+QjK6FcFT4MpsuoBnHIo/O3StRRg==",
 			"cpu": [
 				"x64"
 			],
@@ -8453,9 +8356,9 @@
 			}
 		},
 		"node_modules/lightningcss-linux-arm-gnueabihf": {
-			"version": "1.32.0",
-			"resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.32.0.tgz",
-			"integrity": "sha512-x6rnnpRa2GL0zQOkt6rts3YDPzduLpWvwAF6EMhXFVZXD4tPrBkEFqzGowzCsIWsPjqSK+tyNEODUBXeeVHSkw==",
+			"version": "1.33.0",
+			"resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.33.0.tgz",
+			"integrity": "sha512-N7FVBe6iS24MlM6R/4RBTxGhQheZGs7tiQ9U32UtF75NzP5Q7xWPRqLBCKxlRQRk3rY1jCIPLzx7WzOhuUIRLQ==",
 			"cpu": [
 				"arm"
 			],
@@ -8474,9 +8377,9 @@
 			}
 		},
 		"node_modules/lightningcss-linux-arm64-gnu": {
-			"version": "1.32.0",
-			"resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.32.0.tgz",
-			"integrity": "sha512-0nnMyoyOLRJXfbMOilaSRcLH3Jw5z9HDNGfT/gwCPgaDjnx0i8w7vBzFLFR1f6CMLKF8gVbebmkUN3fa/kQJpQ==",
+			"version": "1.33.0",
+			"resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.33.0.tgz",
+			"integrity": "sha512-j2v/itmy4HlNxlc6voKXYgBqNi0Ng2LShg4z7GufpEgs05P+2suBVyi9I6YHq5uoVFx9ETin3eCEhLVyXGQnKg==",
 			"cpu": [
 				"arm64"
 			],
@@ -8495,9 +8398,9 @@
 			}
 		},
 		"node_modules/lightningcss-linux-arm64-musl": {
-			"version": "1.32.0",
-			"resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.32.0.tgz",
-			"integrity": "sha512-UpQkoenr4UJEzgVIYpI80lDFvRmPVg6oqboNHfoH4CQIfNA+HOrZ7Mo7KZP02dC6LjghPQJeBsvXhJod/wnIBg==",
+			"version": "1.33.0",
+			"resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.33.0.tgz",
+			"integrity": "sha512-yiO5ROMuYQgXbC60yjZU5CYSFZGKXL0HFATXt9mHJn1+zW55oCtMI9NfcVhYLMFDL7gV7oBPon/EmMMGg2OvtQ==",
 			"cpu": [
 				"arm64"
 			],
@@ -8516,9 +8419,9 @@
 			}
 		},
 		"node_modules/lightningcss-linux-x64-gnu": {
-			"version": "1.32.0",
-			"resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.32.0.tgz",
-			"integrity": "sha512-V7Qr52IhZmdKPVr+Vtw8o+WLsQJYCTd8loIfpDaMRWGUZfBOYEJeyJIkqGIDMZPwPx24pUMfwSxxI8phr/MbOA==",
+			"version": "1.33.0",
+			"resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.33.0.tgz",
+			"integrity": "sha512-ar+Ju7LmcN0Jo4FpL4hpFybwNG9/3A/Br5KW2n2jyODg3MEZXaDYADdemoNS+BDNfMgKvylJLj4S5tyRActuAg==",
 			"cpu": [
 				"x64"
 			],
@@ -8537,9 +8440,9 @@
 			}
 		},
 		"node_modules/lightningcss-linux-x64-musl": {
-			"version": "1.32.0",
-			"resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.32.0.tgz",
-			"integrity": "sha512-bYcLp+Vb0awsiXg/80uCRezCYHNg1/l3mt0gzHnWV9XP1W5sKa5/TCdGWaR/zBM2PeF/HbsQv/j2URNOiVuxWg==",
+			"version": "1.33.0",
+			"resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.33.0.tgz",
+			"integrity": "sha512-RYiYbkokw0trfKqqzfF55lginwEPrD3OJDfTuJzFs1MK6iFnDenaz1fqLLtX4ITG3OktJQXOeTaw1awrBAlZPw==",
 			"cpu": [
 				"x64"
 			],
@@ -8558,9 +8461,9 @@
 			}
 		},
 		"node_modules/lightningcss-win32-arm64-msvc": {
-			"version": "1.32.0",
-			"resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.32.0.tgz",
-			"integrity": "sha512-8SbC8BR40pS6baCM8sbtYDSwEVQd4JlFTOlaD3gWGHfThTcABnNDBda6eTZeqbofalIJhFx0qKzgHJmcPTnGdw==",
+			"version": "1.33.0",
+			"resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.33.0.tgz",
+			"integrity": "sha512-1K+MPfLSFVpphzpdbfkhlWk6wBrTObBzS2T6db10PNOZgR9GoVsAWzwNyuhUYYbTp23j+4RrncfujZ4uAzXvwA==",
 			"cpu": [
 				"arm64"
 			],
@@ -8579,9 +8482,9 @@
 			}
 		},
 		"node_modules/lightningcss-win32-x64-msvc": {
-			"version": "1.32.0",
-			"resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.32.0.tgz",
-			"integrity": "sha512-Amq9B/SoZYdDi1kFrojnoqPLxYhQ4Wo5XiL8EVJrVsB8ARoC1PWW6VGtT0WKCemjy8aC+louJnjS7U18x3b06Q==",
+			"version": "1.33.0",
+			"resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.33.0.tgz",
+			"integrity": "sha512-OlEICDx/Xl0FqSp4bry8zFnCvGpig3Gl4gCquvYwHuqJKEC1+n9NgDniFvqHGmMv1ZkqDJrDqKKSykTDX+ehuA==",
 			"cpu": [
 				"x64"
 			],
@@ -10785,9 +10688,9 @@
 			}
 		},
 		"node_modules/postcss": {
-			"version": "8.5.14",
-			"resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.14.tgz",
-			"integrity": "sha512-SoSL4+OSEtR99LHFZQiJLkT59C5B1amGO1NzTwj7TT1qCUgUO6hxOvzkOYxD+vMrXBM3XJIKzokoERdqQq/Zmg==",
+			"version": "8.5.25",
+			"resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.25.tgz",
+			"integrity": "sha512-DTPx3RWSSnWyzLxQnlH0rJP+EW5ekl16ZU4/psbIhA0e53kJfdgaN5vKM+xP7yJtXVu+nfdVFmlgFDEKAe4Pyw==",
 			"devOptional": true,
 			"funding": [
 				{
@@ -10805,7 +10708,7 @@
 			],
 			"license": "MIT",
 			"dependencies": {
-				"nanoid": "^3.3.11",
+				"nanoid": "^3.3.16",
 				"picocolors": "^1.1.1",
 				"source-map-js": "^1.2.1"
 			},
@@ -11497,9 +11400,9 @@
 			"license": "MIT"
 		},
 		"node_modules/postcss/node_modules/nanoid": {
-			"version": "3.3.11",
-			"resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz",
-			"integrity": "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==",
+			"version": "3.3.16",
+			"resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz",
+			"integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==",
 			"devOptional": true,
 			"funding": [
 				{
@@ -12195,13 +12098,13 @@
 			"license": "Unlicense"
 		},
 		"node_modules/rolldown": {
-			"version": "1.0.1",
-			"resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.0.1.tgz",
-			"integrity": "sha512-X0KQHljNnEkWNqqiz9zJrGunh1B0HgOxLXvnFpCOcadzcy5qohZ3tqMEUg00vncoRovXuK3ZqCT9KnnKzoInFQ==",
+			"version": "1.2.2",
+			"resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.2.2.tgz",
+			"integrity": "sha512-opwpo1tQBAcpSUJDt94B7hhLNGOKjCdE//XXjeLrnx9b83bjnw45tXdg1b09yEw/VLFBJGZpwRULMmOZo7ol+A==",
 			"devOptional": true,
 			"license": "MIT",
 			"dependencies": {
-				"@oxc-project/types": "=0.130.0",
+				"@oxc-project/types": "=0.142.0",
 				"@rolldown/pluginutils": "^1.0.0"
 			},
 			"bin": {
@@ -12211,21 +12114,20 @@
 				"node": "^20.19.0 || >=22.12.0"
 			},
 			"optionalDependencies": {
-				"@rolldown/binding-android-arm64": "1.0.1",
-				"@rolldown/binding-darwin-arm64": "1.0.1",
-				"@rolldown/binding-darwin-x64": "1.0.1",
-				"@rolldown/binding-freebsd-x64": "1.0.1",
-				"@rolldown/binding-linux-arm-gnueabihf": "1.0.1",
-				"@rolldown/binding-linux-arm64-gnu": "1.0.1",
-				"@rolldown/binding-linux-arm64-musl": "1.0.1",
-				"@rolldown/binding-linux-ppc64-gnu": "1.0.1",
-				"@rolldown/binding-linux-s390x-gnu": "1.0.1",
-				"@rolldown/binding-linux-x64-gnu": "1.0.1",
-				"@rolldown/binding-linux-x64-musl": "1.0.1",
-				"@rolldown/binding-openharmony-arm64": "1.0.1",
-				"@rolldown/binding-wasm32-wasi": "1.0.1",
-				"@rolldown/binding-win32-arm64-msvc": "1.0.1",
-				"@rolldown/binding-win32-x64-msvc": "1.0.1"
+				"@rolldown/binding-android-arm64": "1.2.2",
+				"@rolldown/binding-darwin-arm64": "1.2.2",
+				"@rolldown/binding-darwin-x64": "1.2.2",
+				"@rolldown/binding-freebsd-x64": "1.2.2",
+				"@rolldown/binding-linux-arm-gnueabihf": "1.2.2",
+				"@rolldown/binding-linux-arm64-gnu": "1.2.2",
+				"@rolldown/binding-linux-arm64-musl": "1.2.2",
+				"@rolldown/binding-linux-ppc64-gnu": "1.2.2",
+				"@rolldown/binding-linux-s390x-gnu": "1.2.2",
+				"@rolldown/binding-linux-x64-gnu": "1.2.2",
+				"@rolldown/binding-linux-x64-musl": "1.2.2",
+				"@rolldown/binding-openharmony-arm64": "1.2.2",
+				"@rolldown/binding-win32-arm64-msvc": "1.2.2",
+				"@rolldown/binding-win32-x64-msvc": "1.2.2"
 			}
 		},
 		"node_modules/roughjs": {
@@ -13835,9 +13737,9 @@
 			"license": "MIT"
 		},
 		"node_modules/tinyglobby": {
-			"version": "0.2.16",
-			"resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.16.tgz",
-			"integrity": "sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg==",
+			"version": "0.2.17",
+			"resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz",
+			"integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==",
 			"devOptional": true,
 			"license": "MIT",
 			"dependencies": {
@@ -14373,17 +14275,17 @@
 			}
 		},
 		"node_modules/vite": {
-			"version": "8.0.13",
-			"resolved": "https://registry.npmjs.org/vite/-/vite-8.0.13.tgz",
-			"integrity": "sha512-MFtjBYgzmSxmgA4RAfjIyXWpGe1oALnjgUTzzV7QLx/TKxCzjtMH6Fd9/eVK+5Fg1qNoz5VAwsmMs/NofrmJvw==",
+			"version": "8.2.0",
+			"resolved": "https://registry.npmjs.org/vite/-/vite-8.2.0.tgz",
+			"integrity": "sha512-pn+CFpM0lwDeKwmOq1ZaBK/9sjorZcgqxki6MbY/jPEVd9vichIlmlD4HmQ5wdP5EgqQCFRaACBxMC7uEGc6lQ==",
 			"devOptional": true,
 			"license": "MIT",
 			"dependencies": {
-				"lightningcss": "^1.32.0",
-				"picomatch": "^4.0.4",
-				"postcss": "^8.5.14",
-				"rolldown": "1.0.1",
-				"tinyglobby": "^0.2.16"
+				"lightningcss": "^1.33.0",
+				"picomatch": "^4.0.5",
+				"postcss": "^8.5.23",
+				"rolldown": "~1.2.0",
+				"tinyglobby": "^0.2.17"
 			},
 			"bin": {
 				"vite": "bin/vite.js"
@@ -14399,7 +14301,7 @@
 			},
 			"peerDependencies": {
 				"@types/node": "^20.19.0 || >=22.12.0",
-				"@vitejs/devtools": "^0.1.18",
+				"@vitejs/devtools": "^0.4.0",
 				"esbuild": "^0.27.0 || ^0.28.0",
 				"jiti": ">=1.21.0",
 				"less": "^4.0.0",
@@ -14960,9 +14862,9 @@
 			"integrity": "sha512-/ovcLWlIO+TQMrnWwcWoXquJI6hTZ+Zpo4POhV8z6e+pb4cVModGysASI9mERn2e9uj8/xSRmYqk54TLG8oUbQ=="
 		},
 		"node_modules/windmill-parser-wasm-yaml": {
-			"version": "1.593.0",
-			"resolved": "https://registry.npmjs.org/windmill-parser-wasm-yaml/-/windmill-parser-wasm-yaml-1.593.0.tgz",
-			"integrity": "sha512-Gyx4aR2jsJYuDrD3mCNTmz7LWOQQXPw5yKNCC1xRgUOPfjsD/tINAFfsBLwVOSmlQQcFZO+wHm4KtDtXOcnGVw=="
+			"version": "1.770.0",
+			"resolved": "https://registry.npmjs.org/windmill-parser-wasm-yaml/-/windmill-parser-wasm-yaml-1.770.0.tgz",
+			"integrity": "sha512-RngxbcKYYFt3MHYqdYTzbtH6EMPfqJtY4/mqRqfLUie4cE9mmOBa9X9M3VEFVo53CD1dCRa9wJKZmeJzE5We5Q=="
 		},
 		"node_modules/windmill-sql-datatype-parser-wasm": {
 			"version": "1.512.0",
diff --git a/frontend/package.json b/frontend/package.json
index 01e68d2acf..ff080f353b 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.775.2",
+	"version": "1.783.0",
 	"scripts": {
 		"dev": "vite dev",
 		"dev:ui-builder": "mv static/ui_builder static/ui_builder.dev-disabled 2>/dev/null || true ; trap 'mv static/ui_builder.dev-disabled static/ui_builder 2>/dev/null || true' EXIT ; vite dev",
@@ -73,7 +73,7 @@
 		"tar": "^7.5.4",
 		"tslib": "^2.6.1",
 		"typescript": "^5.5.0",
-		"vite": "^8.0.13",
+		"vite": "^8.2.0",
 		"vite-plugin-mkcert": "^2.0.0",
 		"vitest": "^4.1.0",
 		"vitest-browser-svelte": "^2.0.1"
@@ -170,7 +170,7 @@
 		"windmill-parser-wasm-rust": "1.647.1",
 		"windmill-parser-wasm-ts": "1.695.0",
 		"windmill-parser-wasm-wac": "1.668.6",
-		"windmill-parser-wasm-yaml": "1.593.0",
+		"windmill-parser-wasm-yaml": "1.770.0",
 		"windmill-sql-datatype-parser-wasm": "1.512.0",
 		"windmill-utils-internal": "1.8.2",
 		"xterm": "^5.3.0",
@@ -647,7 +647,6 @@
 		}
 	},
 	"optionalDependencies": {
-		"@rollup/rollup-linux-x64-gnu": "^4.35.0",
 		"fsevents": "^2.3.3"
 	}
 }
diff --git a/frontend/src/lib/aiStore.ts b/frontend/src/lib/aiStore.ts
index bd03f1baa4..1e8fb6ac61 100644
--- a/frontend/src/lib/aiStore.ts
+++ b/frontend/src/lib/aiStore.ts
@@ -1,6 +1,9 @@
+// Keep this module a leaf: it holds AI model *state* only, and must not import the AI
+// client (`components/copilot/lib`) or anything under `components/copilot/chat` — those
+// import aiStore back, and such a cycle crashes the app once the bundler splits it across
+// chunks (docs/frontend-import-cycles.md; the build fails on the chunk cycle, not on this).
 import { writable, get } from 'svelte/store'
-import { workspaceAIClients } from './components/copilot/lib'
-import { type AIProviderModel, type AIProvider, WorkspaceService, type AIConfig } from './gen'
+import { type AIProviderModel, type AIProvider, type AIConfig } from './gen'
 import {
 	aiUserDisabled,
 	COPILOT_SESSION_MODEL_SETTING_NAME,
@@ -77,31 +80,10 @@ function dedupeModels(models: AIProviderModel[]): AIProviderModel[] {
 	})
 }
 
-// copilotInfo/copilotSessionModel are global, so concurrent loads (e.g. a fast
-// session switch between workspaces) race: an earlier call resolving last would
-// clobber the active workspace's config. Apply only the most recent call's
-// result via a monotonic token — last invocation wins regardless of resolution
-// order. init() is synchronous so its ordering already matches.
-let loadCopilotToken = 0
 // The workspace copilotInfo currently reflects. A session send awaits this
 // matching its committed workspace so getCurrentModel() can't read the previous
 // workspace's provider/model while the scoped load is still in flight.
 export const copilotWorkspace = writable<string | undefined>(undefined)
-export async function loadCopilot(workspace: string) {
-	const token = ++loadCopilotToken
-	workspaceAIClients.init(workspace)
-	try {
-		const info = await WorkspaceService.getCopilotInfo({ workspace })
-		if (token !== loadCopilotToken) return
-		setCopilotInfo(info)
-		copilotWorkspace.set(workspace)
-	} catch (err) {
-		if (token !== loadCopilotToken) return
-		setCopilotInfo({})
-		copilotWorkspace.set(workspace)
-		console.error('Could not get copilot info', err)
-	}
-}
 
 export function setCopilotInfo(aiConfig: AIConfig) {
 	if (Object.keys(aiConfig.providers ?? {}).length > 0) {
diff --git a/frontend/src/lib/assets/app.css b/frontend/src/lib/assets/app.css
index 23bf45c7fa..760f4c0261 100644
--- a/frontend/src/lib/assets/app.css
+++ b/frontend/src/lib/assets/app.css
@@ -60,6 +60,155 @@
 		font-display: swap;
 	}
 
+	/* Firefox rasterizes the macOS bitmap emoji font (Apple Color Emoji, sbix) at a size
+	   that ignores an ancestor's `transform: scale()`, so emoji keep their unzoomed size
+	   inside the flow graph canvas. Noto's COLR glyphs are vectors and scale like any
+	   other text. unicode-range split verbatim from Google Fonts so pages fetch only the
+	   chunks they render — a range edited out of step with its file mis-gates that. */
+	@font-face {
+		font-family: 'Noto Color Emoji';
+		src: url('/fonts/noto-color-emoji.0.woff2') format('woff2');
+		font-weight: 400;
+		font-display: swap;
+		unicode-range: U+1f1e6-1f1ff;
+	}
+
+	@font-face {
+		font-family: 'Noto Color Emoji';
+		src: url('/fonts/noto-color-emoji.1.woff2') format('woff2');
+		font-weight: 400;
+		font-display: swap;
+		unicode-range:
+			U+200d, U+2620, U+26a7, U+fe0f, U+1f308, U+1f38c, U+1f3c1, U+1f3f3-1f3f4, U+1f6a9,
+			U+e0062-e0063, U+e0065, U+e0067, U+e006c, U+e006e, U+e0073-e0074, U+e0077, U+e007f;
+	}
+
+	@font-face {
+		font-family: 'Noto Color Emoji';
+		src: url('/fonts/noto-color-emoji.2.woff2') format('woff2');
+		font-weight: 400;
+		font-display: swap;
+		unicode-range:
+			U+23, U+2a, U+30-39, U+a9, U+ae, U+200d, U+203c, U+2049, U+20e3, U+2122, U+2139, U+2194-2199,
+			U+21a9-21aa, U+23cf, U+23e9-23ef, U+23f8-23fa, U+24c2, U+25aa-25ab, U+25b6, U+25c0,
+			U+25fb-25fe, U+2611, U+2622-2623, U+2626, U+262a, U+262e-262f, U+2638, U+2640, U+2642,
+			U+2648-2653, U+2660, U+2663, U+2665-2666, U+2668, U+267b, U+267e-267f, U+2695, U+269b-269c,
+			U+26a0, U+26a7, U+26aa-26ab, U+26ce, U+26d4, U+2705, U+2714, U+2716, U+271d, U+2721,
+			U+2733-2734, U+2747, U+274c, U+274e, U+2753-2755, U+2757, U+2764, U+2795-2797, U+27a1, U+27b0,
+			U+27bf, U+2934-2935, U+2b05-2b07, U+2b1b-2b1c, U+2b55, U+3030, U+303d, U+3297, U+3299, U+fe0f,
+			U+1f170-1f171, U+1f17e-1f17f, U+1f18e, U+1f191-1f19a, U+1f201-1f202, U+1f21a, U+1f22f,
+			U+1f232-1f23a, U+1f250-1f251, U+1f310, U+1f3a6, U+1f3b5-1f3b6, U+1f3bc, U+1f3e7, U+1f441,
+			U+1f499-1f49c, U+1f49f-1f4a0, U+1f4ac-1f4ad, U+1f4b1-1f4b2, U+1f4b9, U+1f4db, U+1f4f2-1f4f6,
+			U+1f500-1f507, U+1f515, U+1f518-1f524, U+1f52f-1f53d, U+1f549, U+1f54e, U+1f5a4, U+1f5e8,
+			U+1f5ef, U+1f6ab, U+1f6ad-1f6b1, U+1f6b3, U+1f6b7-1f6bc, U+1f6be, U+1f6c2-1f6c5,
+			U+1f6d0-1f6d1, U+1f6d7, U+1f6dc, U+1f7e0-1f7eb, U+1f7f0, U+1f90d-1f90e, U+1f9d1-1f9d2,
+			U+1f9e1, U+1fa75-1fa77, U+1faaf;
+	}
+
+	@font-face {
+		font-family: 'Noto Color Emoji';
+		src: url('/fonts/noto-color-emoji.3.woff2') format('woff2');
+		font-weight: 400;
+		font-display: swap;
+		unicode-range:
+			U+200d, U+231a-231b, U+2328, U+23f0-23f3, U+2602, U+260e, U+2692, U+2694, U+2696-2697, U+2699,
+			U+26b0-26b1, U+26cf, U+26d1, U+26d3, U+2702, U+2709, U+270f, U+2712, U+fe0f, U+1f302, U+1f321,
+			U+1f392-1f393, U+1f3a9, U+1f3bd, U+1f3ee, U+1f3f7, U+1f3fa, U+1f451-1f462, U+1f484,
+			U+1f489-1f48a, U+1f48c-1f48e, U+1f4a1, U+1f4a3, U+1f4a5, U+1f4b0, U+1f4b3-1f4b8,
+			U+1f4bb-1f4da, U+1f4dc-1f4f1, U+1f4ff, U+1f508-1f514, U+1f516-1f517, U+1f526-1f529,
+			U+1f52c-1f52e, U+1f550-1f567, U+1f56f-1f570, U+1f576, U+1f587, U+1f58a-1f58d, U+1f5a5,
+			U+1f5a8, U+1f5b1-1f5b2, U+1f5c2-1f5c4, U+1f5d1-1f5d3, U+1f5dc-1f5de, U+1f5e1, U+1f5f3,
+			U+1f6aa, U+1f6ac, U+1f6bd, U+1f6bf, U+1f6c1, U+1f6cb, U+1f6cd-1f6cf, U+1f6d2, U+1f6e0-1f6e1,
+			U+1f6f0, U+1f97b-1f97f, U+1f9af, U+1f9ba, U+1f9e2-1f9e6, U+1f9ea-1f9ec, U+1f9ee-1f9f4,
+			U+1f9f7-1f9ff, U+1fa71-1fa74, U+1fa79-1fa7b, U+1fa86, U+1fa8e-1fa8f, U+1fa91-1fa93, U+1fa96,
+			U+1fa99-1faa0, U+1faa2-1faa7, U+1faaa-1faae;
+	}
+
+	@font-face {
+		font-family: 'Noto Color Emoji';
+		src: url('/fonts/noto-color-emoji.4.woff2') format('woff2');
+		font-weight: 400;
+		font-display: swap;
+		unicode-range:
+			U+265f, U+26bd-26be, U+26f3, U+26f8, U+fe0f, U+1f004, U+1f0cf, U+1f380-1f384, U+1f386-1f38b,
+			U+1f38d-1f391, U+1f396-1f397, U+1f399-1f39b, U+1f39e-1f39f, U+1f3a3-1f3a5, U+1f3a7-1f3a9,
+			U+1f3ab-1f3b4, U+1f3b7-1f3bb, U+1f3bd-1f3c0, U+1f3c5-1f3c6, U+1f3c8-1f3c9, U+1f3cf-1f3d3,
+			U+1f3f8-1f3f9, U+1f47e, U+1f4e2, U+1f4f7-1f4fd, U+1f52b, U+1f579, U+1f58c-1f58d, U+1f5bc,
+			U+1f6f7, U+1f6f9, U+1f6fc, U+1f93f, U+1f941, U+1f945, U+1f947-1f94f, U+1f9e7-1f9e9,
+			U+1f9f5-1f9f6, U+1fa70-1fa71, U+1fa80-1fa81, U+1fa83-1fa85, U+1fa87-1fa8a, U+1fa94-1fa95,
+			U+1fa97-1fa98, U+1faa1, U+1faa9, U+1fadf;
+	}
+
+	@font-face {
+		font-family: 'Noto Color Emoji';
+		src: url('/fonts/noto-color-emoji.5.woff2') format('woff2');
+		font-weight: 400;
+		font-display: swap;
+		unicode-range:
+			U+2693, U+26e9-26ea, U+26f1-26f2, U+26f4-26f5, U+26fa, U+26fd, U+2708, U+fe0f, U+1f301,
+			U+1f303, U+1f306-1f307, U+1f309, U+1f310, U+1f3a0-1f3a2, U+1f3aa, U+1f3cd-1f3ce, U+1f3d5,
+			U+1f3d7-1f3db, U+1f3df-1f3e6, U+1f3e8-1f3ed, U+1f3ef-1f3f0, U+1f488, U+1f492, U+1f4ba,
+			U+1f54b-1f54d, U+1f5fa-1f5ff, U+1f680-1f6a2, U+1f6a4-1f6a8, U+1f6b2, U+1f6d1, U+1f6d5-1f6d6,
+			U+1f6dd-1f6df, U+1f6e2-1f6e5, U+1f6e9, U+1f6eb-1f6ec, U+1f6f3-1f6f6, U+1f6f8, U+1f6fa-1f6fb,
+			U+1f9bc-1f9bd, U+1f9ed, U+1f9f3, U+1fa7c;
+	}
+
+	@font-face {
+		font-family: 'Noto Color Emoji';
+		src: url('/fonts/noto-color-emoji.6.woff2') format('woff2');
+		font-weight: 400;
+		font-display: swap;
+		unicode-range:
+			U+200d, U+2615, U+fe0f, U+1f32d-1f330, U+1f336, U+1f33d, U+1f344-1f37f, U+1f382, U+1f52a,
+			U+1f7e9, U+1f7eb, U+1f942-1f944, U+1f950-1f96f, U+1f99e, U+1f9aa, U+1f9c0-1f9cb, U+1fad0-1fadc;
+	}
+
+	@font-face {
+		font-family: 'Noto Color Emoji';
+		src: url('/fonts/noto-color-emoji.7.woff2') format('woff2');
+		font-weight: 400;
+		font-display: swap;
+		unicode-range:
+			U+200d, U+2600-2601, U+2603-2604, U+2614, U+2618, U+26a1, U+26c4-26c5, U+26c8, U+26f0, U+2728,
+			U+2744, U+2b1b, U+2b50, U+fe0f, U+1f300, U+1f304-1f305, U+1f308, U+1f30a-1f30f, U+1f311-1f321,
+			U+1f324-1f32c, U+1f331-1f335, U+1f337-1f33c, U+1f33e-1f344, U+1f3d4, U+1f3d6, U+1f3dc-1f3de,
+			U+1f3f5, U+1f400-1f43f, U+1f490, U+1f4a7, U+1f4ae, U+1f525, U+1f54a, U+1f573, U+1f577-1f578,
+			U+1f648-1f64a, U+1f6d8, U+1f940, U+1f980-1f9ae, U+1f9ba, U+1fa90, U+1faa8, U+1fab0-1fabf,
+			U+1facd-1facf, U+1fae7;
+	}
+
+	@font-face {
+		font-family: 'Noto Color Emoji';
+		src: url('/fonts/noto-color-emoji.8.woff2') format('woff2');
+		font-weight: 400;
+		font-display: swap;
+		unicode-range:
+			U+200d, U+2640, U+2642, U+2695-2696, U+26f7, U+26f9, U+2708, U+2764, U+27a1, U+fe0f, U+1f33e,
+			U+1f373, U+1f37c, U+1f384-1f385, U+1f393, U+1f3a4, U+1f3a8, U+1f3c2-1f3c4, U+1f3c7,
+			U+1f3ca-1f3cc, U+1f3eb, U+1f3ed, U+1f3fb-1f3ff, U+1f430, U+1f466-1f469, U+1f46b-1f478,
+			U+1f47c, U+1f481-1f483, U+1f486-1f487, U+1f48b, U+1f48f, U+1f491, U+1f4bb-1f4bc, U+1f527,
+			U+1f52c, U+1f574-1f575, U+1f57a, U+1f645-1f647, U+1f64b, U+1f64d-1f64e, U+1f680, U+1f692,
+			U+1f6a3, U+1f6b4-1f6b6, U+1f6c0, U+1f6cc, U+1f91d, U+1f926, U+1f930-1f931, U+1f934-1f93a,
+			U+1f93c-1f93e, U+1f977, U+1f9af-1f9b3, U+1f9b8-1f9b9, U+1f9bc-1f9bd, U+1f9cc-1f9cf,
+			U+1f9d1-1f9df, U+1fa70, U+1fa82, U+1fac3-1fac5, U+1fac8, U+1faef;
+	}
+
+	@font-face {
+		font-family: 'Noto Color Emoji';
+		src: url('/fonts/noto-color-emoji.9.woff2') format('woff2');
+		font-weight: 400;
+		font-display: swap;
+		unicode-range:
+			U+200d, U+2194-2195, U+2603, U+261d, U+2620, U+2639-263a, U+2665, U+26a1, U+26c4, U+270a-270d,
+			U+2728, U+2763-2764, U+2b50, U+fe0f, U+1f31a-1f31f, U+1f32b, U+1f389-1f38a, U+1f3fb-1f3ff,
+			U+1f440-1f450, U+1f463-1f465, U+1f479-1f47b, U+1f47d-1f480, U+1f485, U+1f48b-1f48c,
+			U+1f493-1f49f, U+1f4a2, U+1f4a4-1f4a6, U+1f4a8-1f4ab, U+1f4af, U+1f525, U+1f573, U+1f590,
+			U+1f595-1f596, U+1f5a4, U+1f5e3, U+1f600-1f644, U+1f648-1f64a, U+1f64c, U+1f64f,
+			U+1f90c-1f925, U+1f927-1f92f, U+1f932-1f933, U+1f970-1f976, U+1f978-1f97a, U+1f9a0,
+			U+1f9b4-1f9b7, U+1f9bb, U+1f9be-1f9bf, U+1f9d0, U+1f9e0-1f9e1, U+1fa75-1fa79, U+1fac0-1fac2,
+			U+1fac6, U+1fae0-1fae6, U+1fae8-1faea, U+1faef-1faf8;
+	}
+
 	.prose-xs ul {
 		margin-top: 0.5rem;
 		list-style-type: '- ';
@@ -131,8 +280,9 @@
 	}
 
 	/* Subtle scrollbar: a thin, rounded thumb that only appears on hover, on both
-	   axes. Shared by ScrollableX (tab strips, code blocks) and the AI chat. Size
-	   via the `--wm-scrollbar-size` var (default 6px). Higher specificity than the
+	   axes. Shared by ScrollableX (code blocks, tab headers) and the AI chat. Size
+	   via the `--wm-scrollbar-size` var (default 6px) — WebKit only; Firefox sizes
+	   `thin` itself and spends ~11px of the box on it. Higher specificity than the
 	   app-wide `*::-webkit-scrollbar`, so it overrides it. */
 	.scrollbar-subtle {
 		scrollbar-width: thin;
diff --git a/frontend/src/lib/components/AddUser.svelte b/frontend/src/lib/components/AddUser.svelte
index e3b1455d77..aef1dbd400 100644
--- a/frontend/src/lib/components/AddUser.svelte
+++ b/frontend/src/lib/components/AddUser.svelte
@@ -12,11 +12,61 @@
 	import Toggle from './Toggle.svelte'
 	import Tooltip from './Tooltip.svelte'
 	import { UserPlus } from 'lucide-svelte'
+	import Select from './select/Select.svelte'
+	import { resource } from 'runed'
 
 	const dispatch = createEventDispatcher()
 
 	let email: string | undefined = $state()
 	let username: string | undefined = $state()
+	let emailFilterText: string = $state('')
+	let typedEmail: string = $state('')
+	let popoverOpen: boolean = $state(false)
+	let dropdownOpen: boolean = $state(false)
+	let addedCount: number = $state(0)
+
+	// Only superadmins may list the instance users, everyone else just types the email in.
+	// The list stays capped: what is typed narrows it server-side rather than client-side.
+	const instanceUsers = resource(
+		() => ({
+			search: emailFilterText,
+			isSuperadmin: $superadmin,
+			open: popoverOpen,
+			workspace: $workspaceStore,
+			addedCount
+		}),
+		async ({ search, isSuperadmin, open, workspace }, _previous, { onCleanup }) => {
+			if (!isSuperadmin || !open || !workspace) return []
+			const request = UserService.listAddableInstanceUsers({
+				workspace,
+				perPage: 10,
+				search: search || undefined
+			})
+			// A superseded run is only aborted through the promise it registers here. Without this a
+			// slow earlier search can land last and overwrite the results of the newer one.
+			onCleanup(() => request.cancel())
+			return await request
+		},
+		{ debounce: 300, initialValue: [] }
+	)
+
+	let emailItems = $derived(
+		instanceUsers.current.map((u) => ({
+			value: u.email,
+			label: u.username ? `${u.username} (${u.email})` : u.email
+		}))
+	)
+
+	const EMAIL_REGEX = /^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/
+	// A whole address typed into the picker is submittable on its own, so `Add` stays reachable
+	// without going through the "Add new" row. A search term that is not an address is not: it
+	// would be submitted verbatim and rejected instead of adding whoever the list is showing.
+	let effectiveEmail = $derived(
+		email ??
+			(EMAIL_REGEX.test(typedEmail.trim().toLowerCase())
+				? typedEmail.trim().toLowerCase()
+				: undefined)
+	)
 
 	function handleKeyUp(event: KeyboardEvent) {
 		const key = event.key
@@ -47,20 +97,24 @@
 			})
 			sendUserToast(`Service account '${username}' created`)
 		} else {
+			// Read once: the picker's own state changes as soon as the request lands.
+			const email = effectiveEmail!
 			await WorkspaceService.addUser({
 				workspace: $workspaceStore!,
 				requestBody: {
-					email: email!,
+					email,
 					username: automateUsernameCreation ? undefined : username,
 					is_admin: selected == 'admin',
 					operator: selected == 'operator'
 				}
 			})
 			sendUserToast(`Added ${email}`)
-			if (!(await UserService.existsEmail({ email: email! }))) {
+			// The picker excludes members server-side, so it has to refetch to drop this one.
+			addedCount++
+			if (!(await UserService.existsEmail({ email }))) {
 				let isSuperadmin = $superadmin
 				if (!isCloudHosted()) {
-					const emailCopy = email!
+					const emailCopy = email
 					sendUserToast(
 						`User ${email} is not registered yet on the instance. ${
 							!isSuperadmin
@@ -94,7 +148,7 @@
 	let isServiceAccount = $derived(selected === 'service_account')
 </script>
 
-<Popover placement="bottom-end">
+<Popover placement="bottom-end" bind:isOpen={popoverOpen} onClose={() => (typedEmail = '')}>
 	{#snippet trigger()}
 		<Button variant="accent" unifiedSize="md" nonCaptureEvent={true} startIcon={{ icon: UserPlus }}>
 			Add new user
@@ -116,7 +170,46 @@
 				/>
 			{:else}
 				<span class="text-xs mb-1 leading-6">Email</span>
-				<input type="email mb-1" onkeyup={handleKeyUp} placeholder="email" bind:value={email} />
+				<!-- `loading` is deliberately not passed: Select disables its input while loading, which
+				would blur the field on every search-as-you-type round trip. -->
+				<Select
+					bind:value={email}
+					bind:open={
+						() => dropdownOpen,
+						(v) => {
+							dropdownOpen = v
+							// A closed Select renders its value, not the search text, so an address that
+							// stays submittable has to become the value — otherwise `Add` is armed with
+							// something no longer on screen.
+							if (!v) {
+								const typed = typedEmail.trim().toLowerCase()
+								if (EMAIL_REGEX.test(typed)) email = typed
+								typedEmail = ''
+							}
+						}
+					}
+					bind:filterText={
+						() => emailFilterText,
+						(v) => {
+							emailFilterText = v
+							// Only the user's own edits are kept: Select clears this text when it closes or
+							// when a row is picked, which must not wipe the address about to be submitted.
+							if (dropdownOpen) {
+								typedEmail = v
+								if (v) email = undefined
+							}
+						}
+					}
+					items={emailItems}
+					placeholder="email"
+					clearable
+					onCreateItem={(e) => (email = e.trim().toLowerCase())}
+					noItemsMsg={instanceUsers.loading
+						? 'Loading...'
+						: $superadmin
+							? 'No user found on the instance'
+							: 'Type an email address'}
+				/>
 
 				{#if !automateUsernameCreation}
 					<span class="text-xs mb-1 pt-2 leading-6">Username</span>
@@ -205,15 +298,14 @@
 				size="sm"
 				on:click={() => {
 					addUser().then(() => {
-						// @ts-ignore
 						email = undefined
-						// @ts-ignore
+						typedEmail = ''
 						username = undefined
 					})
 				}}
 				disabled={isServiceAccount
 					? username === undefined || username === ''
-					: email === undefined || (!automateUsernameCreation && username === undefined)}
+					: effectiveEmail === undefined || (!automateUsernameCreation && username === undefined)}
 			>
 				Add
 			</Button>
diff --git a/frontend/src/lib/components/ApiConnectForm.svelte b/frontend/src/lib/components/ApiConnectForm.svelte
index c0a25daeb7..e3927ddc64 100644
--- a/frontend/src/lib/components/ApiConnectForm.svelte
+++ b/frontend/src/lib/components/ApiConnectForm.svelte
@@ -58,7 +58,11 @@
 		viewJsonSchema = false
 		try {
 			schema = resourceTypeInfo.schema as any
-			schema.order = schema.order ?? Object.keys(schema.properties).sort()
+			// A resource type may declare no properties at all — `dbt_profile` is a
+			// `profiles.yml` block whose keys are its adapter's, not Windmill's. That
+			// is a JSON-edited type, NOT a missing one: `Object.keys(undefined)` threw
+			// into the catch below, so the drawer told the user to sync a type it had.
+			schema.order = schema.order ?? Object.keys(schema.properties ?? {}).sort()
 			notFound = false
 		} catch (e) {
 			notFound = true
@@ -233,7 +237,7 @@
 	>
 	<SyncResourceTypes {resourceType} {onSynced} />
 {/if}
-{#if notFound || viewJsonSchema}
+{#if notFound || viewJsonSchema || !schema?.properties}
 	{#if !emptyString(error)}<span class="text-red-400 text-xs mb-1 flex flex-row-reverse"
 			>{error}</span
 		>{:else}<div class="py-2"></div>{/if}
diff --git a/frontend/src/lib/components/ArgInput.svelte b/frontend/src/lib/components/ArgInput.svelte
index de5517add3..5ee7a5f429 100644
--- a/frontend/src/lib/components/ArgInput.svelte
+++ b/frontend/src/lib/components/ArgInput.svelte
@@ -719,7 +719,8 @@
 							onkeydown: () => (ignoreValueUndefined = true),
 							placeholder: placeholder ?? defaultValue ?? '',
 							min: extra['min'],
-							max: extra['max']
+							max: extra['max'],
+							step: extra['step']
 						}}
 						{error}
 						bind:value
diff --git a/frontend/src/lib/components/AssignableTagsInner.svelte b/frontend/src/lib/components/AssignableTagsInner.svelte
index cda34487af..e1ad0baf8e 100644
--- a/frontend/src/lib/components/AssignableTagsInner.svelte
+++ b/frontend/src/lib/components/AssignableTagsInner.svelte
@@ -82,14 +82,21 @@
 		}
 	}
 
+	async function setCustomTags(value: string[]) {
+		await SettingService.setGlobal({
+			key: CUSTOM_TAGS_SETTING,
+			requestBody: { value }
+		})
+		// Servers answer from an in-memory tag cache that replicas only refresh on the
+		// next global-settings poll, so refetching here can still return the pre-write
+		// list. The value just written is authoritative.
+		customTags = value
+		dispatch('refresh')
+	}
+
 	async function saveCustomTag(tag: string, restoreCustomTags: boolean = false) {
 		try {
-			await SettingService.setGlobal({
-				key: CUSTOM_TAGS_SETTING,
-				requestBody: { value: [...(customTags ?? []), tag.trim().replaceAll(' ', '_')] }
-			})
-			dispatch('refresh')
-			loadCustomTags()
+			await setCustomTags([...(customTags ?? []), tag.trim().replaceAll(' ', '_')])
 			sendUserToast(restoreCustomTags ? 'Tag restored' : 'Tag added')
 			if (!restoreCustomTags) {
 				newTag = ''
@@ -98,6 +105,22 @@
 			sendUserToast(`Could not ${restoreCustomTags ? 'restore' : 'save'} custom tag: ${err}`, true)
 		}
 	}
+
+	async function removeCustomTag(tag: string) {
+		try {
+			await setCustomTags((customTags ?? []).filter((x) => x != tag))
+			sendUserToast('Tag removed', false, [
+				{
+					label: 'Undo',
+					callback: () => {
+						saveCustomTag(tag, true)
+					}
+				}
+			])
+		} catch (err) {
+			sendUserToast(`Could not remove custom tag: ${err}`, true)
+		}
+	}
 </script>
 
 <svelte:window onkeydown={onKeyDown} />
@@ -119,24 +142,7 @@
 						<button
 							class="z-10 rounded-full p-1 duration-200 hover:bg-gray-200"
 							aria-label="Remove item"
-							onclick={stopPropagation(
-								preventDefault(async () => {
-									await SettingService.setGlobal({
-										key: CUSTOM_TAGS_SETTING,
-										requestBody: { value: customTags?.filter((x) => x != customTag) }
-									})
-									dispatch('refresh')
-									loadCustomTags()
-									sendUserToast('Tag removed', false, [
-										{
-											label: 'Undo',
-											callback: () => {
-												saveCustomTag(customTag, true)
-											}
-										}
-									])
-								})
-							)}
+							onclick={stopPropagation(preventDefault(() => removeCustomTag(customTag)))}
 						>
 							<X size={12} />
 						</button>
diff --git a/frontend/src/lib/components/CompareDrafts.svelte b/frontend/src/lib/components/CompareDrafts.svelte
index f900766fb4..88107f8bba 100644
--- a/frontend/src/lib/components/CompareDrafts.svelte
+++ b/frontend/src/lib/components/CompareDrafts.svelte
@@ -1,6 +1,7 @@
 <script lang="ts">
 	import WorkspaceDeployLayout from './WorkspaceDeployLayout.svelte'
 	import { maskHasDraftRow } from './sessions/modifiedItemsMask'
+	import { pipelineFolderFromBundlePath } from '$lib/pipelinePaths'
 	import DiffDrawer from './DiffDrawer.svelte'
 	import WorkspaceDeployItemSummary from './WorkspaceDeployItemSummary.svelte'
 	import DraftBadge from './DraftBadge.svelte'
@@ -28,7 +29,8 @@
 		useWorkspaceDrafts
 	} from '$lib/workspaceDrafts.svelte'
 	import type { Kind as LayoutKind } from '$lib/utils_deployable'
-	import { userStore } from '$lib/stores'
+	import { userStore, userWorkspaces } from '$lib/stores'
+	import { childWorkspaceNoun } from '$lib/utils/devWorkspaceLabel'
 
 	interface Props {
 		currentWorkspaceId: string
@@ -160,6 +162,10 @@
 	// (unrelated to the fork's own work) are the common case worth hiding.
 	let hideUnchanged = $state(true)
 
+	const currentNoun = $derived(
+		childWorkspaceNoun($userWorkspaces.find((w) => w.id === currentWorkspaceId))
+	)
+
 	// The list (and, in the default view, the Draft Count) come from the Workspace
 	// Drafts module; deploy/discard invalidate the resource, so the list refetches
 	// and deployed items drop off without a manual reload here.
@@ -578,15 +584,9 @@
 		trigger_azure: '/azure_triggers',
 		trigger_email: '/email_triggers'
 	}
-	// A data-pipeline bundle is keyed at `f/<folder>/data_pipeline`; its editor
-	// is the pipeline view of that folder.
-	function pipelineFolderFromPath(path: string): string | undefined {
-		const segs = path.split('/')
-		return segs[0] === 'f' && segs.length >= 2 ? segs[1] : undefined
-	}
 	function draftEditUrl(d: Row): string | undefined {
 		if (d.draftKind === 'data_pipeline') {
-			const folder = pipelineFolderFromPath(d.path)
+			const folder = pipelineFolderFromBundlePath(d.path)
 			return folder
 				? `/pipeline/${encodeURIComponent(folder)}?workspace=${encodeURIComponent(currentWorkspaceId)}`
 				: undefined
@@ -616,7 +616,7 @@
 		// The pipeline bundle's storage path (`f/<folder>/data_pipeline`) is an
 		// implementation detail — show the folder it belongs to.
 		if (d.draftKind === 'data_pipeline') {
-			const folder = pipelineFolderFromPath(d.path)
+			const folder = pipelineFolderFromBundlePath(d.path)
 			return folder ? `f/${folder}` : d.path
 		}
 		const path = d.draft_path ?? d.path
@@ -668,8 +668,7 @@
 							size="xs"
 							options={{
 								right: 'Hide unchanged drafts',
-								rightTooltip:
-									"Hide drafts identical to the parent workspace. A fork inherits the parent's drafts when it's created; those are unrelated to the changes made in this fork."
+								rightTooltip: `Hide drafts identical to the parent workspace. A ${currentNoun} inherits the parent's drafts when it's created; those are unrelated to the changes made in this ${currentNoun}.`
 							}}
 						/>
 					{/if}
diff --git a/frontend/src/lib/components/CompareWorkspaces.svelte b/frontend/src/lib/components/CompareWorkspaces.svelte
index 9a2d513a4c..875eda25ce 100644
--- a/frontend/src/lib/components/CompareWorkspaces.svelte
+++ b/frontend/src/lib/components/CompareWorkspaces.svelte
@@ -43,11 +43,15 @@
 		checkDeployPermission,
 		deployItem,
 		deleteItemInWorkspace,
+		diffActionableInDirection,
+		diffCreatesInTarget,
+		diffRemovesInTarget,
 		getItemValue,
 		getOnBehalfOf,
 		type DeployPermission,
 		type DeployResult
 	} from '$lib/utils_workspace_deploy'
+	import { asSyncDeploy } from '$lib/deployOrigin'
 	import { isTriggerOrScheduleKind } from 'windmill-utils-internal'
 	import Tooltip from './Tooltip.svelte'
 	import OnBehalfOfSelector, {
@@ -64,6 +68,7 @@
 	import CompareModeToggle, { type CompareMode } from './CompareModeToggle.svelte'
 	import CompareTargetPicker from './CompareTargetPicker.svelte'
 	import { displayDate } from '$lib/utils'
+	import { childWorkspaceNoun } from '$lib/utils/devWorkspaceLabel'
 	import { editUrlFor } from './sessions/forkEditUrl'
 	import { diffInMask } from './sessions/modifiedItemsMask'
 	import DatatableSchemaDiff from './DatatableSchemaDiff.svelte'
@@ -114,6 +119,10 @@
 		/** False while the (async) chatMask is still loading. The select-all default
 		 * waits for this so it doesn't race the mask. Defaults to true. */
 		chatMaskReady?: boolean
+		/** Whether the mask also scopes the update direction (parent→fork). True only
+		 * for an explicit `?items=` deep link, which can legitimately name items to
+		 * pull in — a session's mask never can (see the preselect rule below). */
+		maskAppliesToUpdate?: boolean
 		/** Selecting `draft` asks the page to swap us out for CompareDrafts;
 		 * deploy_to/update are handled internally but reported so the page can
 		 * remember the direction. */
@@ -142,6 +151,7 @@
 		draftKeys = new Set<string>(),
 		chatMask,
 		chatMaskReady = true,
+		maskAppliesToUpdate = false,
 		onModeSelected,
 		onChanged
 	}: Props = $props()
@@ -391,6 +401,8 @@
 	let currentWorkspaceInfo = $derived($userWorkspaces.find((w) => w.id == currentWorkspaceId))
 	let parentWorkspaceInfo = $derived($userWorkspaces.find((w) => w.id == parentWorkspaceId))
 
+	let currentNoun = $derived(childWorkspaceNoun(currentWorkspaceInfo))
+
 	// An arbitrary target is one-way: the pair has no tally, so nothing distinguishes
 	// a change made here from one made there, and the "update current" direction
 	// would list every difference as an incoming change.
@@ -407,13 +419,9 @@
 	let canPreserveOnBehalfOf = $derived(mergeIntoParent ? canPreserveInParent : canPreserveInCurrent)
 
 	let selectableDiffs = $derived(
-		comparison?.diffs.filter((diff) => {
-			if (mergeIntoParent) {
-				return diff.ahead > 0
-			} else {
-				return diff.behind > 0
-			}
-		}) ?? []
+		comparison?.diffs.filter((diff) =>
+			diffActionableInDirection(diff, mergeIntoParent, isArbitraryTarget)
+		) ?? []
 	)
 
 	let selectedItems = $state<string[]>([])
@@ -443,7 +451,7 @@
 				? `No changes between this workspace and ${parentWorkspaceId}.`
 				: mergeIntoParent
 					? `Nothing to deploy — ${parentWorkspaceId} already has every change from this workspace.`
-					: `Nothing to update — this fork is up to date with ${parentWorkspaceId}.`
+					: `Nothing to update — this ${currentNoun} is up to date with ${parentWorkspaceId}.`
 	)
 
 	let conflictingDiffs = $derived(
@@ -457,10 +465,17 @@
 		}) ?? []
 	)
 
+	// Gates the "update before deploying" alert, so it counts what a merge would
+	// actually carry — not every row with an `ahead` counter, which includes the
+	// parent-only ones the merge direction leaves out.
 	let itemsWithAheadChanges = $derived(
 		comparison?.diffs.filter((diff) => {
 			const status = deploymentStatus[getItemKey(diff)]?.status
-			return diff && diff.ahead > 0 && !(status && status == 'deployed')
+			return (
+				diff &&
+				diffActionableInDirection(diff, true, isArbitraryTarget) &&
+				!(status && status == 'deployed')
+			)
 		}) ?? []
 	)
 
@@ -477,6 +492,7 @@
 	let onBehalfOfChoice = $state<Record<string, OnBehalfOfChoice>>({})
 	let customOnBehalfOf = $state<Record<string, OnBehalfOfDetails>>({})
 	let deployTargetWorkspace = $derived(mergeIntoParent ? parentWorkspaceId : currentWorkspaceId)
+	let deploySourceWorkspace = $derived(mergeIntoParent ? currentWorkspaceId : parentWorkspaceId)
 
 	function getItemKey(diff: WorkspaceItemDiff): string {
 		return `${diff.kind}:${diff.path}`
@@ -606,6 +622,17 @@
 		return undefined
 	}
 
+	/**
+	 * Authorization half of the on_behalf_of pair for flows/scripts. Only a custom pick
+	 * names one; for every other choice the backend derives it from the email, so
+	 * returning undefined clears the source item's value rather than keeping it.
+	 */
+	function getOnBehalfOfPermissionedAsForDeploy(itemKey: string, kind: Kind): string | undefined {
+		if (kind === 'trigger' || isTriggerOrScheduleKind(kind)) return undefined
+		if (onBehalfOfChoice[itemKey] !== 'custom') return undefined
+		return customOnBehalfOf[itemKey]?.permissionedAs
+	}
+
 	let diffDrawer: DiffDrawer | undefined = $state(undefined)
 	let isFlow = $state(true)
 
@@ -630,12 +657,10 @@
 
 	// All *diff* items selected. Trigger items are opt-in and don't count
 	// toward "all selected" — see item merge below in deployableItems.
-	// Deploying a row the current workspace lacks deletes it in the target. Against
-	// the parent that is a real deletion to propagate and is selected like anything
-	// else; against an arbitrary target the two workspaces were simply never in sync,
-	// so it takes an explicit act on that row. No bulk action may sweep one in.
+	// A row whose deploy deletes in the target takes an explicit tick (see
+	// `diffRemovesInTarget`); no bulk action may sweep one in.
 	function removesInTarget(diff: WorkspaceItemDiff): boolean {
-		return isArbitraryTarget && diff.exists_in_fork === false
+		return diffRemovesInTarget(diff, mergeIntoParent)
 	}
 	let bulkSelectableDiffs = $derived(selectableDiffs.filter((d) => !removesInTarget(d)))
 
@@ -680,17 +705,14 @@
 	) {
 		deploymentStatus[statusKey] = { status: 'loading' }
 
-		// Check if the item was deleted in the source workspace.
-		// If so, archive/delete it in the target workspace instead of copying.
+		// The workspace this deploy reads from doesn't have the item: archive/delete
+		// it in the target instead of copying. Same predicate as the row's badge and
+		// its exclusion from bulk selection, so what the row says is what it does.
 		const diff = comparison?.diffs.find((d) => getItemKey(d) === statusKey)
-		const itemDeletedInSource = diff
-			? mergeIntoParent
-				? diff.exists_in_fork === false
-				: diff.exists_in_source === false
-			: false
+		const removes = diff ? removesInTarget(diff) : false
 
 		let result: DeployResult
-		if (itemDeletedInSource) {
+		if (removes) {
 			result = await deleteItemInWorkspace(kind, path, workspaceToDeployTo)
 		} else {
 			result = await deployItem({
@@ -698,7 +720,8 @@
 				path,
 				workspaceFrom,
 				workspaceTo: workspaceToDeployTo,
-				onBehalfOf: getOnBehalfOfForDeploy(statusKey, kind)
+				onBehalfOf: getOnBehalfOfForDeploy(statusKey, kind),
+				onBehalfOfPrincipal: getOnBehalfOfPermissionedAsForDeploy(statusKey, kind)
 			})
 		}
 
@@ -760,22 +783,29 @@
 		let anyFailed = false
 		// Datatables whose migrations deployed cleanly — candidates for a run prompt.
 		const deployedMigrationDatatables = new Set<string>()
-		for (const itemKey of sortedItems) {
-			const deployable = deployableItems.find((d) => d.key === itemKey)
+		const applyAll = async () => {
+			for (const itemKey of sortedItems) {
+				const deployable = deployableItems.find((d) => d.key === itemKey)
 
-			if (!deployable) {
-				sendUserToast(`Undeployable item: ${itemKey}`, true)
-				continue
-			}
+				if (!deployable) {
+					sendUserToast(`Undeployable item: ${itemKey}`, true)
+					continue
+				}
 
-			const from = mergeIntoParent ? current : parent
-			await deploy(deployable.kind, deployable.path, to, from, itemKey)
-			if (deploymentStatus[itemKey]?.status === 'failed') {
-				anyFailed = true
-			} else if (deployable.kind === 'datatable_migration') {
-				deployedMigrationDatatables.add(deployable.path.split('/')[0])
+				const from = mergeIntoParent ? current : parent
+				await deploy(deployable.kind, deployable.path, to, from, itemKey)
+				if (deploymentStatus[itemKey]?.status === 'failed') {
+					anyFailed = true
+				} else if (deployable.kind === 'datatable_migration') {
+					deployedMigrationDatatables.add(deployable.path.split('/')[0])
+				}
 			}
 		}
+		// Updating the fork copies the parent's state in, so the tally must not read
+		// the result as the fork authoring anything. Merging the other way is the
+		// opposite: someone chose those changes for the target, and a fork chain
+		// needs that to stay authored so it can be merged on again.
+		await (mergeIntoParent ? applyAll() : asSyncDeploy(applyAll))
 		deploying = false
 		deselectAll()
 
@@ -879,17 +909,25 @@
 		// Items with a pending draft are also left out by default: the deployed
 		// version (not the draft) is what moves, so we make the user opt in.
 		// The update direction (parent→fork) is never something the chat caused, so
-		// when scoped to a chat's items (chatMask set) preselect nothing there.
-		if (chatMask && !mergeIntoParent) {
+		// when scoped to a chat's items (chatMask set) preselect nothing there —
+		// unless the mask came in as an explicit `?items=` deep link, which names
+		// what to pull.
+		if (chatMask && !mergeIntoParent && !maskAppliesToUpdate) {
 			selectedItems = []
 			return
 		}
 		const filtered = bulkSelectableDiffs.filter(
 			(d) => !isTriggerOrScheduleKind(d.kind) && !hasDraft(d)
 		)
+		// The update direction leaves out two ambiguous shapes, both still one click
+		// away through "Select all": a conflict, and a parent-only row the fork has
+		// deploy events for — the fork may have dropped it on purpose, and a routine
+		// update must not silently bring it back.
 		const conflictSafe = mergeIntoParent
 			? filtered
-			: filtered.filter((d) => !(d.ahead > 0 && d.behind > 0))
+			: filtered.filter(
+					(d) => !(d.ahead > 0 && d.behind > 0) && !(d.ahead > 0 && diffCreatesInTarget(d, false))
+				)
 		// When reached from a session's Review, narrow the default to this chat's items.
 		const scoped = chatMask ? conflictSafe.filter((d) => diffInMask(d, chatMask)) : conflictSafe
 		selectedItems = scoped
@@ -975,6 +1013,10 @@
 	let removalKeys = new Set<string>()
 	$effect(() => {
 		const diffs = comparison?.diffs
+		// Removals are direction-dependent, so a flip must refresh the set: keeping the
+		// other direction's would make every row of the new one look freshly flipped
+		// and revoke the opt-in this guard protects.
+		;[mergeIntoParent]
 		if (!diffs) return
 		untrack(() => {
 			const current = new Set(diffs.filter(removesInTarget).map((d) => getItemKey(d)))
@@ -1374,7 +1416,10 @@
 									variant="accent"
 									unifiedSize="xs"
 									disabled={scanning}
-									startIcon={{ icon: scanning ? Loader2 : DiffIcon }}
+									startIcon={{
+										icon: scanning ? Loader2 : DiffIcon,
+										classes: scanning ? 'animate-spin' : undefined
+									}}
 									onClick={() => onScan?.()}
 								>
 									{scanning ? 'Computing diff…' : 'Compute diff'}
@@ -1395,7 +1440,8 @@
 								<span>
 									{#if mergeIntoParent}
 										This workspace has {draftCount} undeployed draft{draftCount !== 1 ? 's' : ''}.
-										Only deployed versions in this fork can be sent to {parentWorkspaceId} — deploy
+										Only deployed versions in this {currentNoun} can be sent to {parentWorkspaceId} —
+										deploy
 										{draftCount !== 1 ? 'them' : 'it'} first, otherwise those changes won't be included.
 									{:else}
 										This workspace has {draftCount} undeployed draft{draftCount !== 1 ? 's' : ''}.
@@ -1419,14 +1465,14 @@
 						<Alert title="Conflicting changes detected" type="warning" class="mt-2">
 							<span>
 								{conflictingDiffs.length} item{conflictingDiffs.length !== 1 ? 's have' : ' has'} conflicting
-								changes, it was modified on the original workspace while changes were made on this fork.
-								Make sure to resolve these before merging.
+								changes, it was modified on the original workspace while changes were made on this
+								{currentNoun}. Make sure to resolve these before merging.
 							</span>
 						</Alert>
 					{/if}
 					{#if hasBehindChanges && hasAheadChanges && !(mergeIntoParent && !canDeployToParent)}
 						<Alert
-							title="This fork is behind {parentWorkspaceId} and needs to be up to date before deploying"
+							title="This {currentNoun} is behind {parentWorkspaceId} and needs to be up to date before deploying"
 							type="warning"
 							class="my-2"
 						>
@@ -1553,39 +1599,23 @@
 							<AlertTriangle class="w-3 h-3 inline mr-0.5" />+Draft
 						</Badge>
 					{/if}
-					<!-- Status badges -->
-					{#if !diff.exists_in_fork && diff.exists_in_source && diff.ahead == 0 && diff.behind > 0}
+					<!-- Status badges. An item on one side only states the effect of
+					     deploying it; the row is offered at all only when the missing side
+					     recorded dropping it (see `diffForkDroppedItem`). -->
+					{#if diffCreatesInTarget(diff, mergeIntoParent)}
 						<Badge
-							title="This item was newly created in the parent workspace '{parentWorkspaceId}'"
+							title="This item exists in '{deploySourceWorkspace}' but not in '{deployTargetWorkspace}' — deploying it creates it there"
 							color="indigo"
 							size="xs">New</Badge
 						>
-					{/if}
-					{#if !diff.exists_in_fork && diff.exists_in_source && diff.ahead > 0}
-						<!-- Same row, two readings: against the parent the fork deleted the
-						     item, while against an arbitrary target it may simply never have
-						     existed here. Deploying removes it there either way — say that
-						     rather than asserting a deletion that may not have happened. -->
+					{:else if removesInTarget(diff)}
+						{@const renamedAway = mergeIntoParent && diff.fork_last_event_kind === 'rename_from'}
 						<Badge
-							title={isArbitraryTarget
-								? `This item exists only in '${parentWorkspaceId}' — deploying it removes it there`
-								: `This item was deleted in '${currentWorkspaceId}'`}
+							title={renamedAway
+								? `'${deploySourceWorkspace}' renamed this item to another path — deploying it removes the old path in '${deployTargetWorkspace}'`
+								: `This item exists in '${deployTargetWorkspace}' but not in '${deploySourceWorkspace}' — deploying it removes it there`}
 							color="red"
-							size="xs">{isArbitraryTarget ? 'Removes in target' : 'Deleted'}</Badge
-						>
-					{/if}
-					{#if diff.exists_in_fork && !diff.exists_in_source && diff.behind > 0}
-						<Badge
-							title="This item was deleted in the parent workspace '{parentWorkspaceId}'"
-							color="red"
-							size="xs">Deleted</Badge
-						>
-					{/if}
-					{#if diff.exists_in_fork && !diff.exists_in_source && diff.ahead > 0 && diff.behind == 0}
-						<Badge
-							title="This item was newly created in '{currentWorkspaceId}'"
-							color="indigo"
-							size="xs">New</Badge
+							size="xs">Removes in {deployTargetWorkspace}</Badge
 						>
 					{/if}
 					{@const ciStatus = getCiTestStatus(diff)}
diff --git a/frontend/src/lib/components/ContentSearchInner.svelte b/frontend/src/lib/components/ContentSearchInner.svelte
index 4b04b9b07a..34f3815a47 100644
--- a/frontend/src/lib/components/ContentSearchInner.svelte
+++ b/frontend/src/lib/components/ContentSearchInner.svelte
@@ -68,15 +68,6 @@
 		return ` (${n})`
 	}
 
-	function escape(htmlStr) {
-		return htmlStr
-			.replace(/&/g, '&amp;')
-			.replace(/</g, '&lt;')
-			.replace(/>/g, '&gt;')
-			.replace(/"/g, '&quot;')
-			.replace(/'/g, '&#39;')
-	}
-
 	let showNbScripts = $state(10)
 	let showNbApps = $state(10)
 	let showNbResources = $state(10)
@@ -127,7 +118,7 @@
 	filter={search}
 	items={scripts}
 	f={(s) => {
-		return escape(s.content)
+		return s.content
 	}}
 	bind:filteredItems={filteredScriptItems}
 />
@@ -136,7 +127,7 @@
 	filter={search}
 	items={resources}
 	f={(s) => {
-		return escape(YAML.stringify(s.value))
+		return YAML.stringify(s.value)
 	}}
 	bind:filteredItems={filteredResourceItems}
 />
@@ -145,7 +136,7 @@
 	filter={search}
 	items={flows}
 	f={(s) => {
-		return escape(YAML.stringify(s.value, null, 4))
+		return YAML.stringify(s.value, null, 4)
 	}}
 	bind:filteredItems={filteredFlowItems}
 />
@@ -154,7 +145,7 @@
 	filter={search}
 	items={apps}
 	f={(s) => {
-		return escape(YAML.stringify(s.value, null, 4))
+		return YAML.stringify(s.value, null, 4)
 	}}
 	bind:filteredItems={filteredAppItems}
 />
diff --git a/frontend/src/lib/components/DBManagerContent.svelte b/frontend/src/lib/components/DBManagerContent.svelte
index 9332d7ad26..68ba0c5f30 100644
--- a/frontend/src/lib/components/DBManagerContent.svelte
+++ b/frontend/src/lib/components/DBManagerContent.svelte
@@ -1,13 +1,18 @@
 <script lang="ts">
 	import { dbSchemas, workspaceStore, type DBSchema } from '$lib/stores'
-	import { sendUserToast, sortArray } from '$lib/utils'
-	import { Loader2 } from 'lucide-svelte'
+	import { sortArray } from '$lib/utils'
+	import { Loader2, RefreshCcw } from 'lucide-svelte'
+	import Alert from './common/alert/Alert.svelte'
+	import Button from './common/button/Button.svelte'
 	import { dbSupportsSchemas } from './apps/components/display/dbtable/utils'
 	import DbManager from './DBManager.svelte'
+	import DbWorkerTagPicker from './DbWorkerTagPicker.svelte'
+	import MissingWorkerTagAlert from './jobs/MissingWorkerTagAlert.svelte'
 	import {
 		dbSchemaOpsWithPreviewScripts,
 		dbTableOpsWithPreviewScripts,
 		getDbType,
+		getDefaultDbTag,
 		getDucklakeSchema
 	} from './dbOps'
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
@@ -43,6 +48,9 @@
 		 *  navigation `$workspaceStore`; pass the acting workspace when embedded in
 		 *  a session preview whose workspace differs from the top nav. */
 		workspace?: string
+		/** Worker tag every job of this manager runs on, overriding the database
+		 *  language's native tag. Bound so the hints below can offer to set it. */
+		workerTag?: string
 	}
 
 	let {
@@ -56,7 +64,8 @@
 		selectedTables = $bindable([]),
 		disabledTables = [],
 		onImport,
-		workspace = undefined
+		workspace = undefined,
+		workerTag = $bindable()
 	}: Props = $props()
 
 	let ws = $derived(workspace ?? $workspaceStore)
@@ -82,30 +91,81 @@
 		return `${ws}:${getDbSchemasPath(input)}`
 	}
 
+	// Reported in place of the loading spinner: both queries run as jobs, so
+	// anything from a bad connection to a tag no worker serves surfaces here
+	// instead of leaving the manager spinning with no explanation. Each query
+	// owns its slot so neither can clear the other's error on a refetch.
+	let schemaError = $state<string | undefined>(undefined)
+	let colDefsError = $state<string | undefined>(undefined)
+	let loadError = $derived(
+		schemaError
+			? { title: 'Could not load the database schema', message: schemaError }
+			: colDefsError
+				? { title: 'Could not load the tables of this database', message: colDefsError }
+				: undefined
+	)
+
+	// A query already handed to the queue cannot be taken back: `resource` aborts its
+	// controller, but the poller behind these queries doesn't watch the signal, and a
+	// job left on a tag no worker serves only fails ~90s later. Stamp each run so a
+	// superseded one can neither report its failure nor overwrite what replaced it —
+	// picking a working tag from the hints below is exactly that race.
+	let colDefsRun = 0
+	let schemaRun = 0
+
 	let colDefs = resource(
-		() => [input, ws],
+		() => [input, ws, workerTag],
 		async () => {
+			const run = ++colDefsRun
+			colDefsError = undefined
 			if (!input) return
-			return await loadAllTablesMetaData(ws, input)
+			try {
+				const metadata = await loadAllTablesMetaData(ws, input, workerTag)
+				return run === colDefsRun ? metadata : colDefs.current
+			} catch (e) {
+				if (run !== colDefsRun) return colDefs.current
+				colDefsError = 'Error loading tables metadata: ' + ((e as Error)?.message || e)
+				return
+			}
 		}
 	)
+
 	let dbSchemasPromise = resource(
-		() => [input, ws],
+		() => [input, ws, workerTag],
 		async () => {
+			const run = ++schemaRun
+			schemaError = undefined
 			if (!input) return
 			const dbSchemasPath = schemaCacheKey(input)
 			if (input.type == 'database') {
-				$dbSchemas[dbSchemasPath] = await getDbSchemas(
+				// Reported through a local, not `schemaError` directly, so a superseded
+				// run's callback can't fail a load that already succeeded.
+				let queryError: string | undefined
+				const schema = await getDbSchemas(
 					input.resourceType,
 					input.resourcePath,
 					ws,
-					(message: string) => sendUserToast(message, true)
+					(message: string) => (queryError = message),
+					{ customTag: workerTag }
 				)
+				if (run !== schemaRun) return
+				if (!schema) {
+					schemaError = queryError ?? 'The schema query returned no schema'
+					return
+				}
+				$dbSchemas[dbSchemasPath] = schema
 			} else if (input.type == 'ducklake') {
-				$dbSchemas[dbSchemasPath] = await getDucklakeSchema({
-					workspace: ws!,
-					ducklake: input.ducklake
-				})
+				try {
+					const schema = await getDucklakeSchema({
+						workspace: ws!,
+						ducklake: input.ducklake,
+						tag: workerTag
+					})
+					if (run === schemaRun) $dbSchemas[dbSchemasPath] = schema
+				} catch (e) {
+					if (run !== schemaRun) return
+					schemaError = 'Error fetching schema: ' + ((e as Error)?.message || e)
+				}
 			}
 		}
 	)
@@ -117,6 +177,24 @@
 		return colDefs.loading || dbSchemasPromise.loading
 	}
 
+	// Knowing the tag up front is what makes the missing-worker hint below possible
+	// without waiting for the poller to give up.
+	let defaultTag = $derived(input ? getDefaultDbTag(input) : undefined)
+	let jobTag = $derived(workerTag ?? defaultTag)
+
+	// A job queued behind busy workers still loads eventually, so this is a hint
+	// rather than an error. The no-worker-at-all case fails outright instead.
+	const SLOW_LOAD_MS = 10_000
+	let slowLoad = $state(false)
+	$effect(() => {
+		if (!isLoading()) {
+			slowLoad = false
+			return
+		}
+		const t = setTimeout(() => (slowLoad = true), SLOW_LOAD_MS)
+		return () => clearTimeout(t)
+	})
+
 	let replPanelSize = $state(36)
 	const REPL_MIN_SIZE = 1.5
 
@@ -145,7 +223,31 @@
 	}}
 />
 
-{#if dbSchema && ws && input}
+<!-- The error branch comes first on purpose: `dbSchema` is read from a cache that
+	survives a failed refetch, so ordering it first would hide the failure behind
+	stale content. -->
+{#if loadError}
+	<div class="h-full w-full flex flex-col items-center justify-center gap-3 p-8">
+		<div class="max-w-2xl w-full flex flex-col gap-3">
+			<Alert type="error" title={loadError.title} size="xs">
+				{loadError.message}
+			</Alert>
+			<div class="self-start">
+				<Button size="xs" color="light" startIcon={{ icon: RefreshCcw }} on:click={() => refresh()}>
+					Retry
+				</Button>
+			</div>
+			<!-- A database that no default worker can reach fails here rather than in the
+				missing-worker path below, so the same override is offered on any load error. -->
+			<DbWorkerTagPicker
+				bind:tag={workerTag}
+				{defaultTag}
+				workspace={ws}
+				class="border-t pt-3 max-w-md"
+			/>
+		</div>
+	</div>
+{:else if dbSchema && ws && input}
 	{@const _input = input}
 	{@const dbType = getDbType(_input)}
 	<Splitpanes horizontal>
@@ -180,11 +282,13 @@
 						colDefs,
 						tableKey,
 						input: _input,
-						workspace: ws
+						workspace: ws,
+						tag: workerTag
 					})}
 				dbSchemaOps={dbSchemaOpsWithPreviewScripts({
 					input: _input,
 					workspace: ws,
+					tag: workerTag,
 					confirmRunOutOfOrder: (pending) =>
 						outOfOrderModal.ask({
 							title: 'Run migration out of order',
@@ -217,6 +321,7 @@
 				<SqlRepl
 					{input}
 					{workspace}
+					tag={workerTag}
 					onData={(data) => {
 						replResultData = data
 					}}
@@ -238,8 +343,28 @@
 	</Splitpanes>
 {:else}
 	<Splitpanes>
-		<Pane class="relative flex justify-center items-center">
+		<Pane class="relative flex flex-col justify-center items-center gap-3 p-8">
 			<Loader2 class="animate-spin" size={32} />
+			{#if slowLoad}
+				<span class="text-xs text-tertiary max-w-md text-center">
+					The schema query is taking a while. It runs as a job, so it waits for a worker serving its
+					tag to be free.
+				</span>
+				{#if jobTag}
+					<MissingWorkerTagAlert
+						tag={jobTag}
+						subject="Database queries"
+						workspace={ws}
+						class="max-w-2xl w-full"
+					/>
+				{/if}
+				<DbWorkerTagPicker
+					bind:tag={workerTag}
+					{defaultTag}
+					workspace={ws}
+					class="max-w-md w-full"
+				/>
+			{/if}
 		</Pane>
 	</Splitpanes>
 {/if}
diff --git a/frontend/src/lib/components/DBManagerDrawer.svelte b/frontend/src/lib/components/DBManagerDrawer.svelte
index 712c4fbccf..4cac116f06 100644
--- a/frontend/src/lib/components/DBManagerDrawer.svelte
+++ b/frontend/src/lib/components/DBManagerDrawer.svelte
@@ -24,6 +24,8 @@
 	import Alert from './common/alert/Alert.svelte'
 	import { sendUserToast } from '$lib/toast'
 	import { isCloudHosted } from '$lib/cloud'
+	import { useDbManagerTag } from './dbManagerTag.svelte'
+	import DbWorkerTagButton from './DbWorkerTagButton.svelte'
 
 	interface Props {
 		uriState: DbManagerUriState
@@ -81,6 +83,12 @@
 
 	let dbManagerContent: DBManagerContent | undefined = $state()
 
+	// Per-database worker tag override, remembered across drawer opens.
+	const workerTag = useDbManagerTag(
+		() => ws,
+		() => uriState.effectiveInput
+	)
+
 	let hasReplResult = $state(false)
 
 	// Export/Import state
@@ -181,6 +189,7 @@
 					bind:this={dbManagerContent}
 					input={uriState.effectiveInput}
 					workspace={uriState.workspace}
+					bind:workerTag={() => workerTag.tag, (v) => (workerTag.tag = v)}
 					bind:hasReplResult
 					bind:selectedSchemaKey={uriState.selectedSchema}
 					bind:selectedTableKey={uriState.selectedTable}
@@ -223,6 +232,14 @@
 					Import
 				</Button>
 			{/if}
+			{#if uriState.effectiveInput && ws}
+				<DbWorkerTagButton
+					bind:tag={() => workerTag.tag, (v) => (workerTag.tag = v)}
+					input={uriState.effectiveInput}
+					workspace={ws}
+				/>
+			{/if}
+
 			<Button
 				loading={dbManagerContent?.isLoading() ?? false}
 				on:click={refreshManager}
diff --git a/frontend/src/lib/components/DBTable.svelte b/frontend/src/lib/components/DBTable.svelte
index 6566542b77..5e0c2c8682 100644
--- a/frontend/src/lib/components/DBTable.svelte
+++ b/frontend/src/lib/components/DBTable.svelte
@@ -70,8 +70,8 @@
 								.then(() => {
 									sendUserToast('Value updated')
 								})
-								.catch(() => {
-									sendUserToast('Error updating value', true)
+								.catch((e) => {
+									sendUserToast('Error updating value: ' + ((e as Error)?.message || e), true)
 									refresh?.()
 								})
 						}
diff --git a/frontend/src/lib/components/DatatableSchemaDiff.svelte b/frontend/src/lib/components/DatatableSchemaDiff.svelte
index ac215747e0..579b7a1923 100644
--- a/frontend/src/lib/components/DatatableSchemaDiff.svelte
+++ b/frontend/src/lib/components/DatatableSchemaDiff.svelte
@@ -13,7 +13,9 @@
 	import SimpleEditor from '$lib/components/SimpleEditor.svelte'
 	import { sendUserToast } from '$lib/toast'
 	import { userWorkspaces } from '$lib/stores'
+	import { childWorkspaceNoun } from '$lib/utils/devWorkspaceLabel'
 	import { runScriptAndPollResult } from '$lib/components/jobs/utils'
+	import { writingJobOptions } from '$lib/components/jobs/writingJob'
 	import YAML from 'yaml'
 	import DrawerContent from './common/drawer/DrawerContent.svelte'
 	import ConfirmationModal from './common/confirmationModal/ConfirmationModal.svelte'
@@ -33,6 +35,11 @@
 
 	let { currentWorkspaceId, parentWorkspaceId }: Props = $props()
 
+	let currentNoun = $derived(
+		childWorkspaceNoun($userWorkspaces.find((w) => w.id === currentWorkspaceId))
+	)
+	let currentNounCap = $derived(currentNoun.charAt(0).toUpperCase() + currentNoun.slice(1))
+
 	let loading = $state(true)
 	let error: string | undefined = $state(undefined)
 	let diffs: DatatableDiff[] = $state([])
@@ -228,14 +235,17 @@
 					throw runErr
 				}
 			} else {
-				await runScriptAndPollResult({
-					workspace: targetWorkspace,
-					requestBody: {
-						args: { database: `datatable://${dtName}` },
-						language: 'postgresql',
-						content: migrationSql
-					}
-				})
+				await runScriptAndPollResult(
+					{
+						workspace: targetWorkspace,
+						requestBody: {
+							args: { database: `datatable://${dtName}` },
+							language: 'postgresql',
+							content: migrationSql
+						}
+					},
+					writingJobOptions
+				)
 			}
 		} catch (e: any) {
 			sendUserToast(e?.body ?? e?.message ?? String(e), true)
@@ -317,8 +327,9 @@
 							<div class="border-t divide-y">
 								{#if diff.aheadChanges.length > 0}
 									<div class="px-3 py-1.5">
-										<div class="text-2xs font-semibold text-blue-500 mb-1">Fork changes (ahead)</div
-										>
+										<div class="text-2xs font-semibold text-blue-500 mb-1">
+											{currentNounCap} changes (ahead)
+										</div>
 										{#each diff.aheadChanges as change}
 											<div class="flex items-center gap-2 text-xs py-0.5">
 												{#if change.kind === 'added'}
@@ -389,8 +400,8 @@
 		<DrawerContent
 			on:close={() => (drawerOpen = false)}
 			title="{drawerChange.schemaName}.{drawerChange.tableName} ({drawerDirection === 'ahead'
-				? 'Fork → Parent'
-				: 'Parent → Fork'})"
+				? `${currentNounCap} → Parent`
+				: `Parent → ${currentNounCap}`})"
 		>
 			{#snippet actions()}
 				<Button
@@ -418,7 +429,7 @@
 				<!-- Diff section -->
 				<div style="height: 45%;">
 					<div class="py-1.5 text-2xs font-semibold text-secondary">
-						Schema diff (parent ↔ fork)
+						Schema diff (parent ↔ {currentNoun})
 					</div>
 					<div class="h-[calc(100%-28px)] border rounded-md overflow-clip">
 						{#await import('$lib/components/DiffEditor.svelte')}
diff --git a/frontend/src/lib/components/DbWorkerTagButton.svelte b/frontend/src/lib/components/DbWorkerTagButton.svelte
new file mode 100644
index 0000000000..3cbb60dc53
--- /dev/null
+++ b/frontend/src/lib/components/DbWorkerTagButton.svelte
@@ -0,0 +1,39 @@
+<script lang="ts">
+	import { Tag } from 'lucide-svelte'
+	import Button from './common/button/Button.svelte'
+	import Popover from './meltComponents/Popover.svelte'
+	import DbWorkerTagPicker from './DbWorkerTagPicker.svelte'
+	import { getDefaultDbTag } from './dbOps'
+	import type { DbInput } from './dbTypes'
+
+	interface Props {
+		/** Tag override; undefined runs the database's jobs on their native tag. */
+		tag: string | undefined
+		input: DbInput
+		/** Workspace the custom tags are read from; defaults to the navigation one. */
+		workspace?: string
+	}
+
+	let { tag = $bindable(), input, workspace = undefined }: Props = $props()
+
+	let defaultTag = $derived(getDefaultDbTag(input))
+</script>
+
+<Popover floatingConfig={{ strategy: 'absolute', placement: 'bottom-end' }}>
+	{#snippet trigger()}
+		<Button
+			size="xs"
+			color="light"
+			startIcon={{ icon: Tag }}
+			nonCaptureEvent
+			title="Worker tag the database jobs run on"
+		>
+			{tag ?? 'Worker tag'}
+		</Button>
+	{/snippet}
+	{#snippet content()}
+		<div class="p-4 w-96">
+			<DbWorkerTagPicker bind:tag {defaultTag} {workspace} />
+		</div>
+	{/snippet}
+</Popover>
diff --git a/frontend/src/lib/components/DbWorkerTagPicker.svelte b/frontend/src/lib/components/DbWorkerTagPicker.svelte
new file mode 100644
index 0000000000..15b7b8032a
--- /dev/null
+++ b/frontend/src/lib/components/DbWorkerTagPicker.svelte
@@ -0,0 +1,29 @@
+<script lang="ts">
+	import WorkerTagSelect from './WorkerTagSelect.svelte'
+
+	interface Props {
+		/** Tag override; undefined runs the jobs on `defaultTag`. */
+		tag: string | undefined
+		/** Tag the jobs carry with no override, i.e. the database language's native one. */
+		defaultTag: string | undefined
+		/** Workspace the custom tags are read from; defaults to the navigation one. */
+		workspace?: string
+		class?: string
+	}
+
+	let {
+		tag = $bindable(),
+		defaultTag,
+		workspace = undefined,
+		class: className = ''
+	}: Props = $props()
+</script>
+
+<div class={'flex flex-col gap-1 ' + className}>
+	<span class="text-xs font-semibold text-secondary">Worker tag</span>
+	<WorkerTagSelect bind:tag noLabel nullTag={defaultTag} workspaceId={workspace} size="sm" />
+	<span class="text-xs text-tertiary">
+		Queries of this database run as jobs tagged <b>{defaultTag}</b>. Pick a custom tag to run them
+		on a specific worker group instead, e.g. the only one that can reach this database.
+	</span>
+</div>
diff --git a/frontend/src/lib/components/DefaultScriptsInner.svelte b/frontend/src/lib/components/DefaultScriptsInner.svelte
index 1a451d8264..eaa3d989a0 100644
--- a/frontend/src/lib/components/DefaultScriptsInner.svelte
+++ b/frontend/src/lib/components/DefaultScriptsInner.svelte
@@ -7,10 +7,10 @@
 	import Alert from './common/alert/Alert.svelte'
 
 	interface Props {
-		small?: boolean;
+		small?: boolean
 	}
 
-	let { small = false }: Props = $props();
+	let { small = false }: Props = $props()
 
 	function computeLangs(defaultScripts: WorkspaceDefaultScripts | undefined): Script['language'][] {
 		const allLangs = Object.keys(defaultScriptLanguages) as Script['language'][]
diff --git a/frontend/src/lib/components/DeployWorkspace.svelte b/frontend/src/lib/components/DeployWorkspace.svelte
index e54f6e6b53..1f938dcfdf 100644
--- a/frontend/src/lib/components/DeployWorkspace.svelte
+++ b/frontend/src/lib/components/DeployWorkspace.svelte
@@ -106,6 +106,19 @@
 		return undefined
 	}
 
+	/**
+	 * Authorization half of the on_behalf_of pair for flows/scripts. Only a custom pick
+	 * names one; for every other choice the backend derives it from the email, so
+	 * returning undefined clears the source item's value rather than keeping it.
+	 */
+	function getOnBehalfOfPermissionedAsForDeploy(
+		statusPath: string,
+		kind: Kind
+	): string | undefined {
+		if (kind === 'trigger' || onBehalfOfChoice[statusPath] !== 'custom') return undefined
+		return customOnBehalfOf[statusPath]?.permissionedAs
+	}
+
 	async function reload(path: string) {
 		try {
 			if (!$superadmin) {
@@ -324,7 +337,8 @@
 			workspaceFrom: $workspaceStore!,
 			workspaceTo: workspaceToDeployTo!,
 			additionalInformation,
-			onBehalfOf: getOnBehalfOfForDeploy(statusPath, kind)
+			onBehalfOf: getOnBehalfOfForDeploy(statusPath, kind),
+			onBehalfOfPrincipal: getOnBehalfOfPermissionedAsForDeploy(statusPath, kind)
 		})
 
 		if (result.success) {
diff --git a/frontend/src/lib/components/Dev.svelte b/frontend/src/lib/components/Dev.svelte
index 6d9b21aeb9..54a68dd5a3 100644
--- a/frontend/src/lib/components/Dev.svelte
+++ b/frontend/src/lib/components/Dev.svelte
@@ -712,6 +712,7 @@
 		outputPickerOpenFns,
 		preserveOnBehalfOf: writable(false),
 		savedOnBehalfOfEmail: writable<string | undefined>(undefined),
+		savedOnBehalfOfPermissionedAs: writable<string | undefined>(undefined),
 		devTempScriptRefs: () => flowTempScriptRefs
 	})
 	setContext<PropPickerContext>('PropPickerContext', {
diff --git a/frontend/src/lib/components/DevWorkspaceSetting.svelte b/frontend/src/lib/components/DevWorkspaceSetting.svelte
index 3f523767b8..e148d90c22 100644
--- a/frontend/src/lib/components/DevWorkspaceSetting.svelte
+++ b/frontend/src/lib/components/DevWorkspaceSetting.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
-	import { workspaceStore, userWorkspaces, usersWorkspaceStore } from '$lib/stores'
-	import { WorkspaceService } from '$lib/gen'
+	import { workspaceStore, userWorkspaces, usersWorkspaceStore, superadmin } from '$lib/stores'
+	import { WorkspaceService, type ProtectionRuleset } from '$lib/gen'
 	import { Badge, Button } from '$lib/components/common'
 	import Select from '$lib/components/select/Select.svelte'
 	import Toggle from '$lib/components/Toggle.svelte'
@@ -8,31 +8,59 @@
 	import { switchWorkspace } from '$lib/storeUtils'
 	import { goto } from '$app/navigation'
 	import { base } from '$lib/base'
-	import { findCanonicalDevWorkspace } from '$lib/utils/workspaceHierarchy'
-	import { devBadgeText, devLabelKey, devLabelNoun } from '$lib/utils/devWorkspaceLabel'
+	import {
+		findCanonicalDevWorkspace,
+		findWorkspaceAncestors,
+		findWorkspaceDescendants,
+		devWorkspacesInChainAbove
+	} from '$lib/utils/workspaceHierarchy'
+	import { getUserExt } from '$lib/user'
+	import {
+		DEV_WORKSPACE_LABELS,
+		devBadgeText,
+		devLabelKey,
+		devLabelNoun,
+		type DevWorkspaceLabelKey
+	} from '$lib/utils/devWorkspaceLabel'
+	import DevWorkspaceLabelPicker from '$lib/components/workspaceSettings/DevWorkspaceLabelPicker.svelte'
 	import {
 		loadProtectionRules,
-		fetchProtectionRulesForWorkspace,
-		isRuleUnconditionallyActiveInRulesets
+		isRuleActiveInRulesets,
+		isRuleUnconditionallyActiveInRulesets,
+		DEV_WORKSPACE_LOCK_RULE_NAME
 	} from '$lib/workspaceProtectionRules.svelte'
-	import { GitFork, ExternalLink } from 'lucide-svelte'
+	import { GitFork, ExternalLink, Check, Minus, Pen } from 'lucide-svelte'
 	import { resource } from 'runed'
+	import type { Snippet } from 'svelte'
+
+	let {
+		// What this workspace promotes into its parent (deploy target + item filters). Rendered with
+		// the pairing statement it restates, ahead of the parent's protections and of the nested
+		// pairing below — hence handed over rather than placed by the page, which cannot see where
+		// that boundary falls.
+		deployTarget
+	}: { deployTarget?: Snippet } = $props()
 
 	let currentWs = $derived($userWorkspaces.find((w) => w.id === $workspaceStore))
 	let isDev = $derived(currentWs?.is_dev_workspace ?? false)
 	let currentLabel = $derived(devLabelKey(currentWs?.dev_workspace_label))
 	let parentId = $derived(currentWs?.parent_workspace_id ?? undefined)
+	let parentWs = $derived(parentId ? $userWorkspaces.find((w) => w.id === parentId) : undefined)
+	// A throwaway fork sits on neither side of a pairing: it is not its parent's dev workspace, and a
+	// dev of its own would be discarded along with it.
+	let isThrowawayFork = $derived(!!parentId && !isDev)
 	let canonicalDev = $derived(findCanonicalDevWorkspace($workspaceStore, $userWorkspaces))
 
 	// A prod admin who isn't a member of the dev can't see it in their workspace list, so ask the
 	// server (only when the client list doesn't already have it) — otherwise the tab would show the
 	// attach form instead of the existing pairing and detach control.
 	const devWorkspaceResource = resource(
-		() => (!isDev && !parentId && !canonicalDev ? $workspaceStore : undefined),
+		() => (!isThrowawayFork && !canonicalDev ? $workspaceStore : undefined),
 		async (ws) => (ws ? await WorkspaceService.getDevWorkspace({ workspace: ws }) : undefined)
 	)
-	// The paired dev to display: the client entry when we're a member (so "Go to dev workspace" works),
-	// else the server result (pairing + detach still available to a prod admin).
+	// The paired dev to display: the client entry when we're a member, else the server result (pairing
+	// + detach still available to a prod admin). `isMember` decides whether switching into it would
+	// land somewhere the caller can use — a superadmin can enter any workspace, member or not.
 	let pairedDev = $derived(
 		canonicalDev
 			? {
@@ -54,61 +82,192 @@
 	let selectedDevId = $state<string | undefined>(undefined)
 	let lockProdDeploy = $state(true)
 	let lockProdForking = $state(true)
-	// Cosmetic display label chosen when attaching an existing workspace as dev.
-	let attachLabel = $state<'dev' | 'staging'>('dev')
+	// The label names the deploy branch, and dev workspaces in a chain share their git-sync
+	// repositories: two carrying the same label deploy to the same branch. So the picker steers away
+	// from a label the dev workspaces above already hold. Computed without the selected candidate, so
+	// picking one can never take the form away mid-selection.
+	let chainTakenLabels = $derived(
+		new Set(
+			devWorkspacesInChainAbove($workspaceStore, $userWorkspaces).map((w) =>
+				devLabelKey(w.dev_workspace_label)
+			)
+		)
+	)
+	let availableAttachLabels = $derived(DEV_WORKSPACE_LABELS.filter((l) => !chainTakenLabels.has(l)))
+	let attachLabel = $state<DevWorkspaceLabelKey>('dev')
+	// A candidate keeps its own dev workspaces through the attach, labels included: the first one
+	// whose label is already spoken for further up the resulting chain blocks the pairing, whatever
+	// label the candidate itself is given.
+	let candidateClash = $derived.by(() => {
+		if (!selectedDevId) return undefined
+		const taken = new Set<string>([...chainTakenLabels, attachLabel])
+		for (const w of findWorkspaceDescendants(selectedDevId, $userWorkspaces)) {
+			if (!w.is_dev_workspace) continue
+			const label = devLabelKey(w.dev_workspace_label)
+			if (taken.has(label)) return w.id
+			taken.add(label)
+		}
+		return undefined
+	})
 	let busy = $state(false)
 
-	// If this workspace already blocks direct deploy / forking through an existing protection rule, keep
-	// the matching lock toggle on but locked: attaching only manages its own reserved dev-workspace rule,
-	// so turning it "off" here couldn't lift a separately-defined block. Fetched only while the attach form
-	// is on screen; a failed fetch falls back to the editable default-on toggle (real rules still enforce).
-	const rootProtectionRules = resource(
-		() => (!parentId && !pairedDev ? $workspaceStore : undefined),
-		async (ws, _prev, { signal }) => {
+	// Protection-rule state for one workspace. Instantiated twice because a dev workspace shows two
+	// panels at once: the locks its own prod carries, and the locks it would carry as the prod of a
+	// nested dev.
+	function useProtectionRules(getWs: () => string | undefined) {
+		const rules = resource(getWs, async (ws, _prev, { signal }) => {
 			if (!ws) return undefined
-			const rules = await fetchProtectionRulesForWorkspace(ws)
-			// The generated client can't take an abort signal, so drop a superseded response here: a late
-			// result for a previously selected workspace must not overwrite the current one's rules.
+			// `fetchProtectionRulesForWorkspace` fails open with an empty list, which the toggles below
+			// want but the status panel must not read as "nothing is enforced" — so keep the failure.
+			let rules: ProtectionRuleset[] | undefined
+			try {
+				rules = await WorkspaceService.listProtectionRules({ workspace: ws })
+			} catch (e) {
+				console.error(`Failed to fetch protection rules for workspace ${ws}:`, e)
+			}
+			// The generated client can't take an abort signal, so drop a superseded response here: a
+			// late result for a previously selected workspace must not overwrite the current one's.
 			if (signal.aborted) throw new DOMException('superseded', 'AbortError')
-			return { ws, rules }
+			return { ws, rules: rules ?? [], failed: rules === undefined }
+		})
+		// Only trust a result that belongs to the workspace we're currently reading rules for (guards
+		// the in-flight window and any out-of-order response); undefined means "not known yet" and is
+		// treated as locked below.
+		const result = $derived.by(() => {
+			const current = rules.current
+			return current && current.ws === getWs() ? current : undefined
+		})
+		const list = $derived(result?.rules)
+		// Until the fetch resolves for the current workspace its rules are unknown. Treat each lock as
+		// engaged during that window so the toggle is locked on and the effective value stays true:
+		// otherwise a user could turn a lock off and attach before an existing rule is detected,
+		// sending false and omitting the reserved rule — leaving prod unprotected if that rule is
+		// later removed.
+		const unknown = $derived(rules.loading || list === undefined)
+		// Only a rule with no bypass users/groups matches the empty-bypass reserved lock we would
+		// create; a bypassable rule stays editable, otherwise forcing the lock on would revoke the
+		// bypassed users' direct-deploy / forking access.
+		const alreadyBlocksDeploy = $derived(
+			isRuleUnconditionallyActiveInRulesets(list ?? [], 'DisableDirectDeployment')
+		)
+		const alreadyBlocksForking = $derived(
+			isRuleUnconditionallyActiveInRulesets(list ?? [], 'DisableWorkspaceForking')
+		)
+		// What the paired view reports. Unlike the toggles above, this asks whether the rule is
+		// enforced at all: a ruleset with bypass users still blocks everyone outside that list, so it
+		// is in force here even though the attach form leaves its toggle editable.
+		const enforcesDeployBlock = $derived(
+			isRuleActiveInRulesets(list ?? [], 'DisableDirectDeployment')
+		)
+		const enforcesForkingBlock = $derived(
+			isRuleActiveInRulesets(list ?? [], 'DisableWorkspaceForking')
+		)
+		// The named rulesets actually carrying either lock. Reporting only "blocked / allowed" left no
+		// way to reach the rule that decides it, which is the one thing a reader here wants to change.
+		const enforcingRulesets = $derived(
+			(list ?? []).filter(
+				(r) =>
+					r.rules.includes('DisableDirectDeployment') || r.rules.includes('DisableWorkspaceForking')
+			)
+		)
+		// A failed read is not "nothing is enforced": report it as unknown rather than claiming allowed.
+		const readFailed = $derived(result?.failed ?? false)
+		return {
+			get deployLocked() {
+				return alreadyBlocksDeploy || unknown
+			},
+			get forkingLocked() {
+				return alreadyBlocksForking || unknown
+			},
+			get alreadyBlocksDeploy() {
+				return alreadyBlocksDeploy
+			},
+			get alreadyBlocksForking() {
+				return alreadyBlocksForking
+			},
+			get enforcesDeployBlock() {
+				return enforcesDeployBlock
+			},
+			get enforcesForkingBlock() {
+				return enforcesForkingBlock
+			},
+			get enforcingRulesets() {
+				return enforcingRulesets
+			},
+			get readFailed() {
+				return readFailed
+			},
+			get enforcementUnknown() {
+				return unknown || readFailed
+			},
+			refetch: () => rules.refetch()
 		}
-	)
-	// Only trust a result that belongs to the current workspace (guards the in-flight window and any
-	// out-of-order response); undefined means "not known yet" and is treated as locked below.
-	let rootRules = $derived.by(() => {
-		const current = rootProtectionRules.current
-		return current && current.ws === $workspaceStore ? current.rules : undefined
-	})
-	// Only a rule with no bypass users/groups matches the empty-bypass reserved lock we would create; a
-	// bypassable rule stays editable, otherwise forcing the lock on would revoke the bypassed users'
-	// direct-deploy / forking access.
-	let alreadyBlocksDeploy = $derived(
-		isRuleUnconditionallyActiveInRulesets(rootRules ?? [], 'DisableDirectDeployment')
-	)
-	let alreadyBlocksForking = $derived(
-		isRuleUnconditionallyActiveInRulesets(rootRules ?? [], 'DisableWorkspaceForking')
-	)
-	// Until the fetch resolves for the current workspace its rules are unknown. Treat each lock as
-	// engaged during that window so the toggle is locked on and the effective value stays true:
-	// otherwise a user could turn a lock off and attach before an existing rule is detected, sending
-	// false and omitting the reserved rule — leaving prod unprotected if that rule is later removed.
-	let rulesUnknown = $derived(rootProtectionRules.loading || rootRules === undefined)
-	let deployLocked = $derived(alreadyBlocksDeploy || rulesUnknown)
-	let forkingLocked = $derived(alreadyBlocksForking || rulesUnknown)
+	}
+
+	// The locks a pairing applies always sit on the prod side, so each panel reads its own workspace:
+	// the parent's rules describe what this dev workspace is promoted into, this workspace's own
+	// describe what its (possibly nested) dev workspace is promoted into.
+	const parentRules = useProtectionRules(() => (isDev ? parentId : undefined))
+	const ownRules = useProtectionRules(() => (isThrowawayFork ? undefined : $workspaceStore))
+
 	// Sent to the backend: a locked restriction (enforced or not-yet-known) stays on regardless of the
 	// toggle's raw state, keeping the request consistent with what the locked toggle shows.
-	let effectiveLockProdDeploy = $derived(deployLocked || lockProdDeploy)
-	let effectiveLockProdForking = $derived(forkingLocked || lockProdForking)
+	let effectiveLockProdDeploy = $derived(ownRules.deployLocked || lockProdDeploy)
+	let effectiveLockProdForking = $derived(ownRules.forkingLocked || lockProdForking)
 
-	// A standalone root workspace, or an existing fork of this prod (same family), can be attached.
-	// A fork parented to a different workspace can't (the backend rejects a parent that isn't this
-	// prod), so it's excluded here.
+	// Editing the parent's rules from the dev side needs admin IN THE PARENT, which membership does
+	// not imply and this workspace's own admin rights say nothing about: the rulesets tab is
+	// admin-only, so a link offered to anyone else lands them on a tab they cannot open. Asked of the
+	// parent directly, as `is_admin` is per-workspace. A superadmin is admin everywhere and has no
+	// `usr` row to find. Tagged with its workspace and guarded against a superseded response, like the
+	// rules resource above: runed keeps the previous `current` while a new source loads, so switching
+	// between dev workspaces would otherwise offer Edit based on the previous parent's role.
+	const parentUser = resource(
+		() => (isDev && parentId ? parentId : undefined),
+		async (ws, _prev, { signal }) => {
+			if (!ws) return undefined
+			const user = await getUserExt(ws)
+			if (signal.aborted) throw new DOMException('superseded', 'AbortError')
+			return { ws, isAdmin: user?.is_admin === true }
+		}
+	)
+	let canEditParentRules = $derived(
+		$superadmin || (parentUser.current?.ws === parentId && parentUser.current?.isAdmin === true)
+	)
+
+	// With a name, deep-links into that rule's drawer; without one, the rulesets list. Built from
+	// scratch rather than from the current query so no stale `?workspace=<dev>` survives a switch.
+	function rulesetsHref(name?: string): string {
+		const rule = name ? `&rule=${encodeURIComponent(name)}` : ''
+		return `${base}/workspace_settings?tab=rulesets${rule}`
+	}
+
+	function openRulesets(name?: string) {
+		goto(rulesetsHref(name))
+	}
+
+	function openRulesetsInParent(name?: string) {
+		if (!parentId) return
+		switchWorkspace(parentId)
+		goto(rulesetsHref(name))
+	}
+
+	// Reparenting an ancestor below this workspace would close a parent<->child cycle, which the
+	// backend rejects: with a dev workspace allowed as prod, the family root is such an ancestor and
+	// would otherwise show up here as a standalone candidate.
+	let ancestorIds = $derived(
+		new Set(findWorkspaceAncestors($workspaceStore, $userWorkspaces).map((w) => w.id))
+	)
+	// A standalone root workspace, or an existing fork of this workspace (same family), can be
+	// attached. A fork parented to a different workspace can't (the backend rejects a parent that
+	// isn't this one), so it's excluded here.
 	let attachCandidates = $derived(
 		$userWorkspaces
 			.filter(
 				(w) =>
 					w.id !== $workspaceStore &&
 					w.id !== 'admins' &&
+					!ancestorIds.has(w.id) &&
 					(!w.parent_workspace_id || w.parent_workspace_id === $workspaceStore)
 			)
 			.map((w) => ({
@@ -122,10 +281,22 @@
 
 	async function refresh() {
 		usersWorkspaceStore.set(await WorkspaceService.listUserWorkspaces())
-		// Attach/detach changes this (root) workspace's protection rules; reload them so the
-		// direct-deploy / forking lock UI reflects the change without a workspace switch or reload.
+		// Both lookups have to be refetched explicitly: neither resource's source value changes when
+		// this workspace gains or loses its dev workspace, so without this the caller who is not a
+		// member of the dev workspace (the one that reads the pairing from the server rather than
+		// from the workspace list) keeps seeing the pre-attach/detach state until the tab remounts.
+		devWorkspaceResource.refetch()
+		// Attach/detach changes this workspace's protection rules; reload them so the direct-deploy /
+		// forking lock UI reflects the change without a workspace switch or reload.
+		// Refetching duplicates the request `loadProtectionRules` just made, which is the price of it
+		// being the only way to supersede whatever this resource already has in flight: `mutate` just
+		// assigns, so an earlier fetch lands afterwards and puts the pre-attach rules back on screen.
+		// No guard makes seeding safe either — runed shares one `loading` flag, which a superseded
+		// request clears while its replacement is still running. One extra request on an admin-only
+		// action is cheaper than a panel that misreports what is enforced.
 		if ($workspaceStore) {
 			await loadProtectionRules($workspaceStore)
+			ownRules.refetch()
 		}
 	}
 
@@ -170,10 +341,216 @@
 	}
 </script>
 
-{#if isDev && parentId}
+<!-- The locks are protection rules, so being paired does not imply them: a pairing that came from the
+     deploy_to migration rather than from an attach carries neither. `onOpen` navigates to the rules
+     of the workspace this panel describes, which is not the active one on the dev side; it is
+     undefined when the reader is not an admin there. The labels name that workspace in that case,
+     so the button does not switch workspaces without saying so. -->
+{#snippet protectionsPanel(opts: {
+	title: string
+	rules: ReturnType<typeof useProtectionRules>
+	onOpen?: (name?: string) => void
+	editLabel: string
+	manageLabel: string
+})}
+	{@const onOpen = opts.onOpen}
+	{@const rules = opts.rules}
+	<div class="flex flex-col gap-1 rounded-md border bg-surface-secondary p-3">
+		<span class="text-xs font-semibold text-emphasis">{opts.title}</span>
+		{#if rules.enforcementUnknown}
+			<span class="text-2xs text-secondary">
+				{rules.readFailed ? 'Could not read the protection rules' : 'Checking protection rules…'}
+			</span>
+		{:else}
+			<span class="text-2xs text-secondary flex items-center gap-1.5">
+				{#if rules.enforcesDeployBlock}<Check size={12} class="text-green-600" />{:else}<Minus
+						size={12}
+					/>{/if}
+				Direct edits {rules.enforcesDeployBlock ? 'are blocked' : 'are allowed'}
+			</span>
+			<span class="text-2xs text-secondary flex items-center gap-1.5">
+				{#if rules.enforcesForkingBlock}<Check size={12} class="text-green-600" />{:else}<Minus
+						size={12}
+					/>{/if}
+				Forking {rules.enforcesForkingBlock ? 'is blocked' : 'is allowed'}
+			</span>
+			{#if rules.enforcesDeployBlock || rules.enforcesForkingBlock}
+				<!-- Only admins reach this tab, and `check_user_against_rule` lets an admin through
+				     every rule, so without this the reader would try what the panel calls blocked. -->
+				<span class="text-2xs text-secondary">Workspace admins always bypass these rules.</span>
+			{/if}
+			{#if rules.enforcingRulesets.length > 0}
+				<div class="flex flex-col gap-1 mt-2 pt-2 border-t">
+					<span class="text-2xs text-secondary">Enforced by</span>
+					{#each rules.enforcingRulesets as ruleset (ruleset.name)}
+						<div class="flex items-center justify-between gap-2">
+							<div class="flex flex-col min-w-0">
+								<span class="text-2xs font-mono text-emphasis truncate">{ruleset.name}</span>
+								{#if ruleset.name === DEV_WORKSPACE_LOCK_RULE_NAME}
+									<span class="text-2xs text-secondary">Applied by this pairing</span>
+								{/if}
+							</div>
+							{#if onOpen}
+								<Button
+									variant="subtle"
+									unifiedSize="2xs"
+									startIcon={{ icon: Pen }}
+									onclick={() => onOpen(ruleset.name)}
+								>
+									{opts.editLabel}
+								</Button>
+							{/if}
+						</div>
+					{/each}
+				</div>
+			{/if}
+		{/if}
+		{#if onOpen && rules.enforcingRulesets.length === 0}
+			<div class="self-start mt-1">
+				<Button variant="subtle" unifiedSize="2xs" onclick={() => onOpen()}>
+					{opts.manageLabel}
+				</Button>
+			</div>
+		{/if}
+	</div>
+{/snippet}
+
+<!-- This workspace as the prod side of a pairing: the dev it already has, or the form to give it one.
+     Rendered for a root workspace and, since a dev workspace can host its own dev, for a dev
+     workspace too. -->
+{#snippet ownDevSection()}
+	{#if pairedDev}
+		<div class="flex flex-col gap-3 max-w-2xl">
+			<p class="text-sm">
+				This workspace's {devLabelNoun(pairedDev.label)} is <b>{pairedDev.name}</b>
+				({pairedDev.id}). Edits to this workspace are redirected there.
+			</p>
+			{@render protectionsPanel({
+				title: 'Protections in force on this workspace',
+				rules: ownRules,
+				onOpen: openRulesets,
+				editLabel: 'Edit',
+				manageLabel: 'Manage in Rulesets'
+			})}
+			<div class="flex gap-2">
+				{#if pairedDev.isMember || $superadmin}
+					<Button
+						variant="default"
+						startIcon={{ icon: GitFork }}
+						onclick={() => switchWorkspace(pairedDev.id)}
+					>
+						Go to {devLabelNoun(pairedDev.label)}
+					</Button>
+				{/if}
+				<Button color="red" disabled={busy} onclick={() => detach(pairedDev.id)}>Detach</Button>
+			</div>
+		</div>
+	{:else if availableAttachLabels.length === 0}
+		<p class="text-sm text-secondary max-w-2xl">
+			Every environment label is already taken by a dev workspace in this chain, and two carrying
+			the same label would deploy to the same branch. Promote through the existing chain instead.
+		</p>
+	{:else}
+		<div class="flex flex-col gap-3 max-w-2xl">
+			<p class="text-sm text-secondary">
+				Pair this workspace with a dev workspace: the same code with a different environment
+				(resource and variable values). Edits are made in the dev workspace and promoted here.
+			</p>
+			<div class="flex flex-col gap-1">
+				<span class="text-xs font-semibold text-emphasis">Attach an existing workspace as dev</span>
+				<Select
+					items={attachCandidates}
+					bind:value={selectedDevId}
+					placeholder="Select a workspace"
+					clearable
+				/>
+			</div>
+			<DevWorkspaceLabelPicker bind:value={attachLabel} takenLabels={chainTakenLabels} />
+			<!-- Left under the label row rather than replacing it: flipping the label is often the fix. -->
+			{#if candidateClash}
+				<p class="text-2xs text-secondary">
+					<b>{candidateClash}</b> comes with the selected workspace and already deploys to a branch this
+					chain would then use twice. Pick a different label, or another workspace.
+				</p>
+			{/if}
+			<div class="flex flex-col gap-2 rounded-md border bg-surface-secondary p-3">
+				<div class="flex flex-col gap-0.5">
+					<span class="text-xs font-semibold text-emphasis">Protect this workspace on attach</span>
+					<span class="text-2xs text-secondary">
+						Nothing is enforced until you attach: these add protection rules to this workspace so
+						changes are made in the dev workspace and promoted here.
+					</span>
+				</div>
+				{#if ownRules.deployLocked}
+					<div class="flex flex-col gap-0.5">
+						<Toggle
+							checked
+							disabled
+							options={{
+								right: 'Block direct edits in this workspace (deploy via the dev workspace)'
+							}}
+						/>
+						{#if ownRules.alreadyBlocksDeploy}
+							<span class="text-2xs text-secondary ml-11"
+								>Already enforced by an existing protection rule</span
+							>
+						{/if}
+					</div>
+				{:else}
+					<Toggle
+						bind:checked={lockProdDeploy}
+						options={{
+							right: 'Block direct edits in this workspace (deploy via the dev workspace)'
+						}}
+					/>
+				{/if}
+				{#if ownRules.forkingLocked}
+					<div class="flex flex-col gap-0.5">
+						<Toggle checked disabled options={{ right: 'Prevent forking this workspace' }} />
+						{#if ownRules.alreadyBlocksForking}
+							<span class="text-2xs text-secondary ml-11"
+								>Already enforced by an existing protection rule</span
+							>
+						{/if}
+					</div>
+				{:else}
+					<Toggle
+						bind:checked={lockProdForking}
+						options={{ right: 'Prevent forking this workspace' }}
+					/>
+				{/if}
+			</div>
+			<div class="flex gap-2">
+				<Button
+					variant="accent"
+					disabled={busy || !selectedDevId || !!candidateClash}
+					onclick={attach}
+				>
+					Attach dev workspace
+				</Button>
+				<Button
+					variant="default"
+					startIcon={{ icon: GitFork }}
+					onclick={() => goto(`${base}/user/fork_workspace?dev=true`)}
+				>
+					Create a new dev workspace
+				</Button>
+			</div>
+		</div>
+	{/if}
+{/snippet}
+
+{#if isThrowawayFork}
+	<p class="text-sm text-secondary max-w-2xl">
+		Dev workspace pairing is not available on a throwaway fork. This workspace is a fork of
+		<b>{parentId}</b>.
+	</p>
+	{@render deployTarget?.()}
+{:else if isDev && parentId}
 	<div class="flex flex-col gap-3 max-w-2xl">
 		<p class="text-sm">
-			This is a <b>{devLabelNoun(currentWs?.dev_workspace_label)}</b> paired with root workspace
+			This is a <b>{devLabelNoun(currentWs?.dev_workspace_label)}</b> paired with
+			{parentWs?.is_dev_workspace ? devLabelNoun(parentWs.dev_workspace_label) : 'root workspace'}
 			<b>{parentId}</b>. Promote changes from the home page banner or the Compare &amp; Deploy page.
 		</p>
 		<div class="text-2xs text-secondary">
@@ -183,115 +560,43 @@
 				<span class="font-mono">{currentLabel}</span> branch.
 			</span>
 		</div>
+	</div>
+	{@render deployTarget?.()}
+	<div class="flex flex-col gap-3 max-w-2xl mt-6">
+		<!-- A reader who is not a member of the parent gets a 403 listing its rules, which is expected
+			     here rather than an anomaly worth a permanent error box, so drop the panel instead. -->
+		{#if !parentRules.readFailed}
+			{@render protectionsPanel({
+				title: `Protections in force on ${parentId}`,
+				rules: parentRules,
+				onOpen: canEditParentRules ? openRulesetsInParent : undefined,
+				editLabel: `Edit in ${parentId}`,
+				manageLabel: `Manage in ${parentId}`
+			})}
+		{/if}
 		<div>
 			<Button
 				variant="default"
 				startIcon={{ icon: ExternalLink }}
 				onclick={() => switchWorkspace(parentId)}
 			>
-				Go to root workspace
+				Go to {parentWs?.is_dev_workspace
+					? devLabelNoun(parentWs.dev_workspace_label)
+					: 'root workspace'}
 			</Button>
 		</div>
 	</div>
-{:else if pairedDev}
-	<div class="flex flex-col gap-3 max-w-2xl">
-		<p class="text-sm">
-			This workspace's {devLabelNoun(pairedDev.label)} is <b>{pairedDev.name}</b> ({pairedDev.id}).
-			Edits to this workspace are redirected there.
-		</p>
-		<div class="flex gap-2">
-			{#if pairedDev.isMember}
-				<Button
-					variant="default"
-					startIcon={{ icon: GitFork }}
-					onclick={() => switchWorkspace(pairedDev.id)}
-				>
-					Go to {devLabelNoun(pairedDev.label)}
-				</Button>
-			{/if}
-			<Button color="red" disabled={busy} onclick={() => detach(pairedDev.id)}>Detach</Button>
-		</div>
-	</div>
-{:else if parentId}
-	<p class="text-sm text-secondary max-w-2xl">
-		Dev workspace pairing is only available for root workspaces. This workspace is a fork of
-		<b>{parentId}</b>.
-	</p>
-{:else}
-	<div class="flex flex-col gap-3 max-w-2xl">
-		<p class="text-sm text-secondary">
-			Pair this workspace with a dev workspace: the same code with a different environment (resource
-			and variable values). Edits are made in the dev workspace and promoted here.
-		</p>
+	<div class="flex flex-col gap-3 max-w-2xl mt-8 pt-6 border-t">
 		<div class="flex flex-col gap-1">
-			<span class="text-xs font-semibold text-emphasis">Attach an existing workspace as dev</span>
-			<Select
-				items={attachCandidates}
-				bind:value={selectedDevId}
-				placeholder="Select a workspace"
-				clearable
-			/>
-		</div>
-		<div class="text-2xs text-secondary">
-			Label: <Badge color="indigo" small>{devBadgeText(attachLabel)}</Badge>
-			<button
-				type="button"
-				class="text-secondary hover:text-primary hover:underline"
-				onclick={() => (attachLabel = attachLabel === 'staging' ? 'dev' : 'staging')}
-			>
-				Change to {attachLabel === 'staging' ? 'dev' : 'staging'}
-			</button>
-		</div>
-		{#if deployLocked}
-			<div class="flex flex-col gap-0.5">
-				<Toggle
-					checked
-					disabled
-					options={{
-						right: 'Block direct edits in this workspace (deploy via the dev workspace)'
-					}}
-				/>
-				{#if alreadyBlocksDeploy}
-					<span class="text-2xs text-secondary ml-11"
-						>Already enforced by an existing protection rule</span
-					>
-				{/if}
-			</div>
-		{:else}
-			<Toggle
-				bind:checked={lockProdDeploy}
-				options={{
-					right: 'Block direct edits in this workspace (deploy via the dev workspace)'
-				}}
-			/>
-		{/if}
-		{#if forkingLocked}
-			<div class="flex flex-col gap-0.5">
-				<Toggle checked disabled options={{ right: 'Prevent forking this workspace' }} />
-				{#if alreadyBlocksForking}
-					<span class="text-2xs text-secondary ml-11"
-						>Already enforced by an existing protection rule</span
-					>
-				{/if}
-			</div>
-		{:else}
-			<Toggle
-				bind:checked={lockProdForking}
-				options={{ right: 'Prevent forking this workspace' }}
-			/>
-		{/if}
-		<div class="flex gap-2">
-			<Button variant="accent" disabled={busy || !selectedDevId} onclick={attach}>
-				Attach dev workspace
-			</Button>
-			<Button
-				variant="default"
-				startIcon={{ icon: GitFork }}
-				onclick={() => goto(`${base}/user/fork_workspace`)}
-			>
-				Create a new dev workspace
-			</Button>
+			<span class="text-xs font-semibold text-emphasis">This workspace's own dev workspace</span>
+			<p class="text-2xs text-secondary">
+				A dev workspace can itself be paired with one, giving a longer promotion chain (for example
+				dev into staging into prod). It is not the recommended shape — each extra level is another
+				promotion to run — but nothing prevents it.
+			</p>
 		</div>
+		{@render ownDevSection()}
 	</div>
+{:else}
+	{@render ownDevSection()}
 {/if}
-
diff --git a/frontend/src/lib/components/DisplayResult.svelte b/frontend/src/lib/components/DisplayResult.svelte
index 99b47ea86b..8208fb193e 100644
--- a/frontend/src/lib/components/DisplayResult.svelte
+++ b/frontend/src/lib/components/DisplayResult.svelte
@@ -3,6 +3,8 @@
 
 	import { Highlight } from 'svelte-highlight'
 	import { json } from 'svelte-highlight/languages'
+	import DbtRunResult from '$lib/components/dbt/DbtRunResult.svelte'
+	import { parseDbtRun } from '$lib/components/dbt/parseDbtRun'
 	import { copyToClipboard, parseS3Object, roughSizeOfObject } from '$lib/utils'
 	import ExpandableImage from '$lib/components/common/image/ExpandableImage.svelte'
 	import { base } from '$lib/base'
@@ -704,6 +706,13 @@
 		}
 		return undefined
 	})
+
+	// Per-node breakdown of a dbt invocation, rendered above the raw result. On
+	// success it IS the result; on failure the worker puts the same JSON in the
+	// error message after the exit-status line, and that is the case worth
+	// rendering — the failing node is what the user came for. Inert (undefined)
+	// for every other DisplayResult use.
+	let dbtRun = $derived(parseDbtRun(result))
 </script>
 
 <HighlightTheme />
@@ -712,6 +721,10 @@
 	<DataTestsResult tests={dataTests} />
 {/if}
 
+{#if dbtRun}
+	<DbtRunResult run={dbtRun} />
+{/if}
+
 {#if result_stream && result == undefined}
 	<div class="flex flex-col w-full gap-2">
 		<div class="flex items-center gap-2 text-secondary text-xs">
diff --git a/frontend/src/lib/components/DropdownV2.svelte b/frontend/src/lib/components/DropdownV2.svelte
index 3a12198188..6738e7ace8 100644
--- a/frontend/src/lib/components/DropdownV2.svelte
+++ b/frontend/src/lib/components/DropdownV2.svelte
@@ -13,6 +13,7 @@
 	import DropdownV2Inner from './DropdownV2Inner.svelte'
 	import { pointerDownOutside } from '$lib/utils'
 	import { createDropdownMenu, melt, createSync } from '@melt-ui/svelte'
+	import { overlayPortalTarget } from '$lib/components/common/overlayHost.svelte'
 	import type { MenubarMenuElements } from '@melt-ui/svelte'
 	import ResolveOpen from '$lib/components/common/menu/ResolveOpen.svelte'
 	import Button from '$lib/components/common/button/Button.svelte'
@@ -86,12 +87,17 @@
 
 	let buttonEl: HTMLButtonElement | undefined = $state(undefined)
 
+	// Overlays belong to the enclosing pane when there is one — see overlayHost.
+	const hostPortal = overlayPortalTarget('body')
+
 	const {
 		elements: { menu: menuEl, item, trigger },
 		builders,
 		states,
+		options: { portal: portalOption },
 		ids: { menu: dropdownId }
 	} = createDropdownMenu({
+		portal: untrack(() => hostPortal()),
 		positioning: {
 			placement: untrack(() => placement)
 		},
@@ -114,6 +120,10 @@
 		}
 	})
 
+	$effect(() => {
+		$portalOption = hostPortal()
+	})
+
 	const sync = createSync(states)
 	$effect(() => {
 		open
diff --git a/frontend/src/lib/components/EditableSchemaForm.svelte b/frontend/src/lib/components/EditableSchemaForm.svelte
index 5813926abd..5ceef0fbf0 100644
--- a/frontend/src/lib/components/EditableSchemaForm.svelte
+++ b/frontend/src/lib/components/EditableSchemaForm.svelte
@@ -932,7 +932,10 @@
 {/if}
 
 <style>
-	:global(.splitter-hidden .splitpanes__splitter) {
+	/* Direct child only: a descendant selector leaks into nested Splitpanes (e.g. the
+	   sessions preview reuses `.splitter-hidden`, which would otherwise hide the flow
+	   editor / modal splitters too). */
+	:global(.splitter-hidden > .splitpanes__splitter) {
 		background-color: transparent !important;
 		border: none !important;
 		opacity: 0 !important;
diff --git a/frontend/src/lib/components/Editor.svelte b/frontend/src/lib/components/Editor.svelte
index 1215f8ed84..f518632483 100644
--- a/frontend/src/lib/components/Editor.svelte
+++ b/frontend/src/lib/components/Editor.svelte
@@ -10,7 +10,7 @@
 	import { buildWsUrl } from '$lib/wsUrl'
 	import { sendUserToast } from '$lib/toast'
 
-	import { createEventDispatcher, onDestroy, onMount, untrack } from 'svelte'
+	import { createEventDispatcher, onDestroy, onMount, tick, untrack } from 'svelte'
 
 	// import libStdContent from '$lib/es6.d.ts.txt?raw'
 	// import domContent from '$lib/dom.d.ts.txt?raw'
@@ -1670,9 +1670,11 @@
 				// Monaco swallows the keydown (addCommand prevents default and
 				// stops propagation), so page-level Ctrl/Cmd+S handlers never
 				// see it. Re-broadcast as a window event so editors that flush
-				// a draft on the shortcut (raw apps) can react regardless of
-				// which Monaco has focus.
-				window.dispatchEvent(new CustomEvent('wm-monaco-save-shortcut'))
+				// a draft on the shortcut can react regardless of which Monaco
+				// has focus. Only after `tick()`: the autosave payload is parked
+				// by a `$effect`, so dispatching synchronously would make every
+				// listener flush the state from before `updateCode()`.
+				void tick().then(() => window.dispatchEvent(new CustomEvent('wm-monaco-save-shortcut')))
 			})
 
 			editor?.addCommand(KeyMod.CtrlCmd | KeyCode.Enter, function () {
@@ -1971,7 +1973,13 @@
 	})
 
 	onDestroy(() => {
-		console.log('destroying editor')
+		// Flush a pending keystroke debounce, or unmounting discards the last
+		// `changeTimeout` ms of typing. Both guards are load-bearing: without a pending
+		// timer Monaco isn't the newer side (an external write may be), and before init
+		// `getCode()` is '' — flushing either case overwrites real content.
+		if (editor && timeoutModel !== undefined) {
+			updateCode()
+		}
 		valueAfterDispose = getCode()
 		pasteCleanup?.()
 		destroyed = true
@@ -2195,6 +2203,12 @@
 		} else {
 			ed.setValue(next)
 		}
+		// The write above went through `onDidChangeModelContent`, which arms the
+		// keystroke debounce as if the user had typed. Monaco now holds exactly
+		// `code`, so there is nothing to flush — and leaving the timer armed makes
+		// every "is Monaco the newer side?" check (notably the unmount flush) answer
+		// yes on the strength of our own write.
+		cancelPendingChanges()
 	}
 
 	// External `code` prop changes should flow into the Monaco editor. Skip
diff --git a/frontend/src/lib/components/EditorBar.svelte b/frontend/src/lib/components/EditorBar.svelte
index 04f181f4fc..dc2f046850 100644
--- a/frontend/src/lib/components/EditorBar.svelte
+++ b/frontend/src/lib/components/EditorBar.svelte
@@ -1309,7 +1309,11 @@ JsonNode ${windmillPathToCamelCaseName(path)} = JsonNode.Parse(await client.GetS
 
 			{#if customUi?.aiGen != false}
 				{#if openAiChat}
-					<FlowInlineScriptAiButton {moduleId} btnProps={{ variant: 'subtle' }} />
+					<FlowInlineScriptAiButton
+						{moduleId}
+						flushEditor={() => editor?.flushPendingChanges()}
+						btnProps={{ variant: 'subtle' }}
+					/>
 				{/if}
 			{/if}
 
diff --git a/frontend/src/lib/components/FlowBuilder.svelte b/frontend/src/lib/components/FlowBuilder.svelte
index d9692f4812..52af60d7a7 100644
--- a/frontend/src/lib/components/FlowBuilder.svelte
+++ b/frontend/src/lib/components/FlowBuilder.svelte
@@ -58,6 +58,7 @@
 	import FlowImportExportMenu from './flows/header/FlowImportExportMenu.svelte'
 	import FlowPreviewButtons from './flows/header/FlowPreviewButtons.svelte'
 	import type { FlowEditorContext, FlowInput, FlowInputEditorState } from './flows/types'
+	import { setFlowPanelPlacementTelemetry } from './flows/flowEditorTelemetry'
 	import { SelectionManager } from './graph/selectionUtils.svelte'
 	import { NoteEditor } from './graph/noteEditor.svelte'
 	import { setNoteEditorContext } from './graph/noteEditor.svelte'
@@ -111,9 +112,10 @@
 	import type { FlowBuilderProps } from './flow_builder'
 	import { ModulesTestStates } from './modulesTest.svelte'
 	import FlowAssetsHandler, { initFlowGraphAssetsCtx } from './flows/FlowAssetsHandler.svelte'
-	import { buildForkEditUrl, editInForkAllowed, editInForkLabel } from '$lib/utils/editInFork'
+	import { editInForkAllowed, editInForkLabel, openEditInFork } from '$lib/utils/editInFork'
 	import { isCloudHosted } from '$lib/cloud'
 	import { UserDraft } from '$lib/userDraft.svelte'
+	import { setOpenInSessionHandoff } from './sessions/openInSessionContext'
 
 	let {
 		initialPath = $bindable(''),
@@ -171,11 +173,13 @@
 	// For preserve_on_behalf_of feature
 	let preserveOnBehalfOf = writable(false)
 	let savedOnBehalfOfEmail = writable<string | undefined>(savedFlow?.on_behalf_of_email)
+	let savedOnBehalfOfPermissionedAs = writable<string | undefined>(savedFlow?.on_behalf_of)
 
 	// Keep savedOnBehalfOfEmail in sync when savedFlow is loaded asynchronously
 	$effect(() => {
 		if (savedFlow?.on_behalf_of_email !== undefined) {
 			savedOnBehalfOfEmail.set(savedFlow.on_behalf_of_email)
+			savedOnBehalfOfPermissionedAs.set(savedFlow.on_behalf_of)
 		}
 	})
 
@@ -196,6 +200,30 @@
 	// (session pane, drawer, etc.) where the viewport stays wide.
 	let topbarWidth = $state(0)
 	const compactTopbar = $derived(topbarWidth > 0 && topbarWidth < 720)
+
+	const diffEnabled = $derived(customUi?.topBar?.diff != false)
+	// Nothing to compare against until a deployed version exists.
+	const diffDisabled = $derived(!savedFlow || newFlow || savedFlow?.no_deployed === true)
+	const diffTitle = $derived(
+		diffDisabled ? 'Deploy this flow once to compare against the deployed version' : 'Diff'
+	)
+	// The narrow bar (sessions) and the width-collapsed one have no room for a Diff
+	// button, so it moves into the menu ahead of Deployment History instead of
+	// dropping out of reach.
+	const diffInMenu = $derived(condensedHeader || compactTopbar)
+	const diffMenuItems: Item[] = $derived(
+		diffEnabled && diffInMenu
+			? [
+					{
+						displayName: 'Diff',
+						icon: DiffIcon,
+						action: () => openDiffDrawer(),
+						disabled: diffDisabled,
+						tooltip: diffDisabled ? diffTitle : undefined
+					}
+				]
+			: []
+	)
 	let confirmDeploymentCallback: (triggersToDeploy: Trigger[]) => void = () => {}
 
 	// AI changes warning modal
@@ -221,6 +249,8 @@
 	// presence keyed on that URL leaks a phantom self-badge. Hide it here.
 	const inSessionPane = !!getContext('aiChatManager')
 
+	setFlowPanelPlacementTelemetry(!inSessionPane)
+
 	function hasAIChanges(): boolean {
 		return aiChatManager.flowAiChatHelpers?.hasPendingChanges() ?? false
 	}
@@ -324,6 +354,15 @@
 		})
 	}
 
+	// Monaco swallows the keydown, so an editor with focus never reaches the
+	// window handler; Editor/SimpleEditor/TemplateEditor re-broadcast it
+	// (untyped event, hence the manual listener). A step's code editor also
+	// flushes through its `formatAction`, and a redundant flush is a no-op.
+	$effect(() => {
+		window.addEventListener('wm-monaco-save-shortcut', saveDraft)
+		return () => window.removeEventListener('wm-monaco-save-shortcut', saveDraft)
+	})
+
 	// Materialize a brand-new flow's draft before the session preview loads it by
 	// path — an untouched new flow never autosaved, so forcePersist is the only
 	// thing that creates the row. Gated to never-deployed: forcePersist skips the
@@ -461,6 +500,7 @@
 						dedicated_worker: flow.dedicated_worker,
 						visible_to_runner_only: flow.visible_to_runner_only,
 						on_behalf_of_email: flow.on_behalf_of_email,
+						on_behalf_of: flow.on_behalf_of,
 						preserve_on_behalf_of: $preserveOnBehalfOf || undefined,
 						deployment_message: deploymentMsg || undefined,
 						labels: (flow as any).labels
@@ -509,6 +549,7 @@
 						ws_error_handler_muted: flow.ws_error_handler_muted,
 						visible_to_runner_only: flow.visible_to_runner_only,
 						on_behalf_of_email: flow.on_behalf_of_email,
+						on_behalf_of: flow.on_behalf_of,
 						preserve_on_behalf_of: $preserveOnBehalfOf || undefined,
 						deployment_message: deploymentMsg || undefined,
 						labels: (flow as any).labels
@@ -695,6 +736,31 @@
 	// falling back to `$pathStore` in drawer mounts that carry no storage path.
 	const sessionTargetPath = $derived(liveEditorDraftStoragePath || $pathStore)
 
+	const sessionOpen = $derived(
+		sessionTargetPath
+			? {
+					target: { kind: 'flow' as const, path: sessionTargetPath },
+					workspaceId: opWorkspace ?? undefined,
+					beforeOpen: persistDraftForSession
+				}
+			: undefined
+	)
+
+	// Reaches the AI entry point in a step's inline-editor toolbar, which the
+	// recursive module wrapper sits too deep under to be handed a prop. `selected`
+	// is the flow editor's own step param, so the session preview opens on the
+	// step whose code the user was editing. Withheld under `disableAi` (same gate
+	// as the graph toolbar's button): an embed that turned AI off must not get an
+	// entry point that navigates the host out to /sessions.
+	setOpenInSessionHandoff({
+		source: (opts) =>
+			disableAi || !sessionOpen
+				? undefined
+				: opts?.moduleId
+					? { ...sessionOpen, previewParams: { selected: opts.moduleId } }
+					: sessionOpen
+	})
+
 	$effect(() => {
 		if (liveEditorDraftStoragePath === undefined || !opWorkspace) return
 		const workspace = opWorkspace
@@ -721,8 +787,10 @@
 
 	const stepsInputArgs = new StepsInputArgs()
 
+	// Every caller is a deliberate "show me that panel" action (a toolbar button, the
+	// preview's trigger shortcut), so the panel must open even in modal mode.
 	function select(selectedId: string) {
-		selectionManager.selectId(selectedId)
+		selectionManager.selectId(selectedId, { openPanel: true })
 	}
 
 	let insertButtonOpen = writable<boolean>(false)
@@ -754,6 +822,7 @@
 		outputPickerOpenFns,
 		preserveOnBehalfOf,
 		savedOnBehalfOfEmail,
+		savedOnBehalfOfPermissionedAs,
 		opWorkspace: () => opWorkspace
 	})
 
@@ -832,7 +901,8 @@
 				}
 			}
 		}
-		selectionManager.selectId('Input')
+		// Undo restores a selection as a side effect; it is not a request to see Input.
+		selectionManager.selectId('Input', { openPanel: false })
 	}
 
 	function handleRedo() {
@@ -870,7 +940,9 @@
 				}
 				break
 			case 's':
-				if (event.ctrlKey || event.metaKey) {
+				// Shift excluded: the switch lowercases so Ctrl+Shift+S lands here
+				// too, and swallowing it would steal the browser/OS shortcut.
+				if ((event.ctrlKey || event.metaKey) && !event.shiftKey) {
 					saveDraft()
 					event.preventDefault()
 				}
@@ -880,7 +952,9 @@
 					let ids = generateIds()
 					let idx = ids.indexOf(selectedIdStore!)
 					if (idx > -1 && idx < ids.length - 1) {
-						selectionManager.selectId(ids[idx + 1])
+						// Traversal, not a request to see any one panel: the ids list starts with
+						// flow-level entries, and opening the modal mid-walk swallows the arrows.
+						selectionManager.selectId(ids[idx + 1], { openPanel: false })
 						event.preventDefault()
 					}
 				}
@@ -891,7 +965,7 @@
 					let ids = generateIds()
 					let idx = ids.indexOf(selectedIdStore!)
 					if (idx > 0 && idx < ids.length) {
-						selectionManager.selectId(ids[idx - 1])
+						selectionManager.selectId(ids[idx - 1], { openPanel: false })
 						event.preventDefault()
 					}
 				}
@@ -914,7 +988,9 @@
 		onClick: () => void
 	}> = []
 
-	if (untrack(() => customUi).topBar?.extraDeployOptions != false) {
+	// In a session pane every one of these leaves the session (details page, new
+	// tab), so the deploy button carries no dropdown there — as in ScriptBuilder.
+	if (untrack(() => customUi).topBar?.extraDeployOptions != false && !inSessionPane) {
 		if (!newFlow) {
 			dropdownItems.push({
 				label: 'Exit & see details',
@@ -939,7 +1015,7 @@
 		) {
 			dropdownItems.push({
 				label: editInForkLabel(opWorkspace, $userWorkspaces),
-				onClick: () => window.open(buildForkEditUrl('flow', initialPath))
+				onClick: () => openEditInFork('flow', initialPath, opWorkspace)
 			})
 		}
 	}
@@ -997,15 +1073,16 @@
 	const mod = isMac() ? '⌘' : 'Ctrl+'
 
 	function getMoreItems(): Item[] {
+		const leadingItems = [...diffMenuItems, ...baseMenuItems]
 		return [
-			...baseMenuItems,
+			...leadingItems,
 			{
 				displayName: 'Undo',
 				icon: Undo,
 				action: () => handleUndo(),
 				disabled: $history.index === 0,
 				shortcut: `${mod}Z`,
-				separatorTop: baseMenuItems.length > 0
+				separatorTop: leadingItems.length > 0
 			},
 			{
 				displayName: 'Redo',
@@ -1338,13 +1415,7 @@
 							></span>
 						{/if}
 					</div>
-					{#if customUi?.topBar?.diff != false}
-						{@const isDraftOnly = savedFlow?.no_deployed === true}
-						{@const diffDisabled = !savedFlow || newFlow || isDraftOnly}
-						{@const diffTitle =
-							newFlow || isDraftOnly
-								? 'Deploy this flow once to compare against the deployed version'
-								: 'Diff'}
+					{#if diffEnabled && !diffInMenu}
 						<!-- A disabled <button> fires no pointer events, so a title/tooltip on
 						     it never shows on hover. pointer-events-none on the button lets the
 						     hover reach this titled wrapper instead. -->
@@ -1355,7 +1426,6 @@
 								on:click={() => openDiffDrawer()}
 								disabled={diffDisabled}
 								btnClasses={diffDisabled ? 'pointer-events-none' : undefined}
-								iconOnly={compactTopbar}
 								title={diffTitle}
 								startIcon={{ icon: DiffIcon }}
 							>
@@ -1412,6 +1482,7 @@
 					{disabledFlowInputs}
 					disableAi={disableAi || customUi?.stepInputs?.ai == false}
 					disableSettings={customUi?.settingsPanel === false}
+					modalPanel={customUi?.modalPanel != false}
 					{loading}
 					on:reload={() => {
 						renderCount += 1
@@ -1433,7 +1504,7 @@
 					{savedFlow}
 					onDeployTrigger={handleDeployTrigger}
 					onEditInput={(moduleId, key) => {
-						selectionManager.selectId(moduleId)
+						selectionManager.selectId(moduleId, { openPanel: true })
 						// Use new prop-based system
 						forceTestTab[moduleId] = true
 						highlightArg[moduleId] = key
@@ -1448,13 +1519,7 @@
 					aiChatOpen={aiChatManager.open}
 					showFlowAiButton={!disableAi && customUi?.topBar?.aiBuilder != false}
 					toggleAiChat={() => aiChatManager.toggleOpen()}
-					sessionOpen={sessionTargetPath
-						? {
-								target: { kind: 'flow', path: sessionTargetPath },
-								workspaceId: opWorkspace ?? undefined,
-								beforeOpen: persistDraftForSession
-							}
-						: undefined}
+					{sessionOpen}
 					onOpenPreview={flowPreviewButtons?.openPreview}
 					localModuleStates={showJobStatus ? localModuleStates : {}}
 					{showJobStatus}
diff --git a/frontend/src/lib/components/FlowLogViewer.svelte b/frontend/src/lib/components/FlowLogViewer.svelte
index 465275be9d..385d028e7e 100644
--- a/frontend/src/lib/components/FlowLogViewer.svelte
+++ b/frontend/src/lib/components/FlowLogViewer.svelte
@@ -25,7 +25,7 @@
 	import FlowLogRow from './FlowLogRow.svelte'
 	import { Tooltip } from './meltComponents'
 	import FlowTimelineBar from './FlowTimelineBar.svelte'
-	import { getActiveReplay } from './recording/flowRecording.svelte'
+	import { getActiveReplay } from './recording/replay.svelte'
 
 	type RootJobData = Partial<Job>
 
diff --git a/frontend/src/lib/components/FlowPlugConnect.svelte b/frontend/src/lib/components/FlowPlugConnect.svelte
index cd44f3d1bd..8c408b4bda 100644
--- a/frontend/src/lib/components/FlowPlugConnect.svelte
+++ b/frontend/src/lib/components/FlowPlugConnect.svelte
@@ -5,25 +5,50 @@
 	import { twMerge } from 'tailwind-merge'
 
 	interface Props {
-		connecting: boolean;
-		id?: undefined | string;
-		wrapperClasses?: string;
+		connecting: boolean
+		id?: undefined | string
+		wrapperClasses?: string
+		disabled?: boolean
+		title?: string
 	}
 
-	let { connecting, id = undefined, wrapperClasses = '' }: Props = $props();
+	let {
+		connecting,
+		id = undefined,
+		wrapperClasses = '',
+		disabled = false,
+		title = undefined
+	}: Props = $props()
+
+	// The ring is masked by an ::after that resolves `background: inherit` up to whatever
+	// encloses the button. Give it an opaque ground while animating, or the gradient shows
+	// straight through. It can't go on the wrapper itself — the scoped `.gradient-button`
+	// rule outranks a utility class there.
+	const animating = $derived(connecting)
 </script>
 
-<AnimatedButton animate={connecting} baseRadius="6px" animationDuration="2s" marginWidth="2px">
-	<Button
-		variant="default"
-		btnClasses={twMerge(
-			connecting ? 'text-accent' : '',
-			'bg-surface hover:bg-surface-hover group/plug-btn overflow-clip flex p-0'
-		)}
-		on:click
-		{...id ? { id } : {}}
-		{wrapperClasses}
-	>
-		<Plug size={14} />
-	</Button>
-</AnimatedButton>
+<div class="flex {animating ? 'bg-surface rounded-md' : ''}">
+	<AnimatedButton animate={animating} baseRadius="6px" animationDuration="2s" marginWidth="2px">
+		<Button
+			variant="default"
+			btnClasses={twMerge(
+				connecting ? 'text-accent' : '',
+				'bg-surface hover:bg-surface-hover group/plug-btn overflow-clip flex p-0'
+			)}
+			on:click
+			{disabled}
+			{...title ? { title } : {}}
+			{...id ? { id } : {}}
+			wrapperClasses={twMerge(
+				// h-5 matches ButtonType.UnifiedHeightClasses.xs, the height of the
+				// static/expression switch it sits next to. Shrink by exactly the animated
+				// ring's margin so the footprint holds and nothing beside it shifts.
+				animating ? 'h-4 w-7' : 'h-5 w-8',
+				'p-0',
+				wrapperClasses
+			)}
+		>
+			<Plug size={12} />
+		</Button>
+	</AnimatedButton>
+</div>
diff --git a/frontend/src/lib/components/FlowPreviewContent.svelte b/frontend/src/lib/components/FlowPreviewContent.svelte
index dd359fb006..dc42f9828c 100644
--- a/frontend/src/lib/components/FlowPreviewContent.svelte
+++ b/frontend/src/lib/components/FlowPreviewContent.svelte
@@ -41,8 +41,7 @@
 	import { stateSnapshot } from '$lib/svelte5Utils.svelte'
 	import FlowRestartButton from './FlowRestartButton.svelte'
 	import { useNestedRestartState } from './useNestedRestartState.svelte'
-	import { createFlowRecording, setActiveRecording } from './recording/flowRecording.svelte'
-	import type { FlowRecording } from './recording/types'
+	import { buildFlowRecording, downloadRecordingJson } from './recording/runRecording'
 
 	interface Props {
 		previewMode: 'upTo' | 'whole'
@@ -146,9 +145,11 @@
 	let stepHistoryLoader = getStepHistoryLoaderContext()
 	let flowProgressBar: FlowProgressBar | undefined = $state(undefined)
 
-	// Recording & replay
-	let flowRecording = createFlowRecording()
-	let lastRecording: FlowRecording | undefined = $state(undefined)
+	// Recording: nothing is captured live — once the run completes, its id is
+	// remembered and the recording is built from the completed jobs on download.
+	let lastRecordingJobId: string | undefined = $state(undefined)
+	let recordedFlow: OpenFlow | undefined = undefined
+	let downloadingRecording: boolean = $state(false)
 	let recordingMode: boolean = $state(false)
 
 	export function setRecordingMode(on: boolean) {
@@ -196,6 +197,13 @@
 			lastPreviewFlow = JSON.stringify(flowStore.val)
 			flowProgressBar?.reset()
 			const newFlow = extractFlow(previewMode)
+			if (recordingMode) {
+				// Any completed run in recording mode becomes downloadable, so pair
+				// the flow as it is for *this* run — not a stale earlier capture.
+				// Deep-cloned: extractFlow('whole') returns the live store object,
+				// and edits made before download must not rewrite the run's definition.
+				recordedFlow = JSON.parse(JSON.stringify(newFlow))
+			}
 			args = await processSecretArgs(args, flowStore.val.schema as any, opWs)
 			newJobId = await runFlowPreview(
 				args,
@@ -265,49 +273,27 @@
 	}
 
 	async function recordAndTest() {
-		lastRecording = undefined
-		flowRecording.start($pathStore)
-		flowRecording.setFlow(extractFlow(previewMode))
-		setActiveRecording(flowRecording)
+		lastRecordingJobId = undefined
 		await runPreview(previewArgs.val, undefined)
 	}
 
-	function collectSubJobIds(flowStatus: Job['flow_status']): string[] {
-		if (!flowStatus) return []
-		const ids: string[] = []
-		for (const mod of flowStatus.modules ?? []) {
-			if (mod.job) ids.push(mod.job)
-			if (mod.flow_jobs) ids.push(...mod.flow_jobs)
-		}
-		if (flowStatus.failure_module?.job) ids.push(flowStatus.failure_module.job)
-		if (flowStatus.preprocessor_module?.job) ids.push(flowStatus.preprocessor_module.job)
-		return ids
-	}
-
-	async function recordSubJobs(completedJob: Job) {
-		const subJobIds = collectSubJobIds(completedJob.flow_status)
-		await Promise.all(
-			subJobIds.map(async (subId) => {
-				try {
-					const subJob = await JobService.getJob({
-						workspace: opWs!,
-						id: subId
-					})
-					flowRecording.addCompletedJob(subId, subJob)
-					// Recurse into nested flows (flow-within-flow)
-					if (subJob.flow_status) {
-						await recordSubJobs(subJob)
-					}
-				} catch (e) {
-					console.warn('[recording] failed to fetch sub-job', subId, e)
-				}
-			})
-		)
-	}
-
-	function downloadRecording() {
-		if (lastRecording) {
-			flowRecording.download(lastRecording)
+	async function downloadRecording() {
+		if (!lastRecordingJobId || downloadingRecording) return
+		downloadingRecording = true
+		try {
+			// A run started before recording mode was enabled captured no flow —
+			// fall back to the flow as it is now.
+			const recording = await buildFlowRecording(
+				opWs!,
+				lastRecordingJobId,
+				$pathStore,
+				recordedFlow ?? extractFlow(previewMode)
+			)
+			downloadRecordingJson(recording, `flow-recording-${$pathStore.replace(/\//g, '-')}`)
+		} catch (e: any) {
+			sendUserToast('Could not build the recording', true, undefined, e?.toString())
+		} finally {
+			downloadingRecording = false
 		}
 	}
 
@@ -328,24 +314,6 @@
 		scrollableDiv && render && untrack(() => onScrollableDivChange())
 	})
 
-	// During recording, watch sub-job SSE streams to capture incremental logs
-	$effect(() => {
-		// Only watch sub-jobs for the current job (jobId is set after runPreview starts)
-		if (flowRecording.active && job?.flow_status && job?.id === jobId) {
-			const modules = job.flow_status.modules ?? []
-			untrack(() => {
-				for (const mod of modules) {
-					if (mod.job) {
-						flowRecording.watchSubJob(mod.job, opWs!)
-					}
-				}
-				if (job?.flow_status?.failure_module?.job) {
-					flowRecording.watchSubJob(job.flow_status.failure_module.job, opWs!)
-				}
-			})
-		}
-	})
-
 	export async function cancelTest() {
 		isRunning = false
 		try {
@@ -418,7 +386,7 @@
 					>
 						Cancel
 					</Button>
-					{#if flowRecording.active}
+					{#if recordingMode}
 						<span class="text-xs text-red-500 font-medium flex items-center gap-1">
 							<Circle size={8} fill="currentColor" /> Recording
 						</span>
@@ -473,12 +441,13 @@
 							{/if}
 						</Button>
 					{/if}
-					{#if lastRecording && recordingMode}
+					{#if lastRecordingJobId && recordingMode}
 						<Button
 							variant="subtle"
 							unifiedSize="sm"
 							title="Download recording"
 							on:click={downloadRecording}
+							loading={downloadingRecording}
 							startIcon={{ icon: Download }}
 						>
 							Download recording
@@ -638,7 +607,6 @@
 				<div class="w-full my-6">
 					<FlowExecutionStatus
 						{job}
-						workspaceId={opWs}
 						{isOwner}
 						innerModules={job?.flow_status?.modules}
 						{suspendStatus}
@@ -683,13 +651,8 @@
 								stepHistoryLoader?.resetInitial(mod.id)
 							}
 						}
-						if (flowRecording.active) {
-							lastRecording = flowRecording.stop()
-							setActiveRecording(undefined)
-							// Fetch sub-job data and add to recording (they load after the root completes)
-							await recordSubJobs(completedJob)
-							// Trigger reactivity update for lastRecording
-							lastRecording = lastRecording
+						if (recordingMode && completedJob?.id) {
+							lastRecordingJobId = completedJob.id
 						}
 						onJobDone?.()
 					}}
diff --git a/frontend/src/lib/components/FlowStatusViewerInner.svelte b/frontend/src/lib/components/FlowStatusViewerInner.svelte
index d30d98a991..fb99326e83 100644
--- a/frontend/src/lib/components/FlowStatusViewerInner.svelte
+++ b/frontend/src/lib/components/FlowStatusViewerInner.svelte
@@ -49,6 +49,7 @@
 		AI_TOOL_MESSAGE_PREFIX,
 		AI_MCP_TOOL_CALL_PREFIX,
 		AI_WEBSEARCH_PREFIX,
+		getAgentActionStateId,
 		getToolCallId
 	} from './graph/renderers/nodes/AIToolNode.svelte'
 	import JobAssetsViewer from './assets/JobAssetsViewer.svelte'
@@ -60,7 +61,7 @@
 	import { SelectionManager } from './graph/selectionUtils.svelte'
 	import { useThrottle } from 'runed'
 	import { Splitpanes, Pane } from 'svelte-splitpanes'
-	import { getActiveReplay } from './recording/flowRecording.svelte'
+	import { getActiveReplay } from './recording/replay.svelte'
 	import { publishLinkedAgentTools } from './flows/flowState'
 	import {
 		getLinkedAgentTools,
@@ -761,34 +762,28 @@
 
 				if (mod.agent_actions && mod.id) {
 					setModuleState(mod.id, {
-						agent_actions: mod.agent_actions
+						agent_actions: mod.agent_actions,
+						agent_actions_success: mod.agent_actions_success
 					})
 					mod.agent_actions.forEach((action, idx) => {
-						if (mod.id) {
-							if (action.type == 'tool_call') {
-								const toolCallId = getToolCallId(idx, mod.id, action.module_id)
-								const success = mod.agent_actions_success?.[idx]
-								setModuleState(toolCallId, {
-									job_id: action.job_id,
-									type: success != undefined ? (success ? 'Success' : 'Failure') : 'InProgress'
-								})
-							} else if (action.type == 'mcp_tool_call') {
-								const mcpToolCallId = AI_MCP_TOOL_CALL_PREFIX + '-' + mod.id + '-' + idx
-								const success = mod.agent_actions_success?.[idx]
-								setModuleState(mcpToolCallId, {
-									type: success != undefined ? (success ? 'Success' : 'Failure') : 'InProgress'
-								})
-							} else if (action.type == 'web_search') {
-								const websearchId = AI_WEBSEARCH_PREFIX + '-' + mod.id + '-' + idx
-								setModuleState(websearchId, {
-									type: 'Success'
-								})
-							} else if (action.type == 'message') {
-								const toolCallId = getToolCallId(idx, mod.id)
-								setModuleState(toolCallId, {
-									type: 'Success'
-								})
-							}
+						if (!mod.id) {
+							return
+						}
+						const stateId = getAgentActionStateId(idx, mod.id, action)
+						const success = mod.agent_actions_success?.[idx]
+						if (action.type == 'tool_call') {
+							setModuleState(stateId, {
+								job_id: action.job_id,
+								type: success != undefined ? (success ? 'Success' : 'Failure') : 'InProgress'
+							})
+						} else if (action.type == 'mcp_tool_call') {
+							setModuleState(stateId, {
+								type: success != undefined ? (success ? 'Success' : 'Failure') : 'InProgress'
+							})
+						} else {
+							setModuleState(stateId, {
+								type: 'Success'
+							})
 						}
 					})
 				}
diff --git a/frontend/src/lib/components/FlowStatusWaitingForEvents.svelte b/frontend/src/lib/components/FlowStatusWaitingForEvents.svelte
index 1769e0386f..5774e5a2ef 100644
--- a/frontend/src/lib/components/FlowStatusWaitingForEvents.svelte
+++ b/frontend/src/lib/components/FlowStatusWaitingForEvents.svelte
@@ -1,7 +1,6 @@
 <script lang="ts">
 	import { mergeSchema } from '$lib/common'
 	import { type Job, JobService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
 	import { ExternalLink, X } from 'lucide-svelte'
 	import DisplayResult from './DisplayResult.svelte'
@@ -14,6 +13,8 @@
 
 	interface Props {
 		isOwner: boolean
+		/** The workspace the job ran in — pass `job.workspace_id`, never the navigation
+		 *  workspace, which differs whenever the editor is embedded. */
 		workspaceId: string | undefined
 		job: Job
 		light?: boolean
@@ -39,12 +40,12 @@
 		if (jobId === lastJobId) {
 			return
 		}
-		if (!jobId) {
+		if (!jobId || !workspaceId) {
 			return {}
 		}
 		lastJobId = jobId
 		let job_result = (await JobService.getCompletedJobResult({
-			workspace: workspaceId ?? $workspaceStore ?? '',
+			workspace: workspaceId,
 			id: jobId
 		})) as any
 		const args = job_result?.default_args ?? {}
@@ -64,10 +65,14 @@
 	let loading = $state(false)
 	let actionTaken = $state(false)
 	async function continu(approve: boolean) {
+		if (!workspaceId) {
+			sendUserToast('Cannot resume: the job has no workspace', true)
+			return
+		}
 		loading = true
 		try {
 			await JobService.resumeSuspended({
-				workspace: workspaceId ?? $workspaceStore ?? '',
+				workspace: workspaceId,
 				jobId: job?.id ?? '',
 				requestBody: {
 					payload: approve ? (default_payload as any) : undefined,
diff --git a/frontend/src/lib/components/FlowWrapper.svelte b/frontend/src/lib/components/FlowWrapper.svelte
index 2bd24f151a..f1de0c1dfb 100644
--- a/frontend/src/lib/components/FlowWrapper.svelte
+++ b/frontend/src/lib/components/FlowWrapper.svelte
@@ -77,7 +77,7 @@
 </script>
 
 {#if trialRender}
-	<AiChatLayout noPadding={true} {disableAi}>
+	<AiChatLayout noPadding={true} {disableAi} loadAiConfig={!disableAi}>
 		{#if light}<div class="bg-red-500 absolute z-10">Trial version</div>{/if}
 		<!-- Gate on a resolved workspace: the draft handle is detached (local-only)
 		     until one exists, so editing before then would be lost on the re-key. -->
@@ -87,6 +87,7 @@
 				{flowStateStore}
 				{disableAi}
 				{...props}
+				customUi={{ modalPanel: false, ...props.customUi }}
 				liveEditorDraftStoragePath={draftStoragePath || undefined}
 			/>
 		{/if}
diff --git a/frontend/src/lib/components/ForkWorkspaceBanner.svelte b/frontend/src/lib/components/ForkWorkspaceBanner.svelte
index 4a74d97241..940c579fd7 100644
--- a/frontend/src/lib/components/ForkWorkspaceBanner.svelte
+++ b/frontend/src/lib/components/ForkWorkspaceBanner.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-	import { workspaceStore, userWorkspaces } from '$lib/stores'
+	import { workspaceStore, userWorkspaces, userStore, type UserExt } from '$lib/stores'
 	import { ScriptService } from '$lib/gen'
 	import type { WorkspaceComparison } from '$lib/gen'
 	import { fetchWorkspaceComparison } from '$lib/workspaceComparison'
@@ -8,10 +8,14 @@
 	import { goto } from '$app/navigation'
 	import { onMount, untrack } from 'svelte'
 	import { useWorkspaceDrafts } from '$lib/workspaceDrafts.svelte'
-	import { devLabelWord } from '$lib/utils/devWorkspaceLabel'
+	import { childWorkspaceNoun, devLabelWord } from '$lib/utils/devWorkspaceLabel'
+	import { diffActionableInDirection } from '$lib/utils_workspace_deploy'
 
 	let loading = $state(false)
 	let comparison: WorkspaceComparison | undefined = $state(undefined)
+	/** Workspace `comparison` describes; control flow only, never rendered. */
+	let comparisonFor: string | undefined = undefined
+	let requestSeq = 0
 	let error: string | undefined = $state(undefined)
 
 	let currentWorkspaceData = $derived($userWorkspaces.find((w) => w.id === $workspaceStore))
@@ -22,69 +26,126 @@
 	// prefix) also avoids a parentless "Fork of ()" banner when the linkage is dropped.
 	let isFork = $derived(parentWorkspaceId != null)
 	let isDevWorkspace = $derived(currentWorkspaceData?.is_dev_workspace ?? false)
+	let currentNoun = $derived(childWorkspaceNoun(currentWorkspaceData))
+	// Operators run scripts and flows, they never deploy a fork, so the banner and
+	// its CTA are noise for them. Gates the fetches too, not just the markup: the
+	// fork/parent comparison is an expensive tally no operator can act on.
+	//
+	// Only a role fetched for the workspace we are on answers this. `$workspaceStore`
+	// flips synchronously on a switch while `$userStore` still holds the workspace we
+	// left, so trusting it unqualified would flash the banner at (and start the tally
+	// for) an operator entering a fork from a workspace where they are not one.
+	function isConfirmedNonOperator(user: UserExt | undefined, ws: string | undefined): boolean {
+		return !!user && !!ws && user.workspace_id === ws && !user.operator
+	}
+	let isNotOperator = $derived(isConfirmedNonOperator($userStore, $workspaceStore))
+	let showBanner = $derived(isFork && isNotOperator)
 
 	// Drafts in this fork. When the fork is otherwise in sync with its parent, a
 	// user with only pending drafts should still get the draft CTA (mirrors the
-	// non-fork WorkspaceDraftsBanner). Pass undefined when not a fork so it doesn't
-	// fetch.
-	const drafts = useWorkspaceDrafts(() => (isFork ? ($workspaceStore ?? undefined) : undefined))
+	// non-fork WorkspaceDraftsBanner). Pass undefined when the banner is hidden so
+	// it doesn't fetch.
+	const drafts = useWorkspaceDrafts(() => (showBanner ? ($workspaceStore ?? undefined) : undefined))
 	const draftCount = $derived(drafts.count)
 
+	// Every read of `comparison` that decides what the banner says or where its button
+	// goes must go through this: anything else — in flight, failed, or a tally skipped
+	// outright — counts zero of everything, which is indistinguishable from "nothing to
+	// deploy". Typed helper avoids the `never`-inference quirk on `$state` in `$derived`.
+	function isAnswerable(c: WorkspaceComparison | undefined, isLoading: boolean): boolean {
+		return !isLoading && !!c && !c.skipped_comparison
+	}
+	const hasAnswer = $derived(isAnswerable(comparison, loading))
+
 	// Fork is fully in sync with its parent (comparison ran, no ahead/behind diffs).
-	// Typed helper avoids the $state `never`-inference quirk on `comparison` in $derived.
 	function isUpToDate(c: WorkspaceComparison | undefined): boolean {
 		return !!c && !c.skipped_comparison && c.summary.total_diffs === 0
 	}
-	let upToDate = $derived(isUpToDate(comparison))
+	let upToDate = $derived(hasAnswer && isUpToDate(comparison))
 	// Up to date with the parent but local drafts are pending — show the draft
 	// state (same text + CTA as the draft banner) instead of "Everything is up to date".
 	let showDraftsOnly = $derived(upToDate && draftCount > 0)
 
+	// Leaving for a workspace with no comparison of its own has to invalidate whatever
+	// is in flight too, or that response lands as this one's answer — and its CI counts
+	// would be fetched for paths this workspace may not even have.
+	function dropComparison() {
+		requestSeq++
+		comparison = undefined
+		comparisonFor = undefined
+		loading = false
+		resetCiTestSummary()
+	}
+
+	// `isNotOperator` is a dependency of its own: it only turns true once this
+	// workspace's role has landed, which is after the switch that triggered it.
 	$effect(() => {
-		;[$workspaceStore, parentWorkspaceId]
+		;[$workspaceStore, parentWorkspaceId, isNotOperator]
 		untrack(() => {
-			if (isFork && $workspaceStore) {
+			if (showBanner && $workspaceStore) {
 				checkForChanges()
 			} else {
-				comparison = undefined
+				dropComparison()
 			}
 		})
 	})
 
 	onMount(() => {
-		if (isFork && $workspaceStore) {
+		if (showBanner && $workspaceStore) {
 			checkForChanges()
 		} else {
-			comparison = undefined
+			dropComparison()
 		}
 	})
 
 	async function checkForChanges() {
-		if (!$workspaceStore || !parentWorkspaceId) {
+		const ws = $workspaceStore
+		const parent = parentWorkspaceId
+		if (!ws || !parent) {
 			return
 		}
 
+		// A comparison only ever describes the workspace it was requested for. The
+		// component survives a fork switch, so drop the previous fork's rows before
+		// fetching rather than let them answer for this one, and let only the newest
+		// request write — responses can land out of order, and a late one would
+		// otherwise paint another fork's counts over the current answer.
+		if (comparisonFor !== ws) {
+			comparison = undefined
+			comparisonFor = undefined
+			resetCiTestSummary()
+		}
+		const seq = ++requestSeq
 		loading = true
 		error = undefined
 
 		try {
 			// Compare with parent workspace (shared single-flight fetch — the chat
 			// diff tool reuses this result instead of recomputing the comparison)
-			const result = await fetchWorkspaceComparison(parentWorkspaceId, $workspaceStore)
+			const result = await fetchWorkspaceComparison(parent, ws)
 
+			if (seq !== requestSeq) return
 			comparison = result
+			comparisonFor = ws
 		} catch (e) {
+			if (seq !== requestSeq) return
 			console.error('Failed to compare workspaces:', e)
 			error = `Failed to check for changes: ${e}`
-			// Still show banner if there's an error, but with error message
+			// Show the banner with the error rather than the rows we failed to refresh:
+			// on a switch those belong to the fork we just left.
+			comparison = undefined
+			comparisonFor = undefined
 		} finally {
-			loading = false
+			if (seq === requestSeq) loading = false
 		}
 	}
 
+	// Opens the direction the button offers, so the label and the list agree: a fork
+	// with nothing to deploy lands on the update side, not on an empty deploy list.
 	function openComparisonDrawer() {
 		if (parentWorkspaceId && $workspaceStore) {
-			goto('/forks/compare?workspace_id=' + encodeURIComponent($workspaceStore), {
+			const dir = hasAnswer && changesAhead === 0 ? '&dir=update' : ''
+			goto('/forks/compare?workspace_id=' + encodeURIComponent($workspaceStore) + dir, {
 				replaceState: true
 			})
 		}
@@ -103,17 +164,29 @@
 	let ciTestRunning = $state(0)
 	let ciTestTotal = $state(0)
 
+	// These describe the rows of one comparison, so they are dropped with it.
+	function resetCiTestSummary() {
+		ciTestPassing = 0
+		ciTestFailing = 0
+		ciTestRunning = 0
+		ciTestTotal = 0
+	}
+
 	async function fetchCiTestSummary() {
 		if (!$workspaceStore || !comparison?.diffs) return
 		const items = comparison.diffs
 			.filter((d) => d.kind === 'script' || d.kind === 'flow' || d.kind === 'resource')
 			.map((d) => ({ path: d.path, kind: d.kind as 'script' | 'flow' | 'resource' }))
 		if (items.length === 0) return
+		// Counted for the comparison current at call time — the poll below outlives a
+		// fork switch, and a slow batch for the fork we left would repaint this one's.
+		const seq = requestSeq
 		try {
 			const batch = await ScriptService.getCiTestResultsBatch({
 				workspace: $workspaceStore,
 				requestBody: { items }
 			})
+			if (seq !== requestSeq) return
 			let passing = 0
 			let failing = 0
 			let running = 0
@@ -148,10 +221,20 @@
 		return () => clearInterval(interval)
 	})
 
+	// Counted with the compare page's own predicate so the banner never advertises a
+	// direction whose list is empty: the `ahead`/`behind` sums in the summary include
+	// rows a direction does not carry, and miss a parent-only row that the update
+	// direction carries at `behind = 0`.
+	function countDir(c: WorkspaceComparison | undefined, mergeIntoParent: boolean): number {
+		return c?.diffs.filter((d) => diffActionableInDirection(d, mergeIntoParent)).length ?? 0
+	}
+	const changesAhead = $derived(countDir(comparison, true))
+	const changesBehind = $derived(countDir(comparison, false))
+
 	function forkAheadBehindMessage(changesAhead: number, changesBehind: number) {
 		let msg: string[] = []
 		if (changesAhead > 0 || changesBehind > 0) {
-			msg.push('This fork is ')
+			msg.push(`This ${currentNoun} is `)
 			if (changesAhead > 0)
 				msg.push(`${changesAhead} change${changesAhead > 1 ? 's' : ''} ahead of `)
 			if (changesAhead > 0 && changesBehind > 0) msg.push('and ')
@@ -162,20 +245,26 @@
 	}
 </script>
 
-{#if isFork}
+{#if showBanner}
 	<!-- Side padding mirrors the page content container below, so the banner
 	     stays aligned with it instead of bleeding to the viewport edges. -->
 	<div class="w-full text-xs max-w-7xl mx-auto px-4 sm:px-8 pt-2">
 		<div class="bg-blue-50 dark:bg-blue-900 rounded-md px-4 py-2">
-			<div class="flex items-center justify-between">
-				<div class="flex items-center gap-3">
-					<GitFork class="w-4 h-4 text-accent" />
-					<div class="text-sm">
+			<!-- The summary wraps inside its own column while the CTA keeps its width and
+			     stays on the first line: laid out as one non-wrapping row, the summary is
+			     long enough on a laptop-width viewport to push the button out of the
+			     banner instead of getting shorter. -->
+			<div class="flex items-center justify-between gap-x-3">
+				<div class="flex items-center flex-wrap gap-x-3 gap-y-1 min-w-0">
+					<GitFork class="w-4 h-4 text-accent shrink-0" />
+					<div class="text-sm min-w-0">
 						<span class="font-medium text-blue-900 dark:text-blue-100">
 							{isDevWorkspace
 								? `${devLabelWord(currentWorkspaceData?.dev_workspace_label)} workspace of`
 								: 'Fork of'}
-							<b>{parentWorkspaceData?.name}</b> ({parentWorkspaceId})
+							<b>{parentWorkspaceData?.name}</b
+							>{#if parentWorkspaceData?.name !== parentWorkspaceId}
+								({parentWorkspaceId}){/if}
 						</span>
 					</div>
 
@@ -186,17 +275,19 @@
 							{error}
 						</span>
 					{:else if comparison}
-						<div class="flex items-center gap-4 text-xs">
+						<div class="flex items-center flex-wrap gap-x-4 gap-y-1 text-xs min-w-0">
 							{#if comparison.summary.total_diffs > 0}
 								<span class="text-blue-700 dark:text-blue-100">
-									{forkAheadBehindMessage(
-										comparison.summary.total_ahead,
-										comparison.summary.total_behind
-									)}
+									{forkAheadBehindMessage(changesAhead, changesBehind)}
 									<span class="font-semibold underline">{parentWorkspaceId}</span> over {comparison
-										.summary.total_diffs} items:
+										.summary.total_diffs} items<span class="hidden lg:inline">:</span>
 								</span>
-								<div class="flex items-center gap-2">
+								<!-- The per-kind breakdown is the first thing to go on a narrow
+								     viewport: the item total above already sizes the change set, and
+								     the compare page carries the detail. -->
+								<div
+									class="hidden lg:flex items-center flex-wrap gap-x-2 gap-y-1 whitespace-nowrap"
+								>
 									{#if comparison.summary.scripts_changed > 0}
 										<span class="text-blue-700 dark:text-blue-100">
 											{comparison.summary.scripts_changed} script{comparison.summary
@@ -272,17 +363,23 @@
 								{#if ciTestTotal > 0}
 									-
 									{#if ciTestFailing > 0}
-										<div class="flex items-center gap-1 text-red-600 dark:text-red-400">
+										<div
+											class="flex items-center gap-1 text-red-600 dark:text-red-400 whitespace-nowrap"
+										>
 											<CircleX class="w-3 h-3" />
 											<span>CI: {ciTestFailing} failing</span>
 										</div>
 									{:else if ciTestRunning > 0}
-										<div class="flex items-center gap-1 text-yellow-600 dark:text-yellow-400">
+										<div
+											class="flex items-center gap-1 text-yellow-600 dark:text-yellow-400 whitespace-nowrap"
+										>
 											<Loader2 class="w-3 h-3 animate-spin" />
 											<span>CI: {ciTestRunning} running</span>
 										</div>
 									{:else}
-										<div class="flex items-center gap-1 text-green-600 dark:text-green-400">
+										<div
+											class="flex items-center gap-1 text-green-600 dark:text-green-400 whitespace-nowrap"
+										>
 											<CircleCheck class="w-3 h-3" />
 											<span>CI: {ciTestPassing} passing</span>
 										</div>
@@ -291,7 +388,9 @@
 
 								{#if comparison.summary.conflicts > 0}
 									-
-									<div class="flex items-center gap-1 text-orange-600 dark:text-orange-400">
+									<div
+										class="flex items-center gap-1 text-orange-600 dark:text-orange-400 whitespace-nowrap"
+									>
 										<AlertTriangle class="w-3 h-3" />
 										<span
 											>{comparison.summary.conflicts} conflict{comparison.summary.conflicts !== 1
@@ -302,7 +401,7 @@
 								{/if}
 							{:else if comparison.skipped_comparison}
 								<span class="text-blue-600 dark:text-blue-200">
-									This fork was created before the addition of certain windmill features, and
+									This {currentNoun} was created before the addition of certain windmill features, and
 									therefore the changes with its parent workspace cannot be displayed.</span
 								>
 							{:else if showDraftsOnly}
@@ -316,7 +415,7 @@
 					{/if}
 				</div>
 
-				<div class="flex items-center gap-2">
+				<div class="flex items-center gap-2 shrink-0">
 					<Button
 						variant="default"
 						unifiedSize="sm"
@@ -324,10 +423,10 @@
 					>
 						{#if showDraftsOnly}
 							Review & deploy drafts
-						{:else if (comparison?.summary.total_ahead ?? 0) > 0}
+						{:else if !hasAnswer || changesAhead > 0}
 							Review & Deploy Changes
 						{:else}
-							Review & Update fork
+							Review & Update {currentNoun}
 						{/if}
 					</Button>
 				</div>
diff --git a/frontend/src/lib/components/GitRepoViewer.svelte b/frontend/src/lib/components/GitRepoViewer.svelte
index 69fd651c3b..8383748e5f 100644
--- a/frontend/src/lib/components/GitRepoViewer.svelte
+++ b/frontend/src/lib/components/GitRepoViewer.svelte
@@ -319,6 +319,7 @@
 			readOnlyMode
 			hideS3SpecificDetails
 			rootPath={`gitrepos/${ws}/${gitRepoResourcePath}/${commitHash}/`}
+			lazyFolders={false}
 			listStoredFilesRequest={HelpersService.listGitRepoFiles}
 			loadFilePreviewRequest={HelpersService.loadGitRepoFilePreview}
 			testConnectionRequest={(async (_d) => {
diff --git a/frontend/src/lib/components/HighlightCode.svelte b/frontend/src/lib/components/HighlightCode.svelte
index 73c9a08c4a..bb51851003 100644
--- a/frontend/src/lib/components/HighlightCode.svelte
+++ b/frontend/src/lib/components/HighlightCode.svelte
@@ -26,7 +26,10 @@
 
 	interface Props {
 		code?: string
-		language: Script['language'] | 'bunnative' | 'frontend' | 'json' | undefined
+		// `sql` is the dialect-agnostic option: a dbt model's SQL is compiled by
+		// whichever adapter the project targets, so naming one dialect would be a
+		// guess. Every dialect below highlights through the same grammar anyway.
+		language: Script['language'] | 'bunnative' | 'frontend' | 'json' | 'sql' | undefined
 		highlightLanguage?: LanguageType<string> | undefined
 		lines?: boolean
 		className?: string
@@ -56,7 +59,9 @@
 		? 'opacity-0 group-hover:opacity-100 focus-within:opacity-100 transition-opacity duration-150'
 		: ''
 
-	function getLang(lang: Script['language'] | 'bunnative' | 'frontend' | 'json' | undefined) {
+	function getLang(
+		lang: Script['language'] | 'bunnative' | 'frontend' | 'json' | 'sql' | undefined
+	) {
 		switch (lang) {
 			case 'python3':
 				return python
@@ -76,6 +81,8 @@
 				return javascript
 			case 'graphql':
 				return graphql
+			case 'sql':
+				return sql
 			case 'mysql':
 				return sql
 			case 'postgresql':
diff --git a/frontend/src/lib/components/IconedPath.svelte b/frontend/src/lib/components/IconedPath.svelte
index 85257c250b..2f72812ffd 100644
--- a/frontend/src/lib/components/IconedPath.svelte
+++ b/frontend/src/lib/components/IconedPath.svelte
@@ -18,12 +18,12 @@
 		<div>
 			<IconedResourceType width="20px" height="20px" name={path.split('/')[2]} silent={true} />
 		</div>
-		<span class="text-sm truncate">{path}</span>
+		<span class="truncate text-xs text-primary">{path}</span>
 	{:else}
 		<div class="center-center">
 			<Building size={16} />
 		</div>
-		<span class="text-sm truncate">{path}</span>
+		<span class="truncate text-xs text-primary">{path}</span>
 		{#if hash}
 			<Badge>{truncateHash(hash)}</Badge>
 		{/if}
diff --git a/frontend/src/lib/components/InputTransformForm.svelte b/frontend/src/lib/components/InputTransformForm.svelte
index 405b5c5c5b..3f81c821de 100644
--- a/frontend/src/lib/components/InputTransformForm.svelte
+++ b/frontend/src/lib/components/InputTransformForm.svelte
@@ -11,7 +11,7 @@
 <script lang="ts">
 	import type { Schema } from '$lib/common'
 	import type { InputCat, DynamicInput as DynamicInputTypes } from '$lib/utils'
-	import { createEventDispatcher, getContext, onDestroy, untrack } from 'svelte'
+	import { createEventDispatcher, getContext, onDestroy, untrack, type Snippet } from 'svelte'
 	import { computeShow } from '$lib/utils'
 
 	import ArgInput from './ArgInput.svelte'
@@ -41,11 +41,28 @@
 	import S3ArrayHelperButton from './S3ArrayHelperButton.svelte'
 	import { inputBorderClass } from './text_input/TextInput.svelte'
 	import FakeMonacoPlaceHolder from './FakeMonacoPlaceHolder.svelte'
+	import { slideDynamic } from '$lib/transitions'
+	import InputError from './InputError.svelte'
 
 	interface Props {
 		schema: Schema | { properties?: Record<string, any>; required?: string[] }
 		arg: InputTransform | any
 		argName: string
+		/** Display name, when the schema key isn't what the user should read. */
+		label?: string
+		/** Replaces the label header, so a setting's own toggle can name the field. */
+		header?: Snippet
+		/** The kind this field always holds, for a value that doesn't carry a `type` of its
+		 *  own — a flow predicate is stored as a bare `{ expr }`. */
+		argType?: InputTransform['type']
+		/** Keep only the header: the setting owning this field is switched off, so there is
+		 *  no value yet. Rendering the header here (rather than swapping in a bare toggle
+		 *  outside) keeps one persistent row, so the field can slide in and out under it. */
+		collapsed?: boolean
+		/** Slide the input in and out as `collapsed` flips. */
+		animateAppear?: boolean
+		/** Message shown under the field, which also turns its border red. */
+		error?: string | undefined
 		headerTooltip?: string | undefined
 		headerTooltipIconClass?: string
 		HeaderTooltipIcon?: any
@@ -55,7 +72,16 @@
 		pickForField?: string | undefined
 		variableEditor?: VariableEditor | undefined
 		itemPicker?: ItemPicker | undefined
+		/** Hide the static/expression switch, for a field that only ever holds one kind.
+		 *  The connect button and the AI helper stay. */
 		noDynamicToggle?: boolean
+		/** Replaces the default StepInputGen, for a field with its own AI helper. That
+		 *  helper drives `suggestion` (its ghost text) and `aiOnKeyUp` (Tab to accept),
+		 *  which the built-in one reaches through `stepInputGen` instead. */
+		aiGen?: Snippet
+		suggestion?: string
+		focused?: boolean
+		aiOnKeyUp?: (e: KeyboardEvent) => void
 		argExtra?: Record<string, any>
 		pickableProperties?: PickableProperties | undefined
 		enableAi?: boolean
@@ -74,6 +100,12 @@
 		schema = $bindable(),
 		arg = $bindable(),
 		argName = $bindable(),
+		label = undefined,
+		header = undefined,
+		argType = undefined,
+		collapsed = false,
+		animateAppear = false,
+		error = undefined,
 		headerTooltip = undefined,
 		headerTooltipIconClass = '',
 		HeaderTooltipIcon = InfoIcon,
@@ -84,6 +116,10 @@
 		variableEditor = undefined,
 		itemPicker = undefined,
 		noDynamicToggle = false,
+		aiGen = undefined,
+		suggestion = $bindable(),
+		focused = $bindable(),
+		aiOnKeyUp = undefined,
 		argExtra = {},
 		pickableProperties = undefined,
 		enableAi = false,
@@ -119,11 +155,13 @@
 
 	const propPickerWrapperContext: PropPickerWrapperContext | undefined =
 		getContext<PropPickerWrapperContext>('PropPickerWrapper')
+	const pickerMode = $derived(propPickerWrapperContext?.pickerMode?.() ?? 'pane')
 	const {
 		inputMatches,
 		connectProp: focusProp,
 		propPickerConfig,
 		clearConnect: clearFocus,
+		openPicker,
 		exprBeingEdited
 	} = propPickerWrapperContext ?? {}
 
@@ -142,7 +180,11 @@
 		allowedAiTransforms === undefined || allowedAiTransforms.includes(argName)
 	)
 
-	let propertyType = $state(getPropertyType(arg))
+	// `argType` wins over whatever the value carries: a predicate has no `type` field, so
+	// inferring would land it on the static input instead of the expression editor.
+	const argKind = $derived(argType ?? arg?.type)
+	// Seeded once: `propertyType` is what the user switches, and `argType` is fixed per field.
+	let propertyType = $state(untrack(() => argType) ?? getPropertyType(arg))
 
 	function setExpr() {
 		const newArg = $exprsToSet?.[argName]
@@ -266,7 +308,7 @@
 		) {
 			setJavaScriptExpr(arg.value)
 		} else {
-			stepInputGen?.onKeyUp?.(e)
+			;(aiOnKeyUp ?? stepInputGen?.onKeyUp)?.(e)
 		}
 	}
 
@@ -319,6 +361,18 @@
 		})
 	}
 
+	/** A predicate is usually half-written when you reach for a property, so insert at the
+	 *  cursor and leave the rest of the expression alone. Only a field that isn't an
+	 *  expression yet gets replaced outright. */
+	function pickIntoArg(path: string) {
+		if (propertyType === 'javascript' && monaco) {
+			propPickerWrapperContext?.onPick?.(path)
+		} else {
+			connectProperty(path)
+		}
+		dispatch('change', { argName })
+	}
+
 	function connectProperty(rawValue: string) {
 		// Extract path from variable('x') or resource('x') format
 		const varMatch = variableMatch(rawValue)
@@ -419,8 +473,21 @@
 		}
 	}
 
+	// The column beside a settings row delivers here rather than through the host's `select`
+	// handler, which can only reach a mounted expression editor. A collapsed setting has no
+	// field at all, so it gives the target up and the column closes with it.
+	$effect(() => {
+		if (pickerMode !== 'sidePane') return
+		propPickerWrapperContext?.setPickTarget?.(
+			collapsed ? undefined : { id: argName, onSelect: pickIntoArg }
+		)
+	})
+
 	onDestroy(() => {
 		updatePropsBeingEdited(false)
+		if (pickerMode === 'sidePane') {
+			propPickerWrapperContext?.setPickTarget?.(undefined)
+		}
 	})
 
 	let prevArg: any = undefined
@@ -461,7 +528,6 @@
 		resourceTypes = await getResourceTypes()
 	}
 
-	let focused = $state(false)
 	let stepInputGen: StepInputGen | undefined = $state(undefined)
 
 	loadResourceTypes()
@@ -497,8 +563,6 @@
 			['s3object', 's3_object'].includes(schema?.properties?.[argName]?.items?.resourceType)
 	)
 
-	let suggestion: string | undefined = $state()
-
 	// Svelte bug ...
 	// Somehow the value is updated in the UI of the parent, but not in the children
 	// when passed as a prop. setTimeout is a workaround to force the update
@@ -509,85 +573,97 @@
 	})
 </script>
 
-{#if arg != undefined && !hidden}
+{#if (arg != undefined || collapsed) && !hidden}
 	<div class={twMerge('relative group flex flex-col gap-1', className)}>
-		<div class="flex flex-row flex-wrap justify-between gap-1">
-			<div class="flex grow min-h-7 items-end">
-				<FieldHeader
-					label={argName}
-					simpleTooltip={headerTooltip}
-					simpleTooltipIconClass={headerTooltipIconClass}
-					SimpleTooltipIcon={HeaderTooltipIcon}
-					format={schema?.properties?.[argName]?.format}
-					contentEncoding={schema?.properties?.[argName]?.contentEncoding}
-					required={schema.required?.includes(argName)}
-					type={schema.properties?.[argName]?.type}
-				/>
+		<!-- `relative` so the absolute button cluster below anchors to this row rather than
+		     to the whole field, letting it share the label's baseline. `w-full` so an
+		     `align-items` on the caller's class can't shrink the row to its label and pull
+		     `right-0` onto it. -->
+		<div class="relative w-full flex flex-row flex-wrap justify-between gap-1">
+			<!-- min-h-7 reserves room for the button cluster beside a plain label; a custom
+			     header is a control of its own and sets the row's height itself. -->
+			<div class="flex grow items-end {header ? '' : 'min-h-7'}">
+				{#if header}
+					{@render header()}
+				{:else}
+					<FieldHeader
+						label={label ?? argName}
+						simpleTooltip={headerTooltip}
+						simpleTooltipIconClass={headerTooltipIconClass}
+						SimpleTooltipIcon={HeaderTooltipIcon}
+						format={schema?.properties?.[argName]?.format}
+						contentEncoding={schema?.properties?.[argName]?.contentEncoding}
+						required={schema.required?.includes(argName)}
+						type={schema.properties?.[argName]?.type}
+					/>
 
-				{#if isStaticTemplate(inputCat)}
-					<div>
-						<span
-							class="border text-gray-400 dark:text-gray-500 text-2xs font-medium mr-2 px-1 !py-[1px] rounded ml-2.5 {propertyType ==
-								'static' && arg.type === 'javascript'
-								? 'visible'
-								: 'invisible'}"
-						>
-							{'${...}'}
-						</span>
-					</div>
+					{#if isStaticTemplate(inputCat)}
+						<div>
+							<span
+								class="border text-gray-400 dark:text-gray-500 text-2xs font-medium mr-2 px-1 !py-[1px] rounded ml-2.5 {propertyType ==
+									'static' && arg?.type === 'javascript'
+									? 'visible'
+									: 'invisible'}"
+							>
+								{'${...}'}
+							</span>
+						</div>
+					{/if}
 				{/if}
 			</div>
-			{#if !noDynamicToggle}
-				<div
-					class="flex flex-row gap-x-2 z-10 absolute right-0 group-hover:bg-surface transition-colors"
-				>
-					{#if enableAi}
-						<StepInputGen
-							bind:this={stepInputGen}
-							{focused}
-							{arg}
-							schemaProperty={schema?.properties?.[argName]}
-							on:showExpr={(e) => (suggestion = e.detail || undefined)}
-							on:setExpr={(e) => {
-								arg = { type: 'javascript', expr: e.detail }
-								propertyType = 'javascript'
-								monaco?.setCode('')
-								monaco?.insertAtCursor(e.detail)
-							}}
-							{pickableProperties}
-							{argName}
-							btnClass={twMerge(
-								'h-7 min-w-8 px-2',
-								'group-hover:opacity-100 transition-opacity',
-								!connecting ? 'opacity-0' : ''
-							)}
-						/>
-					{/if}
+			<!-- Nothing to connect to or switch while collapsed: there is no value yet. -->
+			<div
+				class="flex flex-row items-end gap-x-2 z-10 absolute right-0 bottom-0 group-hover:bg-surface transition-colors {collapsed
+					? 'hidden'
+					: ''}"
+			>
+				{#if aiGen}
+					{@render aiGen()}
+				{:else if enableAi}
+					<StepInputGen
+						bind:this={stepInputGen}
+						{focused}
+						schemaProperty={schema?.properties?.[argName]}
+						on:showExpr={(e) => (suggestion = e.detail || undefined)}
+						on:setExpr={(e) => {
+							arg = { type: 'javascript', expr: e.detail }
+							propertyType = 'javascript'
+							monaco?.setCode('')
+							monaco?.insertAtCursor(e.detail)
+						}}
+						{pickableProperties}
+						{argName}
+					/>
+				{/if}
 
-					{#if propPickerWrapperContext}
-						<FlowPlugConnect
-							wrapperClasses={twMerge(
-								connecting ? 'h-6 w-7' : 'h-7 w-8',
-								'group-hover:opacity-100 transition-opacity p-0',
-								!connecting ? 'opacity-0' : ''
-							)}
-							id="flow-editor-plug"
-							{connecting}
-							on:click={() => {
-								if ($propPickerConfig?.propName == argName) {
-									clearFocus()
-								} else {
-									focusProp?.(argName, (path) => {
+				{#if propPickerWrapperContext}
+					<FlowPlugConnect
+						wrapperClasses={twMerge(
+							'group-hover:opacity-100 transition-opacity',
+							!connecting ? 'opacity-0' : ''
+						)}
+						id="flow-editor-plug"
+						{connecting}
+						on:click={() => {
+							if ($propPickerConfig?.propName == argName) {
+								clearFocus()
+							} else {
+								focusProp?.(argName, (path) => {
+									if (pickerMode === 'sidePane') {
+										pickIntoArg(path)
+									} else {
 										connectProperty(path)
 										dispatch('change', { argName })
-										return true
-									})
-								}
-							}}
-						/>
-					{/if}
+									}
+									return true
+								})
+							}
+						}}
+					/>
+				{/if}
 
-					<div class="{ButtonType.UnifiedHeightClasses.sm} relative">
+				{#if !noDynamicToggle}
+					<div class="{ButtonType.UnifiedHeightClasses.xs} relative">
 						<ToggleButtonGroup
 							selected={visiblePropertyType}
 							class="h-full"
@@ -708,215 +784,240 @@
 							{/snippet}
 						</ToggleButtonGroup>
 					</div>
-				</div>
-			{/if}
+				{/if}
+			</div>
 		</div>
 
-		<!-- svelte-ignore a11y_no_static_element_interactions -->
-		<div class="relative w-full" onkeyup={handleKeyUp}>
-			<!-- {inputCat}
+		{#if !collapsed}
+			<!-- svelte-ignore a11y_no_static_element_interactions -->
+			<!-- A custom header means a setting's toggle owns this field, so the input is
+			     indented under the toggle's label: `xs` switch (w-7) plus its ml-2. -->
+			<div
+				class="relative w-full {header ? 'pl-9' : ''}"
+				onkeyup={handleKeyUp}
+				transition:slideDynamic|global={{ duration: animateAppear ? 150 : 0 }}
+			>
+				<!-- {inputCat}
 			{propertyType} -->
-			<div class="relative flex flex-row items-top gap-1 justify-between">
-				<div class="min-w-0 grow">
-					{#if suggestion}
-						<div
-							class={`bg-surface-input rounded-md pl-2 overflow-auto ${inputBorderClass({ forceFocus: true })}`}
-						>
-							<FakeMonacoPlaceHolder autoheight code={suggestion} fontSize={12} />
-						</div>
-					{/if}
-					<div
-						class={suggestion ? 'opacity-0 absolute' : ''}
-						onkeydowncapture={(e) => {
-							if (e.key === 'Tab' && suggestion) {
-								e.preventDefault()
-							}
-						}}
-					>
-						{@render innerInput()}
-					</div>
-
-					{#snippet innerInput()}
-						{#if propertyType === 'ai'}
-							<div
-								class="text-sm text-tertiary italic p-3 bg-surface-secondary rounded-md border border-gray-200"
-							>
-								<span class="flex items-center gap-2 text-xs">
-									<InfoIcon size={13} />
-									This field will be filled by the AI agent dynamically
-								</span>
-							</div>
-							{#if argName && schema?.properties?.[argName]?.description}
-								<div class="text-xs italic py-1 text-hint">
-									<pre class="font-main whitespace-normal">
-										{schema.properties[argName].description}
-									</pre>
+				<div class="relative flex flex-row items-top gap-1 justify-between">
+					<div class="min-w-0 grow">
+						<!-- The ghost text covers the input and only the input: it has to stay mounted
+						     (Monaco, focus, Tab) and keep its height, or what follows slides up
+						     underneath it — and the overlay must not reach the rows below, which is
+						     what would bury the Help dropdown. -->
+						<div class="relative">
+							{#if suggestion}
+								<div
+									class={`absolute inset-0 z-10 bg-surface-input rounded-md pl-2 overflow-auto ${inputBorderClass({ forceFocus: true })}`}
+								>
+									<FakeMonacoPlaceHolder autoheight code={suggestion} fontSize={12} />
 								</div>
 							{/if}
-						{:else if isStaticTemplate(inputCat) && propertyType == 'static' && !noDynamicToggle}
-							<div class="flex flex-col gap-1">
+							<div
+								class={suggestion ? 'opacity-0' : ''}
+								onkeydowncapture={(e) => {
+									if (e.key === 'Tab' && suggestion) {
+										e.preventDefault()
+									}
+								}}
+							>
+								{@render innerInput()}
+							</div>
+						</div>
+
+						<InputError {error} />
+
+						<!-- Rendered outside the `suggestion ? opacity-0` wrapper so the AI
+					     step-input autocompletion (ghost text, accepted with Tab) doesn't
+					     hide the Help dropdown — the two stay independent. -->
+						{#if !hideHelpButton && propertyType === 'javascript' && argKind === 'javascript' && arg.expr != undefined}
+							<DynamicInputHelpBox />
+						{/if}
+
+						{#snippet innerInput()}
+							{#if propertyType === 'ai'}
+								<div
+									class="text-sm text-tertiary italic p-3 bg-surface-secondary rounded-md border border-gray-200"
+								>
+									<span class="flex items-center gap-2 text-xs">
+										<InfoIcon size={13} />
+										This field will be filled by the AI agent dynamically
+									</span>
+								</div>
 								{#if argName && schema?.properties?.[argName]?.description}
-									<div class="text-xs text-secondary">
+									<div class="text-xs italic py-1 text-hint">
 										<pre class="font-main whitespace-normal">
 										{schema.properties[argName].description}
-										</pre>
+									</pre>
 									</div>
 								{/if}
+							{:else if isStaticTemplate(inputCat) && propertyType == 'static' && !noDynamicToggle}
+								<div class="flex flex-col gap-1">
+									{#if argName && schema?.properties?.[argName]?.description}
+										<div class="text-xs text-secondary">
+											<pre class="font-main whitespace-normal">
+										{schema.properties[argName].description}
+										</pre>
+										</div>
+									{/if}
 
-								{#if arg}
-									<TemplateEditor
-										bind:this={monacoTemplate}
-										{extraLib}
-										on:focus={onFocus}
-										on:blur={() => {
-											focused = false
-										}}
-										bind:code={arg.value}
-										fontSize={12}
-										on:change={() => {
-											dispatch('change', { argName, arg })
-										}}
-										loadAsync
-										class="bg-surface-input"
-									/>
-								{/if}
-							</div>
-						{:else if (propertyType === undefined || propertyType == 'static') && schema?.properties?.[argName]}
-							<ArgInput
-								{resourceTypes}
-								noMargin
-								compact
-								on:focus={onFocus}
-								on:blur={() => {
-									focused = false
-								}}
-								shouldDispatchChanges
-								on:change={() => {
-									dispatch('change', { argName, arg })
-								}}
-								label={argName}
-								bind:editor={monaco}
-								bind:description={schema.properties[argName].description}
-								bind:value={arg.value}
-								type={schema.properties[argName].type}
-								oneOf={schema.properties[argName].oneOf}
-								required={schema.required?.includes(argName)}
-								bind:pattern={schema.properties[argName].pattern}
-								bind:valid={inputCheck}
-								defaultValue={schema.properties[argName].default}
-								bind:enum_={schema.properties[argName].enum}
-								bind:format={schema.properties[argName].format}
-								contentEncoding={schema.properties[argName].contentEncoding}
-								bind:itemsType={schema.properties[argName].items}
-								properties={schema.properties[argName].properties}
-								nestedRequired={schema.properties[argName].required}
-								displayHeader={false}
-								extra={argExtra}
-								{variableEditor}
-								{itemPicker}
-								bind:pickForField
-								showSchemaExplorer
-								nullable={schema.properties[argName].nullable}
-								bind:title={schema.properties[argName].title}
-								bind:placeholder={schema.properties[argName].placeholder}
-								{helperScript}
-								{s3StorageConfigured}
-								{chatInputEnabled}
-								otherArgs={Object.fromEntries(
-									Object.entries(otherArgs).map(([key, transform]) => [
-										key,
-										transform?.type === 'static'
-											? transform.value
-											: transform?.type === 'javascript'
-												? transform.expr
-												: undefined
-									])
-								)}
-							>
-								{#snippet innerBottomSnippet()}
-									{#if shouldShowS3ArrayHelper}
-										<S3ArrayHelperButton
-											{connecting}
-											onClick={() =>
-												switchToJsAndConnect((path) =>
-													appendPathToArrayExpr(arg?.type === 'javascript' ? arg.expr : '', path)
-												)}
+									{#if arg}
+										<TemplateEditor
+											bind:this={monacoTemplate}
+											{extraLib}
+											on:focus={onFocus}
+											on:blur={() => {
+												focused = false
+											}}
+											bind:code={arg.value}
+											fontSize={12}
+											on:change={() => {
+												dispatch('change', { argName, arg })
+											}}
+											loadAsync
+											class="bg-surface-input"
 										/>
 									{/if}
-								{/snippet}
-							</ArgInput>
-						{:else if arg?.type === 'javascript' && arg.expr != undefined}
-							<div
-								class={`bg-surface-input rounded-md flex flex-col pl-2 overflow-auto ${inputBorderClass({ forceFocus: focused })}`}
-							>
-								<SimpleEditor
-									small
-									bind:this={monaco}
-									bind:code={arg.expr}
-									{extraLib}
-									lang="javascript"
-									shouldBindKey={false}
-									renderLineHighlight="none"
-									hideLineNumbers
-									on:focus={() => {
-										focused = true
-										updatePropsBeingEdited(true)
-									}}
+								</div>
+							{:else if (propertyType === undefined || propertyType == 'static') && schema?.properties?.[argName]}
+								<ArgInput
+									{resourceTypes}
+									noMargin
+									compact
+									on:focus={onFocus}
 									on:blur={() => {
 										focused = false
-										updatePropsBeingEdited(false)
 									}}
+									shouldDispatchChanges
 									on:change={() => {
 										dispatch('change', { argName, arg })
 									}}
-									autoHeight
-									loadAsync
-								/>
-								<!-- <input type="text" bind:value={arg.expr} /> -->
-							</div>
-
-							{#if shouldShowS3ArrayHelper}
-								<S3ArrayHelperButton
-									class="mt-2"
-									{connecting}
-									onClick={() =>
-										focusProp?.(argName, (path) => {
-											appendPathToArrayExpr(arg.expr, path)
-											return true
-										})}
-								/>
-							{/if}
-
-							{#if argName && schema?.properties?.[argName]?.description}
-								<div class="text-xs italic py-1 text-secondary">
-									<pre class="font-main whitespace-normal"
-										>{schema.properties[argName].description}</pre
-									>
+									label={argName}
+									bind:editor={monaco}
+									bind:description={schema.properties[argName].description}
+									bind:value={arg.value}
+									type={schema.properties[argName].type}
+									oneOf={schema.properties[argName].oneOf}
+									required={schema.required?.includes(argName)}
+									bind:pattern={schema.properties[argName].pattern}
+									bind:valid={inputCheck}
+									defaultValue={schema.properties[argName].default}
+									bind:enum_={schema.properties[argName].enum}
+									bind:format={schema.properties[argName].format}
+									contentEncoding={schema.properties[argName].contentEncoding}
+									bind:itemsType={schema.properties[argName].items}
+									properties={schema.properties[argName].properties}
+									nestedRequired={schema.properties[argName].required}
+									displayHeader={false}
+									extra={argExtra}
+									{variableEditor}
+									{itemPicker}
+									bind:pickForField
+									showSchemaExplorer
+									nullable={schema.properties[argName].nullable}
+									bind:title={schema.properties[argName].title}
+									bind:placeholder={schema.properties[argName].placeholder}
+									{helperScript}
+									{s3StorageConfigured}
+									{chatInputEnabled}
+									otherArgs={Object.fromEntries(
+										Object.entries(otherArgs).map(([key, transform]) => [
+											key,
+											transform?.type === 'static'
+												? transform.value
+												: transform?.type === 'javascript'
+													? transform.expr
+													: undefined
+										])
+									)}
+								>
+									{#snippet innerBottomSnippet()}
+										{#if shouldShowS3ArrayHelper}
+											<S3ArrayHelperButton
+												{connecting}
+												onClick={() =>
+													switchToJsAndConnect((path) =>
+														appendPathToArrayExpr(arg?.type === 'javascript' ? arg.expr : '', path)
+													)}
+											/>
+										{/if}
+									{/snippet}
+								</ArgInput>
+							{:else if argKind === 'javascript' && arg.expr != undefined}
+								<!-- svelte-ignore a11y_no_static_element_interactions -->
+								<!-- Reaching for the editor reveals the properties beside it. On pointerdown,
+								     not focus: an editor that was never blurred emits no focus event, so a
+								     column dismissed while it kept the caret could not be brought back. -->
+								<div
+									onpointerdown={() => openPicker?.()}
+									class={`bg-surface-input rounded-md flex flex-col pl-2 overflow-auto ${inputBorderClass({ forceFocus: focused, error: !!error })}`}
+								>
+									<SimpleEditor
+										small
+										bind:this={monaco}
+										bind:code={arg.expr}
+										{extraLib}
+										lang="javascript"
+										shouldBindKey={false}
+										renderLineHighlight="none"
+										hideLineNumbers
+										on:focus={() => {
+											focused = true
+											updatePropsBeingEdited(true)
+											openPicker?.()
+										}}
+										on:blur={() => {
+											focused = false
+											updatePropsBeingEdited(false)
+										}}
+										on:change={() => {
+											dispatch('change', { argName, arg })
+										}}
+										autoHeight
+										loadAsync
+									/>
+									<!-- <input type="text" bind:value={arg.expr} /> -->
 								</div>
-							{/if}
 
-							{#if !hideHelpButton}
-								<DynamicInputHelpBox />
-							{/if}
+								{#if shouldShowS3ArrayHelper}
+									<S3ArrayHelperButton
+										class="mt-2"
+										{connecting}
+										onClick={() =>
+											focusProp?.(argName, (path) => {
+												appendPathToArrayExpr(arg.expr, path)
+												return true
+											})}
+									/>
+								{/if}
 
-							<div class="mb-2"></div>
-						{:else}
-							<span class="text-xs text-red-500">
-								Not recognized input type {argName} ({arg.expr}, {propertyType})
-							</span>
-							<div class="flex mt-2">
-								<Button
-									variant="default"
-									size="xs"
-									on:click={() => {
-										arg.expr = ''
-									}}>Set expr to empty string</Button
-								></div
-							>
-						{/if}
-					{/snippet}
+								{#if argName && schema?.properties?.[argName]?.description}
+									<div class="text-xs italic py-1 text-secondary">
+										<pre class="font-main whitespace-normal"
+											>{schema.properties[argName].description}</pre
+										>
+									</div>
+								{/if}
+
+								<div class="mb-2"></div>
+							{:else}
+								<span class="text-xs text-red-500">
+									Not recognized input type {argName} ({arg.expr}, {propertyType})
+								</span>
+								<div class="flex mt-2">
+									<Button
+										variant="default"
+										size="xs"
+										on:click={() => {
+											arg.expr = ''
+										}}>Set expr to empty string</Button
+									></div
+								>
+							{/if}
+						{/snippet}
+					</div>
 				</div>
 			</div>
-		</div>
+		{/if}
 	</div>
 {/if}
diff --git a/frontend/src/lib/components/JobLoader.svelte b/frontend/src/lib/components/JobLoader.svelte
index 7d00731f94..ec9e4b693c 100644
--- a/frontend/src/lib/components/JobLoader.svelte
+++ b/frontend/src/lib/components/JobLoader.svelte
@@ -21,11 +21,7 @@
 	import type { SupportedLanguage } from '$lib/common'
 	import { sendUserToast } from '$lib/toast'
 	import { DynamicInput, isScriptPreview } from '$lib/utils'
-	import {
-		getActiveRecording,
-		getActiveReplay,
-		getReplayStartTime
-	} from './recording/flowRecording.svelte'
+	import { getActiveReplay, getReplayStartTime } from './recording/replay.svelte'
 
 	// Will be set to number if job is not a flow
 
@@ -714,7 +710,6 @@
 					)
 
 					callbacks?.change?.(job)
-					getActiveRecording()?.recordInitialJob(id, job)
 				}
 
 				if (!onlyResult) {
@@ -824,7 +819,6 @@
 								throw new Error('Not found')
 							}
 							jobUpdateLastFetch = new Date()
-							getActiveRecording()?.recordEvent(id, previewJobUpdates)
 
 							if (job) {
 								updateJobFromProgress(previewJobUpdates, job, callbacks)
diff --git a/frontend/src/lib/components/Login.svelte b/frontend/src/lib/components/Login.svelte
index e59dcaa021..65d20c11f5 100644
--- a/frontend/src/lib/components/Login.svelte
+++ b/frontend/src/lib/components/Login.svelte
@@ -91,7 +91,9 @@
 	const providersType = providers.map((p) => p.type as string)
 
 	let showPassword = $state(false)
-	let logins: OAuthLogin[] | undefined = $state(undefined)
+	// Type argument rather than annotation: annotating narrows the declaration to the
+	// initializer's `undefined`, so a top-level read sees `never` instead of the array.
+	let logins = $state<OAuthLogin[] | undefined>(undefined)
 	let saml: string | undefined = $state(undefined)
 	let smtpConfigured: boolean | undefined = $state(undefined)
 	let disablePasswordLogin = $state(false)
@@ -455,6 +457,8 @@
 	$effect(() => {
 		error && sendUserToast(escapeHtml(error), true)
 	})
+
+	let loginOptionCount = $derived((logins?.length ?? 0) + (saml ? 1 : 0))
 </script>
 
 <div class="bg-surface px-4 py-8 border sm:rounded-lg sm:px-10">
@@ -462,9 +466,7 @@
 		<p class="text-sm text-center text-secondary py-4">Signing you in…</p>
 	{/if}
 	<div
-		class="grid {logins && logins.length > 2 ? 'grid-cols-2' : ''} gap-4 {autoRedirecting
-			? 'hidden'
-			: ''}"
+		class="grid {loginOptionCount > 3 ? 'grid-cols-2' : ''} gap-4 {autoRedirecting ? 'hidden' : ''}"
 	>
 		{#if !logins}
 			{#each Array(4) as _}
@@ -483,17 +485,13 @@
 				{/if}
 			{/each}
 			{#each logins.filter((login) => !providersType?.includes(login.type)) as login}
-				<Button
-					variant="default"
-					btnClasses="mt-2 w-full"
-					on:click={() => storeRedirect(login.type)}
-				>
+				<Button variant="default" on:click={() => storeRedirect(login.type)}>
 					{login.displayName}
 				</Button>
 			{/each}
 		{/if}
 		{#if saml}
-			<Button variant="default" btnClasses="mt-2 w-full" on:click={redirectSaml}>SSO</Button>
+			<Button variant="default" on:click={redirectSaml}>SSO</Button>
 		{/if}
 	</div>
 	{#if !autoRedirecting && !disablePasswordLogin && (saml || (logins && logins.length > 0))}
diff --git a/frontend/src/lib/components/NoDirectDeployAlert.svelte b/frontend/src/lib/components/NoDirectDeployAlert.svelte
index c767ed835a..8223d3a73d 100644
--- a/frontend/src/lib/components/NoDirectDeployAlert.svelte
+++ b/frontend/src/lib/components/NoDirectDeployAlert.svelte
@@ -1,4 +1,9 @@
 <script lang="ts">
+	/**
+	 * Badge for a workspace locked against direct edits, with the rule names, the route into the dev
+	 * workspace and the admin bypass in its popover. Renders nothing for operators, who have no edit
+	 * affordance for it to explain.
+	 */
 	import { userStore, userWorkspaces, workspaceStore } from '$lib/stores'
 	import {
 		canUserBypassRuleKind,
@@ -6,11 +11,13 @@
 		isRuleActive
 	} from '$lib/workspaceProtectionRules.svelte'
 	import { findCanonicalDevWorkspace } from '$lib/utils/workspaceHierarchy'
-	import { devLabelNoun } from '$lib/utils/devWorkspaceLabel'
+	import { devLabelKey, devLabelNoun } from '$lib/utils/devWorkspaceLabel'
 	import { canCreateFork } from '$lib/utils/editInFork'
 	import { switchWorkspace } from '$lib/storeUtils'
-	import { Alert, Button } from './common'
-	import { GitFork } from 'lucide-svelte'
+	import { Badge, Button } from './common'
+	import Popover from './meltComponents/Popover.svelte'
+	import Toggle from './Toggle.svelte'
+	import { GitFork, Lock, ShieldOff } from 'lucide-svelte'
 
 	let activeDeployRulesets = $derived(getActiveRulesetsForKind('DisableDirectDeployment'))
 	let canBypass = $derived(canUserBypassRuleKind('DisableDirectDeployment', $userStore))
@@ -24,7 +31,10 @@
 			: 'You will need to make your changes locally and submit a PR to an authorized user.'
 	)
 	let overrideChecked = $state(false)
-	let canEdit = $derived(!isRuleActive('DisableDirectDeployment') || (canBypass && overrideChecked))
+	// The toggle is only offered to a user who can bypass, but the answer can change under a
+	// workspace switch, so the checked flag alone never grants the edit.
+	let bypassActive = $derived(canBypass && overrideChecked)
+	let canEdit = $derived(!isRuleActive('DisableDirectDeployment') || bypassActive)
 
 	let {
 		onUpdateCanEditStatus = (value) => {}
@@ -35,50 +45,76 @@
 	$effect(() => {
 		onUpdateCanEditStatus(canEdit)
 	})
+
+	let badgeLabel = $derived(
+		bypassActive
+			? 'Protection bypassed'
+			: canonicalDev
+				? `Edits in ${devLabelKey(canonicalDev.dev_workspace_label)}`
+				: 'Edits restricted'
+	)
 </script>
 
 {#if !$userStore?.operator && activeDeployRulesets.length > 0}
 	<div class="my-2">
-		<Alert
-			type="info"
-			title={canonicalDev
-				? `Edits happen in the ${devLabelNoun(canonicalDev.dev_workspace_label)}`
-				: 'Workspace protection active'}
+		<Popover
+			placement="bottom-start"
+			class="inline-flex items-center"
+			triggerAttrs={{ 'aria-label': badgeLabel }}
 		>
-			<div class="flex flex-col gap-2">
-				{#if canonicalDev}
-					<p>
-						Edits to this workspace are made in its {devLabelNoun(canonicalDev.dev_workspace_label)}
-						<b>{canonicalDev.name}</b> ({canonicalDev.id}) and promoted here.
-					</p>
-					<div>
-						<Button
-							btnClasses="w-auto"
+			{#snippet trigger()}
+				<!-- `clickable` is unusable here: it renders the badge as a <button>, nested inside the
+				     one Popover wraps its trigger in. -->
+				<Badge small color={bypassActive ? 'yellow' : 'blue'} class="cursor-pointer">
+					{#if bypassActive}
+						<ShieldOff class="h-3 w-3" />
+					{:else if canonicalDev}
+						<GitFork class="h-3 w-3" />
+					{:else}
+						<Lock class="h-3 w-3" />
+					{/if}
+					{badgeLabel}
+				</Badge>
+			{/snippet}
+			{#snippet content()}
+				<div class="flex flex-col gap-3 p-4 text-xs max-w-sm">
+					{#if canonicalDev}
+						<p class="text-primary">
+							Edits to this workspace are made in its {devLabelNoun(
+								canonicalDev.dev_workspace_label
+							)}
+							<b>{canonicalDev.name}</b> ({canonicalDev.id}) and promoted here.
+						</p>
+						<div>
+							<Button
+								btnClasses="w-auto"
+								size="xs"
+								variant="accent"
+								startIcon={{ icon: GitFork }}
+								onclick={() => {
+									if (canonicalDev) switchWorkspace(canonicalDev.id)
+								}}
+							>
+								Go to {devLabelNoun(canonicalDev.dev_workspace_label)}
+							</Button>
+						</div>
+					{:else}
+						<p class="text-primary">
+							The rule{activeDeployRulesets.length > 1 ? 's' : ''}
+							<b>{activeDeployRulesets.map((r) => r.name).join(', ')}</b>
+							restrict{activeDeployRulesets.length > 1 ? '' : 's'} direct edits to this workspace.
+							{editAdvice}
+						</p>
+					{/if}
+					{#if canBypass}
+						<Toggle
 							size="xs"
-							variant="accent"
-							startIcon={{ icon: GitFork }}
-							onclick={() => {
-								if (canonicalDev) switchWorkspace(canonicalDev.id)
-							}}
-						>
-							Go to {devLabelNoun(canonicalDev.dev_workspace_label)}
-						</Button>
-					</div>
-				{:else}
-					<p>
-						The rule{activeDeployRulesets.length > 1 ? 's' : ''}
-						<b>{activeDeployRulesets.map((r) => r.name).join(', ')}</b>
-						restrict{activeDeployRulesets.length > 1 ? '' : 's'} direct edits to this workspace.
-						{editAdvice}
-					</p>
-				{/if}
-				{#if canBypass}
-					<label class="flex items-center gap-2 cursor-pointer">
-						<input class="rounded max-w-4" type="checkbox" bind:checked={overrideChecked} />
-						<span class="text-xs">Bypass restriction</span>
-					</label>
-				{/if}
-			</div>
-		</Alert>
+							bind:checked={overrideChecked}
+							options={{ right: 'Bypass restriction' }}
+						/>
+					{/if}
+				</div>
+			{/snippet}
+		</Popover>
 	</div>
 {/if}
diff --git a/frontend/src/lib/components/OnBehalfOfSelector.svelte b/frontend/src/lib/components/OnBehalfOfSelector.svelte
index 651b76f94a..67648936ae 100644
--- a/frontend/src/lib/components/OnBehalfOfSelector.svelte
+++ b/frontend/src/lib/components/OnBehalfOfSelector.svelte
@@ -28,6 +28,7 @@
 <script lang="ts">
 	import { Check, UserCog, Users, ExternalLink } from 'lucide-svelte'
 	import MeltPopover from './meltComponents/Popover.svelte'
+	import Portal from './Portal.svelte'
 	import Modal from './common/modal/Modal.svelte'
 	import { userStore } from '$lib/stores'
 	import { UserService, type User } from '$lib/gen'
@@ -57,6 +58,22 @@
 		 * badge so the user sees where the value came from.
 		 */
 		folderDefault?: string | undefined
+		/**
+		 * Raises the popover and user picker above a `ConfirmationModal`, which renders at a
+		 * z-index above the popover layer — without this they open behind the dialog hosting them.
+		 */
+		aboveConfirmationModal?: boolean
+		/**
+		 * Fires as the user picker opens and closes. A host that binds its own Enter/Escape handler
+		 * must suspend it meanwhile: both handlers sit on `window`, where `stopPropagation` can't
+		 * separate them, so Escape in the picker would also dismiss the host.
+		 */
+		onPickerOpenChange?: (open: boolean) => void
+		/**
+		 * `u/username` to label the "me" option with. Usernames are per-workspace, so the current
+		 * one is the wrong name whenever the deploy targets a different workspace.
+		 */
+		myPermissionedAs?: string
 	}
 
 	let {
@@ -68,7 +85,10 @@
 		canPreserve,
 		customValue,
 		isDeployment = true,
-		folderDefault = undefined
+		folderDefault = undefined,
+		aboveConfirmationModal = false,
+		onPickerOpenChange = undefined,
+		myPermissionedAs = undefined
 	}: Props = $props()
 
 	const isTrigger = $derived(kind === 'trigger' || isTriggerOrScheduleKind(kind))
@@ -107,7 +127,9 @@
 
 	let targetDisplayName = $derived(resolveDisplayName(targetValue))
 	let customDisplayName = $derived(resolveDisplayName(customValue))
-	let myDisplayName = $derived($userStore?.username ? `u/${$userStore.username}` : undefined)
+	let myDisplayName = $derived(
+		myPermissionedAs ?? ($userStore?.username ? `u/${$userStore.username}` : undefined)
+	)
 
 	let activeUsers = $derived(users.filter((u) => !u.disabled))
 	let filteredUsers = $derived(
@@ -152,6 +174,11 @@
 		modalOpen = false
 	}
 
+	// Covers every close path — the X, the overlay, Escape — not just `selectUser`.
+	$effect(() => {
+		onPickerOpenChange?.(modalOpen)
+	})
+
 	let selectedDisplayName = $derived.by(() => {
 		if (selected === 'target') return targetDisplayName
 		if (selected === 'me') return myDisplayName
@@ -160,7 +187,11 @@
 	})
 </script>
 
-<MeltPopover placement="bottom" on:openChange={(e) => e.detail && loadUsers()}>
+<MeltPopover
+	placement="bottom"
+	contentClasses={aboveConfirmationModal ? 'z-[10001]' : ''}
+	on:openChange={(e) => e.detail && loadUsers()}
+>
 	{#snippet trigger()}
 		<span class="inline-flex items-center gap-1">
 			<UserCog class="w-4 h-4 {selected ? 'text-green-500' : 'text-yellow-500'}" />
@@ -228,56 +259,65 @@
 	{/snippet}
 </MeltPopover>
 
-<!-- User selection modal -->
-<Modal title="Select a user" bind:open={modalOpen} kind="X">
-	<div class="flex flex-col gap-4">
-		<div class="text-xs text-secondary">
-			{#if isTrigger}
-				Choose the user this trigger will be permissioned as {isDeployment
-					? 'in the target workspace'
-					: 'in this workspace'}. The selected user's permissions will be used when the trigger
-				fires.
-			{:else}
-				Choose the user this {kind} will run on behalf of {isDeployment
-					? 'in the target workspace'
-					: 'in this workspace'}. The selected user's permissions will be used when executing.
-			{/if}
-			<a
-				href="https://www.windmill.dev/docs/core_concepts/roles_and_permissions"
-				target="_blank"
-				rel="noopener noreferrer"
-				class="text-blue-500 hover:underline inline-flex items-center gap-0.5"
-			>
-				Learn more
-				<ExternalLink class="w-3 h-3" />
-			</a>
-		</div>
-
-		<TextInput bind:value={searchQuery} inputProps={{ placeholder: 'Search users...' }} />
-
-		<div class="max-h-60 overflow-y-auto border rounded">
-			{#each filteredUsers as user (user.email)}
-				<button
-					class="w-full flex items-center gap-3 px-3 py-2 text-left text-sm hover:bg-surface-hover border-b last:border-b-0"
-					onclick={() => selectUser(user)}
+<!-- User selection modal. Portalled: the modal positions itself with `fixed`, which resolves
+     against the nearest transformed ancestor — inside a dialog card (which is transformed for
+     its open transition) it would be laid out within that card instead of the viewport. -->
+<Portal>
+	<Modal
+		title="Select a user"
+		bind:open={modalOpen}
+		kind="X"
+		minZIndex={aboveConfirmationModal ? 10001 : undefined}
+	>
+		<div class="flex flex-col gap-4">
+			<div class="text-xs text-secondary">
+				{#if isTrigger}
+					Choose the user this trigger will be permissioned as {isDeployment
+						? 'in the target workspace'
+						: 'in this workspace'}. The selected user's permissions will be used when the trigger
+					fires.
+				{:else}
+					Choose the user this {kind} will run on behalf of {isDeployment
+						? 'in the target workspace'
+						: 'in this workspace'}. The selected user's permissions will be used when executing.
+				{/if}
+				<a
+					href="https://www.windmill.dev/docs/core_concepts/roles_and_permissions"
+					target="_blank"
+					rel="noopener noreferrer"
+					class="text-blue-500 hover:underline inline-flex items-center gap-0.5"
 				>
-					<div class="flex flex-col min-w-0">
-						<span class="font-medium truncate">u/{user.username}</span>
-						<span class="text-xs text-tertiary truncate">{user.email}</span>
+					Learn more
+					<ExternalLink class="w-3 h-3" />
+				</a>
+			</div>
+
+			<TextInput bind:value={searchQuery} inputProps={{ placeholder: 'Search users...' }} />
+
+			<div class="max-h-60 overflow-y-auto border rounded">
+				{#each filteredUsers as user (user.email)}
+					<button
+						class="w-full flex items-center gap-3 px-3 py-2 text-left text-sm hover:bg-surface-hover border-b last:border-b-0"
+						onclick={() => selectUser(user)}
+					>
+						<div class="flex flex-col min-w-0">
+							<span class="font-medium truncate">u/{user.username}</span>
+							<span class="text-xs text-tertiary truncate">{user.email}</span>
+						</div>
+						{#if selected === 'custom' && (customValue === `u/${user.username}` || customValue === user.email)}
+							<Check class="w-4 h-4 text-green-500 ml-auto flex-shrink-0" />
+						{/if}
+					</button>
+				{:else}
+					<div class="px-3 py-4 text-sm text-tertiary text-center">
+						{#if !usersLoaded}
+							Loading users&hellip;
+						{:else}
+							No users found
+						{/if}
 					</div>
-					{#if selected === 'custom' && (customValue === `u/${user.username}` || customValue === user.email)}
-						<Check class="w-4 h-4 text-green-500 ml-auto flex-shrink-0" />
-					{/if}
-				</button>
-			{:else}
-				<div class="px-3 py-4 text-sm text-tertiary text-center">
-					{#if !usersLoaded}
-						Loading users&hellip;
-					{:else}
-						No users found
-					{/if}
-				</div>
-			{/each}
+				{/each}
+			</div>
 		</div>
-	</div>
-</Modal>
+	</Modal>
+</Portal>
diff --git a/frontend/src/lib/components/ResourceEditor.svelte b/frontend/src/lib/components/ResourceEditor.svelte
index 7acc4e485b..8b10841512 100644
--- a/frontend/src/lib/components/ResourceEditor.svelte
+++ b/frontend/src/lib/components/ResourceEditor.svelte
@@ -130,7 +130,11 @@
 		const schema = rt.schema as Schema
 		return {
 			...schema,
-			order: schema.order ?? Object.keys(schema.properties).sort()
+			// A resource type may declare no properties at all — `dbt_profile` is a
+			// `profiles.yml` block whose keys are its adapter's, not Windmill's — and
+			// the form renders those as one JSON editor. `Object.keys(undefined)`
+			// threw here, which left the editor on its loading skeleton forever.
+			order: schema.order ?? Object.keys(schema.properties ?? {}).sort()
 		}
 	})
 	let loadingSchema = $derived(resourceTypeResource.loading)
diff --git a/frontend/src/lib/components/ResourceEditorDrawer.svelte b/frontend/src/lib/components/ResourceEditorDrawer.svelte
index 6c0da69675..5067972cfa 100644
--- a/frontend/src/lib/components/ResourceEditorDrawer.svelte
+++ b/frontend/src/lib/components/ResourceEditorDrawer.svelte
@@ -3,17 +3,21 @@
 
 	import DrawerContent from './common/drawer/DrawerContent.svelte'
 
-	import { Loader2, Save } from 'lucide-svelte'
+	import { History, Loader2, Save } from 'lucide-svelte'
 	import WsSpecificVersions from './WsSpecificVersions.svelte'
-	import { workspaceStore } from '$lib/stores'
+	import { userStore, workspaceStore } from '$lib/stores'
+	import { isOwner } from '$lib/utils'
 	import LocalDraftBanner from './LocalDraftBanner.svelte'
+	import ResourceVersionHistory from './ResourceVersionHistory.svelte'
 
 	let {
 		workspace = undefined,
-		disableChatOffset = false
-	}: { workspace?: string; disableChatOffset?: boolean } = $props()
+		disableChatOffset = false,
+		onRestored = undefined
+	}: { workspace?: string; disableChatOffset?: boolean; onRestored?: () => void } = $props()
 
 	let drawer: Drawer | undefined = $state()
+	let historyDrawer: Drawer | undefined = $state()
 	let canSave = $state(true)
 	let resource_type: string | undefined = $state(undefined)
 	let defaultValues: Record<string, any> | undefined = $state(undefined)
@@ -33,6 +37,16 @@
 	let selected: string | undefined = $state(undefined)
 
 	let effectiveWorkspace = $derived(workspace ?? $workspaceStore!)
+	// The editor renders whichever workspace-specific variant `selected` points at, so history has
+	// to follow it too — otherwise a restore would write over the variant the user is not looking at.
+	let historyWorkspace = $derived(selected ?? effectiveWorkspace)
+	// Clearing is irreversible and the backend gates it on ownership, not write access. $userStore
+	// describes the user in the workspace they are signed into, so it can only answer for that one:
+	// history pointed anywhere else — a ws-specific variant, or an explicit `workspace` prop — gets
+	// no Clear button rather than a verdict computed from the wrong membership.
+	let canClearSelected = $derived(
+		historyWorkspace === $workspaceStore && isOwner(path ?? '', $userStore, $workspaceStore)
+	)
 
 	export async function initEdit(p: string): Promise<void> {
 		resource_type = undefined
@@ -89,6 +103,14 @@
 		{/snippet}
 		{#snippet actions()}
 			{#if mode == 'edit' && path && effectiveWorkspace}
+				<Button
+					variant="default"
+					unifiedSize="md"
+					startIcon={{ icon: History }}
+					on:click={() => historyDrawer?.openDrawer()}
+				>
+					History
+				</Button>
 				<WsSpecificVersions
 					kind="resource"
 					workspaceId={effectiveWorkspace}
@@ -111,3 +133,26 @@
 		{/snippet}
 	</DrawerContent>
 </Drawer>
+
+<Drawer bind:this={historyDrawer} size="1200px">
+	<DrawerContent title="Versions History" on:close={historyDrawer?.closeDrawer} noPadding>
+		{#if path && historyWorkspace}
+			<ResourceVersionHistory
+				{path}
+				workspace={historyWorkspace}
+				canRestore={canWriteSelected}
+				canClear={canClearSelected}
+				onRestore={() => {
+					historyDrawer?.closeDrawer()
+					// Close the editor too. It holds a baseline captured before the restore, and
+					// any local draft on top of it, so saving from it afterwards would write the
+					// pre-restore value straight back over the version just restored.
+					drawer?.closeDrawer()
+					// Its own callback rather than the `refresh` event: callers bind that to
+					// reopening a picker (EditorBar), which a restore should not trigger.
+					onRestored?.()
+				}}
+			/>
+		{/if}
+	</DrawerContent>
+</Drawer>
diff --git a/frontend/src/lib/components/ResourceForm.svelte b/frontend/src/lib/components/ResourceForm.svelte
index 2c563a8e95..3820004593 100644
--- a/frontend/src/lib/components/ResourceForm.svelte
+++ b/frontend/src/lib/components/ResourceForm.svelte
@@ -291,7 +291,7 @@
 		{:else if !can_write}
 			<input type="text" disabled value={rawCode} />
 		{:else}
-			{#if !viewJsonSchema}
+			{#if !viewJsonSchema && !resourceSchema}
 				<div class="flex flex-col gap-2 mb-4">
 					<p class="text-red-500 dark:text-red-400 text-xs">
 						Resource type '{resource_type}' not found in your workspace
diff --git a/frontend/src/lib/components/ResourceVersionHistory.svelte b/frontend/src/lib/components/ResourceVersionHistory.svelte
new file mode 100644
index 0000000000..90e41b74f0
--- /dev/null
+++ b/frontend/src/lib/components/ResourceVersionHistory.svelte
@@ -0,0 +1,314 @@
+<script lang="ts">
+	import { Pane, Splitpanes } from 'svelte-splitpanes'
+	import { ResourceService, type ResourceVersion } from '$lib/gen'
+	import { workspaceStore } from '$lib/stores'
+	import { Skeleton } from '$lib/components/common'
+	import Button from './common/button/Button.svelte'
+	import HighlightCode from './HighlightCode.svelte'
+	import ToggleButtonGroup from './common/toggleButton-v2/ToggleButtonGroup.svelte'
+	import ToggleButton from './common/toggleButton-v2/ToggleButton.svelte'
+	import { Code, Diff, History, Loader2, RotateCcw, Trash2 } from 'lucide-svelte'
+	import Alert from './common/alert/Alert.svelte'
+	import VersionListItem from './VersionListItem.svelte'
+	import { displayDate } from '$lib/utils'
+	import { sendUserToast } from '$lib/toast'
+
+	let {
+		path,
+		workspace = undefined,
+		canRestore = true,
+		canClear = false,
+		onRestore = undefined
+	}: {
+		path: string
+		workspace?: string
+		canRestore?: boolean
+		canClear?: boolean
+		onRestore?: () => void
+	} = $props()
+
+	let effectiveWorkspace = $derived(workspace ?? $workspaceStore!)
+
+	let versions = $state<ResourceVersion[] | undefined>(undefined)
+	// Which row is highlighted, updated on click. `loaded` is dropped the moment the selection
+	// moves and only reinstated once its own fetch lands, so the pane can never show one version's
+	// JSON under another version's highlight.
+	let selectedId = $state<number | undefined>(undefined)
+	let loaded = $state<{ id: number; value: string; missing: string[] } | undefined>(undefined)
+	// Undefined until the newest version's value arrives, which is what "Diff with current" needs.
+	// Fetched without blocking the list, so an absent baseline disables the diff rather than
+	// holding up the drawer everyone else opened to read.
+	let currentValue = $state<string | undefined>(undefined)
+	// The backend decides this, rather than sending the resource type for the UI to test, so the
+	// list of never-versioned types stays stated once (INTERNAL_RESOURCE_TYPES) instead of being
+	// restated here in TypeScript as well as in the recording trigger's SQL.
+	let neverVersioned = $state(false)
+	// Bumped per load so a response for a path the drawer has since moved off cannot land. The
+	// component is reused rather than remounted when `path` changes, and `loaded` is what Restore
+	// acts on, so a late response could otherwise restore the previous resource's version.
+	let loadGeneration = 0
+	let view = $state<'value' | 'diff'>('value')
+	let restoring = $state(false)
+	// The newest version holds the live value — recording is a database trigger, so every write
+	// mints one — which makes a diff of it against current necessarily empty.
+	let isCurrent = $derived(loaded !== undefined && versions?.[0]?.id === loaded.id)
+	let clearing = $state(false)
+	let confirmingClear = $state(false)
+
+	function pretty(value: unknown): string {
+		return JSON.stringify(value ?? null, null, 2)
+	}
+
+	async function loadVersions() {
+		const generation = ++loadGeneration
+		// Cleared before the first await, not after: everything below is actionable state, and
+		// leaving it pointing at the previous resource is what lets Restore act on the wrong one.
+		versions = undefined
+		loaded = undefined
+		selectedId = undefined
+		currentValue = undefined
+		// Including the confirmation: it is armed for one resource and acts on whichever the
+		// drawer currently points at, so leaving it up across a retarget would let Confirm delete
+		// a history the user never asked to clear.
+		confirmingClear = false
+		const history = await ResourceService.getResourceHistory({
+			workspace: effectiveWorkspace,
+			path
+		})
+		if (generation !== loadGeneration) return
+		neverVersioned = history.versioned === false
+		// Nothing is selected on open, as in ScriptVersionHistory. Pre-selecting a version would
+		// fill the pane with JSON that reads as the resource's value without being it, since the
+		// drawer opens on the value view rather than the diff.
+		versions = history.versions ?? []
+		void loadDiffBaseline(versions[0]?.id, generation)
+	}
+
+	/// The diff baseline is the newest version, not the resource's live value, even though the two
+	/// hold the same thing: versions are immutable and addressed by id, so this cannot disagree
+	/// with the list it came from, where reading `resource` would reintroduce a mutable second
+	/// source. Deliberately not awaited by the caller — only the diff view needs it, which is two
+	/// interactions away, so the list paints as soon as it arrives.
+	async function loadDiffBaseline(newestId: number | undefined, generation: number) {
+		if (newestId === undefined) return
+		try {
+			const newest = await fetchVersion(newestId)
+			if (generation === loadGeneration) {
+				currentValue = newest.value
+			}
+		} catch {
+			// Leaves `currentValue` undefined, which hides the diff rather than offering one
+			// against nothing.
+		}
+	}
+
+	async function fetchVersion(id: number) {
+		const version = await ResourceService.getResourceVersion({
+			workspace: effectiveWorkspace,
+			version: id
+		})
+		return { id, value: pretty(version.value), missing: version.missing_references ?? [] }
+	}
+
+	async function selectVersion(id: number | undefined, generation = loadGeneration) {
+		selectedId = id
+		// Dropped up front rather than left in place while the new value is in flight: keeping it
+		// would highlight the clicked row while the pane still rendered the previous version, and
+		// a failed fetch would leave that mismatch on screen indefinitely.
+		loaded = undefined
+		if (id === undefined) {
+			return
+		}
+		try {
+			const version = await fetchVersion(id)
+			// Assigned as one object so the id keying the editor and the value it displays can
+			// never be out of step, whatever order the requests come back in.
+			if (selectedId === id && generation === loadGeneration) {
+				loaded = version
+			}
+		} catch (err) {
+			if (selectedId === id && generation === loadGeneration) {
+				selectedId = undefined
+				sendUserToast(`Could not load version ${id}`, true)
+			}
+		}
+	}
+
+	async function restore() {
+		// loaded.id, never selectedId: restoring what the pane is showing. A selection whose value
+		// has not arrived leaves `loaded` undefined, so this writes nothing rather than restoring a
+		// version the user has not seen.
+		const id = loaded?.id
+		if (id === undefined) return
+		restoring = true
+		try {
+			await ResourceService.restoreResourceVersion({
+				workspace: effectiveWorkspace,
+				version: id
+			})
+			sendUserToast(`Restored ${path} to version ${id}`)
+			onRestore?.()
+			await loadVersions()
+		} finally {
+			restoring = false
+		}
+	}
+
+	async function clearHistory() {
+		clearing = true
+		try {
+			await ResourceService.clearResourceHistory({ workspace: effectiveWorkspace, path })
+			sendUserToast(`Cleared past versions of ${path}`)
+			confirmingClear = false
+			await loadVersions()
+		} finally {
+			clearing = false
+		}
+	}
+
+	$effect(() => {
+		if (path && effectiveWorkspace) {
+			loadVersions()
+		}
+	})
+</script>
+
+<Splitpanes class="h-full">
+	<Pane size={20}>
+		{#if versions === undefined}
+			<div class="p-2 flex flex-col gap-2">
+				{#each Array(4) as _}
+					<Skeleton layout={[[2]]} />
+				{/each}
+			</div>
+		{:else if versions.length === 0}
+			<div class="p-4 text-tertiary text-xs">
+				{#if neverVersioned}
+					Resources of this type are written by every job that uses them, so their values are
+					deliberately not kept in history.
+				{:else}
+					No history yet. Versions are recorded from the next edit onwards.
+				{/if}
+			</div>
+		{:else}
+			{#if versions.length > 1 && canClear}
+				<div class="px-3 py-2 border-b">
+					{#if confirmingClear}
+						<p class="text-2xs text-tertiary mb-2">
+							Delete every past version, keeping only the current value? Past values can no longer
+							be compared or restored.
+						</p>
+						<div class="flex flex-row gap-2">
+							<Button size="xs" variant="accent" disabled={clearing} onclick={clearHistory}>
+								{clearing ? 'Clearing' : 'Confirm'}
+							</Button>
+							<Button size="xs" variant="default" onclick={() => (confirmingClear = false)}>
+								Cancel
+							</Button>
+						</div>
+					{:else}
+						<Button
+							size="xs"
+							variant="default"
+							startIcon={{ icon: Trash2 }}
+							onclick={() => (confirmingClear = true)}
+						>
+							Clear past versions
+						</Button>
+					{/if}
+				</div>
+			{/if}
+			<div class="flex flex-col gap-1 p-2">
+				{#each versions as version, index (version.id)}
+					<VersionListItem
+						selected={selectedId === version.id}
+						onclick={() => selectVersion(version.id)}
+					>
+						<div class="flex flex-col gap-0.5 truncate">
+							<div class="text-xs font-medium flex items-center gap-1">
+								{#if index === 0}
+									<History size={12} />
+								{/if}
+								{index === 0 ? 'Current' : `Version ${version.id}`}
+							</div>
+							<div class="text-2xs text-tertiary">
+								{displayDate(version.created_at)}{version.created_by
+									? ` by ${version.created_by}`
+									: ''}
+							</div>
+						</div>
+					</VersionListItem>
+				{/each}
+			</div>
+		{/if}
+	</Pane>
+	<Pane size={80}>
+		{#if loaded === undefined && selectedId !== undefined}
+			<Loader2 class="animate-spin m-4" />
+		{:else if loaded === undefined}
+			<div class="p-4 text-tertiary text-xs">Select a version to inspect its value.</div>
+		{:else}
+			<div class="flex flex-col h-full">
+				<div class="flex flex-row justify-between items-center gap-2 p-2 border-b">
+					{#if isCurrent}
+						<span class="text-2xs text-tertiary">This is the current value</span>
+					{:else if currentValue === undefined}
+						<span class="text-2xs text-tertiary">
+							The current value could not be loaded, so there is no diff to show
+						</span>
+					{:else}
+						<ToggleButtonGroup bind:selected={view}>
+							{#snippet children({ item })}
+								<ToggleButton small value="value" icon={Code} label="Value" {item} />
+								<ToggleButton small value="diff" icon={Diff} label="Diff with current" {item} />
+							{/snippet}
+						</ToggleButtonGroup>
+					{/if}
+					<Button
+						size="xs"
+						variant="default"
+						startIcon={{ icon: RotateCcw }}
+						disabled={restoring || !canRestore || isCurrent}
+						onclick={restore}
+					>
+						Restore this version
+					</Button>
+				</div>
+
+				{#if loaded.missing.length > 0}
+					<div class="px-3 py-2">
+						<Alert type="warning" size="xs" title="References something that no longer exists">
+							This version references {loaded.missing.join(', ')}. Restoring it leaves the resource
+							pointing at something unresolvable until you recreate it.
+						</Alert>
+					</div>
+				{/if}
+
+				<div class="grow min-h-0">
+					{#if view === 'diff' && !isCurrent && currentValue !== undefined}
+						<!-- Imported on demand: the diff is the only thing here that needs Monaco, and
+						     pulling it in on open would load the editor for everyone who just wants to
+						     read a value. -->
+						{#await import('./DiffEditor.svelte')}
+							<Loader2 class="animate-spin m-4" />
+						{:then Module}
+							<Module.default
+								open
+								automaticLayout
+								readOnly
+								defaultLang="json"
+								defaultOriginal={loaded.value}
+								defaultModified={currentValue}
+								className="h-full"
+							/>
+						{/await}
+					{:else}
+						<div class="h-full overflow-auto px-3 py-2">
+							<HighlightCode language="json" code={loaded.value} />
+						</div>
+					{/if}
+				</div>
+			</div>
+		{/if}
+	</Pane>
+</Splitpanes>
diff --git a/frontend/src/lib/components/S3FilePicker.svelte b/frontend/src/lib/components/S3FilePicker.svelte
index 9f702a53c3..5006e2df0b 100644
--- a/frontend/src/lib/components/S3FilePicker.svelte
+++ b/frontend/src/lib/components/S3FilePicker.svelte
@@ -18,6 +18,11 @@
 		selectedFileKey?: { s3: string; storage?: string } | undefined
 		folderOnly?: boolean
 		regexFilter?: RegExp | undefined
+		/**
+		 * Expand one folder level at a time. Turn off to keep listing every key up
+		 * front, which is what lets `regexFilter` prune folders with no match.
+		 */
+		lazyFolders?: boolean
 		/** Workspace to browse S3 storage in — the acting workspace of the editor that
 		 * opened the picker, else the nav workspace. */
 		workspace?: string | undefined
@@ -33,6 +38,7 @@
 		selectedFileKey = $bindable(undefined),
 		folderOnly = false,
 		regexFilter = undefined,
+		lazyFolders = true,
 		workspace = undefined,
 		onClose,
 		onSelectAndClose
@@ -125,6 +131,7 @@
 			{s3ResourcePath}
 			{folderOnly}
 			{regexFilter}
+			{lazyFolders}
 			workspace={effectiveWorkspace}
 		/>
 		{#snippet actions()}
diff --git a/frontend/src/lib/components/S3FilePickerInner.svelte b/frontend/src/lib/components/S3FilePickerInner.svelte
index 8c6ee879fa..5737744034 100644
--- a/frontend/src/lib/components/S3FilePickerInner.svelte
+++ b/frontend/src/lib/components/S3FilePickerInner.svelte
@@ -3,6 +3,7 @@
 		File as FileIcon,
 		FolderClosed,
 		FolderOpen,
+		ChevronDown,
 		RotateCw,
 		Loader2,
 		Download,
@@ -18,6 +19,8 @@
 		type DeleteS3FileData,
 		type DeleteS3FileResponse,
 		type ListStoredFilesData,
+		type ListStoredFilesPagedData,
+		type ListStoredFilesPagedResponse,
 		type ListStoredFilesResponse,
 		type LoadFileMetadataData,
 		type LoadFileMetadataResponse,
@@ -86,7 +89,16 @@
 		>
 		allowDelete?: boolean
 		replaceUnauthorizedWarning?: Snippet
+		/**
+		 * Expand one folder level at a time instead of listing every key up front.
+		 * Callers that override `listStoredFilesRequest` with a listing that has no
+		 * paged counterpart (e.g. git repo files) must turn this off.
+		 */
+		lazyFolders?: boolean
 		listStoredFilesRequest?: (d: ListStoredFilesData) => CancelablePromise<ListStoredFilesResponse>
+		listStoredFilesPagedRequest?: (
+			d: ListStoredFilesPagedData
+		) => CancelablePromise<ListStoredFilesPagedResponse>
 		loadFilePreviewRequest?: (d: LoadFilePreviewData) => CancelablePromise<LoadFilePreviewResponse>
 		loadFileMetadataRequest?: (
 			d: LoadFileMetadataData
@@ -115,7 +127,9 @@
 		allFilesByKey = $bindable({}),
 		allowDelete = false,
 		replaceUnauthorizedWarning,
+		lazyFolders = true,
 		listStoredFilesRequest = HelpersService.listStoredFiles,
+		listStoredFilesPagedRequest = HelpersService.listStoredFilesPaged,
 		loadFilePreviewRequest = HelpersService.loadFilePreview,
 		loadFileMetadataRequest = HelpersService.loadFileMetadata,
 		deleteS3FileRequest = HelpersService.deleteS3File,
@@ -163,13 +177,26 @@
 		  }
 		| undefined = $state(undefined)
 
+	/** Identifies the metadata request that currently owns the preview pane. */
+	let metadataRequestId = 0
+
+	/**
+	 * Flat pagination cursor: `listMarkers[n]` is where page `n + 1` resumes, so `page`
+	 * may only advance over a page that actually loaded. Running ahead of `listMarkers`
+	 * sends no marker and silently replays the first page, and never recovers, because
+	 * the `listMarkers.length == page` guard stops recording from then on.
+	 */
 	let listMarkers: string[]
 	let page = $state(0)
 
 	const maxKeys = 1000
+	/** Entries fetched per folder level before a "Load more" row appears. */
+	const pageSize = 500
 
 	let count = $state(0)
 	let displayedCount = $state(0)
+	/** Flat (non-lazy) listing: whether the last page came back full. */
+	let flatHasMore = $state(false)
 
 	let filter = $state('')
 
@@ -187,17 +214,356 @@
 		}
 	}
 
+	/**
+	 * Marks the synthetic "Load more" row belonging to a folder. Appended to the
+	 * folder's own prefix so the plain lexicographic sort that orders the tree also
+	 * places the row last among that folder's children.
+	 */
+	const LOAD_MORE_SUFFIX = '￿'
+
+	type FolderState = { nextPageToken?: string; loading: boolean; loaded: boolean }
+	let folderState: Record<string, FolderState> = $state({})
+
+	/** Per-level listing only makes sense while browsing; searching stays flat. */
+	let lazyMode = $derived(lazyFolders && filter.trim() === '')
+
+	function nestingLevelOf(key: string): number {
+		const slashes = (key.match(/\//g) ?? []).length
+		return (key.endsWith('/') ? slashes - 1 : slashes) * 2
+	}
+
+	function parentPathOf(key: string): string | undefined {
+		const body = key.endsWith('/') ? key.slice(0, -1) : key
+		const idx = body.lastIndexOf('/')
+		return idx === -1 ? undefined : body.slice(0, idx + 1)
+	}
+
+	/** The parentPath value carried by entries sitting at the browsing root. */
+	let rootParentPath = $derived(rootPath === '' ? undefined : rootPath)
+
+	function addEntry(key: string, type: 'folder' | 'leaf', displayName: string) {
+		if (allFilesByKey[key] !== undefined) return
+		allFilesByKey[key] = {
+			type,
+			full_key: key,
+			display_name: displayName,
+			collapsed: true,
+			parentPath: parentPathOf(key),
+			nestingLevel: nestingLevelOf(key),
+			count: 0
+		}
+	}
+
+	/**
+	 * A level shows only when every folder above it is expanded. The browsing root is
+	 * spelled `rootPath` by `folderState` but `undefined` by an entry's `parentPath`
+	 * (there is no parent entry), so both spellings must resolve here — otherwise the
+	 * root's own "Load more" row is filtered out and the top level is stuck on one page.
+	 */
+	function isLevelVisible(prefix: string | undefined): boolean {
+		if (prefix === rootParentPath || prefix === rootPath) return true
+		if (prefix === undefined) return false
+		const info = allFilesByKey[prefix]
+		if (info === undefined || info.collapsed) return false
+		return isLevelVisible(info.parentPath)
+	}
+
+	/**
+	 * Every key whose ancestors are all expanded, in depth-first order — full keys
+	 * sort that way because a child always starts with its parent's
+	 * delimiter-terminated prefix.
+	 */
+	function computeVisibleKeys(): string[] {
+		const visible: string[] = []
+		for (const key in allFilesByKey) {
+			if (!key.startsWith(rootPath)) continue
+			if (isLevelVisible(allFilesByKey[key].parentPath)) visible.push(key)
+		}
+		for (const prefix in folderState) {
+			if (folderState[prefix].nextPageToken && isLevelVisible(prefix)) {
+				visible.push(prefix + LOAD_MORE_SUFFIX)
+			}
+		}
+		return visible.sort()
+	}
+
+	function refreshDisplayed() {
+		const visible = computeVisibleKeys()
+		displayedFileKeys = visible
+		displayedCount = visible.filter((k) => !k.endsWith(LOAD_MORE_SUFFIX)).length
+	}
+
+	/**
+	 * In-flight request per level. Callers that await `loadFolderPage` need the data
+	 * to be there when it resolves; returning early on a concurrent load would hand
+	 * them a resolved promise and no entries.
+	 */
+	let inFlightFolderLoads: Record<string, Promise<void>> = {}
+
+	/**
+	 * Bumped when a single level is invalidated on its own (a delete refetches it from
+	 * page one). Requests are keyed by prefix alone, so without this a pending "Load
+	 * more" for that level would be joined by the refetch, which would then return
+	 * believing page one had been fetched — leaving the level showing only its later
+	 * pages until a full reload.
+	 */
+	let folderEpoch: Record<string, number> = {}
+
+	/**
+	 * Bumped whenever the listing is thrown away (storage switch, filter change,
+	 * reload). A request started before the bump belongs to the previous listing, so
+	 * its response must not repopulate the cleared state — otherwise switching
+	 * storage mid-load leaves the previous bucket's entries on screen.
+	 */
+	let listingGeneration = 0
+
+	async function loadFolderPage(prefix: string, append: boolean = false): Promise<void> {
+		const generation = listingGeneration
+		const epoch = folderEpoch[prefix] ?? 0
+		const pending = inFlightFolderLoads[prefix]
+		if (pending) {
+			await pending
+			// Only reuse the joined result if it belongs to the same listing *and* the
+			// same epoch of this level.
+			if (generation === listingGeneration && epoch === (folderEpoch[prefix] ?? 0) && !append)
+				return
+		}
+		const run = loadFolderPageInner(prefix, append)
+		inFlightFolderLoads[prefix] = run.catch(() => {})
+		try {
+			await run
+		} finally {
+			delete inFlightFolderLoads[prefix]
+		}
+	}
+
+	async function loadFolderPageInner(prefix: string, append: boolean) {
+		const generation = listingGeneration
+		const epoch = folderEpoch[prefix] ?? 0
+		/** Whether this response still belongs to the listing and level that asked for it. */
+		const stillCurrent = () =>
+			generation === listingGeneration && epoch === (folderEpoch[prefix] ?? 0)
+		const current = folderState[prefix] ?? { loading: false, loaded: false }
+		if (append && current.nextPageToken === undefined) return
+		folderState[prefix] = { ...current, loading: true }
+		try {
+			const page = await listStoredFilesPagedRequest({
+				workspace: ws!,
+				prefix,
+				maxKeys: pageSize,
+				pageToken: append ? current.nextPageToken : undefined,
+				storage,
+				s3ResourcePath
+			})
+			// This listing, or just this level, has been thrown away since the request
+			// went out. Writing the entries back would resurrect the previous storage's
+			// contents, or reinstate a file that was just deleted.
+			if (!stillCurrent()) return
+			// Absent counts as restricted, matching `loadFlatFiles`: the two paths must
+			// not disagree on which way an omitted value falls.
+			if (
+				page.restricted_access === null ||
+				page.restricted_access === undefined ||
+				page.restricted_access === true
+			) {
+				fileListUnavailable = true
+				folderState[prefix] = { loading: false, loaded: true }
+				return
+			}
+			fileListUnavailable = false
+			for (const folder of page.folders ?? []) {
+				addEntry(folder.prefix, 'folder', folder.name)
+			}
+			for (const file of page.files ?? []) {
+				if (regexFilter && !regexFilter.test(file.key)) continue
+				addEntry(file.key, 'leaf', file.name)
+			}
+			folderState[prefix] = {
+				loading: false,
+				loaded: true,
+				// An exhausted level serializes as JSON `null`, which is not `undefined`
+				// — leaving it as-is makes "no more pages" look like another page and
+				// sends the level round again with no token.
+				nextPageToken: page.next_page_token ?? undefined
+			}
+		} catch (e) {
+			if (stillCurrent()) {
+				folderState[prefix] = { ...current, loading: false }
+			}
+			throw e
+		} finally {
+			// A response that lands after the user typed a filter must not rebuild the
+			// list: flat mode owns `displayedFileKeys` then, and rebuilding it under
+			// the lazy visibility rules would prune most of the search results.
+			if (lazyMode && stillCurrent()) {
+				refreshDisplayed()
+			}
+		}
+	}
+
+	/** Surface listing failures instead of leaving a folder looking empty. */
+	function reportFolderError(prefix: string, e: unknown) {
+		console.error('Error listing folder', prefix, e)
+		sendUserToast(`Could not list ${prefix || 'the bucket root'}`, true)
+	}
+
+	function expandFolder(prefix: string) {
+		loadFolderPage(prefix).catch((e) => reportFolderError(prefix, e))
+	}
+
+	function loadMore(prefix: string) {
+		loadFolderPage(prefix, true).catch((e) => reportFolderError(prefix, e))
+	}
+
+	/**
+	 * Bound on the pages fetched while hunting for one entry, so a preselected key
+	 * that no longer exists cannot walk an entire bucket.
+	 */
+	const MAX_PAGES_WHILE_REVEALING = 20
+
+	/**
+	 * Page through `parent` until `child` shows up. A single page is not enough: the
+	 * target can sort past the first page of its own folder, and giving up there
+	 * leaves the selection looking absent.
+	 */
+	async function revealChild(parent: string, child: string, generation: number) {
+		for (let fetched = 0; fetched < MAX_PAGES_WHILE_REVEALING; fetched++) {
+			if (allFilesByKey[child] !== undefined) return
+			const state = folderState[parent]
+			if (state === undefined || !state.loaded) {
+				await loadFolderPage(parent)
+			} else if (state.nextPageToken !== undefined) {
+				await loadFolderPage(parent, true)
+			} else {
+				return
+			}
+			if (generation !== listingGeneration) return
+		}
+	}
+
+	/**
+	 * Reveal a key by loading each folder above it in turn — with per-level listing
+	 * an ancestor's children are not known until that level is fetched.
+	 *
+	 * `generation` is the listing this walk belongs to. A reveal is a chain of round
+	 * trips, so the check has to be repeated after every one of them: a filter typed
+	 * mid-walk switches the picker to the search, and the loads that follow would date
+	 * themselves to that listing and graft browse results onto it.
+	 */
+	async function expandToKey(key: string, generation: number) {
+		if (!key.startsWith(rootPath)) return
+		const rest = key.slice(rootPath.length).split('/')
+		let prefix = rootPath
+		for (let i = 0; i < rest.length - 1; i++) {
+			const child = prefix + rest[i] + '/'
+			await revealChild(prefix, child, generation)
+			if (generation !== listingGeneration) return
+			prefix = child
+			const info = allFilesByKey[prefix]
+			// The folder is genuinely absent; deeper levels cannot exist either.
+			if (info === undefined) break
+			info.collapsed = false
+		}
+		if (allFilesByKey[key] === undefined) {
+			await revealChild(prefix, key, generation)
+			if (generation !== listingGeneration) return
+		}
+		refreshDisplayed()
+	}
+
 	let lastKeyFolders: string[] = $state([])
-	async function loadFiles() {
+
+	/** Reports whether the listing completed, so a caller that moved the cursor can undo it. */
+	async function loadFiles(): Promise<boolean> {
+		if (lazyMode) {
+			// Typing in the filter switches the picker to the flat listing while this is in
+			// flight, and `loadFolderPage` resolves rather than throwing once superseded.
+			// What follows belongs to the listing that started it: expanding a preselected
+			// file would graft browse results into the search, and clearing the flags would
+			// retire the search's spinner.
+			const generation = listingGeneration
+			fileListLoading = true
+			try {
+				await loadFolderPage(rootPath)
+				if (
+					generation === listingGeneration &&
+					selectedFileKey !== undefined &&
+					!emptyString(selectedFileKey.s3)
+				) {
+					await expandToKey(selectedFileKey.s3, generation)
+				}
+			} catch (e) {
+				// `reloadContent` is called un-awaited from `open()`, so without this a
+				// failing root listing surfaces as an unhandled rejection and an empty
+				// tree indistinguishable from an empty bucket.
+				reportFolderError(rootPath, e)
+				return false
+			} finally {
+				if (generation === listingGeneration) {
+					fileListLoading = false
+					fileInfoLoading = false
+				}
+			}
+			return true
+		}
+		// Same contract as the lazy branch above: every caller here is un-awaited, so an
+		// uncaught rejection would leave the drawer on a spinner with nothing said. The
+		// generation guard keeps a superseded listing from clearing the spinner of the one
+		// that replaced it — `loadFlatFiles` returns early rather than throwing in that case.
+		const generation = listingGeneration
+		fileListLoading = true
+		try {
+			await loadFlatFiles()
+		} catch (e) {
+			console.error('Error listing files', e)
+			sendUserToast('Could not list the files', true)
+			// Nothing will load a preview now, so the right-hand pane has to stop waiting
+			// too. On the other exits it is owned by whoever is still fetching metadata.
+			if (generation === listingGeneration) {
+				fileInfoLoading = false
+			}
+			return false
+		} finally {
+			if (generation === listingGeneration) {
+				fileListLoading = false
+			}
+		}
+		return true
+	}
+
+	/** Flat "Load more" / "Keep looking": a page that fails has to give the cursor back. */
+	async function loadNextFlatPage() {
+		// The page number alone does not identify our advance: a filter or storage change
+		// resets the cursor, and the replacement listing can reach the same number before
+		// this request fails. Rolling that one back would strand *its* cursor instead.
+		const generation = listingGeneration
+		page += 1
+		const requested = page
+		const ok = await loadFiles()
+		// Only undo our own advance: another click may have moved it on meanwhile.
+		if (!ok && generation === listingGeneration && page === requested) {
+			page = requested - 1
+		}
+	}
+
+	async function loadFlatFiles() {
+		// Debounced searches overlap: an older response must not add its keys to a newer
+		// search's results or overwrite its pagination state.
+		const generation = listingGeneration
 		fileListLoading = true
 		let availableFiles = await listStoredFilesRequest({
 			workspace: ws!,
 			maxKeys: maxKeys, // fixed pages of 1000 files for now
 			marker: page == 0 ? undefined : listMarkers[page - 1],
-			prefix: rootPath ?? (filter.trim() != '' ? filter : undefined),
+			// `prefix` is evaluated per path *segment* by the storage layer, so sending the
+			// query there matched only whole folder names. `search` matches the raw key
+			// prefix instead, which is what the box means.
+			prefix: rootPath !== '' ? rootPath : undefined,
+			search: filter.trim() !== '' ? filter.trim() : undefined,
 			storage: storage,
 			s3ResourcePath
 		})
+		if (generation !== listingGeneration) return
 		if (
 			availableFiles.restricted_access === null ||
 			availableFiles.restricted_access === undefined ||
@@ -212,7 +578,12 @@
 			if (regexFilter && !regexFilter.test(file_path.s3)) {
 				continue
 			}
-			displayedCount += 1
+			// Only count keys not already in the tree: a page can legitimately repeat
+			// entries, and counting them again makes the total climb while the list
+			// stays put.
+			if (allFilesByKey[file_path.s3] === undefined) {
+				displayedCount += 1
+			}
 			let split_path = file_path.s3.split('/')
 			let parent_path: string | undefined = undefined
 			let current_path: string | undefined = undefined
@@ -249,9 +620,19 @@
 				}
 			}
 		}
+		// A short page means the listing is exhausted. Deriving "there is more" from
+		// `count % maxKeys` instead would keep offering another page whenever the total
+		// happens to be an exact multiple of the page size.
+		// Searching returns an explicit cursor because it skips over keys that did not
+		// match, so the last *returned* key is not where the next page resumes.
+		const serverMarker = availableFiles.next_marker ?? undefined
+		flatHasMore =
+			serverMarker !== undefined ||
+			(filter.trim() === '' && availableFiles.windmill_large_files.length === maxKeys)
 		if (listMarkers.length == page) {
 			count += availableFiles.windmill_large_files.length
 			const nextMarker =
+				serverMarker ??
 				availableFiles.windmill_large_files?.[availableFiles.windmill_large_files.length - 1]?.s3
 			if (nextMarker) listMarkers.push(nextMarker)
 		}
@@ -277,7 +658,12 @@
 				}
 			}
 		}
-		displayedFileKeys = [...new Set(displayedFileKeys)].sort()
+		// The loop above only lists entries at the browsing root, so a later page's
+		// keys land in `allFilesByKey` without ever being displayed — the folder they
+		// belong to is already expanded and nothing re-scans it. Recomputing from the
+		// expansion state picks them up without needing a collapse/expand round trip.
+		// `displayedCount` is left alone: in this mode it counts files loaded, not rows shown.
+		displayedFileKeys = computeVisibleKeys()
 		fileListLoading = false
 		fileInfoLoading = false
 	}
@@ -287,14 +673,36 @@
 			fileInfoLoading = false
 			return
 		}
+		// The pane belongs to the newest request, not to a key: switching storage reloads
+		// the same key, so comparing keys would let an older request speak for a newer one.
+		const requestId = ++metadataRequestId
 		fileInfoLoading = true
-		let fileMetadataRaw = await loadFileMetadataRequest({
-			workspace: ws!,
-			fileKey: fileKey,
-			storage: storage,
-			s3ResourcePath
-		})
+		let fileMetadataRaw: LoadFileMetadataResponse
+		try {
+			fileMetadataRaw = await loadFileMetadataRequest({
+				workspace: ws!,
+				fileKey: fileKey,
+				storage: storage,
+				s3ResourcePath
+			})
+		} catch (e) {
+			// Every caller invokes this un-awaited, so a key that no longer exists would
+			// otherwise leave the preview pane on "Loading..." forever.
+			console.error('Error loading metadata for', fileKey, e)
+			// Unless a later request has taken the pane over: it will report its own
+			// outcome, including the loading flag, and blanking here would undo it.
+			if (requestId !== metadataRequestId) {
+				return
+			}
+			fileMetadata = undefined
+			filePreview = undefined
+			fileInfoLoading = false
+			return
+		}
 
+		if (requestId !== metadataRequestId) {
+			return
+		}
 		if (fileMetadataRaw !== undefined) {
 			fileMetadata = {
 				fileKey: fileKey,
@@ -305,10 +713,15 @@
 			}
 		}
 		// async call
-		loadFilePreview(fileKey, fileMetadataRaw.size_in_bytes, fileMetadataRaw.mime_type)
+		loadFilePreview(fileKey, requestId, fileMetadataRaw.size_in_bytes, fileMetadataRaw.mime_type)
 	}
 
-	async function loadFilePreview(fileKey: string, fileSizeInBytes?: number, fileMimeType?: string) {
+	async function loadFilePreview(
+		fileKey: string,
+		requestId: number,
+		fileSizeInBytes?: number,
+		fileMimeType?: string
+	) {
 		let filePreviewRaw = await loadFilePreviewRequest({
 			workspace: ws!,
 			fileKey: fileKey,
@@ -333,6 +746,9 @@
 				'\n\n ... FILE CONTENT TRUNCATED ...\n\n'
 		}
 
+		if (requestId !== metadataRequestId) {
+			return
+		}
 		if (filePreviewRaw !== undefined) {
 			filePreview = {
 				fileKey: fileKey,
@@ -371,11 +787,45 @@
 		}
 		sendUserToast(`${fileKey} deleted from S3 bucket`)
 		selectedFileKey = { s3: '', storage }
+		// The preview pane and its toolbar render from these rather than from the
+		// selection, so the deleted file stays previewed — and offers to download, move
+		// and delete itself — until they are cleared too.
+		fileMetadata = undefined
+		filePreview = undefined
+		// A metadata load still in flight belongs to the file just deleted; retire it, or
+		// its response repopulates the pane it was cleared from. Retiring it also means
+		// nobody is left to report its outcome, so the pane's loading flag is ours.
+		metadataRequestId += 1
+		fileInfoLoading = false
+		if (lazyMode) {
+			// Only the level the file lived in changed; refetch it from its first page
+			// and keep the rest of the expanded tree. Its already-fetched entries have
+			// to go with the cursor, or the reset cursor would hand out a "Load more"
+			// for pages that are still displayed.
+			const parent = parentPathOf(fileKey) ?? rootPath
+			for (const key of Object.keys(allFilesByKey)) {
+				if (allFilesByKey[key].parentPath === (parent === '' ? undefined : parent)) {
+					delete allFilesByKey[key]
+				}
+			}
+			delete folderState[parent]
+			// Invalidate this level so a pending "Load more" for it is not joined below.
+			folderEpoch[parent] = (folderEpoch[parent] ?? 0) + 1
+			delete inFlightFolderLoads[parent]
+			await loadFolderPage(parent).catch((e) => reportFolderError(parent, e))
+			return
+		}
 		const currentPage = page
-		await clearAndLoadFiles()
-		for (let i = 0; i < currentPage; i++) {
-			page = i + 1
-			await loadFiles()
+		// Every page here has to land, starting with the fresh first one.
+		if (await clearAndLoadFiles()) {
+			for (let i = 0; i < currentPage; i++) {
+				page = i + 1
+				if (!(await loadFiles())) {
+					// Stop at the last page that actually loaded.
+					page = i
+					break
+				}
+			}
 		}
 		const fileKeyFolders = fileKey.split('/').slice(0, -1)
 		let current_path: string | undefined = undefined
@@ -399,11 +849,20 @@
 		displayedFileKeys = [...new Set(displayedFileKeys)].sort()
 	}
 
-	async function clearAndLoadFiles({ keepFilter }: { keepFilter?: boolean } = {}) {
+	/** Reports whether the fresh listing loaded, so a caller replaying pages can stop. */
+	async function clearAndLoadFiles({
+		keepFilter
+	}: { keepFilter?: boolean } = {}): Promise<boolean> {
+		// Anything already in flight belongs to the listing being discarded.
+		listingGeneration += 1
+		inFlightFolderLoads = {}
+		folderEpoch = {}
 		displayedFileKeys = []
 		allFilesByKey = {}
+		folderState = {}
 		count = 0
 		displayedCount = 0
+		flatHasMore = false
 		page = 0
 		listMarkers = []
 		fileMetadata = undefined
@@ -411,7 +870,7 @@
 		if (!keepFilter) {
 			filter = ''
 		}
-		await loadFiles()
+		return await loadFiles()
 	}
 
 	async function moveS3File(srcFileKey: string | undefined, destFileKey: string | undefined) {
@@ -483,9 +942,18 @@
 		}
 		await clearAndLoadFiles()
 		if (selectedFileKey !== undefined) {
-			if (allFilesByKey[selectedFileKey.s3] === undefined) {
+			const entry = allFilesByKey[selectedFileKey.s3]
+			if (entry !== undefined) {
+				if (entry.type !== 'folder') {
+					loadFileMetadataPlusPreviewAsync(selectedFileKey.s3)
+				}
+			} else if (!lazyMode) {
+				// Flat mode has listed everything it is going to, so a missing key really
+				// is missing. Per-level listing has not: only the levels on the way to
+				// the key were fetched, and `selectedFileKey` is bound out to the caller
+				// — blanking it there would silently clear the configured object.
 				selectedFileKey = { s3: '', storage }
-			} else if (allFilesByKey[selectedFileKey.s3].type !== 'folder') {
+			} else {
 				loadFileMetadataPlusPreviewAsync(selectedFileKey.s3)
 			}
 		}
@@ -506,6 +974,27 @@
 	function selectItem(index: number, toggleCollapsed: boolean = true) {
 		let item_key = displayedFileKeys[index]
 		let item = allFilesByKey[item_key]
+		if (item === undefined) return
+		if (lazyMode) {
+			if (item.type === 'folder') {
+				if (folderOnly) {
+					selectedFileKey = { s3: item_key, storage }
+				}
+				if (toggleCollapsed) {
+					item.collapsed = !item.collapsed
+				}
+				if (!item.collapsed && !folderState[item_key]?.loaded) {
+					// Children are unknown until this level is fetched.
+					expandFolder(item_key)
+				} else {
+					refreshDisplayed()
+				}
+			} else {
+				selectedFileKey = { s3: item_key, storage }
+				loadFileMetadataPlusPreviewAsync(selectedFileKey.s3)
+			}
+			return
+		}
 		if (item.type === 'folder') {
 			if (folderOnly) {
 				selectedFileKey = {
@@ -612,7 +1101,12 @@
 			<div class="min-w-[30%] border-r flex flex-col min-h-0">
 				{#if !rootPath}
 					<div class="w-full p-1 border-b">
-						<input type="text" placeholder="Folder prefix" bind:value={filter} class="text-xl" />
+						<input
+							type="text"
+							placeholder="Search by path prefix"
+							bind:value={filter}
+							class="text-xl"
+						/>
 					</div>
 				{/if}
 				{#if displayedFileKeys.length === 0}
@@ -624,8 +1118,22 @@
 						</div>
 					{:else}
 						<div class="p-4 text-primary text-xs text-center italic">
-							No files in the workspace S3 bucket at that prefix
+							{#if filter.trim() !== ''}
+								No files starting with "{filter.trim()}"
+							{:else}
+								No files in the workspace S3 bucket
+							{/if}
 						</div>
+						{#if flatHasMore}
+							<!-- A page can come back empty while keys remain — permission filtering
+							can remove every match. Without this the only control that could resume
+							the listing would be hidden behind the empty state. -->
+							<div class="flex justify-center pb-4">
+								<Button variant="default" size="xs2" on:click={() => loadNextFlatPage()}>
+									Keep looking
+								</Button>
+							</div>
+						{/if}
 					{/if}
 				{:else}
 					<div class="grow min-h-0" bind:clientHeight={listDivHeight}>
@@ -638,7 +1146,12 @@
 							{#snippet header()}{/snippet}
 							{#snippet footer()}{/snippet}
 							{#snippet item({ index, style })}
-								{@const file_info = allFilesByKey[displayedFileKeys[index]]}
+								<!-- VirtualList can render an index past the array while the list is
+								shrinking, so this must tolerate a missing key. -->
+								{@const item_key = displayedFileKeys[index] ?? ''}
+								{@const is_load_more = item_key.endsWith(LOAD_MORE_SUFFIX)}
+								{@const load_more_prefix = is_load_more ? item_key.slice(0, -1) : ''}
+								{@const file_info = allFilesByKey[item_key]}
 
 								<div
 									{style}
@@ -647,7 +1160,38 @@
 										index === displayedFileKeys.length - 1 && 'border-b-0'
 									)}
 								>
-									{#if file_info}
+									{#if is_load_more}
+										<!-- Indented like the siblings it belongs to, so it must discount
+										the browsing root the same way entry rows do. -->
+										{@const loadMoreNesting =
+											nestingLevelOf(load_more_prefix + 'x') - 2 * rootPathNestingLevel}
+										{@const loadingMore = folderState[load_more_prefix]?.loading === true}
+										<!-- svelte-ignore a11y_click_events_have_key_events -->
+										<!-- svelte-ignore a11y_no_static_element_interactions -->
+										<div
+											onclick={() => !loadingMore && loadMore(load_more_prefix)}
+											class={twMerge(
+												'flex flex-row h-full text-xs items-center justify-start text-secondary',
+												loadingMore ? 'cursor-default' : 'cursor-pointer'
+											)}
+										>
+											<div
+												class="flex flex-row w-full gap-2 h-full items-center"
+												style={`margin-left: ${(2 + loadMoreNesting) * 0.25}rem;`}
+											>
+												<!-- Occupies the same slot as the sibling rows' file/folder icon so
+												the labels line up, and holds its width when the spinner swaps in. -->
+												<div class="w-4 shrink-0 flex items-center justify-center">
+													{#if loadingMore}
+														<Loader2 size={16} class="animate-spin" />
+													{:else}
+														<ChevronDown size={16} />
+													{/if}
+												</div>
+												<div class="truncate text-ellipsis w-56">Load more</div>
+											</div>
+										</div>
+									{:else if file_info}
 										{@const nestingLevel = file_info.nestingLevel - 2 * rootPathNestingLevel}
 										<!-- svelte-ignore a11y_click_events_have_key_events -->
 										<!-- svelte-ignore a11y_no_static_element_interactions -->
@@ -665,14 +1209,23 @@
 												style={`margin-left: ${(2 + nestingLevel) * 0.25}rem;`}
 											>
 												{#if file_info.type === 'folder'}
-													{#if file_info.collapsed}<FolderClosed size={16} />{:else}<FolderOpen
+													{#if folderState[file_info.full_key]?.loading}
+														<Loader2 size={16} class="animate-spin" />
+													{:else if file_info.collapsed}<FolderClosed size={16} />{:else}<FolderOpen
 															size={16}
 														/>{/if}
 													<div class="truncate text-ellipsis w-56">
-														{file_info.display_name} ({file_info.count}{count % 1000 === 0 &&
-														lastKeyFolders[file_info.nestingLevel / 2] === file_info.display_name
-															? '+'
-															: ''} item{file_info.count === 1 ? '' : 's'})
+														<!-- An object-store key may contain an empty segment, so `a//` is a real
+														folder whose name is ''. Label it rather than rendering a blank row. -->
+														{#if file_info.display_name === ''}
+															<span class="italic text-secondary">(empty name)</span>
+														{:else}{file_info.display_name}{/if}
+														{#if !lazyMode}
+															({file_info.count}{count % 1000 === 0 &&
+															lastKeyFolders[file_info.nestingLevel / 2] === file_info.display_name
+																? '+'
+																: ''} item{file_info.count === 1 ? '' : 's'})
+														{/if}
 													</div>
 												{:else}
 													<FileIcon size={16} />
@@ -688,27 +1241,24 @@
 						</VirtualList>
 					</div>
 					<div
-						class="flex flex-col gap-2 text-2xs justify-center items-center text-secondary w-full border-t h-16"
+						class="flex flex-col gap-2 text-2xs justify-center items-center text-secondary w-full border-t py-1"
 					>
 						{#if fileListLoading === true}
 							<div class="flex text-secondary mt-1 text-xs justify-center items-center w-full">
 								<Loader2 size={12} class="animate-spin mr-1" /> Loading content
 							</div>
+						{:else if lazyMode}
+							<!-- Per-level listing: totals below the tree would be a count of what
+							happens to be expanded, and each folder carries its own Load more row. -->
+							<div>{displayedCount} item{displayedCount === 1 ? '' : 's'} shown</div>
 						{:else}
 							<div>
-								{displayedCount}{count % maxKeys === 0 ? '+' : ''}
+								{displayedCount}{flatHasMore ? '+' : ''}
 								{displayedCount !== count ? 'filtered ' : ''}items (including inside folders)
 							</div>
 
-							{#if count % maxKeys === 0}
-								<Button
-									variant="default"
-									size="xs2"
-									on:click={() => {
-										page += 1
-										loadFiles()
-									}}
-								>
+							{#if flatHasMore}
+								<Button variant="default" size="xs2" on:click={() => loadNextFlatPage()}>
 									Load more
 								</Button>
 							{/if}
diff --git a/frontend/src/lib/components/SchemaFormWithArgPicker.svelte b/frontend/src/lib/components/SchemaFormWithArgPicker.svelte
index c4275f48b0..4879579de7 100644
--- a/frontend/src/lib/components/SchemaFormWithArgPicker.svelte
+++ b/frontend/src/lib/components/SchemaFormWithArgPicker.svelte
@@ -196,7 +196,10 @@
 </div>
 
 <style>
-	:global(.splitter-hidden .splitpanes__splitter) {
+	/* Direct child only: a descendant selector leaks into nested Splitpanes (e.g. the
+	   sessions preview reuses `.splitter-hidden`, which would otherwise hide the flow
+	   editor / modal splitters too). */
+	:global(.splitter-hidden > .splitpanes__splitter) {
 		background-color: transparent !important;
 		border: none !important;
 		opacity: 0 !important;
diff --git a/frontend/src/lib/components/ScriptAdvancedSettings.svelte b/frontend/src/lib/components/ScriptAdvancedSettings.svelte
index 67fadbe36a..a42c2e8909 100644
--- a/frontend/src/lib/components/ScriptAdvancedSettings.svelte
+++ b/frontend/src/lib/components/ScriptAdvancedSettings.svelte
@@ -214,7 +214,7 @@
 		{/if}
 	</Section>
 
-	<Section label="Delete after completion">
+	<Section label="Delete after completion" eeOnly>
 		{#snippet header()}
 			<Tooltip
 				documentationLink="https://www.windmill.dev/docs/script_editor/settings#delete-after-use"
@@ -223,9 +223,6 @@
 				the specified delay once it is complete. Set to 0 for immediate deletion. The deletion is
 				irreversible. This settings ONLY applies when the script is used within a flow or triggered
 				synchronously.
-				{#if !$enterpriseLicense}
-					This option is only available on Windmill Enterprise Edition.
-				{/if}
 			</Tooltip>
 		{/snippet}
 		<div class="flex gap-2 shrink flex-col">
diff --git a/frontend/src/lib/components/ScriptBuilder.svelte b/frontend/src/lib/components/ScriptBuilder.svelte
index bd30cd6909..9ce8c17022 100644
--- a/frontend/src/lib/components/ScriptBuilder.svelte
+++ b/frontend/src/lib/components/ScriptBuilder.svelte
@@ -43,6 +43,8 @@
 	import { invalidateWorkspacePaths } from './PathNameAutocomplete.svelte'
 	import { notifyContractWarnings } from './assets/AssetGraph/schemaContracts'
 	import ScriptEditor from './ScriptEditor.svelte'
+	import DbtEditor from './dbt/DbtEditor.svelte'
+	import { findModulePathClash } from './scriptModulePath'
 	import { Alert, Button, Drawer, SecondsInput, Tab, TabContent, Tabs } from './common'
 	import LanguageIcon from './common/languageIcons/LanguageIcon.svelte'
 	import type { SupportedLanguage, Schema } from '$lib/common'
@@ -69,7 +71,7 @@
 	import { useLocalStorageValue } from '$lib/svelte5Utils.svelte'
 	import { parsePipelineAnnotations } from './assets/AssetGraph/parsePipelineAnnotations'
 	import DropdownV2 from './DropdownV2.svelte'
-	import { type Item } from '$lib/utils'
+	import { getLocalSetting, storeLocalSetting, type Item } from '$lib/utils'
 	import { sendUserToast } from '$lib/toast'
 	import { isCloudHosted } from '$lib/cloud'
 	import Awareness from './Awareness.svelte'
@@ -88,6 +90,8 @@
 	import { getContext, onMount, setContext, tick, untrack } from 'svelte'
 	import EditorHeader from './EditorHeader.svelte'
 	import ScriptSettingsBadges from './ScriptSettingsBadges.svelte'
+	import Badge from './common/badge/Badge.svelte'
+	import Modal from './common/modal/Modal.svelte'
 	import AutosaveIndicator from './AutosaveIndicator.svelte'
 	import LabelsInput from './LabelsInput.svelte'
 
@@ -104,7 +108,7 @@
 	import WorkerTagSelect from './WorkerTagSelect.svelte'
 	import type { ButtonType } from './common/button/model'
 	import DebounceLimit from './flows/DebounceLimit.svelte'
-	import { buildForkEditUrl, editInForkAllowed, editInForkLabel } from '$lib/utils/editInFork'
+	import { editInForkAllowed, editInForkLabel, openEditInFork } from '$lib/utils/editInFork'
 	import OnBehalfOfSelector, { type OnBehalfOfChoice } from './OnBehalfOfSelector.svelte'
 	import WacExportDrawer from './scripts/WacExportDrawer.svelte'
 	import { UserDraft } from '$lib/userDraft.svelte'
@@ -222,8 +226,10 @@
 	let isDeployer = $derived($userStore?.groups?.includes(WM_DEPLOYERS_GROUP) ?? false)
 	let canPreserve = $derived(!!$userStore?.is_admin || !!$userStore?.is_super_admin || isDeployer)
 	let originalOnBehalfOfEmail = $derived(savedScript?.on_behalf_of_email)
+	let originalOnBehalfOfPermissionedAs = $derived(savedScript?.on_behalf_of)
 	let onBehalfOfChoice: OnBehalfOfChoice = $state(undefined)
 	let customOnBehalfOfEmail: string = $state('')
+	let myPermissionedAs = $derived($userStore?.username ? `u/${$userStore.username}` : undefined)
 
 	let metadataOpen = $state(
 		!untrack(() => neverShowMeta) &&
@@ -235,7 +241,33 @@
 	)
 
 	let editor: Editor | undefined = $state(undefined)
-	let scriptEditor: ScriptEditor | undefined = $state(undefined)
+	// A dbt script gets its own editor: the artifact is a project bundle — a file
+	// tree, a descriptor, run arguments and a model graph — not a body of code.
+	// Both answer to the same handful of calls below, so everything around them
+	// is unchanged.
+	let scriptEditor: ScriptEditor | DbtEditor | undefined = $state(undefined)
+	let isDbt = $derived(script.language === 'dbt')
+	// dbt hides Generated UI, but the initialiser picks a tab before the language is
+	// known, so `ui` can be selected. Fall back only to an ENABLED tab — the other
+	// TabContents are not gated on their disable flags — and otherwise stay on `ui`,
+	// whose content IS gated for dbt, so nothing renders rather than something hidden.
+	$effect(() => {
+		if (isDbt && selectedTab === 'ui') {
+			const first = (
+				[
+					['metadata', customUi?.settingsPanel?.disableMetadata],
+					['runtime', customUi?.settingsPanel?.disableRuntime],
+					['triggers', customUi?.settingsPanel?.disableTriggers]
+				] as const
+			).find(([, disabled]) => disabled !== true)?.[0]
+			if (first) selectedTab = first
+		}
+	})
+	// The version whose stored graph the dbt editor draws until a refresh replaces
+	// it. A script never deployed has none, and `NewScript` carries no hash.
+	let deployedScriptHash = $derived(
+		savedScript && 'hash' in savedScript ? (savedScript.hash as string) : undefined
+	)
 	let captureTable: CaptureTable | undefined = $state(undefined)
 	let wacExportDrawer: WacExportDrawer | undefined = $state(undefined)
 
@@ -454,6 +486,8 @@
 					language: 'bun'
 				}
 			}
+		} else if (script.language === 'dbt') {
+			seedDbtProject()
 		}
 		const restarter = scheduleRestartSync(userDraftPath, { waitForContent: true })
 		initContent(script.language, script.kind, template).finally(() => restarter.markContentReady())
@@ -673,6 +707,7 @@
 					has_preprocessor: script.has_preprocessor,
 					deployment_message: deploymentMsg || undefined,
 					on_behalf_of_email: script.on_behalf_of_email,
+					on_behalf_of: script.on_behalf_of,
 					preserve_on_behalf_of: preserveOnBehalfOf || undefined,
 					assets: script.assets,
 					modules: script.modules,
@@ -831,7 +866,7 @@
 												{
 													label: editInForkLabel(opWorkspace, $userWorkspaces),
 													onClick: () => {
-														window.open(buildForkEditUrl('script', initialPath))
+														openEditInFork('script', initialPath, opWorkspace)
 													}
 												}
 											]
@@ -883,9 +918,11 @@
 	}
 
 	function onKeyDown(event: KeyboardEvent) {
-		switch (event.key) {
+		// Lowercased so Caps Lock (which yields `S`) still saves. Shift excluded:
+		// Ctrl+Shift+S must reach the browser/OS.
+		switch (event.key.length === 1 ? event.key.toLowerCase() : event.key) {
 			case 's':
-				if (event.ctrlKey || event.metaKey) {
+				if ((event.ctrlKey || event.metaKey) && !event.shiftKey) {
 					saveDraft()
 					event.preventDefault()
 				}
@@ -893,6 +930,14 @@
 		}
 	}
 
+	// Monaco swallows the keydown, so a code editor with focus never reaches the
+	// window handler above; Editor/SimpleEditor/TemplateEditor re-broadcast it
+	// (untyped event, hence the manual listener).
+	$effect(() => {
+		window.addEventListener('wm-monaco-save-shortcut', saveDraft)
+		return () => window.removeEventListener('wm-monaco-save-shortcut', saveDraft)
+	})
+
 	let path: Path | undefined = $state(undefined)
 	// Seed "path is already chosen" so the summary→path auto-slug (which only
 	// runs for new scripts with initialPath == '') doesn't clobber a path the
@@ -971,7 +1016,48 @@
 
 	function handleDeployTrigger(_trigger: Trigger) {}
 
+	// A dbt script's modules ARE its dbt project, and the runtime refuses one
+	// without a `dbt_project.yml`. Seeded from BOTH entry points — the empty-script
+	// bootstrap and the language picker — because reaching dbt by switching an
+	// existing draft otherwise produces a script that cannot deploy or run.
+	// Existing modules are left alone: switching away and back must not discard a
+	// project the user has already grown.
+	function seedDbtProject() {
+		// Keyed on the project file rather than on "has any modules at all": a
+		// draft that grew modules under another language carries none of what dbt
+		// needs, and the worker refuses a bundle with no `dbt_project.yml` — so
+		// that draft reached dbt in a state it could neither deploy nor run.
+		// Matched on the canonical path: a bundle pushed with `./dbt_project.yml`
+		// already has the project file, and seeding a second spelling of it is the
+		// two-keys-one-file collision the editor's add-file checks refuse.
+		if (findModulePathClash(script.modules, 'dbt_project.yml')) return
+		script.modules = {
+			'dbt_project.yml': {
+				content:
+					'name: my_dbt_project\nversion: "1.0"\nprofile: my_dbt_project\nmodels:\n  my_dbt_project:\n    +materialized: view\n',
+				language: 'dbt'
+			},
+			'models/example.sql': {
+				content: 'select 1 as id\n',
+				language: 'dbt'
+			},
+			// Last, so anything already written wins: the previous language's
+			// helper files are inert to dbt and are the user's to remove.
+			...(script.modules ?? {})
+		}
+	}
+
+	/// Shown once, the first time dbt is chosen: the moment of choosing is when
+	/// "this is alpha and its details will move" is worth knowing, rather than
+	/// after a project has been built on it.
+	const DBT_ALPHA_SEEN = 'dbt_alpha_ack'
+	let dbtAlphaOpen = $state(false)
+
 	function onScriptLanguageTrigger(lang: 'docker' | 'bunnative' | ScriptLang) {
+		if (lang === 'dbt' && getLocalSetting(DBT_ALPHA_SEEN) !== 'true') {
+			dbtAlphaOpen = true
+			storeLocalSetting(DBT_ALPHA_SEEN, 'true')
+		}
 		if (lang == 'docker') {
 			template = 'docker'
 		} else if (lang == 'bunnative') {
@@ -980,9 +1066,19 @@
 			template = 'script'
 		}
 		let language = langToLanguage(lang)
+		if (language === 'dbt') {
+			// A project bundle only ever runs as an action, and the selector that
+			// would set this back is hidden for dbt — so a script arriving here as a
+			// trigger or approval would keep a kind it cannot fill and drop out of
+			// the action pickers, with nothing on screen to repair it.
+			script.kind = 'script'
+		}
 		//
 		initContent(language, script.kind, template)
 		script.language = language
+		if (language === 'dbt') {
+			seedDbtProject()
+		}
 	}
 
 	function onSummaryChange(value: string) {
@@ -1093,7 +1189,10 @@
 							label="Runtime"
 						/>
 					{/if}
-					{#if customUi?.settingsPanel?.disableGeneratedUi !== true}
+					<!-- Not for dbt: its run form is derived from the descriptor server-side
+					     (`dbt_arg_schema`), so anything refined here is overwritten by the
+					     next deploy. -->
+					{#if customUi?.settingsPanel?.disableGeneratedUi !== true && !isDbt}
 						<Tab
 							value="ui"
 							aiId="script-builder-ui"
@@ -1241,6 +1340,9 @@
 															} as ButtonType.Icon}
 														>
 															<span class="truncate">{label}</span>
+															{#if lang === 'dbt'}
+																<Badge color="orange" verySmall baseClass="ml-1">alpha</Badge>
+															{/if}
 														</Button>
 														{#snippet text()}
 															{label} is only available with an enterprise license
@@ -1350,7 +1452,10 @@
 											CI Test Python
 										</Button>
 									</div>
-									{#if customUi?.settingsPanel?.metadata?.disableScriptKind !== true}
+									<!-- Not for dbt: each kind tags a script for a role in a flow that a project
+										     bundle cannot fill (approval, trigger, preprocessor), and the runtime only
+										     ever runs it as an action. -->
+									{#if customUi?.settingsPanel?.metadata?.disableScriptKind !== true && !isDbt}
 										<Section label="Script kind">
 											{#snippet header()}
 												<Tooltip
@@ -1781,10 +1886,12 @@
 													on:change={() => {
 														if (script.on_behalf_of_email) {
 															script.on_behalf_of_email = undefined
+															script.on_behalf_of = undefined
 															preserveOnBehalfOf = false
 															onBehalfOfChoice = undefined
 														} else {
 															script.on_behalf_of_email = $userStore?.email
+															script.on_behalf_of = myPermissionedAs
 														}
 													}}
 													options={{
@@ -1800,14 +1907,19 @@
 															onBehalfOfChoice = choice
 															if (choice === 'me') {
 																script.on_behalf_of_email = $userStore?.email
+																script.on_behalf_of = myPermissionedAs
 																customOnBehalfOfEmail = ''
 																preserveOnBehalfOf = false
 															} else if (choice === 'target') {
+																// Keep the saved pair. A script that has no recorded principal yet
+																// sends the email alone and the backend derives one from it.
 																script.on_behalf_of_email = originalOnBehalfOfEmail
+																script.on_behalf_of = originalOnBehalfOfPermissionedAs
 																customOnBehalfOfEmail = ''
 																preserveOnBehalfOf = true
 															} else if (choice === 'custom' && details) {
 																script.on_behalf_of_email = details.email
+																script.on_behalf_of = details.permissionedAs
 																customOnBehalfOfEmail = details.email
 																preserveOnBehalfOf = true
 															}
@@ -1892,12 +2004,14 @@
 									{/if}
 								</div>
 							</TabContent>
-							<TabContent value="ui" class="h-full p-4">
-								<ScriptSchema
-									bind:schema={script.schema}
-									customUi={customUi?.settingsPanel?.metadata?.editableSchemaForm}
-								/>
-							</TabContent>
+							{#if !isDbt}
+								<TabContent value="ui" class="h-full p-4">
+									<ScriptSchema
+										bind:schema={script.schema}
+										customUi={customUi?.settingsPanel?.metadata?.editableSchemaForm}
+									/>
+								</TabContent>
+							{/if}
 							<TabContent value="triggers" class="h-full">
 								<TriggersEditor
 									on:applyArgs={applyArgs}
@@ -2121,57 +2235,105 @@
 			</div>
 		{/if}
 
-		<ScriptEditor
-			{disableAi}
-			workspaceOverride={opWorkspace}
-			sessionOpen={userDraftPath
-				? {
-						// URL draft path the editor loads/saves by, not the friendly
-						// `script.path` (a new script's has no row → "not found").
-						target: { kind: 'script', path: userDraftPath },
-						workspaceId: opWorkspace ?? undefined,
-						beforeOpen: persistDraftForSession
-					}
-				: undefined}
-			bind:selectedTab={selectedInputTab}
-			{customUi}
-			{onTestJob}
-			collabMode
-			edit={initialPath != ''}
-			on:format={() => {
-				saveDraft()
-			}}
-			on:saveDraft={() => {
-				saveDraft()
-			}}
-			on:openTriggers={openTriggers}
-			on:applyArgs={applyArgs}
-			on:addPreprocessor={addPreprocessor}
-			bind:editor
-			bind:this={scriptEditor}
-			bind:schema={script.schema}
-			path={script.path}
-			stablePathForCaptures={initialPath || fakeInitialPath}
-			bind:code={script.content}
-			lang={script.language}
-			timeout={script.timeout}
-			kind={script.kind}
-			autoKind={script.auto_kind}
-			{template}
-			tag={script.tag}
-			lastSavedCode={savedScript?.content}
-			lastDeployedCode={savedScript?.content}
-			bind:args
-			bind:hasPreprocessor
-			bind:captureTable
-			bind:assets={script.assets}
-			bind:modules={script.modules}
-			enablePreprocessorSnippet
-			{testPanelCollapsed}
-		/>
+		{#if isDbt}
+			<DbtEditor
+				workspaceOverride={opWorkspace}
+				{customUi}
+				{onTestJob}
+				on:format={() => saveDraft()}
+				on:saveDraft={() => saveDraft()}
+				bind:editor
+				bind:this={scriptEditor}
+				bind:schema={script.schema}
+				path={script.path}
+				bind:code={script.content}
+				timeout={script.timeout}
+				tag={script.tag}
+				deployedHash={deployedScriptHash}
+				bind:args
+				bind:modules={script.modules}
+			/>
+		{:else}
+			<ScriptEditor
+				{disableAi}
+				workspaceOverride={opWorkspace}
+				sessionOpen={userDraftPath
+					? {
+							// URL draft path the editor loads/saves by, not the friendly
+							// `script.path` (a new script's has no row → "not found").
+							target: { kind: 'script', path: userDraftPath },
+							workspaceId: opWorkspace ?? undefined,
+							beforeOpen: persistDraftForSession
+						}
+					: undefined}
+				bind:selectedTab={selectedInputTab}
+				{customUi}
+				{onTestJob}
+				collabMode
+				edit={initialPath != ''}
+				on:format={() => {
+					saveDraft()
+				}}
+				on:saveDraft={() => {
+					saveDraft()
+				}}
+				on:openTriggers={openTriggers}
+				on:applyArgs={applyArgs}
+				on:addPreprocessor={addPreprocessor}
+				bind:editor
+				bind:this={scriptEditor}
+				bind:schema={script.schema}
+				path={script.path}
+				stablePathForCaptures={initialPath || fakeInitialPath}
+				bind:code={script.content}
+				lang={script.language}
+				timeout={script.timeout}
+				kind={script.kind}
+				autoKind={script.auto_kind}
+				{template}
+				tag={script.tag}
+				lastSavedCode={savedScript?.content}
+				lastDeployedCode={savedScript?.content}
+				bind:args
+				bind:hasPreprocessor
+				bind:captureTable
+				bind:assets={script.assets}
+				bind:modules={script.modules}
+				enablePreprocessorSnippet
+				{testPanelCollapsed}
+			/>
+		{/if}
 	</div>
 {:else}
 	Script Builder not available to operators
 {/if}
 
+<Modal title="dbt on Windmill is in alpha" bind:open={dbtAlphaOpen} cancelText="Got it">
+	<div class="flex flex-col gap-3 text-sm text-secondary">
+		<p>
+			A dbt script is a whole dbt project: the files are the script's module bundle, the content is
+			a <span class="font-mono text-xs">wm_dbt.yaml</span> descriptor, and the models become
+			<span class="font-mono text-xs">dbt://</span> assets in the graph.
+		</p>
+		<p>
+			Expect rough edges, and expect details to move: the descriptor's fields, what a run returns,
+			and how the graph is stored are all still settling.
+		</p>
+		<p>
+			Deploying and running work today, and an existing project needs no changes —
+			<span class="font-mono text-xs">cp -r</span> it into the script's folder and push. Nothing here
+			is load-bearing for other languages.
+		</p>
+		<p class="text-xs">
+			<a
+				href="https://www.windmill.dev/docs/getting_started/scripts_quickstart"
+				target="_blank"
+				rel="noreferrer"
+				class="text-blue-500 hover:underline">Docs</a
+			>
+			· report anything surprising, it is the most useful thing at this stage.
+		</p>
+	</div>
+</Modal>
+
 <WacExportDrawer bind:this={wacExportDrawer} />
diff --git a/frontend/src/lib/components/ScriptEditor.svelte b/frontend/src/lib/components/ScriptEditor.svelte
index 9a65fc9d2b..936d49f3ee 100644
--- a/frontend/src/lib/components/ScriptEditor.svelte
+++ b/frontend/src/lib/components/ScriptEditor.svelte
@@ -19,6 +19,7 @@
 	import { isWorkflowAsCode } from '$lib/components/graph/wacToFlow'
 	import WacDiagram from '$lib/components/graph/WacDiagram.svelte'
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
+	import { canonicalModulePath, findModulePathClash } from './scriptModulePath'
 	import SchemaForm from './SchemaForm.svelte'
 	import PowerShellCommonParams from './PowerShellCommonParams.svelte'
 	import LogPanel from './scriptEditor/LogPanel.svelte'
@@ -124,9 +125,7 @@
 	import { deepEqual } from 'fast-equals'
 	import { usePreparedAssetSqlQueries } from '$lib/infer.svelte'
 	import { resource, watch } from 'runed'
-	import { createScriptRecording } from './recording/scriptRecording.svelte'
-	import { setActiveRecording } from './recording/flowRecording.svelte'
-	import type { ScriptRecording } from './recording/types'
+	import { buildScriptRecording, downloadRecordingJson } from './recording/runRecording'
 	import DropdownV2 from './DropdownV2.svelte'
 
 	interface Props {
@@ -354,6 +353,10 @@
 		editor?.setCode(editorCode)
 	}
 
+	// Whether the open file is tested as a runnable of its own. A `__mod` helper
+	// is.
+	let onModuleArgs = $derived(activeModuleTab !== null)
+
 	let effectiveLang = $derived(
 		activeModuleTab && modules?.[activeModuleTab]
 			? (modules[activeModuleTab].language as Preview['language'])
@@ -476,25 +479,33 @@
 
 	function validateModulePath(path: string): string {
 		if (!path.trim()) return ''
-		const moduleLang = inferModuleLang(path)
+		const canonical = canonicalModulePath(path)
+		if ('error' in canonical) return canonical.error
+		const moduleLang = inferModuleLang(canonical.path)
 		if (!moduleLang) {
 			const exts = allowedModuleExtensions.join(', ')
 			return `File must end with a supported extension: ${exts}`
 		}
-		const matchedExt = allowedModuleExtensions.find((ext) => path.endsWith(ext))
+		const matchedExt = allowedModuleExtensions.find((ext) => canonical.path.endsWith(ext))
 		if (!matchedExt) {
 			const exts = allowedModuleExtensions.join(', ')
 			return `File must end with a supported extension for this language: ${exts}`
 		}
-		if (modules?.[path.trim()]) {
-			return `Module ${path.trim()} already exists`
+		const clash = findModulePathClash(modules, canonical.path)
+		if (clash) {
+			return `Module ${clash} already exists`
 		}
 		return ''
 	}
 
 	function addModule() {
-		const modulePath = modulePathInput.trim()
-		if (!modulePath) return
+		if (!modulePathInput.trim()) return
+		const canonical = canonicalModulePath(modulePathInput)
+		if ('error' in canonical) {
+			modulePathError = canonical.error
+			return
+		}
+		const modulePath = canonical.path
 		const error = validateModulePath(modulePath)
 		if (error) {
 			modulePathError = error
@@ -525,27 +536,41 @@
 
 	function validateRenameModulePath(newPath: string, oldPath: string): string {
 		if (!newPath.trim()) return ''
-		const moduleLang = inferModuleLang(newPath)
+		const canonical = canonicalModulePath(newPath)
+		if ('error' in canonical) return canonical.error
+		const moduleLang = inferModuleLang(canonical.path)
 		if (!moduleLang) {
 			const exts = allowedModuleExtensions.join(', ')
 			return `File must end with a supported extension: ${exts}`
 		}
-		const matchedExt = allowedModuleExtensions.find((ext) => newPath.endsWith(ext))
+		const matchedExt = allowedModuleExtensions.find((ext) => canonical.path.endsWith(ext))
 		if (!matchedExt) {
 			const exts = allowedModuleExtensions.join(', ')
 			return `File must end with a supported extension for this language: ${exts}`
 		}
-		if (newPath.trim() !== oldPath && modules?.[newPath.trim()]) {
-			return `Module ${newPath.trim()} already exists`
+		const clash = findModulePathClash(modules, canonical.path, oldPath)
+		if (clash) {
+			return `Module ${clash} already exists`
 		}
 		return ''
 	}
 
+	/// A spelling of the name the module already has. Nothing to do, so the button
+	/// that would submit it stays disabled rather than being a dead click.
+	function renameIsNoop(input: string, oldPath: string): boolean {
+		const canonical = canonicalModulePath(input)
+		return 'path' in canonical && canonical.path === oldPath
+	}
+
 	function renameModule(oldPath: string) {
-		const newPath = renameModuleInput.trim()
-		if (!newPath || newPath === oldPath) {
+		if (!renameModuleInput.trim()) return
+		const canonical = canonicalModulePath(renameModuleInput)
+		if ('error' in canonical) {
+			renameModuleError = canonical.error
 			return
 		}
+		const newPath = canonical.path
+		if (newPath === oldPath) return
 		const error = validateRenameModulePath(newPath, oldPath)
 		if (error) {
 			renameModuleError = error
@@ -716,9 +741,21 @@
 	let pastPreviewsRequest: ReturnType<typeof JobService.listCompletedJobs> | undefined
 	let validCode = $state(true)
 
-	// Recording
-	let scriptRecording = createScriptRecording()
-	let lastRecording: ScriptRecording | undefined = $state(undefined)
+	// Recording: nothing is captured live — a "record" run just remembers the
+	// completed job id plus the code/args/schema as they were at run time, and
+	// the recording is built from the completed job on download.
+	let recordingArmed = false
+	let lastRecordingJobId: string | undefined = $state(undefined)
+	let recordingMeta:
+		| {
+				scriptPath: string
+				code: string
+				language: string
+				args: Record<string, any>
+				schema?: Record<string, any>
+		  }
+		| undefined = undefined
+	let downloadingRecording = $state(false)
 
 	let wsProvider: WebsocketProvider | undefined = $state(undefined)
 	let yContent: Y.Text | undefined = $state(undefined)
@@ -830,23 +867,23 @@
 		// keep the latest choice as the active mode.
 		if (opts?.cascade !== undefined) cascadeDownstream = opts.cascade
 		// Discard any previous recording when running a normal test
-		if (!scriptRecording.active) {
-			lastRecording = undefined
+		if (!recordingArmed) {
+			lastRecordingJobId = undefined
 		}
 		// Not defined if JobProgressBar not loaded
 		jobProgressBar?.reset()
 		// Flush module edits back to modules map before running preview
 		flushModuleContent()
 
-		const testCode = activeModuleTab !== null ? editorCode : code
-		const testLang = activeModuleTab !== null ? effectiveLang : lang
-		const rawTestArgs =
-			activeModuleTab !== null
-				? testPanelArgs
-				: selectedTab === 'preprocessor' || kind === 'preprocessor'
-					? { _ENTRYPOINT_OVERRIDE: 'preprocessor', ...(args ?? {}) }
-					: (args ?? {})
-		const testSchema = activeModuleTab !== null ? testPanelSchema : schema
+		const onModule = onModuleArgs
+		const testCode = onModule ? editorCode : code
+		const testLang = onModule ? effectiveLang : lang
+		const rawTestArgs = onModule
+			? testPanelArgs
+			: selectedTab === 'preprocessor' || kind === 'preprocessor'
+				? { _ENTRYPOINT_OVERRIDE: 'preprocessor', ...(args ?? {}) }
+				: (args ?? {})
+		const testSchema = onModule ? testPanelSchema : schema
 		const testArgs = await processSecretArgs(rawTestArgs, testSchema, opWs)
 		if (showPsCommonParams) {
 			for (const [k, v] of Object.entries(psCommonParams)) {
@@ -873,25 +910,27 @@
 			undefined,
 			undefined,
 			{
-				done(_x) {
-					if (scriptRecording.active) {
-						lastRecording = scriptRecording.stop()
-						setActiveRecording(undefined)
+				done(x) {
+					if (recordingArmed) {
+						recordingArmed = false
+						lastRecordingJobId = x?.id
 					}
 					if (historyTabActive) {
 						loadPastTests()
 					}
 				},
-				doneError({ error }) {
-					if (scriptRecording.active) {
-						lastRecording = scriptRecording.stop()
-						setActiveRecording(undefined)
+				doneError({ id, error }) {
+					// A failed run is still a completed job and records fine.
+					if (recordingArmed) {
+						recordingArmed = false
+						lastRecordingJobId = id
 					}
 					console.error(error)
 				}
 			},
 			undefined,
-			activeModuleTab !== null ? undefined : modules,
+			// A `__mod` helper is tested alone, so its siblings are left out.
+			onModule ? undefined : modules,
 			undefined,
 			timeout
 		)
@@ -903,15 +942,31 @@
 	}
 
 	async function recordAndTest() {
-		lastRecording = undefined
-		scriptRecording.start(path ?? '', code, lang ?? '', args ?? {}, schema)
-		setActiveRecording(scriptRecording)
+		lastRecordingJobId = undefined
+		recordingMeta = {
+			scriptPath: path ?? '',
+			code,
+			language: lang ?? '',
+			args: JSON.parse(JSON.stringify(args ?? {})),
+			schema: schema ? JSON.parse(JSON.stringify(schema)) : undefined
+		}
+		recordingArmed = true
 		await runTest()
 	}
 
-	function downloadRecording() {
-		if (lastRecording) {
-			scriptRecording.download(lastRecording)
+	async function downloadRecording() {
+		if (!lastRecordingJobId || !recordingMeta || downloadingRecording) return
+		downloadingRecording = true
+		try {
+			const recording = await buildScriptRecording(opWs!, lastRecordingJobId, recordingMeta)
+			downloadRecordingJson(
+				recording,
+				`script-recording-${(recording.script_path || 'untitled').replace(/\//g, '-')}`
+			)
+		} catch (e: any) {
+			sendUserToast('Could not build the recording', true, undefined, e?.toString())
+		} finally {
+			downloadingRecording = false
 		}
 	}
 
@@ -1986,12 +2041,13 @@
 												{/if}
 											{/if}
 										</div>
-										{#if lastRecording}
+										{#if lastRecordingJobId}
 											<Button
 												on:click={downloadRecording}
 												unifiedSize="md"
 												startIcon={{ icon: Download }}
 												iconOnly
+												loading={downloadingRecording}
 												title="Download recording"
 											/>
 										{/if}
@@ -2241,7 +2297,7 @@
 												<JsonInputs
 													on:select={(e) => {
 														if (e.detail) {
-															if (activeModuleTab !== null) {
+															if (onModuleArgs) {
 																testPanelArgs = e.detail
 															} else {
 																args = e.detail
@@ -2259,7 +2315,7 @@
 													bind:clientHeight={schemaHeight}
 												>
 													{#key argsRender}
-														{#if activeModuleTab !== null}
+														{#if onModuleArgs}
 															<SchemaForm
 																workspace={opWs}
 																helperScript={{
@@ -2339,6 +2395,8 @@
 		startIcon={{ icon: Play, classes: 'animate-none' }}
 		shortCut={{ Icon: CornerDownLeft }}
 	>
+		<!-- Named, because a run that silently narrowed to whichever file happens to
+		     be open is the kind of surprise a warehouse bill discovers. -->
 		Test
 	</Button>
 {/snippet}
@@ -2371,7 +2429,7 @@
 		previewIsLoading={debugMode ? $debugState.running && !$debugState.stopped : testIsLoading}
 		{editor}
 		{diffEditor}
-		args={activeModuleTab !== null ? testPanelArgs : args}
+		args={onModuleArgs ? testPanelArgs : args}
 		{showCaptures}
 		customUi={customUi?.previewPanel}
 		showCustomResultPanel={showDebugPanel}
@@ -2497,7 +2555,7 @@
 					close()
 				}}
 				disabled={!renameModuleInput.trim() ||
-					renameModuleInput.trim() === oldPath ||
+					renameIsNoop(renameModuleInput, oldPath) ||
 					!!renameModuleError}>Rename</Button
 			>
 		</div>
@@ -2595,7 +2653,7 @@
 				</Popover>
 			</div>
 		{/if}
-		<div class="relative flex-1 min-h-0 !overflow-visible">
+		<div class="relative flex-1 min-h-0 min-w-0 !overflow-visible">
 			<div class="absolute bg-surface top-2 right-4 z-10 flex flex-row gap-2">
 				{#if assets?.length}
 					<AssetsDropdownButton {assets} />
@@ -2732,6 +2790,11 @@
 			awareness={wsProvider?.awareness}
 			on:change={(e) => {
 				if (activeModuleTab === null) {
+					// `editorCode`, not the payload: `setCode` dispatches the string it was
+					// handed, but Monaco may have normalized it (EOL) while applying it, and
+					// the re-entrant `updateCode` that runs inside `setCode` has already put
+					// that normalized text here. Taking the payload would leave `code`
+					// disagreeing with the buffer.
 					code = editorCode
 					lastSyncedCode = code
 					inferSchema(e.detail)
diff --git a/frontend/src/lib/components/ScriptVersionHistory.svelte b/frontend/src/lib/components/ScriptVersionHistory.svelte
index 4d053fc433..693ddef47c 100644
--- a/frontend/src/lib/components/ScriptVersionHistory.svelte
+++ b/frontend/src/lib/components/ScriptVersionHistory.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
-	import { classNames, emptyString } from '$lib/utils'
+	import { emptyString } from '$lib/utils'
 	import { ScriptService, type ScriptHistory } from '$lib/gen'
 	import { workspaceStore } from '$lib/stores'
 	import { Skeleton } from '$lib/components/common'
@@ -10,6 +10,7 @@
 	import { ExternalLink, Pencil, ArrowRight, X, Diff, Code } from 'lucide-svelte'
 	import ToggleButtonGroup from './common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from './common/toggleButton-v2/ToggleButton.svelte'
+	import VersionListItem from './VersionListItem.svelte'
 
 	const dispatch = createEventDispatcher()
 
@@ -66,14 +67,8 @@
 				{#if versions && versions.length > 0}
 					<div class="flex gap-2 flex-col">
 						{#each versions ?? [] as version, versionIndex}
-							<!-- svelte-ignore a11y_click_events_have_key_events -->
-							<!-- svelte-ignore a11y_no_static_element_interactions -->
-							<div
-								class={classNames(
-									'border flex gap-1 truncate justify-between flex-row w-full items-center p-2 rounded-md cursor-pointer ',
-									selectedVersion?.script_hash == version.script_hash ? 'bg-surface-selected' : '',
-									'hover:bg-surface-hover'
-								)}
+							<VersionListItem
+								selected={selectedVersion?.script_hash == version.script_hash}
 								onclick={() => {
 									selectedVersion = version
 									selectedVersionIndex = versionIndex
@@ -98,20 +93,22 @@
 								<span class="text-xs truncate">
 									{#if emptyString(version.deployment_msg)}Version {version.script_hash}{:else}{version.deployment_msg}{/if}
 								</span>
-								{#if openDetails}
-									<Button
-										on:click={() => {
-											dispatch('openDetails', { version: version.script_hash })
-										}}
-										class="ml-2 inline-flex gap-1 text-xs items-center"
-										size="xs"
-										color="light"
-										variant="border"
-									>
-										Run page<ExternalLink size={14} />
-									</Button>
-								{/if}
-							</div>
+								{#snippet action()}
+									{#if openDetails}
+										<Button
+											on:click={() => {
+												dispatch('openDetails', { version: version.script_hash })
+											}}
+											class="mr-2 shrink-0 inline-flex gap-1 text-xs items-center"
+											size="xs"
+											color="light"
+											variant="border"
+										>
+											Run page<ExternalLink size={14} />
+										</Button>
+									{/if}
+								{/snippet}
+							</VersionListItem>
 						{/each}
 					</div>
 				{:else}
diff --git a/frontend/src/lib/components/ScriptWrapper.svelte b/frontend/src/lib/components/ScriptWrapper.svelte
index ff8fc8b2f5..0684e8e092 100644
--- a/frontend/src/lib/components/ScriptWrapper.svelte
+++ b/frontend/src/lib/components/ScriptWrapper.svelte
@@ -38,7 +38,7 @@
 	})
 </script>
 
-<AiChatLayout noPadding {disableAi}>
+<AiChatLayout noPadding {disableAi} loadAiConfig={!disableAi}>
 	{#if $workspaceStore && draftSync.draft}
 		<ScriptBuilder
 			bind:script={draftSync.draft}
diff --git a/frontend/src/lib/components/SearchItems.svelte b/frontend/src/lib/components/SearchItems.svelte
index 069fabfe99..1413059ff5 100644
--- a/frontend/src/lib/components/SearchItems.svelte
+++ b/frontend/src/lib/components/SearchItems.svelte
@@ -1,6 +1,7 @@
 <script lang="ts">
 	import uFuzzy from '@leeoniya/ufuzzy'
 	import { untrack } from 'svelte'
+	import { escapeHtml } from '$lib/utils'
 
 	interface Props {
 		filter?: string
@@ -14,6 +15,13 @@
 
 	let uf = new uFuzzy(untrack(() => opts))
 
+	// Consumers render `marked` with {@html}, and the searched text is workspace
+	// content (paths, descriptions, resource types, ...). uFuzzy's default mark
+	// concatenates the raw substrings, so escape every part and let only the
+	// <mark> wrapper through as markup.
+	const markEscaped = (part: string, matched: boolean) =>
+		matched ? `<mark>${escapeHtml(part)}</mark>` : escapeHtml(part)
+
 	function filterItems() {
 		let trimmed = filter.trim()
 		if (items == undefined || trimmed.length == 0) {
@@ -32,7 +40,11 @@
 			let infoIdx = order[i]
 			result.push({
 				...items[info.idx[infoIdx]],
-				marked: uFuzzy.highlight(plaintextItems[info.idx[infoIdx]], info.ranges[infoIdx])
+				marked: uFuzzy.highlight(
+					plaintextItems[info.idx[infoIdx]],
+					info.ranges[infoIdx],
+					markEscaped
+				)
 			})
 		}
 		filteredItems = result
diff --git a/frontend/src/lib/components/SimpleEditor.svelte b/frontend/src/lib/components/SimpleEditor.svelte
index f1c4daa962..37616aa83a 100644
--- a/frontend/src/lib/components/SimpleEditor.svelte
+++ b/frontend/src/lib/components/SimpleEditor.svelte
@@ -29,7 +29,7 @@
 
 	import { allClasses } from './apps/editor/componentsPanel/cssUtils'
 
-	import { createEventDispatcher, onDestroy, onMount, untrack } from 'svelte'
+	import { createEventDispatcher, onDestroy, onMount, tick, untrack } from 'svelte'
 
 	import libStdContent from '$lib/es6.d.ts.txt?raw'
 	import domContent from '$lib/dom.d.ts.txt?raw'
@@ -59,6 +59,11 @@
 	// import { createConfiguredEditor } from 'vscode/monaco'
 	// import type { IStandaloneCodeEditor } from 'vscode/vscode/vs/editor/standalone/browser/standaloneCodeEditor'
 
+	/** Trailing debounce window (ms) on Monaco's onDidChangeModelContent. */
+	const CHANGE_TIMEOUT = 200
+
+	let changeTimeoutId: number | undefined = undefined
+
 	let divEl: HTMLDivElement | null = null
 	let editor = $state<meditor.IStandaloneCodeEditor | null>(null)
 	let model: meditor.ITextModel
@@ -98,7 +103,8 @@
 		readOnly = false,
 		minHeight = 1000,
 		renderLineHighlight = 'none',
-		suggestion
+		suggestion,
+		leadingChangeSync = false
 	}: {
 		lang: string
 		code?: string
@@ -130,6 +136,11 @@
 		minHeight?: number
 		renderLineHighlight?: 'all' | 'line' | 'gutter' | 'none'
 		suggestion?: string
+		/** Materialize `code` on the first change of a burst instead of only after
+		 * the trailing debounce. Set it when a control's enabled state derives from
+		 * `code`; leave it off where each extra sync costs work downstream (an app
+		 * code input feeding an autoRefresh runnable re-runs a job per sync). */
+		leadingChangeSync?: boolean
 	} = $props()
 
 	let yPadding = MONACO_Y_PADDING
@@ -156,11 +167,21 @@
 			code = ncode
 		}
 		editor?.setValue(ncode)
+		// setValue emits a change event of its own; drop the burst it opens so an edit
+		// made right after an authoritative overwrite still counts as a leading change.
+		cancelPendingChanges()
 		if (formatCode) {
 			format()
 		}
 	}
 
+	function cancelPendingChanges(): void {
+		if (changeTimeoutId !== undefined) {
+			clearTimeout(changeTimeoutId)
+			changeTimeoutId = undefined
+		}
+	}
+
 	export function formatCode(): void {
 		format()
 	}
@@ -408,12 +429,21 @@
 			pasteListenerCleanup = () => pasteTarget?.removeEventListener('keydown', onPasteKeydown, true)
 		}
 
-		let timeoutModel: number | undefined = undefined
-		editor.onDidChangeModelContent((event) => {
-			timeoutModel && clearTimeout(timeoutModel)
-			timeoutModel = setTimeout(() => {
+		editor.onDidChangeModelContent(() => {
+			// A paste is a single change, so under a trailing-only sync `code` stays
+			// stale for CHANGE_TIMEOUT after it: a consumer gating a control on `code`
+			// (FlowYamlEditor disables "Apply changes" until it differs from a snapshot)
+			// then swallows a click made in that window. Schedule before firing so a
+			// re-entrant change from a consumer does not count as leading too.
+			const leading = leadingChangeSync && changeTimeoutId === undefined
+			cancelPendingChanges()
+			changeTimeoutId = setTimeout(() => {
+				changeTimeoutId = undefined
 				updateCode()
-			}, 200)
+			}, CHANGE_TIMEOUT)
+			if (leading) {
+				updateCode()
+			}
 		})
 		editor.onDidChangeCursorPosition((event) => {
 			if (key) editorPositionMap[key] = event.position
@@ -428,8 +458,9 @@
 				updateCode()
 				shouldBindKey && format && format()
 				// See Editor.svelte — re-broadcast the swallowed shortcut for
-				// page-level draft-flush handlers.
-				window.dispatchEvent(new CustomEvent('wm-monaco-save-shortcut'))
+				// page-level draft-flush handlers, after `tick()` so they see
+				// the value `updateCode()` just materialized.
+				void tick().then(() => window.dispatchEvent(new CustomEvent('wm-monaco-save-shortcut')))
 			})
 
 			editor.addCommand(KeyMod.CtrlCmd | KeyMod.Shift | KeyCode.Digit7, function () {
@@ -460,8 +491,9 @@
 				updateCode()
 				shouldBindKey && format && format()
 				// See Editor.svelte — re-broadcast the swallowed shortcut for
-				// page-level draft-flush handlers.
-				window.dispatchEvent(new CustomEvent('wm-monaco-save-shortcut'))
+				// page-level draft-flush handlers, after `tick()` so they see
+				// the value `updateCode()` just materialized.
+				void tick().then(() => window.dispatchEvent(new CustomEvent('wm-monaco-save-shortcut')))
 			})
 
 			editor.addCommand(KeyMod.CtrlCmd | KeyCode.Enter, function () {
@@ -620,6 +652,11 @@
 
 	onDestroy(() => {
 		try {
+			// Same guards as Editor: only a pending keystroke debounce is ours to flush.
+			if (editor && changeTimeoutId !== undefined) {
+				updateCode()
+			}
+			cancelPendingChanges()
 			valueAfterDispose = getCode()
 			pasteListenerCleanup?.()
 			vimDisposable?.dispose()
diff --git a/frontend/src/lib/components/SqlRepl.svelte b/frontend/src/lib/components/SqlRepl.svelte
index 3763f7aeed..e19da629bd 100644
--- a/frontend/src/lib/components/SqlRepl.svelte
+++ b/frontend/src/lib/components/SqlRepl.svelte
@@ -2,6 +2,7 @@
 	import { CornerDownLeft, Loader2 } from 'lucide-svelte'
 	import Button from './common/button/Button.svelte'
 	import { runScriptAndPollResult } from './jobs/utils'
+	import { writingJobOptions } from './jobs/writingJob'
 	import { workspaceStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
 	import { untrack } from 'svelte'
@@ -27,13 +28,16 @@
 		/** Workspace the REPL queries and DDL migrations run against; defaults to
 		 * the nav workspace. */
 		workspace?: string | undefined
+		/** Worker tag the queries run on instead of the language's native one. */
+		tag?: string | undefined
 	}
 	let {
 		input,
 		onData,
 		placeholderTableName,
 		onSchemaChange,
-		workspace = undefined
+		workspace = undefined,
+		tag = undefined
 	}: Props = $props()
 	let ws = $derived(workspace ?? $workspaceStore)
 	let dbType = $derived(getDbType(input))
@@ -120,10 +124,12 @@
 					requestBody: {
 						language: getLanguageByResourceType(dbType),
 						content: transformedCode,
-						args: dbArg
+						args: dbArg,
+						tag
 					}
 				},
-				{ withJobData: true }
+				// The user types arbitrary SQL here, so treat every run as a write.
+				{ withJobData: true, ...writingJobOptions }
 			)) as any
 			if (statements.length > 1) {
 				result = result[result.length - 1]
diff --git a/frontend/src/lib/components/TemplateEditor.svelte b/frontend/src/lib/components/TemplateEditor.svelte
index 2fef927c9a..ea4407aecc 100644
--- a/frontend/src/lib/components/TemplateEditor.svelte
+++ b/frontend/src/lib/components/TemplateEditor.svelte
@@ -21,7 +21,7 @@
 
 	import libStdContent from '$lib/es6.d.ts.txt?raw'
 	import { editor as meditor, Uri as mUri, languages, Range, KeyMod, KeyCode } from 'monaco-editor'
-	import { createEventDispatcher, getContext, onDestroy, onMount, untrack } from 'svelte'
+	import { createEventDispatcher, getContext, onDestroy, onMount, tick, untrack } from 'svelte'
 	import type { AppViewerContext } from './apps/types'
 	import { writable } from 'svelte/store'
 	// import '@codingame/monaco-vscode-standalone-languages'
@@ -505,7 +505,13 @@
 		editor.onDidFocusEditorText(() => {
 			dispatch('focus')
 
-			editor?.addCommand(KeyMod.CtrlCmd | KeyCode.KeyS, function () {})
+			editor?.addCommand(KeyMod.CtrlCmd | KeyCode.KeyS, function () {
+				updateCode()
+				// See Editor.svelte — re-broadcast the swallowed shortcut for
+				// page-level draft-flush handlers, after `tick()` so they see
+				// the value `updateCode()` just materialized.
+				void tick().then(() => window.dispatchEvent(new CustomEvent('wm-monaco-save-shortcut')))
+			})
 
 			editor?.addCommand(KeyMod.CtrlCmd | KeyMod.Shift | KeyCode.Digit7, function () {})
 		})
diff --git a/frontend/src/lib/components/TimeAgo.svelte b/frontend/src/lib/components/TimeAgo.svelte
index 52423372e8..cf3f019432 100644
--- a/frontend/src/lib/components/TimeAgo.svelte
+++ b/frontend/src/lib/components/TimeAgo.svelte
@@ -9,6 +9,8 @@
 		noDate?: boolean
 		isRecent?: boolean
 		noSeconds?: boolean
+		/** Single-unit form ("2m", "3h", "5d") for rows too narrow for "2 mins ago". */
+		compact?: boolean
 	}
 
 	let {
@@ -16,7 +18,8 @@
 		agoOnlyIfRecent = false,
 		noDate = false,
 		isRecent = $bindable(true),
-		noSeconds = false
+		noSeconds = false,
+		compact = false
 	}: Props = $props()
 
 	let computedTimeAgo: string | undefined = $state(undefined)
@@ -24,7 +27,10 @@
 	let interval
 
 	onMount(() => {
-		// Update every minute for noSeconds mode, every second for regular mode
+		// compact schedules itself below; it needs no fixed rate.
+		if (compact) return
+
+		// Update every minute for noSeconds mode, every second otherwise.
 		const intervalMs = noSeconds ? 60000 : 1000
 		interval = setInterval(() => {
 			computeDate()
@@ -40,6 +46,36 @@
 		}
 	})
 
+	// Waking on the boundary of the unit on screen, rather than at a fixed rate: `2h` only
+	// changes on the hour, and a row that reads `5d` must not hold a 1s timer to find that
+	// out. Re-armed when `date` changes, so an item edited to now leaves its day-long wait.
+	$effect(() => {
+		if (!compact) return
+		const at = date
+		let handle: ReturnType<typeof setTimeout> | undefined
+		const tick = () => {
+			computeDate()
+			handle = setTimeout(tick, compactDelayMs(at))
+		}
+		handle = setTimeout(tick, compactDelayMs(at))
+		return () => {
+			handle && clearTimeout(handle)
+		}
+	})
+
+	function compactDelayMs(dateString: string): number {
+		const secs = secondsAgo(new Date(dateString))
+		const left =
+			secs < 60
+				? 1
+				: secs < 3600
+					? 60 - (secs % 60)
+					: secs < 86_400
+						? 3600 - (secs % 3600)
+						: 86_400 - (secs % 86_400)
+		return left * 1000
+	}
+
 	async function computeDate() {
 		computedTimeAgo = await displayDaysAgo(date)
 	}
@@ -80,6 +116,21 @@
 	async function displayDaysAgo(dateString: string): Promise<string> {
 		const date = new Date(dateString)
 
+		if (compact) {
+			// The s/m/h/d ladder the hand-rolled `ago()` helpers around the codebase use
+			// (PipelineEventLog, PipelineActivityPanel, IndexerMemorySettings): seconds stay
+			// meaningful right up to the minute mark.
+			const secs = secondsAgo(date)
+			if (secs < 60) return `${secs}s`
+			const mins = minutesAgo(date)
+			if (mins < 60) return `${mins}m`
+			const hours = hoursAgo(date)
+			if (hours < 24) return `${hours}h`
+			// Days all the way up, never an absolute date: callers read as "<slot> ago", and
+			// the hand-rolled ago() helpers this mirrors have no date fallback either.
+			return `${daysAgo(date)}d`
+		}
+
 		// New noSeconds mode
 		if (noSeconds) {
 			const mins = minutesAgo(date)
diff --git a/frontend/src/lib/components/Toggle.svelte b/frontend/src/lib/components/Toggle.svelte
index 4555dd6881..16e1086a94 100644
--- a/frontend/src/lib/components/Toggle.svelte
+++ b/frontend/src/lib/components/Toggle.svelte
@@ -6,9 +6,9 @@
 	import { createEventDispatcher, untrack } from 'svelte'
 	import { twMerge } from 'tailwind-merge'
 	import Tooltip from './Tooltip.svelte'
-	import { AlertTriangle } from 'lucide-svelte'
 	import { triggerableByAI } from '$lib/actions/triggerableByAI.svelte'
 	import { inputBorderClass } from './text_input/TextInput.svelte'
+	import EEOnly from './EEOnly.svelte'
 
 	interface Props {
 		options?: {
@@ -55,99 +55,119 @@
 
 	const dispatch = createEventDispatcher<{ change: boolean }>()
 	const bothOptions = Boolean(untrack(() => options).left) && Boolean(untrack(() => options).right)
+	// Same badge the labelled containers (Label, Section, Subsection) show. Gated on
+	// `disabled` rather than on the license: a caller can leave an EE-only toggle
+	// interactive on CE precisely because it is already on, and "EE only" beside a control
+	// that plainly works reads as a lie.
+	const showEeBadge = $derived(eeOnly && disabled)
 </script>
 
-<label
-	for={id}
-	class="{className || ''} z-auto flex flex-row items-center duration-50 {disabled
-		? 'grayscale opacity-50 cursor-not-allowed'
-		: 'cursor-pointer'}"
-	title={options?.title}
->
-	{#if Boolean(options?.left)}
-		<span
-			class={twMerge(
-				'mr-2 font-normal duration-50 select-none',
-				bothOptions || textDisabled ? (checked ? 'text-disabled' : 'text-primary') : 'text-primary',
-				size === '2xs' ? 'text-2xs' : 'text-xs',
-				textClass
-			)}
-			style={textStyle}
-		>
-			{options?.left}
-			{#if options?.leftTooltip}
-				<Tooltip light={lightMode}>{options?.leftTooltip}</Tooltip>
-			{/if}
-		</span>
-	{/if}
-
-	<!-- svelte-ignore a11y_click_events_have_key_events -->
-	<!-- svelte-ignore a11y_no_static_element_interactions -->
-	<div
-		class="relative"
-		onclick={stopPropagation(bubble('click'))}
-		use:triggerableByAI={{
-			id: aiId,
-			description: aiDescription,
-			callback: () => {
-				checked = !checked
-			}
-		}}
+{#snippet control()}
+	<label
+		for={id}
+		class="{className || ''} z-auto flex flex-row items-center duration-50 {disabled
+			? 'grayscale opacity-50 cursor-not-allowed'
+			: 'cursor-pointer'}"
+		title={options?.title}
 	>
-		<input
-			onfocus={bubble('focus')}
-			onclick={bubble('click')}
-			{disabled}
-			type="checkbox"
-			{id}
-			class="sr-only peer"
-			bind:checked
-			onchange={stopPropagation((e) => {
-				dispatch('change', !!checked)
-			})}
-		/>
+		{#if Boolean(options?.left)}
+			<span
+				class={twMerge(
+					'mr-2 font-normal duration-50 select-none',
+					bothOptions || textDisabled
+						? checked
+							? 'text-disabled'
+							: 'text-primary'
+						: 'text-primary',
+					size === '2xs' ? 'text-2xs' : 'text-xs',
+					textClass
+				)}
+				style={textStyle}
+			>
+				{options?.left}
+				{#if options?.leftTooltip}
+					<Tooltip light={lightMode}>{options?.leftTooltip}</Tooltip>
+				{/if}
+			</span>
+		{/if}
+
+		<!-- svelte-ignore a11y_click_events_have_key_events -->
+		<!-- svelte-ignore a11y_no_static_element_interactions -->
 		<div
-			class={classNames(
-				"transition-all bg-surface-sunken rounded-full peer peer-checked:after:translate-x-full peer-checked:after:border-white after:content-[''] after:absolute  after:bg-surface after:border-white after:border after:rounded-full after:transition-all items-center",
-				color == 'red'
-					? 'peer-checked:bg-red-600'
-					: color == 'blue'
-						? 'peer-checked:bg-blue-400 '
-						: 'peer-checked:bg-nord-950 dark:peer-checked:bg-nord-900',
-				size === 'md'
-					? 'w-11 h-6 after:top-0.5 after:left-[2px] after:h-5 after:w-5'
-					: size === 'sm'
-						? 'w-9 h-5 after:top-0.5 after:left-[2px] after:h-4 after:w-4'
-						: size === '2xs'
-							? 'w-5 h-3 after:top-0.5 after:left-[2px] after:h-2 after:w-2'
-							: 'w-7 h-4 after:top-0.5 after:left-[2px] after:h-3 after:w-3',
-				inputBorderClass()
-			)}
-		></div>
-	</div>
-	{#if Boolean(options?.right)}
-		<span
-			class={twMerge(
-				'ml-2 font-normal duration-50 select-none',
-				bothOptions || textDisabled ? (checked ? 'text-primary' : 'text-disabled') : 'text-primary',
-				size === '2xs' ? 'text-2xs' : 'text-xs',
-				textClass
-			)}
-			style={textStyle}
+			class="relative"
+			onclick={stopPropagation(bubble('click'))}
+			use:triggerableByAI={{
+				id: aiId,
+				description: aiDescription,
+				callback: () => {
+					checked = !checked
+				}
+			}}
 		>
-			{options?.right}
-			{#if options?.rightTooltip}
-				<Tooltip documentationLink={options.rightDocumentationLink}>
-					{options.rightTooltip}
-				</Tooltip>
-			{/if}
-		</span>
-	{/if}
-	{@render right?.()}
-</label>
-{#if eeOnly && disabled}
-	<span class="inline-flex text-xs items-center gap-1 !text-yellow-500 whitespace-nowrap ml-8">
-		<AlertTriangle size={16} />
-		EE only <Tooltip>Enterprise Edition only feature</Tooltip>
-	</span>
+			<input
+				onfocus={bubble('focus')}
+				onclick={bubble('click')}
+				{disabled}
+				type="checkbox"
+				{id}
+				class="sr-only peer"
+				bind:checked
+				onchange={stopPropagation((e) => {
+					dispatch('change', !!checked)
+				})}
+			/>
+			<div
+				class={classNames(
+					"transition-all bg-surface-sunken rounded-full peer peer-checked:after:translate-x-full peer-checked:after:border-white after:content-[''] after:absolute  after:bg-surface after:border-white after:border after:rounded-full after:transition-all items-center",
+					color == 'red'
+						? 'peer-checked:bg-red-600'
+						: color == 'blue'
+							? 'peer-checked:bg-blue-400 '
+							: 'peer-checked:bg-nord-950 dark:peer-checked:bg-nord-900',
+					size === 'md'
+						? 'w-11 h-6 after:top-0.5 after:left-[2px] after:h-5 after:w-5'
+						: size === 'sm'
+							? 'w-9 h-5 after:top-0.5 after:left-[2px] after:h-4 after:w-4'
+							: size === '2xs'
+								? 'w-5 h-3 after:top-0.5 after:left-[2px] after:h-2 after:w-2'
+								: 'w-7 h-4 after:top-0.5 after:left-[2px] after:h-3 after:w-3',
+					inputBorderClass()
+				)}
+			></div>
+		</div>
+		{#if Boolean(options?.right)}
+			<span
+				class={twMerge(
+					'ml-2 font-normal duration-50 select-none',
+					bothOptions || textDisabled
+						? checked
+							? 'text-primary'
+							: 'text-disabled'
+						: 'text-primary',
+					size === '2xs' ? 'text-2xs' : 'text-xs',
+					textClass
+				)}
+				style={textStyle}
+			>
+				{options?.right}
+				{#if options?.rightTooltip}
+					<Tooltip documentationLink={options.rightDocumentationLink}>
+						{options.rightTooltip}
+					</Tooltip>
+				{/if}
+			</span>
+		{/if}
+		{@render right?.()}
+	</label>
+{/snippet}
+
+{#if showEeBadge}
+	<!-- The badge sits outside the label: a disabled one is greyed out and half
+	     transparent, which would swallow it. -->
+	<div class="flex flex-row items-center gap-2">
+		{@render control()}
+		<EEOnly />
+	</div>
+{:else}
+	{@render control()}
 {/if}
diff --git a/frontend/src/lib/components/UpdateDevWorkspaceModal.svelte b/frontend/src/lib/components/UpdateDevWorkspaceModal.svelte
new file mode 100644
index 0000000000..c53b1436c8
--- /dev/null
+++ b/frontend/src/lib/components/UpdateDevWorkspaceModal.svelte
@@ -0,0 +1,348 @@
+<script lang="ts">
+	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
+	import { Alert } from '$lib/components/common'
+	import { base } from '$lib/base'
+	import { goto } from '$lib/navigation'
+	import { sendUserToast } from '$lib/toast'
+	import { updateDevWorkspaceModal } from '$lib/utils/editInForkModal.svelte'
+	import { claimTab, devWorkspaceEditUrl } from '$lib/utils/editInFork'
+	import {
+		checkItemDeployAccess,
+		checkItemExists,
+		createFolderIfAbsent,
+		deployItem,
+		getOnBehalfOfOrThrow,
+		type DeployResult,
+		type DeployTargetAccess
+	} from '$lib/utils_workspace_deploy'
+	import { COMPARE_ITEMS_PARAM } from '$lib/components/sessions/modifiedItemsMask'
+	import OnBehalfOfSelector, {
+		needsOnBehalfOfSelection,
+		type OnBehalfOfChoice,
+		type OnBehalfOfDetails
+	} from '$lib/components/OnBehalfOfSelector.svelte'
+	import Tooltip from '$lib/components/Tooltip.svelte'
+
+	const pending = $derived(updateDevWorkspaceModal.val)
+
+	let updating = $state(false)
+	/** The user picker stacks above this dialog and owns the keyboard while it's up (`keyListen`). */
+	let pickerOpen = $state(false)
+
+	/**
+	 * A lookup tagged with the request it answers. Requests outlive the prompt that started them
+	 * (no abort signal on the client), so cancelling and reopening leaves two in flight — without
+	 * the tag the last to settle decides this item's permissions and identity. `undefined` means
+	 * "not looked up yet", which is what gates confirming.
+	 */
+	type Tagged<T> = { req: NonNullable<typeof pending>; value: T }
+	function forPending<T>(res: Tagged<T> | undefined): Tagged<T> | undefined {
+		return res && res.req === pending ? res : undefined
+	}
+
+	// Re-run per opened item: the modal is mounted for the whole session, the rules can change under
+	// it, and write access is per-path so it can differ between two items in the same workspace.
+	let accessLookup = $state<Tagged<DeployTargetAccess> | undefined>(undefined)
+	let sourceLookup = $state<Tagged<{ onBehalfOf?: string; failed?: boolean }> | undefined>(
+		undefined
+	)
+
+	$effect(() => {
+		const req = pending
+		accessLookup = undefined
+		sourceLookup = undefined
+		onBehalfOfChoice = undefined
+		customOnBehalfOf = undefined
+		if (!req) return
+		let live = true
+		void checkItemDeployAccess(req.devWorkspaceId, req.itemPath).then((value) => {
+			if (live) accessLookup = { req, value }
+		})
+		// `failed` rather than `undefined`: an unreadable source is not one with no identity, and
+		// conflating them would quietly hand the copy to the deploying user.
+		void getOnBehalfOfOrThrow(req.itemType, req.itemPath, req.prodWorkspaceId).then(
+			(onBehalfOf) => {
+				if (live) sourceLookup = { req, value: { onBehalfOf } }
+			},
+			() => {
+				if (live) sourceLookup = { req, value: { failed: true } }
+			}
+		)
+		return () => {
+			live = false
+		}
+	})
+
+	const access = $derived(forPending(accessLookup))
+	const permission = $derived(access?.value.permission)
+
+	// The compare page's update direction (prod -> dev) with this one item preselected. Where the
+	// confirm button leads when the user can't deploy here, so the request still has somewhere to go.
+	const compareHref = $derived(
+		pending
+			? `${base}/forks/compare?workspace_id=${encodeURIComponent(pending.devWorkspaceId)}` +
+					`&mode=fork&dir=update` +
+					`&${COMPARE_ITEMS_PARAM}=${encodeURIComponent(`${pending.itemType}:${pending.itemPath}`)}`
+			: ''
+	)
+
+	// Falls open while the check is in flight so the modal doesn't flash a refusal it may retract;
+	// confirming stays blocked until it lands (see `confirmBlocked`).
+	const canDeploy = $derived(permission?.ok !== false)
+
+	// Identity the item will run under once it lands in the dev workspace. Offered only when the
+	// prod item has an on_behalf_of of its own — otherwise there is no identity to carry over and
+	// the deploying user is the only sensible answer (`needsOnBehalfOfSelection`).
+	const sourceOnBehalfOf = $derived(forPending(sourceLookup))
+	const showOnBehalfOf = $derived(
+		!!pending && needsOnBehalfOfSelection(pending.itemType, sourceOnBehalfOf?.value.onBehalfOf)
+	)
+
+	// Left unset until the user picks, and confirming is blocked meanwhile. The selector's own
+	// "preserve the target's value" default can't apply: the item is absent from the dev workspace.
+	let onBehalfOfChoice = $state<OnBehalfOfChoice>(undefined)
+	let customOnBehalfOf = $state<OnBehalfOfDetails | undefined>(undefined)
+
+	// 'me' is sent explicitly rather than left blank. Sending nothing means "no preference", which
+	// lets the target folder's `default_permissioned_as` claim the item — so the option labelled
+	// "me" would deploy it as somebody else. No choice at all (selector hidden) still defers to it.
+	const chosenIdentity = $derived(
+		onBehalfOfChoice === 'custom'
+			? customOnBehalfOf
+			: onBehalfOfChoice === 'me'
+				? access?.value.me
+				: undefined
+	)
+
+	const onBehalfOfUnset = $derived(showOnBehalfOf && onBehalfOfChoice === undefined)
+	// Blocked until both lookups land *for this item* — Enter is bound to confirm, so a fast one
+	// would otherwise deploy past the permission check and skip a required choice. Not blocked once
+	// refused: the button leads to the compare page then.
+	const sourceOnBehalfOfFailed = $derived(!!sourceOnBehalfOf?.value.failed)
+	// An identity has to be picked but we don't know who "me" is there, so no choice can be honoured:
+	// sending nothing would hand the item to the folder default instead.
+	const targetIdentityUnknown = $derived(showOnBehalfOf && !!access && !access.value.me)
+	const confirmBlocked = $derived(
+		canDeploy &&
+			(!access ||
+				!sourceOnBehalfOf ||
+				sourceOnBehalfOfFailed ||
+				targetIdentityUnknown ||
+				onBehalfOfUnset)
+	)
+
+	function close() {
+		updateDevWorkspaceModal.val = undefined
+	}
+
+	/**
+	 * Deploying `f/<folder>/<name>` into a workspace with no `<folder>` succeeds but orphans the
+	 * item — it lands with no folder to carry its permissions. Anything else it needs (resources,
+	 * variables, resource types) stays the compare page's job, exactly as it is there.
+	 */
+	async function ensureFolder(req: NonNullable<typeof pending>): Promise<DeployResult> {
+		const folder = req.itemPath.match(/^f\/([^/]+)\//)?.[1]
+		if (!folder) return { success: true }
+		const folderPath = `f/${folder}`
+		try {
+			if (await checkItemExists('folder', folderPath, req.devWorkspaceId)) return { success: true }
+		} catch (e) {
+			// The one probe that must not fail open: deploying while the folder is in fact missing is
+			// the orphaning above, and nothing downstream would catch it.
+			return { success: false, error: `could not check whether ${folderPath} exists (${e})` }
+		}
+		// Create-only: nobody asked for this folder to be deployed, so it must never overwrite one
+		// that appeared meanwhile. See `createFolderIfAbsent`.
+		const result = await createFolderIfAbsent(folder, req.prodWorkspaceId, req.devWorkspaceId)
+		if (result.droppedAccess?.length) {
+			// Narrower than the source rather than wider, so it doesn't block the deploy — but it is
+			// still not what the folder looked like where it came from.
+			sendUserToast(
+				`${folderPath} was created without access for ${result.droppedAccess.join(', ')} — ` +
+					`no such user or group in ${req.devWorkspaceName}`
+			)
+		}
+		return result
+	}
+
+	async function presenceInDev(
+		req: NonNullable<typeof pending>
+	): Promise<'present' | 'absent' | 'unknown'> {
+		try {
+			return (await checkItemExists(req.itemType, req.itemPath, req.devWorkspaceId))
+				? 'present'
+				: 'absent'
+		} catch {
+			return 'unknown'
+		}
+	}
+
+	async function confirm() {
+		const req = pending
+		if (!req || updating) return
+		// Claimed before the first `await`, for the same reason the dropdown entry claims one: a tab
+		// opened from a promise continuation never appears on Safari. Released on every path that
+		// leaves the prompt up, so a retry starts from a clean slate.
+		const tab = req.openInNewTab ? claimTab() : undefined
+		async function leaveTo(url: string, destination: string) {
+			if (tab) tab.show(url)
+			else if (req!.openInNewTab) {
+				// The claim was blocked, and so is this. Every caller has already closed the prompt and
+				// may have deployed, so staying silent would read as the confirm having done nothing.
+				if (!window.open(url)) sendUserToast(`Allow popups to open ${destination}`, true)
+			} else await goto(url)
+		}
+		const itemInDev = `${req.itemPath} in ${req.devWorkspaceName}`
+		if (!canDeploy) {
+			// Read before closing: the href is derived from the request being answered, so clearing it
+			// first leaves nothing to navigate to.
+			const href = compareHref
+			close()
+			await leaveTo(href, 'the compare page')
+			return
+		}
+		updating = true
+		// Folders carry no on_behalf_of, so only the item itself takes one.
+		let result = await ensureFolder(req)
+		if (result.success) {
+			// The prompt is only up because the item was absent, so this asks once more before writing
+			// and the write itself refuses to become an update (`createOnly` below). Between them,
+			// whoever landed it meanwhile is opened rather than overwritten.
+			const presence = await presenceInDev(req)
+			if (presence === 'present') {
+				updating = false
+				close()
+				sendUserToast(`${req.itemPath} is already in ${req.devWorkspaceName}, opening it`)
+				await leaveTo(
+					devWorkspaceEditUrl(req.itemType, req.itemPath, req.devWorkspaceId),
+					itemInDev
+				)
+				return
+			}
+			if (presence === 'unknown') {
+				// Someone may have landed it meanwhile and writing would overwrite them, so this probe
+				// can't fail open either. Prompt stays up so a retry is one click away.
+				updating = false
+				tab?.discard()
+				sendUserToast(
+					`Could not check whether ${req.itemPath} is already in ${req.devWorkspaceName}`,
+					true
+				)
+				return
+			}
+			const deployed = await deployItem({
+				kind: req.itemType,
+				path: req.itemPath,
+				workspaceFrom: req.prodWorkspaceId,
+				workspaceTo: req.devWorkspaceId,
+				onBehalfOf: chosenIdentity?.email,
+				onBehalfOfPrincipal: chosenIdentity?.permissionedAs,
+				createOnly: true
+			})
+			if (deployed.conflict) {
+				// Landed between the probe above and the write, and `createOnly` refused rather than
+				// replacing it. Their version stands; open it, as the probe's own branch does.
+				updating = false
+				close()
+				sendUserToast(`${req.itemPath} is already in ${req.devWorkspaceName}, opening it`)
+				await leaveTo(
+					devWorkspaceEditUrl(req.itemType, req.itemPath, req.devWorkspaceId),
+					itemInDev
+				)
+				return
+			}
+			result = deployed
+		}
+		updating = false
+		if (!result.success) {
+			// Kept open so the failure is attached to the item it happened on — a lone item can
+			// fail to stand on its own (missing resource, resource type...).
+			tab?.discard()
+			sendUserToast(
+				`Could not update ${req.devWorkspaceName} with ${req.itemPath}: ${result.error}`,
+				true
+			)
+			return
+		}
+		close()
+		await leaveTo(devWorkspaceEditUrl(req.itemType, req.itemPath, req.devWorkspaceId), itemInDev)
+	}
+</script>
+
+<ConfirmationModal
+	open={!!pending}
+	type="info"
+	title="{pending?.devWorkspaceName} is behind on this item"
+	confirmationText={canDeploy ? 'Update and edit' : 'Open compare page'}
+	loading={updating}
+	keyListen={!pickerOpen}
+	confirmDisabled={confirmBlocked}
+	onConfirmed={confirm}
+	onCanceled={close}
+>
+	{#if pending}
+		<p>
+			<span class="font-mono">{pending.itemPath}</span>
+			exists in <b>{pending.prodWorkspaceId}</b> but not in its dev workspace
+			<b>{pending.devWorkspaceName}</b>.
+		</p>
+		{#if canDeploy}
+			<p class="mt-2">
+				Update <b>{pending.devWorkspaceName}</b> with it to edit it there.
+			</p>
+			{#if sourceOnBehalfOfFailed}
+				<div class="mt-2">
+					<Alert type="error" size="xs" title="Could not read {pending.itemPath}">
+						Its "run on behalf of" user is unknown, so updating could silently reassign the item to
+						you. Retry from the compare page.
+					</Alert>
+				</div>
+			{:else if targetIdentityUnknown}
+				<div class="mt-2">
+					<Alert
+						type="error"
+						size="xs"
+						title="Could not read your account in {pending.devWorkspaceName}"
+					>
+						This item needs a "run on behalf of" user and none can be applied without it. Retry from
+						the compare page.
+					</Alert>
+				</div>
+			{:else if showOnBehalfOf}
+				<div class="mt-3 flex items-center gap-2">
+					<span class="text-xs text-secondary">Runs on behalf of</span>
+					<OnBehalfOfSelector
+						targetWorkspace={pending.devWorkspaceId}
+						targetValue={undefined}
+						selected={onBehalfOfChoice}
+						onSelect={(choice, details) => {
+							onBehalfOfChoice = choice
+							if (details) customOnBehalfOf = details
+						}}
+						kind={pending.itemType}
+						canPreserve={access?.value.canPreserveOnBehalfOf ?? false}
+						customValue={customOnBehalfOf?.permissionedAs}
+						aboveConfirmationModal
+						onPickerOpenChange={(open) => (pickerOpen = open)}
+						myPermissionedAs={access?.value.me?.permissionedAs}
+					/>
+				</div>
+				{#if onBehalfOfUnset}
+					<span class="text-xs text-yellow-600">
+						You must set the "on behalf of" user before updating
+						<Tooltip class="text-yellow-600">
+							The "run on behalf of" field defines which user's permissions will be applied during
+							execution. Make sure this is set to an appropriate user before updating.
+						</Tooltip>
+					</span>
+				{/if}
+			{/if}
+		{:else if permission}
+			<div class="mt-2">
+				<Alert type="warning" size="xs" title="You can't update {pending.devWorkspaceName}">
+					{permission.reason}
+				</Alert>
+			</div>
+		{/if}
+	{/if}
+</ConfirmationModal>
diff --git a/frontend/src/lib/components/VersionListItem.svelte b/frontend/src/lib/components/VersionListItem.svelte
new file mode 100644
index 0000000000..78c56d428e
--- /dev/null
+++ b/frontend/src/lib/components/VersionListItem.svelte
@@ -0,0 +1,37 @@
+<script lang="ts">
+	import { classNames } from '$lib/utils'
+	import type { Snippet } from 'svelte'
+
+	/**
+	 * One selectable row in a version-history list. Owns only the card chrome, so the several
+	 * history drawers (script, resource, …) stay visually identical while each supplies its own
+	 * row content.
+	 *
+	 * `action` is a sibling of the select button rather than part of `children` so a row can
+	 * carry its own control (a link, a menu) without nesting one button inside another.
+	 */
+	let {
+		selected = false,
+		onclick,
+		children,
+		action
+	}: {
+		selected?: boolean
+		onclick?: () => void
+		children: Snippet
+		action?: Snippet
+	} = $props()
+</script>
+
+<div
+	class={classNames(
+		'border flex gap-1 truncate justify-between flex-row w-full items-center rounded-md',
+		selected ? 'bg-surface-selected' : '',
+		'hover:bg-surface-hover focus-within:border-border-selected'
+	)}
+>
+	<button type="button" class="flex-1 min-w-0 truncate text-left p-2 cursor-pointer" {onclick}>
+		{@render children()}
+	</button>
+	{@render action?.()}
+</div>
diff --git a/frontend/src/lib/components/WorkerRepl.svelte b/frontend/src/lib/components/WorkerRepl.svelte
index a4a3e77ce9..180da6bb98 100644
--- a/frontend/src/lib/components/WorkerRepl.svelte
+++ b/frontend/src/lib/components/WorkerRepl.svelte
@@ -105,7 +105,12 @@
 				}
 			})
 
-			let result: any = await pollJobResult(jobId, $workspaceStore!)
+			// The shell tag is the worker's name prefix, which its shell loop pulls
+			// directly instead of advertising it in `worker_ping`, so the missing-worker
+			// check would read it as unserved.
+			let result: any = await pollJobResult(jobId, $workspaceStore!, {
+				failIfNoWorkerForTag: false
+			})
 
 			if (isOnlyCdCommand) {
 				working_directory = (result as string).replace(/(\r\n|\n|\r)/g, '')
@@ -365,9 +370,10 @@
 					>
 						Full path
 
-						<Tooltip
-							class="absolute top-0.5"
-						>Commands run in the default directory. Run a standalone ‘cd’ to change it. Chained or invalid ‘cd’ commands won’t apply.</Tooltip>
+						<Tooltip class="absolute top-0.5"
+							>Commands run in the default directory. Run a standalone ‘cd’ to change it. Chained or
+							invalid ‘cd’ commands won’t apply.</Tooltip
+						>
 					</Badge>
 				</div>
 				<input type="text" disabled bind:value={working_directory} />
diff --git a/frontend/src/lib/components/WorkspaceDeployLayout.svelte b/frontend/src/lib/components/WorkspaceDeployLayout.svelte
index 52ce309e9e..66beb18b73 100644
--- a/frontend/src/lib/components/WorkspaceDeployLayout.svelte
+++ b/frontend/src/lib/components/WorkspaceDeployLayout.svelte
@@ -85,7 +85,10 @@
 	}: Props = $props()
 
 	let selectableItems = $derived(items.filter(selectablePredicate))
-	let hasSelectableItems = $derived(selectableItems.length > 0)
+	// "Select all" is a bulk action, so it lives or dies by the bulk-selectable set:
+	// a list of nothing but bulk-excluded rows would otherwise offer an enabled
+	// control that selects nothing. Each such row is still selectable on its own.
+	let hasSelectableItems = $derived(selectableItems.some((i) => !bulkExcluded(i)))
 
 	// Plain row click and the checkbox both toggle this row in/out — multi-select
 	// is the default, no modifier needed.
@@ -195,6 +198,13 @@
 					{#if showGroupHeaders}
 						{@const selectable = groupSelectable(group)}
 						{@const selectedCount = selectable.filter((i) => selectedItems.includes(i.key)).length}
+						<!-- The label counts every ticked row, bulk-excluded ones included: those
+						     are deployed like any other, and reporting only the bulk-selectable
+						     ones would contradict the deploy button. The checkbox above keeps its
+						     own count, which must ignore them to reach a full-checked state. -->
+						{@const selectedInGroup = group.items.filter((i) =>
+							selectedItems.includes(i.key)
+						).length}
 						<!-- The disabled-state hint lives on the row: a disabled Checkbox is
 						     pointer-events-none, so a title on the input would never show. -->
 						<div
@@ -219,8 +229,8 @@
 							{/if}
 							<span class="text-xs font-semibold text-secondary truncate">{group.label}</span>
 							<span class="text-2xs text-tertiary whitespace-nowrap">
-								{group.items.length} item{group.items.length !== 1 ? 's' : ''}{selectedCount > 0
-									? ` · ${selectedCount} selected`
+								{group.items.length} item{group.items.length !== 1 ? 's' : ''}{selectedInGroup > 0
+									? ` · ${selectedInGroup} selected`
 									: ''}
 							</span>
 							{#if groupActions}
diff --git a/frontend/src/lib/components/WorkspaceDraftsBanner.svelte b/frontend/src/lib/components/WorkspaceDraftsBanner.svelte
index 074cefee3a..2e0110f710 100644
--- a/frontend/src/lib/components/WorkspaceDraftsBanner.svelte
+++ b/frontend/src/lib/components/WorkspaceDraftsBanner.svelte
@@ -33,9 +33,9 @@
 	     stays aligned with it instead of bleeding to the viewport edges. -->
 	<div class="w-full text-xs max-w-7xl mx-auto px-4 sm:px-8 pt-2">
 		<div class="bg-blue-50 dark:bg-blue-900 rounded-md px-4 py-2">
-			<div class="flex items-center justify-between">
-				<div class="flex items-center gap-3">
-					<Pencil class="w-4 h-4 text-accent" />
+			<div class="flex flex-wrap items-center justify-between gap-x-3 gap-y-2">
+				<div class="flex items-center gap-3 min-w-0">
+					<Pencil class="w-4 h-4 text-accent shrink-0" />
 					<span class="text-xs font-medium text-blue-900 dark:text-blue-100">
 						This workspace has {draftCount} draft{draftCount !== 1 ? 's' : ''}
 					</span>
diff --git a/frontend/src/lib/components/apps/components/display/dbtable/AppDbExplorer.svelte b/frontend/src/lib/components/apps/components/display/dbtable/AppDbExplorer.svelte
index 8e068274b8..2696e0912c 100644
--- a/frontend/src/lib/components/apps/components/display/dbtable/AppDbExplorer.svelte
+++ b/frontend/src/lib/components/apps/components/display/dbtable/AppDbExplorer.svelte
@@ -399,7 +399,13 @@
 			resolvedConfig.type.configuration[selected].table
 		)
 
-		if (!tableMetadata) return
+		if (!tableMetadata) {
+			//@ts-ignore
+			gridItem.data.configuration.columnDefs.loading = false
+			gridItem.data = gridItem.data
+			$app = $app
+			return
+		}
 
 		let old: TableMetadata = (columnDefs?.value as TableMetadata) ?? []
 		if (!Array.isArray(old)) {
diff --git a/frontend/src/lib/components/apps/components/display/dbtable/duckdbQuicksearchColumns.test.ts b/frontend/src/lib/components/apps/components/display/dbtable/duckdbQuicksearchColumns.test.ts
new file mode 100644
index 0000000000..9b26c3dcb8
--- /dev/null
+++ b/frontend/src/lib/components/apps/components/display/dbtable/duckdbQuicksearchColumns.test.ts
@@ -0,0 +1,35 @@
+import { describe, expect, it } from 'vitest'
+import { buildVisibleFieldList, duckdbQuicksearchColumns, type ColumnDef } from './utils'
+
+function col(field: string, datatype: string, extra: Partial<ColumnDef> = {}): ColumnDef {
+	return { field, datatype, ...extra } as ColumnDef
+}
+
+describe('duckdbQuicksearchColumns', () => {
+	it('casts list and array columns, and nothing else', () => {
+		expect(
+			duckdbQuicksearchColumns([
+				col('id', 'VARCHAR'),
+				col('tags', 'VARCHAR[]'),
+				col('pos', 'INTEGER[3]'),
+				col('meta', 'STRUCT(a INTEGER)')
+			])
+		).toBe('"id", CAST("tags" AS VARCHAR), CAST("pos" AS VARCHAR), "meta"')
+	})
+
+	// This byte-identity is what keeps the policy digest of an already-deployed
+	// Database Studio app valid; a table with no list column must produce the
+	// query it produced before quicksearch learned to cast anything.
+	it('emits the plain column list when no column is a list', () => {
+		const columnDefs = [col('id', 'VARCHAR'), col('n', 'INTEGER'), col('at', 'TIMESTAMP')]
+		expect(duckdbQuicksearchColumns(columnDefs)).toBe(
+			buildVisibleFieldList(columnDefs, 'duckdb').join(', ')
+		)
+	})
+
+	it('skips ignored columns', () => {
+		expect(
+			duckdbQuicksearchColumns([col('id', 'VARCHAR'), col('tags', 'VARCHAR[]', { ignored: true })])
+		).toBe('"id"')
+	})
+})
diff --git a/frontend/src/lib/components/apps/components/display/dbtable/metadata.ts b/frontend/src/lib/components/apps/components/display/dbtable/metadata.ts
index 1d0fa63342..d20485648d 100644
--- a/frontend/src/lib/components/apps/components/display/dbtable/metadata.ts
+++ b/frontend/src/lib/components/apps/components/display/dbtable/metadata.ts
@@ -1,5 +1,3 @@
-import { JobService } from '$lib/gen'
-
 import { runScriptAndPollResult } from '$lib/components/jobs/utils'
 import type { DbInput } from '$lib/components/dbTypes'
 import {
@@ -43,53 +41,38 @@ export async function loadTableMetaData(
 	// back to `DATABASE()`), so we don't read the resource value client-side for it.
 	const content = makeMetadataMarker('LOAD_TABLE_METADATA', { table }, ducklake)
 
-	const job = await JobService.runScriptPreview({
-		workspace,
-		requestBody: { language, content, args: dbArg }
-	})
+	try {
+		const rows = (await runScriptAndPollResult({
+			workspace,
+			requestBody: { language, content, args: dbArg }
+		})) as Record<string, any>[]
+		const result = rows.map(lowercaseKeys)
 
-	const maxRetries = 8
-	let attempts = 0
-	while (attempts < maxRetries) {
-		try {
-			await new Promise((resolve) => setTimeout(resolve, 1000 * (attempts || 0.6)))
-
-			const testResult = (await JobService.getCompletedJob({
-				workspace,
-				id: job
-			})) as any
-
-			if (testResult.success) {
-				attempts = maxRetries
-
-				const result = testResult.result.map(lowercaseKeys)
-
-				// For Snowflake, fetch primary keys separately
-				if (
-					input.type === 'database' &&
-					(input.resourceType === 'snowflake' || (input.resourceType as any) === 'snowflake_oauth')
-				) {
-					const map: Record<string, TableMetadata> = { [table]: result }
-					await fetchAndAddSnowflakePrimaryKeysInMap(map, input, workspace, table)
-					return map[table]
-				}
-
-				return result
-			} else {
-				attempts++
-			}
-		} catch (error) {
-			attempts++
+		// For Snowflake, fetch primary keys separately
+		if (
+			input.type === 'database' &&
+			(input.resourceType === 'snowflake' || (input.resourceType as any) === 'snowflake_oauth')
+		) {
+			const map: Record<string, TableMetadata> = { [table]: result }
+			await fetchAndAddSnowflakePrimaryKeysInMap(map, input, workspace, table)
+			return map[table]
 		}
-	}
 
-	console.error('Failed to load table metadata after maximum retries.')
-	return undefined
+		return result
+	} catch (e) {
+		console.error('Failed to load table metadata', e)
+		sendUserToast('Error loading table metadata: ' + ((e as Error)?.message || e), true)
+		return undefined
+	}
 }
 
+/** Throws on failure without reporting it: every caller renders the error in its
+ * own pane, so toasting here would double-report it. */
 export async function loadAllTablesMetaData(
 	workspace: string | undefined,
-	input: DbInput
+	input: DbInput,
+	// Overrides the language's native worker tag.
+	tag?: string
 ): Promise<Record<string, TableMetadata> | undefined> {
 	if (!input || !workspace) return undefined
 
@@ -105,7 +88,7 @@ export async function loadAllTablesMetaData(
 
 		let result = (await runScriptAndPollResult({
 			workspace,
-			requestBody: { language, content, args: dbArg }
+			requestBody: { language, content, args: dbArg, tag }
 		})) as ({ table_name: string; schema_name?: string } & object)[]
 		const map: Record<string, TableMetadata> = {}
 
@@ -116,11 +99,11 @@ export async function loadAllTablesMetaData(
 			map[tableKey].push(col)
 		}
 
-		await fetchAndAddSnowflakePrimaryKeysInMap(map, input, workspace)
+		await fetchAndAddSnowflakePrimaryKeysInMap(map, input, workspace, undefined, tag)
 
 		return map
 	} catch (e) {
-		sendUserToast('Error loading tables metadata: ' + e, 'error')
+		console.error('Failed to load tables metadata', e)
 		throw e
 	}
 }
@@ -137,13 +120,14 @@ async function fetchAndAddSnowflakePrimaryKeysInMap(
 	map: Record<string, TableMetadata>,
 	input: DbInput,
 	workspace: string,
-	tableKey?: string
+	tableKey?: string,
+	tag?: string
 ) {
 	if (
 		input.type == 'database' &&
 		(input.resourceType === 'snowflake' || (input.resourceType as any) === 'snowflake_oauth')
 	) {
-		let pkResult = await fetchSnowflakePrimaryKeys(workspace, getDatabaseArg(input), tableKey)
+		let pkResult = await fetchSnowflakePrimaryKeys(workspace, getDatabaseArg(input), tableKey, tag)
 		for (const pk of pkResult) {
 			const pkTableKey = `${pk.schema_name}.${pk.table_name}`.toUpperCase()
 			// Also check the original casing and the provided tableKey
@@ -166,17 +150,19 @@ async function fetchAndAddSnowflakePrimaryKeysInMap(
 async function fetchSnowflakePrimaryKeys(
 	workspace: string,
 	dbArg: any,
-	tableKey?: string
+	tableKey?: string,
+	tag?: string
 ): Promise<SnowflakeShowPrimaryKeysResult[]> {
 	const payload: Record<string, unknown> = {}
 	if (tableKey) payload.table = tableKey
 	const content = makeMetadataMarker('SNOWFLAKE_PRIMARY_KEYS', payload, undefined)
-	return (await JobService.runScriptPreviewAndWaitResult({
+	return (await runScriptAndPollResult({
 		workspace,
 		requestBody: {
 			language: 'snowflake',
 			args: dbArg,
-			content
+			content,
+			tag
 		}
 	})) as SnowflakeShowPrimaryKeysResult[]
 }
@@ -206,7 +192,7 @@ export async function getDbSchemas(
 
 	let result: unknown
 	try {
-		result = await JobService.runScriptPreviewAndWaitResult({
+		result = await runScriptAndPollResult({
 			workspace,
 			requestBody: {
 				language: sqlScript.lang as Preview['language'],
diff --git a/frontend/src/lib/components/apps/components/display/dbtable/queries/count.ts b/frontend/src/lib/components/apps/components/display/dbtable/queries/count.ts
index dc422f48e6..b93a1d669d 100644
--- a/frontend/src/lib/components/apps/components/display/dbtable/queries/count.ts
+++ b/frontend/src/lib/components/apps/components/display/dbtable/queries/count.ts
@@ -11,7 +11,12 @@ import type { AppInput, RunnableByName } from '$lib/components/apps/inputType'
 import { wrapDucklakeQuery } from '../../../../../ducklake'
 import type { DbType, DbInput } from '$lib/components/dbTypes'
 import { buildParameters } from '../utils'
-import { getLanguageByResourceType, type ColumnDef, buildVisibleFieldList } from '../utils'
+import {
+	getLanguageByResourceType,
+	type ColumnDef,
+	buildVisibleFieldList,
+	duckdbQuicksearchColumns
+} from '../utils'
 
 export function makeCountQuery(
 	dbType: DbType,
@@ -118,8 +123,8 @@ export function makeCountQuery(
 		}
 		case 'duckdb':
 			if (filteredColumns.length > 0) {
-				quicksearchCondition += ` ($quicksearch = '' OR CONCAT(' ', ${filteredColumns.join(
-					', '
+				quicksearchCondition += ` ($quicksearch = '' OR CONCAT(' ', ${duckdbQuicksearchColumns(
+					columnDefs
 				)}) LIKE CONCAT('%', $quicksearch, '%'))`
 			} else {
 				quicksearchCondition += ` ($quicksearch = '' OR 1 = 1)`
diff --git a/frontend/src/lib/components/apps/components/display/dbtable/queries/select.ts b/frontend/src/lib/components/apps/components/display/dbtable/queries/select.ts
index 737dfdc329..be01457434 100644
--- a/frontend/src/lib/components/apps/components/display/dbtable/queries/select.ts
+++ b/frontend/src/lib/components/apps/components/display/dbtable/queries/select.ts
@@ -11,7 +11,12 @@ import type { AppInput, RunnableByName } from '$lib/components/apps/inputType'
 import { wrapDucklakeQuery } from '../../../../../ducklake'
 import type { DbType, DbInput } from '$lib/components/dbTypes'
 import { buildParameters } from '../utils'
-import { getLanguageByResourceType, type ColumnDef, buildVisibleFieldList } from '../utils'
+import {
+	getLanguageByResourceType,
+	type ColumnDef,
+	buildVisibleFieldList,
+	duckdbQuicksearchColumns
+} from '../utils'
 
 function makeSnowflakeSelectQuery(
 	table: string,
@@ -298,8 +303,8 @@ CASE WHEN :order_by = '${column.field}' AND :is_desc IS true THEN \`${column.fie
 				)
 				.join(',\n')}`
 
-			quicksearchCondition = `($quicksearch = '' OR CONCAT(${filteredColumns.join(
-				', '
+			quicksearchCondition = `($quicksearch = '' OR CONCAT(${duckdbQuicksearchColumns(
+				columnDefs
 			)}) ILIKE '%' || $quicksearch || '%')`
 
 			query += `SELECT ${filteredColumns.join(', ')} FROM ${table}\n`
diff --git a/frontend/src/lib/components/apps/components/display/dbtable/utils.ts b/frontend/src/lib/components/apps/components/display/dbtable/utils.ts
index 3304bbdf0b..bf81ec07bb 100644
--- a/frontend/src/lib/components/apps/components/display/dbtable/utils.ts
+++ b/frontend/src/lib/components/apps/components/display/dbtable/utils.ts
@@ -305,11 +305,32 @@ export async function formatGraphqlSchema(schema: IntrospectionQuery): Promise<s
 	return printSchema(buildClientSchema(schema))
 }
 
+// Filter out hidden columns to avoid counting the wrong number of rows
+function visibleColumnDefs(columnDefs: ColumnDef[]): ColumnDef[] {
+	return columnDefs.filter((columnDef: ColumnDef) => columnDef && columnDef.ignored !== true)
+}
+
 export function buildVisibleFieldList(columnDefs: ColumnDef[], dbType: DbType) {
-	// Filter out hidden columns to avoid counting the wrong number of rows
-	return columnDefs
-		.filter((columnDef: ColumnDef) => columnDef && columnDef.ignored !== true)
-		.map((column) => renderDbQuotedIdentifier(column?.field, dbType))
+	return visibleColumnDefs(columnDefs).map((column) =>
+		renderDbQuotedIdentifier(column?.field, dbType)
+	)
+}
+
+/**
+ * DuckDB's `concat` doubles as list concatenation, so a LIST or ARRAY beside a
+ * VARCHAR is a binder error rather than an implicit cast, and quicksearch
+ * concatenates every visible column, so one of them makes the table
+ * unpreviewable. Everything else concatenates as text and stays uncast: this
+ * query is digested into the policy of every deployed Database Studio app, and
+ * a changed string invalidates it until the app is redeployed.
+ */
+export function duckdbQuicksearchColumns(columnDefs: ColumnDef[]): string {
+	return visibleColumnDefs(columnDefs)
+		.map((column) => {
+			const quoted = renderDbQuotedIdentifier(column?.field, 'duckdb')
+			return column?.datatype?.trimEnd().endsWith(']') ? `CAST(${quoted} AS VARCHAR)` : quoted
+		})
+		.join(', ')
 }
 
 export function renderDbQuotedIdentifier(identifier: string, dbType: DbType): string {
diff --git a/frontend/src/lib/components/apps/editor/AppDeploymentHistory.svelte b/frontend/src/lib/components/apps/editor/AppDeploymentHistory.svelte
index 6e73f97c19..7a508aac71 100644
--- a/frontend/src/lib/components/apps/editor/AppDeploymentHistory.svelte
+++ b/frontend/src/lib/components/apps/editor/AppDeploymentHistory.svelte
@@ -3,6 +3,7 @@
 	import { AppService } from '$lib/gen'
 	import { workspaceStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
+	import { deployRawAppValue } from '$lib/rawAppDeploy'
 	import DeploymentHistory from './DeploymentHistory.svelte'
 
 	interface Props {
@@ -17,13 +18,29 @@
 	}
 
 	async function updateApp(app: any) {
-		await AppService.updateApp({
-			workspace: $workspaceStore!,
-			path: app.path,
-			requestBody: {
-				...app
-			}
-		})
+		if (app.raw_app) {
+			// A raw version restores through the raw endpoint, which rebuilds its
+			// bundle. `allowKindChange` so the last version from before a conversion
+			// restores the app as raw — the way to undo one. The low-code direction
+			// stays refused: it has no bundle to write.
+			await deployRawAppValue({
+				workspace: $workspaceStore!,
+				path: app.path,
+				value: app.value,
+				summary: app.summary,
+				policy: app.policy,
+				customPath: app.custom_path,
+				allowKindChange: true
+			})
+		} else {
+			await AppService.updateApp({
+				workspace: $workspaceStore!,
+				path: app.path,
+				requestBody: {
+					...app
+				}
+			})
+		}
 
 		historyBrowserDrawerOpen = false
 	}
@@ -32,9 +49,13 @@
 <Drawer bind:open={historyBrowserDrawerOpen} size="1200px">
 	<DrawerContent title="Deployment History" on:close={() => (historyBrowserDrawerOpen = false)}>
 		<DeploymentHistory
-			on:restore={(e) => {
-				sendUserToast('App restored from previous deployment')
-				updateApp(e.detail)
+			on:restore={async (e) => {
+				try {
+					await updateApp(e.detail)
+					sendUserToast('App restored from previous deployment')
+				} catch (err: any) {
+					sendUserToast(`Could not restore app: ${err.body ?? err.message}`, true)
+				}
 			}}
 			{appPath}
 			on:close={() => {
diff --git a/frontend/src/lib/components/apps/editor/AppEditorHeader.svelte b/frontend/src/lib/components/apps/editor/AppEditorHeader.svelte
index 0871833613..a57dc87622 100644
--- a/frontend/src/lib/components/apps/editor/AppEditorHeader.svelte
+++ b/frontend/src/lib/components/apps/editor/AppEditorHeader.svelte
@@ -79,7 +79,7 @@
 	import AppEditorHeaderDeploy from './AppEditorHeaderDeploy.svelte'
 	import { computeSecretUrl } from './appDeploy.svelte'
 	import { updatePolicy } from './appPolicy'
-	import { buildForkEditUrl, editInForkAllowed, editInForkLabel } from '$lib/utils/editInFork'
+	import { editInForkAllowed, editInForkLabel, openEditInFork } from '$lib/utils/editInFork'
 	import { isCloudHosted } from '$lib/cloud'
 
 	interface Props {
@@ -465,6 +465,28 @@
 		}
 	}
 
+	/** Flush the pending autosave (also covers the toggle-off parked case).
+	 * Returns whether there was a draft to flush — false in the AI session pane,
+	 * which owns no handle. */
+	function flushDraft(): boolean {
+		if (inSessionPane || !$workspaceStore || !userDraftPath) return false
+		void UserDraftDbSyncer.flush({
+			workspace: $workspaceStore,
+			itemKind: 'app',
+			path: userDraftPath
+		})
+		return true
+	}
+
+	// Monaco swallows the keydown, so an inline script or template editor with
+	// focus never reaches the window handler below; Editor/SimpleEditor/
+	// TemplateEditor re-broadcast it (untyped event, hence the manual listener).
+	$effect(() => {
+		const onMonacoSave = () => void flushDraft()
+		window.addEventListener('wm-monaco-save-shortcut', onMonacoSave)
+		return () => window.removeEventListener('wm-monaco-save-shortcut', onMonacoSave)
+	})
+
 	let lock = false
 	function onKeyDown(event: KeyboardEvent) {
 		if (lock) return
@@ -492,17 +514,12 @@
 				}
 				break
 			case 's':
-				if (event.ctrlKey || event.metaKey) {
+				// Shift excluded: the switch lowercases so Ctrl+Shift+S lands here
+				// too, and swallowing it would steal the browser/OS shortcut.
+				// Swallowed only when there is a draft to flush, so the contexts
+				// that can't act on it (AI session pane) leave the key alone.
+				if ((event.ctrlKey || event.metaKey) && !event.shiftKey && flushDraft()) {
 					event.preventDefault()
-					// Flush the pending autosave (also covers the toggle-off parked
-					// case); no-op in the AI session pane (no handle there).
-					if (!inSessionPane && $workspaceStore && userDraftPath) {
-						void UserDraftDbSyncer.flush({
-							workspace: $workspaceStore,
-							itemKind: 'app',
-							path: userDraftPath
-						})
-					}
 				}
 				break
 			// case 'ArrowDown': {
@@ -1142,7 +1159,7 @@
 									{
 										label: editInForkLabel($workspaceStore, $userWorkspaces),
 										onClick: () => {
-											window.open(buildForkEditUrl('app', $appPath))
+											openEditInFork('app', $appPath, $workspaceStore)
 										}
 									}
 								]
diff --git a/frontend/src/lib/components/apps/editor/AppEditorHeaderDeploy.svelte b/frontend/src/lib/components/apps/editor/AppEditorHeaderDeploy.svelte
index 880c24810d..f673711159 100644
--- a/frontend/src/lib/components/apps/editor/AppEditorHeaderDeploy.svelte
+++ b/frontend/src/lib/components/apps/editor/AppEditorHeaderDeploy.svelte
@@ -21,6 +21,7 @@
 		type OnBehalfOfChoice
 	} from '$lib/components/OnBehalfOfSelector.svelte'
 	import { canUserBypassRuleKind, protectionRulesState } from '$lib/workspaceProtectionRules.svelte'
+	import { FRONTEND_SDK_SCOPES } from '$lib/components/raw_apps/sdkScopes'
 
 	const WM_DEPLOYERS_GROUP = 'wm_deployers'
 
@@ -299,6 +300,12 @@
 		checked={policy.sandbox == true}
 		on:change={(e) => {
 			policy.sandbox = e.detail || undefined
+			// Frontend API access exists only for a sandboxed app, so turning
+			// isolation off drops the declared scopes with it rather than leaving
+			// them set but inert.
+			if (!e.detail) {
+				policy.frontend_sdk_scopes = undefined
+			}
 			// A not-yet-deployed app has no row to PATCH — `setPublishState` (POST
 			// /apps/update) would 404. The flag rides along in the `policy` the first
 			// deploy sends (createApp), so here we only mutate it locally. Persist
@@ -329,6 +336,58 @@
 	{/if}
 </div>
 
+{#if rawApp && policy.sandbox == true}
+	<h2 class="text-xs font-semibold">Frontend API access</h2>
+	<div class="mb-6 mt-2">
+		<div class="text-xs text-secondary mb-3">
+			Let the app's frontend code call the Windmill API through the <code>windmill-client</code>
+			SDK, authenticated as <b>the viewer</b> (unlike runnables, which run on behalf of the
+			publisher). Each viewer is asked to approve the scopes below before the app runs. Grant only
+			what the app needs: its code — or an XSS bug in it — can use them as that viewer. Add
+			<code>windmill-client</code> to the app's dependencies to import it; it configures itself from
+			the token handed to the bundle.
+		</div>
+		{#each FRONTEND_SDK_SCOPES as scope (scope.value)}
+			<div class="mb-2">
+				<Toggle
+					size="xs"
+					options={{ right: scope.label }}
+					checked={policy.frontend_sdk_scopes?.includes(scope.value) ?? false}
+					on:change={(e) => {
+						const current: string[] = policy.frontend_sdk_scopes ?? []
+						const next = e.detail
+							? [...current, scope.value]
+							: current.filter((s) => s !== scope.value)
+						// Keep the curated order so the consent banner and the stored
+						// consent compare stably across deploys.
+						const ordered = FRONTEND_SDK_SCOPES.map((s) => s.value).filter((s) => next.includes(s))
+						policy.frontend_sdk_scopes = ordered.length > 0 ? ordered : undefined
+						// Same as sandbox: a not-yet-deployed app has no row to PATCH, so the
+						// scopes ride along in the first deploy's policy instead.
+						if (savedApp && !newApp) {
+							setPublishState('Frontend API access updated')
+						}
+					}}
+					disabled={!savedApp}
+				/>
+				<div class="text-xs text-hint ml-9">{scope.description}</div>
+			</div>
+		{/each}
+		{#if newApp}
+			<div class="text-xs text-tertiary mt-1">Takes effect when you first deploy this app.</div>
+		{/if}
+		{#if policy.frontend_sdk_scopes?.length}
+			<div class="mt-2">
+				<Alert type="info" title="Redeploy to use the SDK from a sandboxed app" size="xs">
+					A sandboxed app calls the API cross-origin, which older <code>windmill-client</code> versions
+					cannot do. An app bundled before this Windmill version fails with a CORS error until you deploy
+					it again, which re-bundles it against a current client.
+				</Alert>
+			</div>
+		{/if}
+	</div>
+{/if}
+
 {#if !hideSecretUrl}
 	<h2>Public URL</h2>
 
diff --git a/frontend/src/lib/components/apps/editor/AppJsonEditor.svelte b/frontend/src/lib/components/apps/editor/AppJsonEditor.svelte
index 1e44b147f3..e60a149cfa 100644
--- a/frontend/src/lib/components/apps/editor/AppJsonEditor.svelte
+++ b/frontend/src/lib/components/apps/editor/AppJsonEditor.svelte
@@ -11,6 +11,7 @@
 	import { userStore, workspaceStore } from '$lib/stores'
 	import { createEventDispatcher } from 'svelte'
 	import { Globe, Loader2, Save } from 'lucide-svelte'
+	import { deployRawAppValue } from '$lib/rawAppDeploy'
 
 	let jsonViewerDrawer: Drawer | undefined = $state()
 
@@ -50,7 +51,17 @@
 		loading = false
 	}
 
+	// The button drops a rejection, so failures — invalid JSON, a raw app whose
+	// sources don't bundle — have to surface here or Deploy looks like a no-op.
 	export async function saveApp() {
+		try {
+			await deploy()
+		} catch (err: any) {
+			sendUserToast(`Could not save app: ${err.body ?? err.message}`, true)
+		}
+	}
+
+	async function deploy() {
 		const parsed = JSON.parse(code)
 		if (isDraftOnly) {
 			// No deployed row — `updateApp` would 404. Route through the syncer
@@ -65,6 +76,19 @@
 			})
 			dispatch('change')
 			sendUserToast('Draft saved')
+		} else if (isRawApp) {
+			// A raw app's value holds its sources, so deploying it means re-bundling.
+			await deployRawAppValue({
+				workspace: $workspaceStore!,
+				path,
+				value: parsed,
+				summary: app?.summary,
+				policy: app?.policy,
+				customPath: app?.custom_path
+			})
+			dispatch('change')
+			UserDraft.remove('raw_app', path)
+			sendUserToast('App deployed')
 		} else {
 			await AppService.updateApp({
 				workspace: $workspaceStore!,
diff --git a/frontend/src/lib/components/apps/editor/InWorkspaceAppViewer.svelte b/frontend/src/lib/components/apps/editor/InWorkspaceAppViewer.svelte
index cd50455a18..d5839c6766 100644
--- a/frontend/src/lib/components/apps/editor/InWorkspaceAppViewer.svelte
+++ b/frontend/src/lib/components/apps/editor/InWorkspaceAppViewer.svelte
@@ -50,12 +50,13 @@
 	const hideRefreshBar = page.url.searchParams.get('hideRefreshBar') === 'true'
 
 	// Embedder side: mint a scoped embed token (by path) from the member's session.
-	async function fetchEmbedToken(): Promise<{ token?: string }> {
+	async function fetchEmbedToken(opts?: { sdkConsent?: boolean }): Promise<{ token?: string }> {
 		const headers: Record<string, string> = {}
 		if (typeof OpenAPI.TOKEN === 'string' && OpenAPI.TOKEN) {
 			headers['Authorization'] = `Bearer ${OpenAPI.TOKEN}`
 		}
-		const res = await fetch(`${OpenAPI.BASE}/w/${workspace}/apps/embed_token/p/${path}`, {
+		const consent = opts?.sdkConsent ? '?sdk_consent=true' : ''
+		const res = await fetch(`${OpenAPI.BASE}/w/${workspace}/apps/embed_token/p/${path}${consent}`, {
 			headers
 		})
 		if (!res.ok) {
diff --git a/frontend/src/lib/components/apps/editor/PublicAppFrame.svelte b/frontend/src/lib/components/apps/editor/PublicAppFrame.svelte
index 43dc937651..3ba1bac617 100644
--- a/frontend/src/lib/components/apps/editor/PublicAppFrame.svelte
+++ b/frontend/src/lib/components/apps/editor/PublicAppFrame.svelte
@@ -32,6 +32,8 @@
 	import Login from '$lib/components/Login.svelte'
 	import { WINDMILL_RESERVED_QUERY_PARAMS } from '$lib/utils'
 	import { EMBED_NAV_CONTEXT_KEY, type EmbedNav } from '../types'
+	import RawAppSdkConsent from '$lib/components/raw_apps/RawAppSdkConsent.svelte'
+	import { hasStoredSdkConsent, storeSdkConsent } from '$lib/components/raw_apps/sdkScopes'
 
 	type EmbedToken = {
 		token?: string | null
@@ -39,6 +41,8 @@
 		sandbox?: boolean
 		app_path?: string | null
 		workspace_id?: string | null
+		sdk_scopes?: string[] | null
+		viewer_email?: string | null
 	}
 
 	let {
@@ -48,8 +52,10 @@
 		viewerUrl
 	}: {
 		/** Embedder-side: validate access + mint the scoped token. Throws with a
-		 * `.status` of 401 (login required) or 404 (not found). */
-		fetchEmbedToken: () => Promise<EmbedToken>
+		 * `.status` of 401 (login required) or 404 (not found). Pass
+		 * `sdkConsent` once the viewer accepted the frontend-SDK permission
+		 * banner — only then does the backend mint the raw-app SDK token. */
+		fetchEmbedToken: (opts?: { sdkConsent?: boolean }) => Promise<EmbedToken>
 		/** Viewer-side: fired (once per received token) when the embed token is
 		 * available, before the app renders. Use it to kick off data loading.
 		 * `requestTokenRefresh` asks the embedder for a fresh token on a 401. */
@@ -188,10 +194,28 @@
 	}
 
 	// ---------------------------- embedder mode ----------------------------
-	let status: 'loading' | 'ready' | 'noPermission' | 'notExists' = $state('loading')
+	let status: 'loading' | 'ready' | 'noPermission' | 'notExists' | 'sdkPrompt' = $state('loading')
 	let embedToken: string | null = $state(null)
 	let iframeEl: HTMLIFrameElement | undefined = $state(undefined)
 
+	// Raw-app frontend SDK (viewer-permissioned windmill-client): the scopes the
+	// app policy declares, and the viewer-identity token minted after consent.
+	// RawAppPreview reads the token via context and exposes it to the bundle as
+	// `window.process.env` so a bundled `windmill-client` auto-configures.
+	let sdkScopes: string[] | undefined = $state(undefined)
+	let sdkToken: string | undefined = $state(undefined)
+	// The viewer's own email (from the embed-token response), used to key the
+	// stored "do not ask again" per person on this shared browser origin.
+	let viewerEmail = $state('')
+	// Set once the viewer declined, or a mint failed for a reason other than lost
+	// access: from then on the app renders credential-less without asking again.
+	let sdkTokenless = false
+	// See `mintWithConsent`: every render-mode change restarts initialization, but
+	// a bounded number of times so an app being redeployed continuously can't spin
+	// the viewer.
+	let modeChangeRestarts = 0
+	const MAX_MODE_CHANGE_RESTARTS = 3
+
 	// WIN-2006: publisher opted this app into sandbox isolation (alpha). When false
 	// (the default) the app runs same-origin with the viewer's full session — the
 	// pre-isolation behavior.
@@ -224,6 +248,14 @@
 		}
 	})
 
+	// Read by RawAppPreview: the consented viewer-scoped SDK token to expose to
+	// the bundle, sandboxed or not.
+	setContext('RAW_APP_SDK_TOKEN', {
+		get value() {
+			return sdkToken
+		}
+	})
+
 	function buildViewerUrl(): string {
 		// Default: embed the current route. The in-workspace viewer overrides this
 		// with a dedicated cookieless, chrome-less viewer route (`/app_embed`).
@@ -243,22 +275,121 @@
 			isRaw = resp.raw_app ?? false
 			appPath = resp.app_path ?? undefined
 			workspaceId = resp.workspace_id ?? undefined
-			status = 'ready'
-
-			if (unsandboxed || isRaw) {
-				// Render the app directly on this origin: same-origin when unsandboxed
-				// (the default), or a single opaque bundle iframe when it's a sandboxed
-				// raw app.
-				onViewerReady?.(undefined, requestTokenRefresh)
-			} else {
-				// Sandboxed low-code: hand the scoped token to the opaque viewer iframe.
-				postTokenToIframe()
+			// The backend only advertises scopes where a token could actually be
+			// minted (a raw app, viewer authenticated), and mints one only on the
+			// follow-up request carrying the viewer's consent.
+			sdkScopes = resp.sdk_scopes?.length ? resp.sdk_scopes : undefined
+			viewerEmail = resp.viewer_email ?? ''
+			sdkToken = undefined
+			if (sdkScopes && !sdkTokenless) {
+				if (!hasStoredSdkConsent(viewerEmail, workspaceId ?? '', appPath ?? '', sdkScopes)) {
+					// Ask before the app's code runs: the token is the bundle's only
+					// direct API access, so the answer decides that whole surface.
+					status = 'sdkPrompt'
+					return
+				}
+				await mintWithConsent()
+				return
 			}
+			finishReady()
 		} catch (e: any) {
 			status = e?.status === 401 ? 'noPermission' : 'notExists'
 		}
 	}
 
+	/** Re-request the token with consent. The token is optional (see "Open without
+	 * granting"), so any failure other than lost access still renders the app
+	 * credential-less — a scope-restricted viewer (external-JWT share link) would
+	 * otherwise never see it. Returns whether a token was obtained. */
+	async function mintWithConsent(): Promise<boolean> {
+		const approved = sdkScopes ?? []
+		const wasRaw = isRaw
+		const wasSandboxed = sandboxed
+		try {
+			const resp = await fetchEmbedToken({ sdkConsent: true })
+			// A redeploy during the prompt changes what `token` means (SDK token when
+			// raw, embed token when sandboxed low-code), so rendering from the first
+			// response's mode would bypass new isolation or leave the viewer
+			// unauthenticated. Start over; bounded so redeploys can't bounce forever.
+			const modeChanged =
+				(resp.raw_app ?? false) !== wasRaw || (resp.sandbox ?? false) !== wasSandboxed
+			if (modeChanged) {
+				if (modeChangeRestarts < MAX_MODE_CHANGE_RESTARTS) {
+					modeChangeRestarts++
+					await initEmbedder()
+					return false
+				}
+				// Out of restarts: render nothing rather than route a token meant for
+				// another mode (a low-code embed token into `sdkToken`, say).
+				status = 'notExists'
+				return false
+			}
+			sandboxed = resp.sandbox ?? false
+			isRaw = resp.raw_app ?? false
+			appPath = resp.app_path ?? appPath
+			workspaceId = resp.workspace_id ?? workspaceId
+			const granted = resp.sdk_scopes ?? []
+			if (!granted.every((s) => approved.includes(s))) {
+				// The app was redeployed with more scopes between the prompt and the
+				// mint. Never inject a token carrying scopes the viewer wasn't shown:
+				// drop it and ask again with the new set.
+				sdkScopes = granted
+				sdkToken = undefined
+				status = 'sdkPrompt'
+				return false
+			}
+			sdkToken = resp.token ?? undefined
+		} catch (e: any) {
+			if (e?.status === 401) {
+				status = 'noPermission'
+				return false
+			}
+			console.warn('Failed to mint the raw app frontend SDK token', e)
+			// The failed request left us no fresh view of how the app must render, and
+			// the first response's mode may already be stale (a redeploy can have
+			// enabled sandbox isolation while the prompt was open). Re-init for current
+			// metadata; `sdkTokenless` stops that pass from retrying the mint.
+			sdkToken = undefined
+			sdkTokenless = true
+			await initEmbedder()
+			return false
+		}
+		finishReady()
+		return sdkToken !== undefined
+	}
+
+	function finishReady() {
+		status = 'ready'
+		if (unsandboxed || isRaw) {
+			// Render the app directly on this origin: same-origin when unsandboxed
+			// (the default), or a single opaque bundle iframe when it's a sandboxed
+			// raw app.
+			onViewerReady?.(undefined, requestTokenRefresh)
+		} else {
+			// Sandboxed low-code: hand the scoped token to the opaque viewer iframe.
+			postTokenToIframe()
+		}
+	}
+
+	async function onSdkConsentContinue(dontAskAgain: boolean) {
+		status = 'loading'
+		const minted = await mintWithConsent()
+		// Only remember the choice once it actually produced a token, so a viewer
+		// whose mint fails keeps being asked instead of silently never getting one.
+		if (dontAskAgain && minted) {
+			storeSdkConsent(viewerEmail, workspaceId ?? '', appPath ?? '', sdkScopes ?? [])
+		}
+	}
+
+	/** Declined: render credential-less, never stored. Re-init first — a redeploy
+	 * during the prompt can have enabled sandboxing, and the pre-prompt mode would
+	 * put that bundle on the same-origin path. */
+	function onSdkConsentDecline() {
+		sdkToken = undefined
+		sdkTokenless = true
+		initEmbedder()
+	}
+
 	function postTokenToIframe() {
 		// The iframe is an opaque origin ("null"), which cannot be named as a
 		// targetOrigin, so we use '*'. This only relaxes the receiver-origin
@@ -390,6 +521,14 @@
 			<a href={base}>Go to Windmill</a>
 		</Alert>
 	</div>
+{:else if status === 'sdkPrompt'}
+	<!-- Raw-app frontend SDK: ask before the app's code runs, so the viewer sees
+	     what it will be able to do with their identity. -->
+	<RawAppSdkConsent
+		scopes={sdkScopes ?? []}
+		onContinue={onSdkConsentContinue}
+		onDecline={onSdkConsentDecline}
+	/>
 {:else if status === 'noPermission'}
 	<!-- Login happens here, on the embedder (main) window, so the session cookie
 	     is set on the main origin only and never reaches the opaque iframe. -->
diff --git a/frontend/src/lib/components/apps/editor/inlineScriptsPanel/EmptyInlineScript.svelte b/frontend/src/lib/components/apps/editor/inlineScriptsPanel/EmptyInlineScript.svelte
index edaefe947a..214ab3e31d 100644
--- a/frontend/src/lib/components/apps/editor/inlineScriptsPanel/EmptyInlineScript.svelte
+++ b/frontend/src/lib/components/apps/editor/inlineScriptsPanel/EmptyInlineScript.svelte
@@ -7,7 +7,7 @@
 	import { inferArgs } from '$lib/infer'
 	import { initialCode } from '$lib/script_helpers'
 	import { emptySchema } from '$lib/utils'
-	import { defaultScriptLanguages, getScriptByPath, processLangs } from '$lib/scripts'
+	import { defaultScriptLanguages, getScriptByPath, processInlineLangs } from '$lib/scripts'
 
 	import { Building, GitFork, Globe2 } from 'lucide-svelte'
 	import { createEventDispatcher } from 'svelte'
@@ -88,7 +88,7 @@
 	}
 
 	let langs = $derived(
-		processLangs(undefined, $defaultScripts?.order ?? Object.keys(defaultScriptLanguages))
+		processInlineLangs(undefined, $defaultScripts?.order ?? Object.keys(defaultScriptLanguages))
 			.map((l) => [defaultScriptLanguages[l], l])
 			.filter(
 				(x) =>
diff --git a/frontend/src/lib/components/apps/editor/settingsPanel/InputsSpecEditor.svelte b/frontend/src/lib/components/apps/editor/settingsPanel/InputsSpecEditor.svelte
index 6a6d820582..f921f4aeca 100644
--- a/frontend/src/lib/components/apps/editor/settingsPanel/InputsSpecEditor.svelte
+++ b/frontend/src/lib/components/apps/editor/settingsPanel/InputsSpecEditor.svelte
@@ -359,6 +359,7 @@
 				}}
 				readOnlyMode={false}
 				regexFilter={/\.(png|jpg|jpeg|svg|webp)$/i}
+				lazyFolders={false}
 			/>
 		{:else if componentInput?.type === 'user'}
 			<span class="text-2xs italic text-primary">Field's value is set by the user</span>
diff --git a/frontend/src/lib/components/assets/AssetGraph/AssetGraphCanvas.svelte b/frontend/src/lib/components/assets/AssetGraph/AssetGraphCanvas.svelte
index 3e5e9d8cef..27f6ce6be7 100644
--- a/frontend/src/lib/components/assets/AssetGraph/AssetGraphCanvas.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/AssetGraphCanvas.svelte
@@ -18,10 +18,15 @@
 	import PanToNode from './PanToNode.svelte'
 	import InitialFitView from './InitialFitView.svelte'
 	import { layoutAssetGraph } from './assetGraphLayout'
-	import { computeMutedReadKeys } from './resolveGraph'
+	import { computeMutedReadKeys, dbtAssociations } from './resolveGraph'
 	import { buildDownstreamMap } from './graphTraversal'
 	import { buildLineageDownstreamMap } from './boundedCascade'
-	import type { AssetGraphResponse, AssetGraphSelection, NativeTriggerKind } from './types'
+	import type {
+		AssetGraphResponse,
+		AssetGraphSelection,
+		AssetRunState,
+		NativeTriggerKind
+	} from './types'
 	import type { RunnableRunState } from './activeRunnables.svelte'
 	import type { AssetKind } from '$lib/gen'
 	import { NODE } from '$lib/components/graph/util'
@@ -179,6 +184,11 @@
 		 * When a node's nonce changes, it flashes a fading green background — its
 		 * producer just recomputed it. Driven by the replay player frame-by-frame. */
 		recomputedAssetIds?: ReadonlyMap<string, number>
+		/** What a run is currently doing to each relation, keyed `asset:<kind>:<path>`
+		 *  like every other per-asset map here.
+		 *  Distinct from `recomputedAssetIds`, which is a one-shot pulse: this is
+		 *  the state a node holds until the run moves it. */
+		assetRunStatus?: ReadonlyMap<string, AssetRunState>
 		/** Let the wheel zoom the canvas (and swallow the page scroll while doing
 		 * so). Default true for the full-height editor/player. Set false when the
 		 * canvas is embedded inline inside a scrollable container, so a wheel
@@ -215,6 +225,7 @@
 		viewportFitKey = '',
 		highlightActiveRun = false,
 		recomputedAssetIds,
+		assetRunStatus,
 		scrollZoom = true
 	}: Props = $props()
 
@@ -244,6 +255,7 @@
 			| 'data-test'
 			| 'macro'
 			| 'test-dependency'
+			| 'dbt-ref'
 		unsaved?: boolean
 		// Muted read edge: a ducklake/s3 input read every run whose (default)
 		// auto cascade trigger is suppressed by `// mute` / `// mute all`.
@@ -287,6 +299,26 @@
 		// by node id across producers).
 		const addedTestNodes = new Set<string>()
 
+		// A dbt script owns every relation its project materializes. Drawing that
+		// as one edge per model buries the lineage that matters — `ref()` between
+		// models, and native consumers — under a fan-out that grows with the
+		// project, so the association is carried by the model's badge and its
+		// hover/click highlight instead. Only the DRAWING is dropped: the
+		// producer rows still drive cascade dispatch and "who produced this".
+		const dbtRunnableIds = new Set(
+			g.runnables.filter((r) => r.dbt).map((r) => `${r.usage_kind}:${r.path}`)
+		)
+		// Association only — the canvas deliberately draws no edge for it.
+		const { ownerByAsset: dbtOwnerByAsset, writesByOwner: dbtWritesByOwner } = dbtAssociations(
+			g.runnables,
+			g.edges
+		)
+		// Per-relation dbt description, to tell a project's own declared source
+		// from a relation another script materializes.
+		const dbtAssetProvenance = new Map(
+			g.assets.filter((a) => a.dbt).map((a) => [`asset:${a.kind}:${a.path}`, a.dbt!])
+		)
+
 		const hasAddNode = onAddPipelineScript != null
 		if (hasAddNode) {
 			nodes.push({
@@ -395,6 +427,7 @@
 					path: a.path,
 					fork_materialization: a.fork_materialization,
 					derived_from: a.derived_from,
+					dbt: a.dbt,
 					onAddScript: onAddScriptForAsset,
 					pathPrefix,
 					defaultPathSuffix,
@@ -404,7 +437,32 @@
 					producerFailed,
 					// Bumped by the replay player when this asset's producer just
 					// recomputed it — the node flashes green and fades.
-					recomputePulse: recomputedAssetIds?.get(assetId)
+					recomputePulse: recomputedAssetIds?.get(assetId),
+					// What the run in view is doing to this relation right now.
+					runStatus: assetRunStatus?.get(assetId)?.status,
+					runRowCount: assetRunStatus?.get(assetId)?.rowCount,
+					// The dbt project that materializes this relation, related by
+					// badge rather than by an edge — so only when that node is on
+					// this graph. The run page and the pipeline page both hide it,
+					// and passing handlers anyway makes the chip advertise a click
+					// that resolves to nothing.
+					...(dbtOwnerByAsset.has(assetId)
+						? {
+								onDbtHover: (on: boolean) => (dbtHoverId = on ? assetId : undefined),
+								onDbtSelect: () => {
+									// `runnable:<kind>:<path>` — the id shape `build` uses.
+									const owner = model.dbtOwnerByAsset.get(assetId)
+									const [kind, ...rest] = owner?.split(':') ?? []
+									if (kind && rest.length) {
+										onselect?.({
+											kind: 'runnable',
+											runnable_kind: kind as 'script' | 'flow',
+											path: rest.join(':')
+										})
+									}
+								}
+							}
+						: {})
 				}
 			})
 		}
@@ -475,6 +533,8 @@
 					tag: r.tag,
 					retry: r.retry,
 					macros: r.macros,
+					dbt: r.dbt,
+					onDbtHover: (on: boolean) => (dbtHoverId = on ? rid : undefined),
 					unsaved: r.unsaved ?? false,
 					// Same dispatch the asset node uses, only routed when the
 					// runnable is a script (the page handler short-circuits
@@ -522,10 +582,28 @@
 		// (`// mute` / `// mute all` opted the default auto trigger out). Gated
 		// on pipeline scripts inside the helper (non-pipeline reads never derive).
 		const mutedReadKeys = computeMutedReadKeys(g.edges, g.triggers, g.runnables)
+		// A dbt script owns every relation of its project. Drawing that as one
+		// edge per model buries the lineage that matters (`ref()` between models,
+		// and native consumers) under a fan-out that grows with the project — so
+		// the association is carried by the node badge and its hover/click
+		// highlight instead. Only the DRAWING is dropped: the producer rows still
+		// drive cascade dispatch and "who produced this".
 		for (const e of g.edges) {
 			const runnableId = `${e.runnable_kind}:${e.runnable_path}`
 			const assetId = `asset:${e.asset_kind}:${e.asset_path}`
 			const access = e.access_type ?? 'r'
+			// A dbt project's own relations are related by badge, not by edges: its
+			// writes are the fan-out, and its declared sources already reach its
+			// models through the `ref()` edges, so both would be noise.
+			//
+			// A read of a relation ANOTHER script builds is different — that is how
+			// two selections of one project compose (decision 6), it carries the
+			// cascade, and no `ref()` edge survives the split to stand in for it.
+			// Kept, or the two halves render as disconnected islands.
+			if (dbtRunnableIds.has(runnableId)) {
+				const isOwnSource = dbtAssetProvenance.get(assetId)?.resource_type === 'source'
+				if (access === 'w' || access === 'rw' || isOwnSource) continue
+			}
 			if (access === 'w' || access === 'rw') {
 				// Data tests assert on the `// materialize` target, which is always
 				// a ducklake asset (v1 enforces this), so only the ducklake
@@ -621,6 +699,17 @@
 			})
 		}
 
+		// dbt `ref()` lineage: model → model inside one project. The dbt script
+		// writes every one of them, so without these the canvas shows a flat
+		// fan-out from the script and loses the project's actual shape.
+		const assetNodeIds = new Set(g.assets.map((a) => `asset:${a.kind}:${a.path}`))
+		for (const de of g.dbt_edges ?? []) {
+			const from = `asset:dbt:${de.from_asset_path}`
+			const to = `asset:dbt:${de.to_asset_path}`
+			if (!assetNodeIds.has(from) || !assetNodeIds.has(to)) continue
+			edges.push({ id: `dbtref:${from}->${to}`, source: from, target: to, kind: 'dbt-ref' })
+		}
+
 		// Non-asset triggers (schedule + native) are rendered as source nodes
 		// above the pipeline script. Real (non-missing) nodes are
 		// deduplicated per (kind, ref) tuple so a single schedule shared
@@ -787,11 +876,24 @@
 			}
 		}
 
-		return { nodes, edges }
+		return { nodes, edges, dbtOwnerByAsset, dbtWritesByOwner }
 	}
 
 	let model = $derived(build(graph))
 
+	// dbt association, surfaced by emphasis instead of edges. Hovering a model's
+	// dbt badge lights up the project node that materializes it; hovering the
+	// project node lights up every model it owns. Clicking the badge selects the
+	// project node, so the association survives the pointer leaving.
+	let dbtHoverId = $state<string | undefined>(undefined)
+	let dbtEmphasisIds = $derived.by(() => {
+		if (!dbtHoverId) return new Set<string>()
+		const owned = model.dbtWritesByOwner.get(dbtHoverId)
+		if (owned) return new Set<string>([dbtHoverId, ...owned])
+		const owner = model.dbtOwnerByAsset.get(dbtHoverId)
+		return owner ? new Set<string>([dbtHoverId, owner]) : new Set<string>()
+	})
+
 	let selectedId = $derived.by(() => {
 		if (!selection) return undefined
 		return selection.kind === 'asset'
@@ -895,12 +997,13 @@
 				else if (boundPick.bounded.has(n.id)) boundClass = 'wm-bound-in'
 				else if (!boundPick.eligible.has(n.id)) boundClass = 'wm-bound-dim'
 			}
+			const dbtClass = dbtEmphasisIds.has(n.id) ? 'wm-dbt-linked' : undefined
 			return {
 				id: n.id,
 				type: n.type,
 				position: { x: p.x + xCenter + xShift, y: p.y + 40 },
 				data: n.data,
-				class: boundClass ?? runClass ?? assetClass,
+				class: boundClass ?? dbtClass ?? runClass ?? assetClass,
 				selected: n.id === selectedId,
 				// All nodes non-draggable: the layout is sugiyama-computed,
 				// dragging would fight the reactive re-layout. Selection is
@@ -1064,6 +1167,21 @@
 						label = 'test needs'
 						labelStyle = 'fill: rgb(217 119 6); font-size: 10px; font-weight: 600;'
 						break
+					case 'dbt-ref':
+						// model → model inside one dbt project. Orange, matching the
+						// dbt badges, and dashed because the edge is dbt's own lineage
+						// rather than a Windmill read/write the cascade acts on.
+						style = 'stroke: rgb(234 88 12); stroke-width: 1.25px;'
+						strokeDasharray = '4 3'
+						markerColor = 'rgb(234 88 12)'
+						label = 'ref'
+						labelStyle = 'fill: rgb(234 88 12); font-size: 10px; font-weight: 600;'
+						// Same rule the pipeline uses for a running script: the edges
+						// touching what is happening animate. Here the unit of work is
+						// the model, so the edges feeding the one dbt is building move,
+						// and the flow reads in DAG order as it advances.
+						animated = assetRunStatus?.get(e.target)?.status === 'running'
+						break
 					default:
 						style = ''
 				}
@@ -1181,9 +1299,32 @@
 		}
 		// 'schedule' doesn't produce a selection.
 	}
+
+	/// Clicking empty canvas clears the selection. `onselect` already promises it
+	/// can receive `undefined`, it just never did — so a details pane opened from
+	/// a node had no way to close by clicking off it.
+	///
+	/// Read off the click TARGET rather than SvelteFlow's `onpaneclick`, which
+	/// does not fire here: what counts as "empty" is everything that is not a
+	/// node, an edge or one of the canvas's own controls, and that is a question
+	/// about the DOM the click landed on. In the CAPTURE phase, because the flow
+	/// stops the click before it bubbles back out to this wrapper.
+	function handleBackgroundClick(event: MouseEvent) {
+		if (boundPick || !onselect) return
+		const t = event.target as HTMLElement | null
+		if (
+			t?.closest(
+				'.svelte-flow__node, .svelte-flow__edge, .svelte-flow__controls, .svelte-flow__minimap, .svelte-flow__panel'
+			)
+		) {
+			return
+		}
+		onselect(undefined)
+	}
 </script>
 
-<div class="w-full h-full relative" bind:clientWidth={paneWidth}>
+<!-- svelte-ignore a11y_click_events_have_key_events, a11y_no_static_element_interactions -->
+<div class="w-full h-full relative" bind:clientWidth={paneWidth} onclickcapture={handleBackgroundClick}>
 	<SvelteFlow
 		{nodes}
 		{edges}
@@ -1254,6 +1395,11 @@
 	/* Activity-panel emphasis — soft, monochromatic, less prominent than the
 	   blue details selection above. Hover is a thin neutral ring (transient);
 	   pinning an expanded run is a soft-blue ring. */
+	/* A dbt project node and the models it materializes, related by badge
+	   rather than by edges — hovering either lights up the whole set. */
+	:global(.svelte-flow__node.wm-dbt-linked .drop-shadow-sm) {
+		@apply outline outline-2 outline-orange-400/80;
+	}
 	:global(.svelte-flow__node.wm-run-hover .drop-shadow-sm) {
 		@apply outline outline-1 outline-gray-400 dark:outline-gray-500;
 	}
diff --git a/frontend/src/lib/components/assets/AssetGraph/AssetGraphDetailsPane.svelte b/frontend/src/lib/components/assets/AssetGraph/AssetGraphDetailsPane.svelte
index d48ecbe09e..2c5e5fd97e 100644
--- a/frontend/src/lib/components/assets/AssetGraph/AssetGraphDetailsPane.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/AssetGraphDetailsPane.svelte
@@ -27,7 +27,9 @@
 	import { inferArgs } from '$lib/infer'
 	import { emptySchema, sendUserToast } from '$lib/utils'
 	import type { Schema } from '$lib/common'
-	import type { AssetGraphSelection, PipelineMode } from './types'
+	import type { AssetGraphSelection, DbtAssetProvenance, PipelineMode } from './types'
+	import HighlightCode from '$lib/components/HighlightCode.svelte'
+	import DbtIcon from '$lib/components/icons/DbtIcon.svelte'
 	import PipelineScriptView from './PipelineScriptView.svelte'
 	import {
 		parsePipelineAnnotations,
@@ -154,6 +156,9 @@
 		// resolved graph). Drives the transitive column-lineage trace shown for a
 		// selected materialized asset.
 		selectionColumnGraph?: ColumnLineageGraph
+		/** dbt provenance of the selected relation, when a dbt project
+		 *  materializes it — carries the model's own SQL. */
+		selectionDbt?: DbtAssetProvenance
 		// Whether the selected ducklake asset's schema can evolve (whole-table
 		// `replace` producer). Forwarded to the Schema tab: version history when
 		// true, a single fixed-schema view when false. Defaults to true (unknown).
@@ -284,6 +289,7 @@
 		onScriptRemoved,
 		selectionProducers = [],
 		selectionColumnGraph,
+		selectionDbt,
 		schemaCanEvolve = true,
 		selectionForkMaterialization = undefined,
 		schemaContractContext = undefined,
@@ -426,6 +432,20 @@
 			)
 	)
 
+	// Where the selected model's file sits on disk: the producing script's
+	// module folder holds the dbt project verbatim, so this is the path a
+	// `wmill sync pull` writes and the one to edit.
+	let dbtBundlePath = $derived.by(() => {
+		const file = selectionDbt?.original_file_path
+		if (!file) return undefined
+		// A relation may have several script producers, and nothing here says which
+		// of them is the dbt project this model came from. Prefixing the wrong one
+		// names a `__dbt` folder that does not exist, so an ambiguous relation shows
+		// the path inside the project alone.
+		const scripts = selectionProducers.filter((p) => p.kind === 'script')
+		return scripts.length === 1 ? `${scripts[0].path}__dbt/${file}` : file
+	})
+
 	// Bound from ScriptEditor — populated by inferAssets on every code
 	// change. Forwarded to the page so the canvas can re-derive write
 	// edges as the user edits the body (e.g. renaming a CREATE TABLE
@@ -1216,6 +1236,25 @@
 										</div>
 									</div>
 								{/key}
+							{:else if selectionDbt?.raw_code}
+								<!-- The transform behind the node. Read-only on purpose: dbt
+								     development is a local loop (`dbt run --select`, `dbt test`
+								     against a dev target), and a browser textarea over one file
+								     of a project is a worse version of it. The header names the
+								     file's path in the bundle so the edit is one `cd` away. -->
+								<div class="flex flex-col h-full min-h-0">
+									<div
+										class="shrink-0 flex items-center gap-2 px-3 py-1.5 text-2xs border-b bg-surface-secondary text-secondary"
+									>
+										<DbtIcon width={11} height={11} />
+										<span class="font-mono truncate">{dbtBundlePath ?? selectionDbt.unique_id}</span
+										>
+										<span class="ml-auto shrink-0 opacity-70">read-only · edit locally</span>
+									</div>
+									<div class="flex-1 min-h-0 overflow-auto">
+										<HighlightCode language="sql" code={selectionDbt.raw_code} />
+									</div>
+								</div>
 							{:else}
 								<div class="p-3 text-xs text-secondary">
 									No inline preview yet for {selection.asset_kind}. Use the producer/consumer arrows
diff --git a/frontend/src/lib/components/assets/AssetGraph/AssetNode.svelte b/frontend/src/lib/components/assets/AssetGraph/AssetNode.svelte
index 999559a0c7..815db36b18 100644
--- a/frontend/src/lib/components/assets/AssetGraph/AssetNode.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/AssetNode.svelte
@@ -14,13 +14,17 @@
 		Loader2,
 		Plus,
 		ShieldCheck,
-		ShieldAlert
+		ShieldAlert,
+		CheckCircle2,
+		XCircle
 	} from 'lucide-svelte'
 	import type { ScriptLang } from '$lib/gen'
 	import { enterpriseLicense, workspaceStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/utils'
 	import { PIPELINE_LANGUAGES } from './pipelineLanguages'
 	import type { PipelineOutputKind } from './pipelineTemplates'
+	import type { DbtAssetProvenance } from './types'
+	import DbtIcon from '$lib/components/icons/DbtIcon.svelte'
 
 	// Shape used for both the data prop and the run callback. Drafts carry
 	// `content` / `language` so the page-level run handler can dispatch to
@@ -44,6 +48,15 @@
 			// "current view of <dim>" marker so it reads as a derived node, not an
 			// unrelated table.
 			derived_from?: string
+			// dbt provenance when this warehouse table is a dbt node: which model
+			// it is, how dbt materializes it, its tags and its generic tests.
+			dbt?: DbtAssetProvenance
+			/** Hovering the dbt chip emphasizes the project node that
+			 *  materializes this model — the association the graph deliberately
+			 *  does not draw as an edge. */
+			onDbtHover?: (on: boolean) => void
+			/** Clicking it selects that project node. */
+			onDbtSelect?: () => void
 			onAddScript?: (
 				asset: { kind: AssetKind; path: string },
 				language: ScriptLang,
@@ -78,6 +91,11 @@
 			// producer just recomputed it. A change triggers a one-shot green
 			// fade so a freshly-written table stands out as the run progresses.
 			recomputePulse?: number
+			// What the run being viewed is doing to this relation. dbt records it
+			// per model as it walks the DAG, so the graph moves with the run
+			// instead of only settling once the job ends.
+			runStatus?: 'running' | 'materialized' | 'failed'
+			runRowCount?: number | null
 		}
 		// SvelteFlow injects this on the node component when the user clicks
 		// the node. Combined with our own `hovered` state to drive the
@@ -133,6 +151,40 @@
 
 	let showAdd = $derived(data.onAddScript != undefined)
 
+	// dbt badge. `materialized` is dbt's own word rather than the Windmill
+	// strategy because `view` and `ephemeral` have no strategy, and showing the
+	// dbt word keeps the node legible to someone reading their own project.
+	let dbtLabel = $derived(data.dbt?.materialized ?? data.dbt?.resource_type)
+	let dbtTitle = $derived.by(() => {
+		const d = data.dbt
+		if (!d) return ''
+		const lines = [`dbt ${d.resource_type}: ${d.unique_id}`]
+		if (d.materialized) {
+			const strategy = d.materialize_strategy ? ` -> ${d.materialize_strategy}` : ''
+			lines.push(`materialized: ${d.materialized}${strategy}`)
+		}
+		if (d.tags?.length) lines.push(`tags: ${d.tags.join(', ')}`)
+		for (const t of d.data_tests ?? []) {
+			const col = t.column ? ` on ${t.column}` : ''
+			lines.push(`test ${t.kind}${col}${t.severity ? ` [${t.severity}]` : ''}`)
+		}
+		const cols = Object.entries(d.columns ?? {})
+		if (cols.length) {
+			lines.push(
+				`columns: ${cols.map(([c, desc]) => (desc ? `${c} (${desc})` : c)).join(', ')}`
+			)
+		}
+		if (d.freshness) {
+			const f = d.freshness as Record<string, { count?: number; period?: string }>
+			const window = (k: string) =>
+				f[k]?.count != null ? `${k.replace('_after', '')} after ${f[k].count}${f[k].period?.[0] ?? ''}` : ''
+			const windows = ['warn_after', 'error_after'].map(window).filter(Boolean)
+			if (windows.length) lines.push(`freshness: ${windows.join(', ')}`)
+		}
+		if (d.description) lines.push(d.description)
+		return lines.join('\n')
+	})
+
 	// Data-test outcome badge. Only guarded assets show it. The write's fate on a
 	// failing test differs by edition — surface which one applies so a shared
 	// parent/fork table name can't hide a silently-published bad version.
@@ -200,6 +252,39 @@
 			class={`shrink-0 ml-2 mr-2 ${selected ? 'text-accent' : 'text-blue-600 dark:text-blue-400'}`}
 			size="14px"
 		/>
+		{#if data.runStatus}
+			<!-- The run in view, per relation: a spinner while its producer is
+			     building it, then its outcome. Left of the name so the eye finds
+			     the moving nodes first on a wide graph. -->
+			<span
+				class="shrink-0 mr-1 {data.runStatus === 'failed'
+					? 'text-red-600 dark:text-red-400'
+					: data.runStatus === 'materialized'
+						? 'text-green-600 dark:text-green-400'
+						: 'text-blue-600 dark:text-blue-400'}"
+				title={data.runStatus}
+			>
+				{#if data.runStatus === 'running'}
+					<Loader2 size={11} class="animate-spin" />
+				{:else if data.runStatus === 'failed'}
+					<XCircle size={11} />
+				{:else}
+					<CheckCircle2 size={11} />
+				{/if}
+			</span>
+			<!-- Rows the run wrote. Recorded per relation already, and the cheapest
+			     answer to "did this model actually produce anything" — a model that
+			     built green but emitted 0 rows is the failure that looks like a
+			     success. Only once settled: mid-build the number is not yet real. -->
+			{#if data.runStatus === 'materialized' && data.runRowCount != undefined}
+				<span
+					class="shrink-0 mr-1 text-3xs tabular-nums text-tertiary"
+					title="{data.runRowCount} rows written by this run"
+				>
+					{Intl.NumberFormat().format(data.runRowCount)}
+				</span>
+			{/if}
+		{/if}
 		<span class="flex-1 min-w-0 pr-1 py-0.5 text-2xs font-mono text-emphasis truncate">
 			{formatShortAssetPath(asset)}
 		</span>
@@ -225,6 +310,34 @@
 				fork
 			</span>
 		{/if}
+		<!-- dbt chip: names the materialization dbt declares, plus a test count
+		     when the model carries generic tests. Orange keeps it visually
+		     separate from the fork/SCD2 chips, which describe Windmill state.
+		     Where the project node is on the graph it also stands in for the edge
+		     to it: hovering lights that node up, clicking selects it. Where it is
+		     not — the run page, and a pipeline holding a dbt project — there is
+		     nothing to point at, so the chip renders inert. -->
+		{#if data.dbt}
+			<button
+				type="button"
+				class="shrink-0 mr-1.5 flex items-center gap-0.5 rounded px-1 py-px text-3xs font-semibold tracking-wide bg-orange-100 dark:bg-orange-900/40 text-orange-700 dark:text-orange-300 border border-orange-300 dark:border-orange-700 {data.onDbtSelect
+					? 'hover:brightness-95 cursor-pointer'
+					: 'cursor-default'}"
+				title={dbtTitle}
+				onmouseenter={() => data.onDbtHover?.(true)}
+				onmouseleave={() => data.onDbtHover?.(false)}
+				onclick={(e) => {
+					e.stopPropagation()
+					data.onDbtSelect?.()
+				}}
+			>
+				<DbtIcon width={9} height={9} />
+				{dbtLabel}
+				{#if data.dbt.data_tests?.length}
+					<span class="opacity-70">&middot; {data.dbt.data_tests.length}T</span>
+				{/if}
+			</button>
+		{/if}
 		<!-- SCD2 companion marker: this node is the `<dim>_current` "latest row
 		     per key" view its producer maintains alongside the base dimension.
 		     Icon-only (the pill already truncates); the title names the base. -->
diff --git a/frontend/src/lib/components/assets/AssetGraph/DataTablePreview.svelte b/frontend/src/lib/components/assets/AssetGraph/DataTablePreview.svelte
index 751e149266..1b86fa6853 100644
--- a/frontend/src/lib/components/assets/AssetGraph/DataTablePreview.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/DataTablePreview.svelte
@@ -102,6 +102,11 @@
 			: undefined
 	)
 
+	// Kept apart from "no columns for this table": a failed metadata read says
+	// nothing about whether the table exists, so reporting it as missing would
+	// point the user at the wrong problem.
+	let colDefsError = $state<string | undefined>(undefined)
+
 	// Metadata for every table in the datatable. We query the lot rather
 	// than just the one we care about because `loadAllTablesMetaData` is
 	// what `dbTableOpsWithPreviewScripts` and the rest of the DB manager
@@ -111,14 +116,12 @@
 	let colDefs = resource(
 		() => [input, refreshKey],
 		async ([_input]) => {
+			colDefsError = undefined
 			if (!_input || !$workspaceStore) return undefined
 			try {
 				return await loadAllTablesMetaData($workspaceStore, _input)
-			} catch {
-				// Connection/permission errors look identical to "table
-				// missing" from the user's POV inside the preview pane;
-				// the full error is surfaced via the existing sendUserToast
-				// path inside loadAllTablesMetaData.
+			} catch (e) {
+				colDefsError = (e as Error)?.message || String(e)
 				return undefined
 			}
 		}
@@ -187,6 +190,12 @@
 		<div class="absolute inset-0 flex items-center justify-center text-tertiary">
 			<Loader2 class="animate-spin" size={20} />
 		</div>
+	{:else if colDefsError}
+		<div class="absolute inset-0 flex flex-col items-center justify-center gap-2 p-6 text-center">
+			<AlertTriangle size={20} class="text-red-500" />
+			<span class="text-sm font-medium text-emphasis">Could not read the datatable</span>
+			<span class="text-2xs text-tertiary max-w-md">{colDefsError}</span>
+		</div>
 	{:else if !tableColDefs}
 		<!-- Datatable exists but the specific table doesn't — most often
 		     because no upstream pipeline script has run yet to create it. -->
diff --git a/frontend/src/lib/components/assets/AssetGraph/DucklakeResultPreview.svelte b/frontend/src/lib/components/assets/AssetGraph/DucklakeResultPreview.svelte
index 403a100aa2..f21ca486af 100644
--- a/frontend/src/lib/components/assets/AssetGraph/DucklakeResultPreview.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/DucklakeResultPreview.svelte
@@ -53,15 +53,19 @@
 		scoped && partition ? `_wm_partition = '${partition.replaceAll("'", "''")}'` : undefined
 	)
 
+	// Distinct from "no columns for this table": a failed metadata read says
+	// nothing about whether the table exists.
+	let colDefsError = $state<string | undefined>(undefined)
+
 	let colDefs = resource(
 		() => [input, refreshKey] as const,
 		async ([_input]) => {
+			colDefsError = undefined
 			if (!_input || !$workspaceStore) return undefined
 			try {
 				return await loadAllTablesMetaData($workspaceStore, _input)
-			} catch {
-				// A load failure reads the same as "table missing" from the preview's
-				// POV; the underlying error is surfaced by loadAllTablesMetaData.
+			} catch (e) {
+				colDefsError = (e as Error)?.message || String(e)
 				return undefined
 			}
 		}
@@ -119,6 +123,11 @@
 		<div class="flex items-center justify-center p-4 text-tertiary">
 			<Loader2 class="animate-spin" size={18} />
 		</div>
+	{:else if colDefsError}
+		<div class="flex items-start gap-2 p-3 text-2xs text-tertiary">
+			<AlertTriangle size={14} class="text-red-500 shrink-0 mt-0.5" />
+			{colDefsError}
+		</div>
 	{:else if !tableColDefs}
 		<div class="flex items-center gap-2 p-3 text-2xs text-tertiary">
 			<AlertTriangle size={14} class="text-amber-500" />
diff --git a/frontend/src/lib/components/assets/AssetGraph/PipelineDbtSignpost.svelte b/frontend/src/lib/components/assets/AssetGraph/PipelineDbtSignpost.svelte
new file mode 100644
index 0000000000..495e9a34bd
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/PipelineDbtSignpost.svelte
@@ -0,0 +1,40 @@
+<script lang="ts">
+	import { base } from '$lib/base'
+	import Alert from '$lib/components/common/alert/Alert.svelte'
+	import Button from '$lib/components/common/button/Button.svelte'
+	import DbtIcon from '$lib/components/icons/DbtIcon.svelte'
+	import { BookOpen } from 'lucide-svelte'
+
+	const DBT_DOCS = 'https://www.windmill.dev/docs/getting_started/scripts_quickstart/dbt'
+</script>
+
+<Alert type="info" title="Prefer using dbt? Windmill also runs dbt" size="xs">
+	<div class="flex flex-col gap-2">
+		<p>
+			A pipeline is Windmill's own abstraction; an existing dbt project stays a dbt project, and
+			runs here unchanged as its own kind of script, with dbt still owning its models, refs and
+			tests. All it needs is a warehouse configured under
+			<a class="underline" href="{base}/workspace_settings?tab=dbt">Settings → dbt</a>. Its models
+			show up in the asset graph as <span class="font-mono">dbt://</span> nodes, visible next to whatever
+			pipelines you do build, so you can adopt pipelines later, or never.
+		</p>
+		<div class="flex flex-row flex-wrap items-center gap-2">
+			<!-- The dbt mark goes in as a child rather than `startIcon`: that slot
+			     sizes its icon with lucide's `size`, which DbtIcon has no prop for. -->
+			<Button variant="default" unifiedSize="sm" href="{base}/scripts/add?lang=dbt">
+				<DbtIcon width={14} height={14} />
+				New dbt script
+			</Button>
+			<Button
+				variant="subtle"
+				unifiedSize="sm"
+				href={DBT_DOCS}
+				target="_blank"
+				rel="noreferrer"
+				startIcon={{ icon: BookOpen }}
+			>
+				dbt documentation
+			</Button>
+		</div>
+	</div>
+</Alert>
diff --git a/frontend/src/lib/components/assets/AssetGraph/PipelineGraphEditor.svelte b/frontend/src/lib/components/assets/AssetGraph/PipelineGraphEditor.svelte
index 7db35c2353..3439fa5ad5 100644
--- a/frontend/src/lib/components/assets/AssetGraph/PipelineGraphEditor.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/PipelineGraphEditor.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
 	import { untrack, type Snippet } from 'svelte'
+	import { PIPELINE_DRAFT_KIND, pipelineBundlePath } from '$lib/pipelinePaths'
 	import { Loader2 } from 'lucide-svelte'
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
 	import { DraftService } from '$lib/gen'
@@ -16,8 +17,7 @@
 		AssetGraphResponse,
 		AssetGraphSelection,
 		NativeTriggerKind,
-		PipelineMode
-	} from './types'
+		PipelineMode, DbtAssetProvenance } from './types'
 	import type { AssetKind, Script, ScriptLang } from '$lib/gen'
 	import type { RunnableRunState, PipelineEvent } from './activeRunnables.svelte'
 	import type { PipelineOutputKind } from './pipelineTemplates'
@@ -76,6 +76,7 @@
 		localScriptsVersion,
 		selectionProducers = [],
 		selectionColumnGraph,
+		selectionDbt,
 		schemaCanEvolve = true,
 		selectionForkMaterialization = undefined,
 		schemaContractContext = undefined,
@@ -181,6 +182,8 @@
 		selectionProducers?: Array<{ kind: 'script' | 'flow'; path: string; unsaved?: boolean }>
 		/** Transitive column-lineage trace for a selected ducklake asset (route page). */
 		selectionColumnGraph?: ColumnLineageGraph
+		/** dbt provenance of the selected relation — carries its SQL. */
+		selectionDbt?: DbtAssetProvenance
 		schemaCanEvolve?: boolean
 		/** Fork workspaces: data-environment state of the selected ducklake asset (route page). */
 		selectionForkMaterialization?: 'fork' | 'deferred'
@@ -262,8 +265,7 @@
 	// the global drafts list. localStorage is a synchronous crash mirror, READ only
 	// for the one-time migration below; the DB is the source of truth on load.
 	// FlowBuilder's autosave analogue — gated by `persistDrafts`.
-	const PIPELINE_DRAFT_KIND = 'data_pipeline' as const
-	let pipelineDraftPath = $derived(`f/${folder}/data_pipeline`)
+	let pipelineDraftPath = $derived(pipelineBundlePath(folder))
 	let storageKey = $derived(`pipeline-${folder}`)
 	type PipelineDraftBundle = { drafts: Array<[string, PipelineDraft]>; activeDraftPath?: string }
 	// Hydration is tracked on the editor instance (`editor.hydratedFromDb`), not a
@@ -512,6 +514,7 @@
 						selection={activeDraft ? undefined : editor.selection}
 						selectionProducers={activeDraft ? [] : selectionProducers}
 						{selectionColumnGraph}
+						{selectionDbt}
 						{schemaCanEvolve}
 						{selectionForkMaterialization}
 						{schemaContractContext}
diff --git a/frontend/src/lib/components/assets/AssetGraph/RunnableNode.svelte b/frontend/src/lib/components/assets/AssetGraph/RunnableNode.svelte
index d8a977539b..c260bc2e5b 100644
--- a/frontend/src/lib/components/assets/AssetGraph/RunnableNode.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/RunnableNode.svelte
@@ -18,6 +18,7 @@
 		XCircle,
 		Zap
 	} from 'lucide-svelte'
+	import DbtIcon from '$lib/components/icons/DbtIcon.svelte'
 	import { twMerge } from 'tailwind-merge'
 	import { preventDefault, stopPropagation } from 'svelte/legacy'
 	import type { GraphUsageKind } from './types'
@@ -45,6 +46,13 @@
 			// Macros this script provides (deployed/drafted `// macros` library).
 			// Non-empty renders the ƒ chip marking the node as a macro library.
 			macros?: { name: string; params: string; is_table: boolean }[]
+			// Set on a dbt script: the number of models the project materializes.
+			// One runnable node stands for the whole project, so the count is what
+			// tells it apart from a single-output script.
+			dbt?: { model_count: number }
+			/** Hovering the project badge emphasizes every model it
+			 *  materializes — the fan-out the graph deliberately omits. */
+			onDbtHover?: (on: boolean) => void
 			// Last-run status + run count observed this session (from the
 			// folder queue poll). Undefined until the first observed run.
 			runState?: RunnableRunState
@@ -188,7 +196,19 @@
 </script>
 
 <!-- svelte-ignore a11y_no_static_element_interactions -->
-<div class="relative" onmouseenter={() => (hover = true)} onmouseleave={() => (hover = false)}>
+<!-- Hovering anywhere on a dbt project node highlights the models it
+     materializes: the association the graph does not draw as edges. -->
+<div
+	class="relative"
+	onmouseenter={() => {
+		hover = true
+		data.onDbtHover?.(true)
+	}}
+	onmouseleave={() => {
+		hover = false
+		data.onDbtHover?.(false)
+	}}
+>
 	<!--
 		Mirrors the flow editor's step styling (getNodeColorClasses): muted
 		surface-tertiary fill with a quiet gray border, accent only for the
@@ -276,6 +296,15 @@
 				<span class="text-3xs leading-none">×{data.macros.length}</span>
 			</div>
 		{/if}
+		{#if data.dbt}
+			<div
+				class="shrink-0 flex items-center gap-0.5 px-1 py-0.5 mr-1 rounded-sm bg-orange-100 dark:bg-orange-900/40 text-orange-700 dark:text-orange-300"
+				title={`dbt project — materializes ${data.dbt.model_count} model${data.dbt.model_count === 1 ? '' : 's'}`}
+			>
+				<DbtIcon width={10} height={10} />
+				<span class="text-3xs leading-none">×{data.dbt.model_count}</span>
+			</div>
+		{/if}
 		{#if data.runState}
 			{@const rs = data.runState}
 			<div
diff --git a/frontend/src/lib/components/assets/AssetGraph/cascadeRun.ts b/frontend/src/lib/components/assets/AssetGraph/cascadeRun.ts
index 407dc886f9..e948eb2cf5 100644
--- a/frontend/src/lib/components/assets/AssetGraph/cascadeRun.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/cascadeRun.ts
@@ -23,7 +23,7 @@ export const CASCADE_JOB_TIMEOUT_MS = 30 * 60 * 1000
 // Data-asset kinds a pipeline graph resolves — the `asset_kinds` filter for the
 // `/assets/graph` fetch. Shared so the pipeline editor and deploy-to-hub request
 // the same nodes/edges (and can't silently diverge when a kind is added).
-export const DATA_ASSET_KINDS = ['s3object', 'ducklake', 'datatable', 'volume']
+export const DATA_ASSET_KINDS = ['s3object', 'ducklake', 'datatable', 'volume', 'dbt']
 
 export type LocalScriptContent = {
 	content: string
diff --git a/frontend/src/lib/components/assets/AssetGraph/hideDbtRunnables.test.ts b/frontend/src/lib/components/assets/AssetGraph/hideDbtRunnables.test.ts
new file mode 100644
index 0000000000..1d4f8eb64d
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/hideDbtRunnables.test.ts
@@ -0,0 +1,99 @@
+import { describe, it, expect } from 'vitest'
+import { hideDbtRunnables } from './hideDbtRunnables'
+import type { AssetGraphResponse } from './types'
+
+// A folder holding both a dbt project (2 models, one of them a shared mart) and
+// a pipeline member that reads that mart.
+function graph(): AssetGraphResponse {
+	return {
+		assets: [
+			{ kind: 'dbt', path: 'u/a/wh/s/stg_orders', dbt: { unique_id: 'model.p.stg_orders' } },
+			{ kind: 'dbt', path: 'u/a/wh/s/fct_orders', dbt: { unique_id: 'model.p.fct_orders' } },
+			{ kind: 's3object', path: 'out.csv' }
+		] as AssetGraphResponse['assets'],
+		runnables: [
+			{ path: 'f/x/dbtproj', usage_kind: 'script', dbt: { model_count: 2 } },
+			{ path: 'f/x/report', usage_kind: 'script', in_pipeline: true }
+		],
+		edges: [
+			{
+				runnable_path: 'f/x/dbtproj',
+				runnable_kind: 'script',
+				asset_kind: 'dbt',
+				asset_path: 'u/a/wh/s/stg_orders',
+				access_type: 'w'
+			},
+			{
+				runnable_path: 'f/x/dbtproj',
+				runnable_kind: 'script',
+				asset_kind: 'dbt',
+				asset_path: 'u/a/wh/s/fct_orders',
+				access_type: 'w'
+			},
+			{
+				runnable_path: 'f/x/report',
+				runnable_kind: 'script',
+				asset_kind: 'dbt',
+				asset_path: 'u/a/wh/s/fct_orders',
+				access_type: 'r'
+			}
+		],
+		triggers: [
+			{
+				trigger_kind: 'asset',
+				asset_kind: 'dbt',
+				asset_path: 'u/a/wh/s/fct_orders',
+				runnable_kind: 'script',
+				runnable_path: 'f/x/report'
+			}
+		],
+		dbt_edges: [{ from_asset_path: 'u/a/wh/s/stg_orders', to_asset_path: 'u/a/wh/s/fct_orders' }]
+	}
+}
+
+describe('hideDbtRunnables', () => {
+	it('drops the dbt script node and its write edges', () => {
+		const g = hideDbtRunnables(graph())
+		expect(g.runnables.map((r) => r.path)).toEqual(['f/x/report'])
+		expect(g.edges.map((e) => e.runnable_path)).toEqual(['f/x/report'])
+	})
+
+	it('keeps every model and its ref() lineage — the tables are the pipeline’s business', () => {
+		const g = hideDbtRunnables(graph())
+		expect(g.assets).toHaveLength(3)
+		expect(g.dbt_edges).toHaveLength(1)
+		// The cascade edge from the mart to its consumer is what survives.
+		expect(g.triggers).toHaveLength(1)
+	})
+
+	it('keeps a flow that shares a path with the dbt script', () => {
+		// A script and a flow may share a path; the graph keys runnables by
+		// `(usage_kind, path)`, so only the dbt script may be removed.
+		const base = graph()
+		const g = hideDbtRunnables({
+			...base,
+			runnables: [...base.runnables, { path: 'f/x/dbtproj', usage_kind: 'flow', in_pipeline: true }],
+			edges: [
+				...base.edges,
+				{
+					runnable_path: 'f/x/dbtproj',
+					runnable_kind: 'flow',
+					asset_kind: 's3object',
+					asset_path: 'flow-out.csv',
+					access_type: 'w'
+				}
+			]
+		})
+		expect(g.runnables.map((r) => `${r.usage_kind}:${r.path}`).sort()).toEqual([
+			'flow:f/x/dbtproj',
+			'script:f/x/report'
+		])
+		expect(g.edges.some((e) => e.runnable_kind === 'flow')).toBe(true)
+	})
+
+	it('is a no-op on a folder with no dbt project', () => {
+		const base = graph()
+		const plain = { ...base, runnables: base.runnables.filter((r) => !r.dbt) }
+		expect(hideDbtRunnables(plain)).toBe(plain)
+	})
+})
diff --git a/frontend/src/lib/components/assets/AssetGraph/hideDbtRunnables.ts b/frontend/src/lib/components/assets/AssetGraph/hideDbtRunnables.ts
new file mode 100644
index 0000000000..7e819cedb9
--- /dev/null
+++ b/frontend/src/lib/components/assets/AssetGraph/hideDbtRunnables.ts
@@ -0,0 +1,40 @@
+import type { AssetGraphResponse } from './types'
+
+/**
+ * The pipeline's view of a folder that also holds a dbt project.
+ *
+ * The relations a dbt project materializes belong on this graph: they are what
+ * a pipeline script downstream of a mart reads, so the lineage into it is
+ * visible. The dbt *script* does not. It is not a pipeline member — it is
+ * authored in a local `dbt run` loop and has its own script and run pages — so
+ * rendering it beside the pipeline's own scripts is what blurs which of the two
+ * a folder holds.
+ *
+ * Its models stay, with their `ref()` lineage. Only the node is dropped.
+ */
+export function hideDbtRunnables(graph: AssetGraphResponse): AssetGraphResponse {
+	// Keyed by `(usage_kind, path)`, which is the graph's identity for a runnable
+	// — a script and a flow may share a path, and keying on path alone would take
+	// the flow's node, edges and triggers down with the dbt script's.
+	const key = (usage_kind: string, path: string) => `${usage_kind}:${path}`
+	const dbtRunnables = new Set(
+		graph.runnables.filter((r) => r.dbt).map((r) => key(r.usage_kind, r.path))
+	)
+	if (dbtRunnables.size === 0) return graph
+
+	const kept = (usage_kind: string, path: string) => !dbtRunnables.has(key(usage_kind, path))
+	return {
+		...graph,
+		runnables: graph.runnables.filter((r) => kept(r.usage_kind, r.path)),
+		edges: graph.edges.filter((e) => kept(e.runnable_kind, e.runnable_path)),
+		triggers: graph.triggers.filter((t) => kept(t.runnable_kind, t.runnable_path)),
+		// A macro library is a script; a dbt script defines no macros, so neither
+		// end can be a flow. Kept on the script key for symmetry with the rest.
+		macro_edges: graph.macro_edges?.filter(
+			(m) => kept('script', m.lib_path) && kept('script', m.consumer_path)
+		),
+		test_edges: graph.test_edges?.filter(
+			(t) => kept(t.producer_kind, t.producer_path) && kept(t.runnable_kind, t.runnable_path)
+		)
+	}
+}
diff --git a/frontend/src/lib/components/assets/AssetGraph/parsePipelineAnnotations.test.ts b/frontend/src/lib/components/assets/AssetGraph/parsePipelineAnnotations.test.ts
index 51aaf97f52..b608c91c76 100644
--- a/frontend/src/lib/components/assets/AssetGraph/parsePipelineAnnotations.test.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/parsePipelineAnnotations.test.ts
@@ -233,3 +233,62 @@ describe('parseDurationSecs', () => {
 		expect(parseDurationSecs('999999999d')).toBeUndefined()
 	})
 })
+
+describe('dbt:// canonicalization', () => {
+	const readPath = (line: string) => parsePipelineAnnotations(line).triggerAssets?.[0]?.path
+
+	it('folds every spelling of a relation onto one key', () => {
+		const canonical = 'u/me/wh/analytics/orders'
+		expect(readPath('// on dbt://u/me/wh/Analytics/Orders')).toBe(canonical)
+		expect(readPath('// on dbt://u/me/wh/"Analytics"/"Orders"')).toBe(canonical)
+		expect(readPath('// on dbt://u/me/wh/`analytics`/`orders`')).toBe(canonical)
+		expect(readPath('// on dbt://u/me/wh/[Analytics]/[Orders]')).toBe(canonical)
+	})
+
+	it('unquotes each half of a qualified database.schema segment', () => {
+		// Only an unquoted period separates the two halves — the backend
+		// ingest keys the same relation as `archive.sales/orders`, so
+		// stripping just the outer quote pair would split the node in two.
+		expect(readPath('// on dbt://u/me/wh/"Archive"."Sales"/"Orders"')).toBe(
+			'u/me/wh/archive.sales/orders'
+		)
+	})
+
+	// Every dialect escapes its own delimiter by doubling it, and the worker and
+	// `canonicalize_table_asset_path` both decode it — a live annotation that did
+	// not would point the canvas at a different key than the deploy, which is two
+	// nodes for one table. The decoded spelling has to land there too: this
+	// function also sees names that have already been through `split_relation`.
+	it('decodes a doubled delimiter, and leaves a lone one alone', () => {
+		expect(readPath('// on dbt://u/me/wh/"sales""east"/"orders"')).toBe(
+			'u/me/wh/sales"east/orders'
+		)
+		expect(readPath('// on dbt://u/me/wh/analytics/"order""s"')).toBe(
+			'u/me/wh/analytics/order"s'
+		)
+		expect(readPath('// on dbt://u/me/wh/`da``ta`/`orders`')).toBe('u/me/wh/da`ta/orders')
+		expect(readPath('// on dbt://u/me/wh/[my]]schema]/[orders]')).toBe(
+			'u/me/wh/my]schema/orders'
+		)
+		// Already decoded: a lone delimiter is part of the name, not an opening
+		// quote, so both spellings agree.
+		expect(readPath('// on dbt://u/me/wh/sales"east/orders')).toBe(
+			readPath('// on dbt://u/me/wh/"sales""east"/"orders"')
+		)
+	})
+
+	// `canonicalize_table_asset_path` folds with `to_ascii_lowercase`, so this
+	// must too: full-Unicode folding turns `Sélection` into `sélection` here and
+	// `sÉlection` at deploy — two nodes for one table, which is the split this
+	// canonicalization exists to prevent. Every warehouse accepts such names.
+	it('folds case the way the deploy does, ASCII only', () => {
+		expect(readPath('// on dbt://u/me/wh/Sélection/Orders')).toBe('u/me/wh/sélection/orders')
+		expect(readPath('// on dbt://u/me/wh/ОТЧЁТ/Orders')).toBe('u/me/wh/ОТЧЁТ/orders')
+	})
+
+	it('leaves the resource path alone', () => {
+		expect(readPath('// on dbt://u/Me/WH/analytics/orders')).toBe(
+			'u/Me/WH/analytics/orders'
+		)
+	})
+})
diff --git a/frontend/src/lib/components/assets/AssetGraph/parsePipelineAnnotations.ts b/frontend/src/lib/components/assets/AssetGraph/parsePipelineAnnotations.ts
index 5fdbc4c748..e6384d9ddf 100644
--- a/frontend/src/lib/components/assets/AssetGraph/parsePipelineAnnotations.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/parsePipelineAnnotations.ts
@@ -18,9 +18,84 @@ const ASSET_PREFIXES: Array<[string, AssetKind]> = [
 	['$res:', 'resource'],
 	['ducklake://', 'ducklake'],
 	['datatable://', 'datatable'],
-	['volume://', 'volume']
+	['volume://', 'volume'],
+	['dbt://', 'dbt']
 ]
 
+/** Canonical spelling of a `dbt://` path — mirror of
+ *  `canonicalize_table_asset_path` in the Rust parser, which is the single
+ *  place a relation becomes a graph key. The live editor must agree with it
+ *  exactly, or an annotation looks connected while typing and lands on a
+ *  different node at deploy. Strips the warehouses' quote characters from the
+ *  schema and name and folds their case; the warehouse-name prefix is spelled
+ *  as the workspace configures it and stays as written. */
+function canonicalizeTablePath(path: string): string {
+	const parts = path.split('/')
+	if (parts.length < 3) return path
+	const name = parts.pop()!
+	const schema = parts.pop()!
+	return [...parts, asciiLower(unquoteSegment(schema)), asciiLower(unquoteIdentifier(name))].join(
+		'/'
+	)
+}
+
+/** ASCII only, because `canonicalize_table_asset_path` folds with
+ *  `to_ascii_lowercase`. Full-Unicode `toLowerCase` disagrees on any accented or
+ *  Cyrillic identifier — every warehouse accepts those — and the deploy and the
+ *  live canvas would then canonicalize one table to two nodes, which is the
+ *  split this whole function exists to prevent. */
+function asciiLower(s: string): string {
+	return s.replace(/[A-Z]/g, (c) => c.toLowerCase())
+}
+
+/** Mirrors the worker's `unquote_identifier`, and must keep mirroring it: a quote
+ *  counts only when it wraps the WHOLE identifier — a lone one inside an
+ *  already-decoded name is part of the name — and a doubled delimiter inside a
+ *  quoted one is that delimiter, which is how every dialect escapes it. Disagree
+ *  with the backend here and the live canvas connects an annotation to a
+ *  different key than the deploy does, which is two nodes for one table. */
+function unquoteIdentifier(s: string): string {
+	const t = s.trim()
+	for (const [open, close] of [
+		['"', '"'],
+		['`', '`'],
+		['[', ']']
+	] as const) {
+		if (t.length >= 2 && t.startsWith(open) && t.endsWith(close)) {
+			return t.slice(1, -1).split(close + close).join(close)
+		}
+	}
+	return t
+}
+
+/** The schema segment carries a `<database>.<schema>` pair when a relation
+ *  overrode its database, and each half is separately quotable, so only an
+ *  UNQUOTED period separates them — one inside an identifier is part of the
+ *  name. Mirrors `unquote_schema_segment`. */
+function unquoteSegment(s: string): string {
+	const t = s.trim()
+	const parts: string[] = []
+	let start = 0
+	let quote: string | undefined = undefined
+	for (let i = 0; i < t.length; i++) {
+		const c = t[i]
+		if (quote !== undefined) {
+			const close = quote === '[' ? ']' : quote
+			if (c === close) {
+				if (t[i + 1] === close) i++
+				else quote = undefined
+			}
+		} else if ((c === '"' || c === '`' || c === '[') && i === start) {
+			quote = c
+		} else if (c === '.') {
+			parts.push(t.slice(start, i))
+			start = i + 1
+		}
+	}
+	parts.push(t.slice(start))
+	return parts.map(unquoteIdentifier).join('.')
+}
+
 // Native trigger keywords — `// on <kind>`. Each is marker-only: the
 // binding lives on the matching trigger row's own `script_path` field.
 // Schedule joins the family — the cron is stored on the schedule row the
@@ -277,11 +352,13 @@ function stripTrailingKvOpts(s: string): string {
 function parseAssetSyntax(s: string): PipelineTriggerAsset | undefined {
 	for (const [prefix, kind] of ASSET_PREFIXES) {
 		if (s.startsWith(prefix)) {
-			// The suffix is kept verbatim, mirroring the Rust `parse_asset_syntax`.
-			// For S3 the path encodes the storage: `s3:///key` yields `/key`
-			// (default storage, leading slash significant) while
-			// `s3://secondary/key` yields `secondary/key` — two different objects.
-			return { kind, path: s.slice(prefix.length) }
+			const suffix = s.slice(prefix.length)
+			// `dbt://` is canonicalized, every other kind's suffix is kept
+			// verbatim — mirroring the Rust `parse_asset_syntax`. For S3 the path
+			// encodes the storage: `s3:///key` yields `/key` (default storage,
+			// leading slash significant) while `s3://secondary/key` yields
+			// `secondary/key` — two different objects.
+			return { kind, path: kind === 'dbt' ? canonicalizeTablePath(suffix) : suffix }
 		}
 	}
 	return undefined
diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineAiHelpers.test.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineAiHelpers.test.ts
index e5f3b74e3d..d1d5c1b233 100644
--- a/frontend/src/lib/components/assets/AssetGraph/pipelineAiHelpers.test.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineAiHelpers.test.ts
@@ -7,12 +7,13 @@ import type { AssetGraphResponse } from './types'
 // wires it. `getFolder` returns the bare folder name (as the route/session do).
 function makeHandle(
 	initial: Array<[string, PipelineDraft]> = [],
-	runnables: Array<{ path: string }> = []
+	runnables: Array<{ path: string }> = [],
+	folder = 'x'
 ) {
 	let drafts = new Map(initial)
 	let forgotten: string[] = []
 	const handle = createPipelineAiHelpers({
-		getFolder: () => 'x',
+		getFolder: () => folder,
 		getWorkspace: () => 'w',
 		getResolvedGraph: () =>
 			({ assets: [], runnables, edges: [], triggers: [] }) as unknown as AssetGraphResponse,
@@ -67,6 +68,15 @@ describe('pipeline AI direct-draft helpers', () => {
 		)
 	})
 
+	it('scopes nodes to the folder name even when the caller passes the owner path', async () => {
+		// A caller holding `f/x` must not turn every node path into `f/f/x/…`.
+		vi.spyOn(ScriptService, 'getScriptByPath').mockRejectedValue(new Error('404'))
+		const { handle, drafts } = makeHandle([], [], 'f/x')
+		expect(handle.getPipelineContext().folder).toBe('x')
+		await handle.proposeNode({ path: 'f/x/n', language: 'duckdb' as any, content: '-- pipeline' })
+		expect([...drafts().keys()]).toEqual(['f/x/n'])
+	})
+
 	it('proposeNode rejects a path outside the open folder', async () => {
 		const { handle, drafts } = makeHandle()
 		await expect(
diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineAiHelpers.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineAiHelpers.ts
index a6874d9b64..5b22a098b1 100644
--- a/frontend/src/lib/components/assets/AssetGraph/pipelineAiHelpers.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineAiHelpers.ts
@@ -6,6 +6,7 @@ import {
 	extractWrites,
 	type AssetWithAltAccessType
 } from '$lib/components/assets/lib'
+import { normalizePipelineFolder } from '$lib/utils/pipelineFolder'
 import { assetUri, autoOutputAsset, type PipelineOutputKind } from './pipelineTemplates'
 import { parsePipelineAnnotations, scd2CurrentTargetPath } from './parsePipelineAnnotations'
 import type { AssetGraphResponse } from './types'
@@ -133,14 +134,21 @@ function dedupeAssets(
 }
 
 export function createPipelineAiHelpers(deps: PipelineAiHelperDeps): PipelineAIChatHelpers {
+	const folderName = () => normalizePipelineFolder(deps.getFolder())
+
 	// A staged draft is always persisted into the OPEN folder's data_pipeline
 	// bundle, so a path outside the folder would silently land an unrelated script
 	// there. Both build and edit must stay scoped to the folder.
 	function assertInFolder(path: string) {
-		const folder = deps.getFolder()
+		const folder = folderName()
 		if (folder && !path.startsWith(`f/${folder}/`)) {
+			// Name the corrected path rather than only the required prefix: the model
+			// otherwise re-sends variants of the same wrong path. A path that is the
+			// folder itself has no node leaf to reuse.
+			const leaf = path.split('/').filter(Boolean).pop()
+			const node = !leaf || leaf === folder ? '<node_name>' : leaf
 			throw new Error(
-				`Pipeline nodes must be in the open folder — use a path under 'f/${folder}/' (got '${path}').`
+				`Pipeline nodes must be in the open folder — use 'f/${folder}/${node}' (got '${path}').`
 			)
 		}
 	}
@@ -198,7 +206,7 @@ export function createPipelineAiHelpers(deps: PipelineAiHelperDeps): PipelineAIC
 				}
 			})
 		return {
-			folder: deps.getFolder(),
+			folder: folderName(),
 			mode: 'edit',
 			nodes,
 			assets: graph.assets.map((a) => assetUri({ kind: a.kind, path: a.path }))
@@ -263,7 +271,7 @@ export function createPipelineAiHelpers(deps: PipelineAiHelperDeps): PipelineAIC
 			const seeded =
 				inferred.writes[0] ??
 				(outputKind
-					? autoOutputAsset(outputKind as PipelineOutputKind, deps.getFolder(), language)
+					? autoOutputAsset(outputKind as PipelineOutputKind, folderName(), language)
 					: undefined)
 			// Effective outputs = what actually becomes an output edge on the canvas:
 			// body/annotation-inferred writes, or the output_kind seed as a fallback.
diff --git a/frontend/src/lib/components/assets/AssetGraph/pipelineTemplates.ts b/frontend/src/lib/components/assets/AssetGraph/pipelineTemplates.ts
index 1e26f2bb31..8c4fdc5d6d 100644
--- a/frontend/src/lib/components/assets/AssetGraph/pipelineTemplates.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/pipelineTemplates.ts
@@ -118,7 +118,10 @@ const LANG_COMPATIBILITY: Record<ScriptLang, PipelineOutputKind[]> = {
 	bunnative: ['none'],
 	nativets: ['none'],
 	ruby: ['none'],
-	rlang: ['none']
+	rlang: ['none'],
+	// A dbt script's outputs come from its manifest, not from a Windmill
+	// template — the picker has nothing to generate for it.
+	dbt: ['none']
 }
 
 export function compatibleOutputKinds(lang: ScriptLang): PipelineOutputKind[] {
@@ -215,7 +218,8 @@ const ASSET_URI_PREFIX: Record<AssetKind, string> = {
 	resource: '$res:',
 	ducklake: 'ducklake://',
 	datatable: 'datatable://',
-	volume: 'volume://'
+	volume: 'volume://',
+	dbt: 'dbt://'
 }
 
 export function assetUri(asset: { kind: AssetKind; path: string }): string {
diff --git a/frontend/src/lib/components/assets/AssetGraph/resolveGraph.test.ts b/frontend/src/lib/components/assets/AssetGraph/resolveGraph.test.ts
index e35054beab..de00aef2be 100644
--- a/frontend/src/lib/components/assets/AssetGraph/resolveGraph.test.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/resolveGraph.test.ts
@@ -1,5 +1,10 @@
 import { describe, expect, it } from 'vitest'
-import { resolveGraph, computeMutedReadKeys, type ResolveGraphInput } from './resolveGraph'
+import {
+	resolveGraph,
+	computeMutedReadKeys,
+	dbtAssociations,
+	type ResolveGraphInput
+} from './resolveGraph'
 import type { PipelineAnnotations } from './parsePipelineAnnotations'
 import type { AssetGraphResponse } from './types'
 import type { AssetWithAltAccessType } from '$lib/components/assets/lib'
@@ -1024,3 +1029,129 @@ describe('open saved script: live overlay vs inferred-lineage maps', () => {
 		).toHaveLength(1)
 	})
 })
+
+describe('dbtAssociations', () => {
+	const runnables = [
+		{ usage_kind: 'script', path: 'f/a/dbtproj', dbt: { model_count: 2 } },
+		{ usage_kind: 'script', path: 'f/a/consumer' }
+	]
+	const edges = [
+		// the project builds a model and reads a source
+		{
+			runnable_kind: 'script',
+			runnable_path: 'f/a/dbtproj',
+			asset_kind: 'dbt',
+			asset_path: 'wh/s/model_a',
+			access_type: 'w'
+		},
+		{
+			runnable_kind: 'script',
+			runnable_path: 'f/a/dbtproj',
+			asset_kind: 'dbt',
+			asset_path: 'wh/s/src_a',
+			access_type: 'r'
+		},
+		// a native consumer reads the model — its edges are none of dbt's business
+		{
+			runnable_kind: 'script',
+			runnable_path: 'f/a/consumer',
+			asset_kind: 'dbt',
+			asset_path: 'wh/s/model_a',
+			access_type: 'r'
+		}
+	]
+
+	it('points every declared relation back at its project', () => {
+		const { ownerByAsset } = dbtAssociations(runnables, edges)
+		// A source is declared by the project too, so its badge finds it.
+		expect(ownerByAsset.get('asset:dbt:wh/s/src_a')).toBe('script:f/a/dbtproj')
+		expect(ownerByAsset.get('asset:dbt:wh/s/model_a')).toBe('script:f/a/dbtproj')
+	})
+
+	it('counts only what the project materializes as its transforms', () => {
+		const { writesByOwner } = dbtAssociations(runnables, edges)
+		// Hovering the project highlights the models it builds, not its inputs.
+		expect([...(writesByOwner.get('script:f/a/dbtproj') ?? [])]).toEqual([
+			'asset:dbt:wh/s/model_a'
+		])
+	})
+
+	it('ignores runnables that are not dbt', () => {
+		const { ownerByAsset } = dbtAssociations([runnables[1]], edges)
+		expect(ownerByAsset.size).toBe(0)
+	})
+})
+
+describe('dbtAssociations with a producer and a consumer of one relation', () => {
+	const runnables = [
+		{ usage_kind: 'script', path: 'f/a/producer', dbt: { model_count: 1 } },
+		{ usage_kind: 'script', path: 'f/a/reader', dbt: { model_count: 1 } }
+	]
+	const write = {
+		runnable_kind: 'script',
+		runnable_path: 'f/a/producer',
+		asset_kind: 'dbt',
+		asset_path: 'wh/s/shared',
+		access_type: 'w'
+	}
+	const read = {
+		runnable_kind: 'script',
+		runnable_path: 'f/a/reader',
+		asset_kind: 'dbt',
+		asset_path: 'wh/s/shared',
+		access_type: 'r'
+	}
+
+	// Backend edge order is unspecified, so the badge must not depend on it.
+	it('always points at the project that builds the relation', () => {
+		for (const edges of [
+			[write, read],
+			[read, write]
+		]) {
+			const { ownerByAsset } = dbtAssociations(runnables, edges)
+			expect(ownerByAsset.get('asset:dbt:wh/s/shared')).toBe('script:f/a/producer')
+		}
+	})
+
+	it('falls back to a reader when nothing here produces the relation', () => {
+		const { ownerByAsset } = dbtAssociations(runnables, [read])
+		expect(ownerByAsset.get('asset:dbt:wh/s/shared')).toBe('script:f/a/reader')
+	})
+})
+
+// Two selections of one project materializing the same model is a shape the
+// backend permits, so the badge has to land on the same one every time — not on
+// whichever write edge the backend happened to return last.
+describe('dbtAssociations with two writers of one relation', () => {
+	const runnables = [
+		{ usage_kind: 'script', path: 'f/a/upstream', dbt: { model_count: 1 } },
+		{ usage_kind: 'script', path: 'f/a/downstream', dbt: { model_count: 1 } }
+	]
+	const writeBy = (p: string) => ({
+		runnable_kind: 'script',
+		runnable_path: p,
+		asset_kind: 'dbt',
+		asset_path: 'wh/s/shared',
+		access_type: 'w'
+	})
+
+	it('picks the same producer whatever order the edges arrive in', () => {
+		const a = writeBy('f/a/upstream')
+		const b = writeBy('f/a/downstream')
+		const first = dbtAssociations(runnables, [a, b]).ownerByAsset.get('asset:dbt:wh/s/shared')
+		const second = dbtAssociations(runnables, [b, a]).ownerByAsset.get('asset:dbt:wh/s/shared')
+		expect(first).toBe(second)
+		expect(first).toBe('script:f/a/downstream')
+	})
+
+	it('still credits both with materializing it', () => {
+		const { writesByOwner } = dbtAssociations(runnables, [
+			writeBy('f/a/upstream'),
+			writeBy('f/a/downstream')
+		])
+		expect(writesByOwner.get('script:f/a/upstream')).toEqual(new Set(['asset:dbt:wh/s/shared']))
+		expect(writesByOwner.get('script:f/a/downstream')).toEqual(
+			new Set(['asset:dbt:wh/s/shared'])
+		)
+	})
+})
diff --git a/frontend/src/lib/components/assets/AssetGraph/resolveGraph.ts b/frontend/src/lib/components/assets/AssetGraph/resolveGraph.ts
index 8ee0ca53d7..867fa6f036 100644
--- a/frontend/src/lib/components/assets/AssetGraph/resolveGraph.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/resolveGraph.ts
@@ -75,9 +75,25 @@ function persistedNativeKinds(base: AssetGraphResponse, path: string): Set<strin
 
 // Read-asset kinds that auto-derive a cascade trigger edge inside a
 // `// pipeline`. Mirror of the backend `is_auto_trigger_kind`
-// (windmill-common assets.rs) — ducklake tables and s3 objects only.
+// (windmill-common assets.rs): ducklake tables and s3 objects.
+//
+// `table` is excluded there and must stay excluded here: dbt is the only
+// producer of a warehouse relation and a dbt run does not dispatch, so an edge
+// derived from one draws a cascade arrow the deploy will never fire.
 const AUTO_TRIGGER_KINDS: ReadonlySet<AssetKind> = new Set(['ducklake', 's3object'])
 
+/** Whether a subscription on this kind can ever fire once deployed.
+ *
+ * A `dbt://` one cannot: dbt is the only producer of a warehouse relation and
+ * a dbt run does not dispatch, so the deploy refuses `// on dbt://…` outright
+ * (`scripts.rs`). The editor must not draw an arrow the deploy will reject —
+ * applied to the EXPLICIT overlays; auto-derivation is already scoped by
+ * `AUTO_TRIGGER_KINDS`. Parsing is left alone so the Rust-parity test still
+ * compares like for like. */
+function canTrigger(kind: AssetKind): boolean {
+	return kind !== 'dbt'
+}
+
 /** `kind:path` refs of a script's `// materialize` write target(s) (base +
  *  the scd2 `<dim>_current` companion), which the body `SELECT` doesn't express. */
 function materializeWriteRefs(parsed: PipelineAnnotations): string[] {
@@ -365,7 +381,7 @@ function makeContext(input: ResolveGraphInput): ResolveContext {
 	const liveRefKeys = new Set<string>()
 	if (openIsSavedEdit) {
 		if (liveAnnotations.scriptPath === openPath) {
-			for (const a of liveAnnotations.annotations.triggerAssets)
+			for (const a of liveAnnotations.annotations.triggerAssets.filter((a) => canTrigger(a.kind)))
 				liveRefKeys.add(`${a.kind}:${a.path}`)
 			// The `// materialize <asset>` target is a declared *output*, but it
 			// lives in an annotation (not the SQL body), so neither triggerAssets
@@ -609,7 +625,7 @@ function seedDraftOverlays(acc: Accumulator, input: ResolveGraphInput) {
 		// stable when the user clicks off this draft. Live annotations
 		// (below) take over for the currently-open draft so keystroke
 		// edits still update in real time.
-		for (const a of parsed.triggerAssets) {
+		for (const a of parsed.triggerAssets.filter((a) => canTrigger(a.kind))) {
 			extraTriggers.push({
 				trigger_kind: 'asset',
 				asset_kind: a.kind,
@@ -688,7 +704,7 @@ function applyLiveBufferOverlay(acc: Accumulator, input: ResolveGraphInput, ctx:
 	for (let i = extraTriggers.length - 1; i >= 0; i--) {
 		if (extraTriggers[i].runnable_path === livePath) extraTriggers.splice(i, 1)
 	}
-	for (const a of liveAnnotations.annotations.triggerAssets) {
+	for (const a of liveAnnotations.annotations.triggerAssets.filter((a) => canTrigger(a.kind))) {
 		const key = `${a.kind}:${a.path}`
 		if (assetKeys.has(key)) continue
 		extraTriggers.push({
@@ -839,3 +855,60 @@ function overlayInferredLineage(acc: Accumulator, input: ResolveGraphInput) {
 	overlayLineage(inferredWritesByPath, 'w')
 	overlayLineage(inferredReadsByPath, 'r')
 }
+
+
+/** dbt project ↔ relation association, for a graph that does NOT draw it.
+ *
+ * A dbt script owns every relation of its project, so drawing one edge per
+ * model buries the lineage that matters — `ref()` between models, and native
+ * consumers — under a fan-out that grows with the project. The canvas suppresses
+ * those edges and conveys the association through the model's badge instead:
+ * `ownerByAsset` powers badge → project, `writesByOwner` powers project →
+ * the transforms it materializes (its sources are inputs, not transforms).
+ *
+ * Only the DRAWING is dropped. The producer rows these are derived from still
+ * answer "who produced this".
+ */
+export function dbtAssociations(
+	runnables: Array<{ usage_kind: string; path: string; dbt?: unknown }>,
+	edges: Array<{
+		runnable_kind: string
+		runnable_path: string
+		asset_kind: string
+		asset_path: string
+		access_type?: string | null
+	}>
+): { ownerByAsset: Map<string, string>; writesByOwner: Map<string, Set<string>> } {
+	const dbtRunnableIds = new Set(
+		runnables.filter((r) => r.dbt).map((r) => `${r.usage_kind}:${r.path}`)
+	)
+	const ownerByAsset = new Map<string, string>()
+	const writesByOwner = new Map<string, Set<string>>()
+	// Candidates per relation, kept apart so the choice does not depend on the
+	// order the edges arrive in. Two things decide it: a project that WRITES a
+	// relation outranks one that merely declares it as a SOURCE, and among
+	// several writers — which the backend permits, two selections of one project
+	// materializing the same model — the smallest id wins. Anything less makes
+	// the badge lead somewhere else between two loads of the same graph.
+	const writersByAsset = new Map<string, string[]>()
+	const readersByAsset = new Map<string, string[]>()
+	for (const e of edges) {
+		const runnableId = `${e.runnable_kind}:${e.runnable_path}`
+		if (!dbtRunnableIds.has(runnableId)) continue
+		const assetId = `asset:${e.asset_kind}:${e.asset_path}`
+		const writes = e.access_type === 'w' || e.access_type === 'rw'
+		const into = writes ? writersByAsset : readersByAsset
+		let candidates = into.get(assetId)
+		if (!candidates) into.set(assetId, (candidates = []))
+		candidates.push(runnableId)
+		if (writes) {
+			let set = writesByOwner.get(runnableId)
+			if (!set) writesByOwner.set(runnableId, (set = new Set()))
+			set.add(assetId)
+		}
+	}
+	for (const [assetId, candidates] of [...readersByAsset, ...writersByAsset]) {
+		ownerByAsset.set(assetId, [...candidates].sort()[0])
+	}
+	return { ownerByAsset, writesByOwner }
+}
diff --git a/frontend/src/lib/components/assets/AssetGraph/types.ts b/frontend/src/lib/components/assets/AssetGraph/types.ts
index d9ef2dafbf..4ada1feec3 100644
--- a/frontend/src/lib/components/assets/AssetGraph/types.ts
+++ b/frontend/src/lib/components/assets/AssetGraph/types.ts
@@ -16,6 +16,50 @@ export interface AssetGraphAssetNode {
 	// the `_current` node; lets the canvas mark it as a derived "current view"
 	// rather than an unrelated table. Lockstep with Rust `GraphAssetNode`.
 	derived_from?: string
+	// Set on a `dbt://` asset a dbt project produces (or, for a source,
+	// consumes). A dbt script is ONE runnable node with many model assets, so
+	// per-model metadata hangs off the asset, not off the script. Lockstep with
+	// Rust `GraphAssetNode.dbt`.
+	dbt?: DbtAssetProvenance
+}
+
+// Describes the RELATION, not a producer: several dbt scripts (different
+// selections of one project) can materialize the same model, and the producer
+// edges already name them.
+export interface DbtAssetProvenance {
+	unique_id: string
+	resource_type: 'model' | 'snapshot' | 'seed' | 'source' | (string & {})
+	// dbt's own word (`table`, `view`, `incremental`, `snapshot`). Kept because
+	// `view` and `ephemeral` have no Windmill write-strategy analogue.
+	materialized?: string
+	materialize_strategy?: 'replace' | 'append' | 'merge' | 'scd2'
+	tags?: string[]
+	description?: string
+	data_tests?: DbtDataTest[]
+	/** Declared column metadata (name -> description). NOT column lineage:
+	 *  `manifest.json` carries none (docs/dbt-runtime.md, decision 14). */
+	columns?: Record<string, string>
+	/** A source's declared freshness policy. */
+	freshness?: unknown
+	/** The model's SQL as written — the transform behind the node. Read-only:
+	 *  this is the copy captured when the graph on screen was parsed, whether
+	 *  that was a deploy or a refresh from the editor's buffer, and the file
+	 *  itself lives in the producing script's `__dbt/` bundle. Absent for tests
+	 *  and for nodes with no body. */
+	raw_code?: string
+	/** Its path inside the dbt project, e.g. `models/staging/stg_orders.sql`. */
+	original_file_path?: string
+}
+
+export interface DbtDataTest {
+	// The four dbt generic tests map one-for-one onto the `// data_test` kinds;
+	// a package test keeps its namespaced name (`dbt_utils.accepted_range`).
+	kind: string
+	column?: string
+	args?: unknown
+	// Lowercased. dbt's own severity decides whether a failure fails the run,
+	// so the badge shows it rather than assuming every test is blocking.
+	severity?: string
 }
 
 export interface AssetGraphRunnableNode {
@@ -73,6 +117,10 @@ export interface AssetGraphRunnableNode {
 	// drives the "defines N macros" badge and the details-pane signature
 	// list. `params` is the verbatim parameter list.
 	macros?: { name: string; params: string; is_table: boolean }[]
+	// Set on a `ScriptLang::Dbt` script: it owns a whole dbt project, so the node
+	// says how many models it materializes rather than reading as a single-output
+	// script. Lockstep with Rust `GraphRunnableNode.dbt`.
+	dbt?: { model_count: number }
 	// Synthesized by the page from a local draft; the script doesn't exist
 	// in the DB yet. Drives a dashed/lower-opacity rendering to mirror how
 	// unsaved triggers are styled — visually distinct from persisted nodes.
@@ -176,6 +224,23 @@ export interface AssetGraphResponse {
 	triggers: AssetGraphTrigger[]
 	macro_edges?: AssetGraphMacroEdge[]
 	test_edges?: AssetGraphTestEdge[]
+	dbt_edges?: AssetGraphDbtEdge[]
+	/** The job whose snapshot the dbt half was resolved from, when one was
+	 *  asked for and found. A run page polls the graph until this is its own
+	 *  job, which is how it knows a dynamic descriptor's ingest has landed. */
+	dbt_snapshot_job?: string
+	/** When the dbt half on screen was parsed, for a graph pinned to a job.
+	 *  What the dbt editor labels its provenance with — a buffer refresh and the
+	 *  deployed version's graph are drawn identically. */
+	dbt_graph_ingested_at?: string
+}
+
+// `ref()` lineage BETWEEN two dbt models, in the terms the canvas draws
+// (relations, not dbt node ids). Without these every model hangs off the one
+// dbt runnable, which reads as a flat fan-out rather than the project's shape.
+export interface AssetGraphDbtEdge {
+	from_asset_path: string
+	to_asset_path: string
 }
 
 export type AssetGraphNodeData =
@@ -196,3 +261,11 @@ export type AssetGraphSelection = AssetGraphNodeData
  * (default) or full editor. View can additionally overlay unsaved drafts
  * ("show drafts" chip) — a view variant, not a separate mode. */
 export type PipelineMode = 'view' | 'edit'
+
+/** What a run in view is doing to one relation, and what it produced. The row
+ *  count is the cheapest answer to "did this model actually output anything" —
+ *  the worker already records it per relation, so nothing extra is fetched. */
+export type AssetRunState = {
+	status: 'running' | 'materialized' | 'failed'
+	rowCount?: number | null
+}
diff --git a/frontend/src/lib/components/assets/lib.ts b/frontend/src/lib/components/assets/lib.ts
index 655f525c86..23531d71f2 100644
--- a/frontend/src/lib/components/assets/lib.ts
+++ b/frontend/src/lib/components/assets/lib.ts
@@ -28,6 +28,8 @@ export function formatAsset(asset: Asset): string {
 			return `datatable://${asset.path}`
 		case 'volume':
 			return `volume://${asset.path}`
+		case 'dbt':
+			return `dbt://${asset.path}`
 	}
 	return 'unknown'
 }
@@ -93,6 +95,12 @@ export function formatAssetKind(asset: {
 			return 'Data table'
 		case 'volume':
 			return 'Volume'
+		case 'dbt':
+			// The SCHEME says dbt because dbt is the only thing that creates one;
+			// the PATH stays the relation, so a mart one project builds and the
+			// `source` the next reads land on one node — their dbt `unique_id`s
+			// differ where the relation does not (docs/dbt-runtime.md, decision 11).
+			return 'dbt table'
 	}
 }
 
diff --git a/frontend/src/lib/components/auditLogs/AuditLogDetails.svelte b/frontend/src/lib/components/auditLogs/AuditLogDetails.svelte
index ed02de2dda..392018750d 100644
--- a/frontend/src/lib/components/auditLogs/AuditLogDetails.svelte
+++ b/frontend/src/lib/components/auditLogs/AuditLogDetails.svelte
@@ -10,6 +10,10 @@
 
 	let { logs, selectedId = undefined }: Props = $props()
 
+	// `span` holds the caller's token prefix, except for job-minted worker tokens, which
+	// stamp the job they run for instead.
+	const JOB_SPAN_PREFIX = 'job-span-'
+
 	const ViewFlowOp: AuditLog['operation'][] = ['jobs.run.flow', 'flows.create', 'flows.update']
 
 	const ViewAppOp: AuditLog['operation'][] = ['apps.create', 'apps.update']
@@ -24,6 +28,17 @@
 					<span class="font-semibold text-xs text-emphasis">ID</span>
 					<span class="text-xs">{log.id}</span>
 				</div>
+				{#if log.span}
+					{@const isJobSpan = log.span.startsWith(JOB_SPAN_PREFIX)}
+					<div class="flex flex-col gap-1">
+						<span class="font-semibold text-xs text-emphasis">
+							{isJobSpan ? 'Job' : 'Token prefix'}
+						</span>
+						<span class="text-xs break-all">
+							{isJobSpan ? log.span.slice(JOB_SPAN_PREFIX.length) : log.span}
+						</span>
+					</div>
+				{/if}
 				<div class="flex flex-col gap-1">
 					<span class="font-semibold text-xs text-emphasis">Parameters</span>
 					<div class="text-xs p-2 bg-surface-secondary rounded-md">
diff --git a/frontend/src/lib/components/auditLogs/AuditLogsFilters.svelte b/frontend/src/lib/components/auditLogs/AuditLogsFilters.svelte
index e6cdb898ea..c367bce01c 100644
--- a/frontend/src/lib/components/auditLogs/AuditLogsFilters.svelte
+++ b/frontend/src/lib/components/auditLogs/AuditLogsFilters.svelte
@@ -198,6 +198,7 @@
 		JOBS_FORCE_CANCEL: 'jobs.force_cancel',
 		JOBS_DISAPPROVAL: 'jobs.disapproval',
 		JOBS_DELETE: 'jobs.delete',
+		JOBS_SHARE_PUBLICLY: 'jobs.share_publicly',
 		ACCOUNT_DELETE: 'account.delete',
 		AI_REQUEST: 'ai.request',
 		RESOURCES_CREATE: 'resources.create',
diff --git a/frontend/src/lib/components/auditLogs/AuditLogsTable.svelte b/frontend/src/lib/components/auditLogs/AuditLogsTable.svelte
index 5ad2cb2065..b0f5b7256a 100644
--- a/frontend/src/lib/components/auditLogs/AuditLogsTable.svelte
+++ b/frontend/src/lib/components/auditLogs/AuditLogsTable.svelte
@@ -205,10 +205,19 @@
 									</div>
 									<div class={showWorkspace ? 'w-2/12 text-xs' : 'w-3/12 text-xs'}>
 										<div class="flex flex-row gap-2 items-center">
-											<div class="whitespace-nowrap overflow-x-auto no-scrollbar max-w-60">
-												{logOrDate.log.username}
+											<!-- end_user can be an arbitrarily long token label; truncate it rather
+											than let it push the username out of the cell. -->
+											<div class="flex flex-row min-w-0 max-w-60 overflow-hidden">
+												<span class="whitespace-nowrap shrink-0" title={logOrDate.log.username}>
+													{logOrDate.log.username}
+												</span>
 												{#if logOrDate.log.parameters && 'end_user' in logOrDate.log.parameters}
-													<span> ({logOrDate.log.parameters.end_user})</span>
+													<span
+														class="truncate pl-1"
+														title={String(logOrDate.log.parameters.end_user)}
+													>
+														({logOrDate.log.parameters.end_user})
+													</span>
 												{/if}
 											</div>
 											<Button
diff --git a/frontend/src/lib/components/common/ScrollableX.svelte b/frontend/src/lib/components/common/ScrollableX.svelte
index 836439bfbb..698c7f57c9 100644
--- a/frontend/src/lib/components/common/ScrollableX.svelte
+++ b/frontend/src/lib/components/common/ScrollableX.svelte
@@ -4,7 +4,9 @@
 	// Subtle horizontal scroll: native overflow (so wheel/trackpad/drag always
 	// work) with the shared `.scrollbar-subtle` thumb (thin, hover-revealed). Bar
 	// thickness is tunable via the `--wm-scrollbar-size` CSS var (pass through
-	// `style`), so denser callers (e.g. the tab strip) can shrink it.
+	// `style`) — WebKit only, so Firefox spends its own ~11px of the box on the
+	// bar whatever this says. Not for a height-constrained row: draw the thumb
+	// yourself there, the way the tab strip does.
 	let {
 		class: c = '',
 		style = '',
diff --git a/frontend/src/lib/components/common/button/Button.svelte b/frontend/src/lib/components/common/button/Button.svelte
index b739076cee..2081e12e29 100644
--- a/frontend/src/lib/components/common/button/Button.svelte
+++ b/frontend/src/lib/components/common/button/Button.svelte
@@ -355,8 +355,12 @@
 			onblur={bubble('blur')}
 			onmouseenter={bubble('mouseenter')}
 			onmouseleave={bubble('mouseleave')}
-			onclick={() => {
+			onclick={(event) => {
 				loading = true
+				// A link button can still want to intercept its own click (e.g. to resolve
+				// the real destination first and preventDefault), so `onClick` must run here
+				// too — the button branch below is not the only one that takes a handler.
+				onClick?.(event)
 				dispatch('click', event)
 				if (!loadUntilNav) {
 					loading = false
diff --git a/frontend/src/lib/components/common/checkbox/Checkbox.svelte b/frontend/src/lib/components/common/checkbox/Checkbox.svelte
index 49e13e9519..270b260d04 100644
--- a/frontend/src/lib/components/common/checkbox/Checkbox.svelte
+++ b/frontend/src/lib/components/common/checkbox/Checkbox.svelte
@@ -14,6 +14,10 @@
 		class?: string | undefined
 		/** Change handler (controlled — the parent owns `checked`). */
 		onChange?: (e: Event & { currentTarget: EventTarget & HTMLInputElement }) => void
+		/** Click handler, for the cases that need the modifier keys a `change`
+		 * event doesn't carry (e.g. shift-click to select a range). Fires before
+		 * `change`, so calling `preventDefault` here suppresses both. */
+		onClick?: (e: MouseEvent & { currentTarget: EventTarget & HTMLInputElement }) => void
 	}
 
 	let {
@@ -22,17 +26,33 @@
 		disabled = false,
 		title = undefined,
 		class: className = undefined,
-		onChange
+		onChange,
+		onClick
 	}: Props = $props()
+
+	let inputEl: HTMLInputElement | undefined = $state()
+	let clicks = $state(0)
+	// A click flips the box before any handler runs, outside Svelte's diff — so a
+	// controlled checkbox whose value does NOT change across a click would keep
+	// the browser's guess. Re-assert after every click, not only on a change.
+	$effect(() => {
+		clicks
+		if (inputEl) inputEl.checked = checked
+	})
 </script>
 
 <input
+	bind:this={inputEl}
 	type="checkbox"
 	{checked}
 	{indeterminate}
 	{disabled}
 	{title}
 	onchange={onChange}
+	onclick={(e) => {
+		onClick?.(e)
+		clicks++
+	}}
 	class={twMerge(
 		'rounded max-w-4 w-full',
 		// When disabled, grey it and let hover fall through to a wrapping trigger
diff --git a/frontend/src/lib/components/common/confirmationModal/ConfirmationModal.svelte b/frontend/src/lib/components/common/confirmationModal/ConfirmationModal.svelte
index fa1cef6726..56244632ef 100644
--- a/frontend/src/lib/components/common/confirmationModal/ConfirmationModal.svelte
+++ b/frontend/src/lib/components/common/confirmationModal/ConfirmationModal.svelte
@@ -1,5 +1,7 @@
 <script lang="ts">
 	import { classNames } from '$lib/utils'
+	import ConditionalPortal from '$lib/components/common/drawer/ConditionalPortal.svelte'
+	import { getOverlayHost, overlayHostActive } from '$lib/components/common/overlayHost.svelte'
 	import { createEventDispatcher, type Snippet } from 'svelte'
 	import { fade } from 'svelte/transition'
 	import Button from '../button/Button.svelte'
@@ -11,6 +13,8 @@
 		confirmationText: string
 		keyListen?: boolean
 		loading?: boolean
+		/** Blocks confirming (button and Enter) while a required choice in `children` is unmade. */
+		confirmDisabled?: boolean
 		open?: boolean
 		type?: 'danger' | 'reload' | 'info'
 		showIcon?: boolean
@@ -29,6 +33,7 @@
 		confirmationText,
 		keyListen = true,
 		loading = false,
+		confirmDisabled = false,
 		open = false,
 		type: _type,
 		showIcon = true,
@@ -41,25 +46,56 @@
 	}: Props = $props()
 	const type = $derived(_type ?? 'danger')
 
+	// Anchored to the enclosing pane when there is one (see overlayHost): portalled into it
+	// and positioned against it, so the dialog covers that pane rather than the whole app.
+	// Both halves are required — `absolute` resolves against the nearest positioned DOM
+	// ancestor, which without the portal is whatever box the caller happens to sit in.
+	const overlayHost = getOverlayHost()
+	const hostEl = $derived(overlayHost?.el())
+	const posClass = $derived(hostEl ? 'absolute' : 'fixed')
+
+	const hostActive = overlayHostActive()
+
 	const dispatch = createEventDispatcher()
 
 	function onKeyDown(event: KeyboardEvent) {
+		// Hidden hosts stay mounted and still receive window keys — see overlayHost.
+		if (!hostActive()) return
 		if (open && keyListen) {
 			// Only intercept Enter/Escape (without modifiers) so shortcuts like
 			// Cmd/Ctrl+C and Cmd/Ctrl+V keep working inside the modal.
 			if (event.metaKey || event.ctrlKey || event.altKey) {
 				return
 			}
+			const popover = (event.target as HTMLElement | null)?.closest?.('[data-popover]')
+			// Content carries no `aria-controls`; a trigger's resolves only while its content is
+			// mounted, which is the only reliable open/closed signal — the trigger's own aria state
+			// is stale because visibility is driven outside melt.
+			const controls = popover?.getAttribute('aria-controls')
+			const popoverOpen = !!popover && (!controls || !!document.getElementById(controls))
+
 			switch (event.key) {
+				// Both keys are gated on the same state as the button they stand for, which is why
+				// they swallow the event first and only then decide. Ungated, Enter re-enters an
+				// in-flight confirm and Escape dismisses the modal out from under one — leaving the
+				// action to finish against a caller that believes it was cancelled.
 				case 'Enter':
+					// A popover needs Enter both to open from its trigger and to choose from its
+					// content, so leave it alone whether or not it is open.
+					if (popover) return
 					event.stopPropagation()
 					event.preventDefault()
+					if (loading || confirmDisabled) break
 					dispatch('confirmed')
 					onConfirmed?.()
 					break
 				case 'Escape':
+					// Only an open popover has something to dismiss; on a closed trigger Escape is
+					// still the dialog's.
+					if (popoverOpen) return
 					event.stopPropagation()
 					event.preventDefault()
+					if (loading) break
 					dispatch('canceled')
 					onCanceled?.()
 					break
@@ -105,80 +141,83 @@
 
 <svelte:window onkeydowncapture={onKeyDown} />
 
-{#if open}
-	<div
-		transition:fadeFast|local
-		class={twMerge('fixed top-0 bottom-0 left-0 right-0', zIndexClass)}
-		role="dialog"
-		{id}
-	>
+<ConditionalPortal condition={!!hostEl} target={hostEl} class="contents">
+	{#if open}
 		<div
-			class={classNames(
-				'fixed inset-0 bg-gray-500 bg-opacity-75 transition-opacity',
-				open ? 'ease-out duration-300 opacity-100' : 'ease-in duration-200 opacity-0'
-			)}
-		></div>
+			transition:fadeFast|local
+			class={twMerge(posClass, 'top-0 bottom-0 left-0 right-0', zIndexClass)}
+			role="dialog"
+			{id}
+		>
+			<div
+				class={classNames(
+					posClass,
+					'inset-0 bg-gray-500 bg-opacity-75 transition-opacity',
+					open ? 'ease-out duration-300 opacity-100' : 'ease-in duration-200 opacity-0'
+				)}
+			></div>
 
-		<div class="fixed inset-0 z-10 overflow-y-auto">
-			<div class="flex min-h-full items-center justify-center p-4">
-				<div
-					class={classNames(
-						'relative transform overflow-hidden rounded-lg bg-surface px-4 pt-5 pb-4 text-left shadow-xl transition-all sm:my-8 sm:w-full sm:max-w-lg sm:p-6',
-						open
-							? 'ease-out duration-300 opacity-100 translate-y-0 sm:scale-100'
-							: 'ease-in duration-200 opacity-0 translate-y-4 sm:translate-y-0 sm:scale-95'
-					)}
-				>
-					<div class="flex">
-						{#if showIcon}
-							<div
-								class={`flex h-12 w-12 items-center justify-center rounded-full ${theme[type].classes.iconWrapper}`}
-							>
-								<Icon class={theme[type].classes.icon} />
-							</div>
-						{/if}
-						<div class={twMerge('ml-0 text-left flex-1 ', showIcon ? 'ml-4' : '')}>
-							<h3 class="text-lg font-medium text-primary">
-								{title}
-							</h3>
-							<div class="mt-2 text-sm text-secondary">
-								{@render children?.()}
-							</div>
-							{#if trashbin}
-								<p class="mt-3 text-xs text-tertiary"
-									>This item will be moved to the trashbin and can be restored by a workspace admin
-									within 3 days.</p
+			<div class="{posClass} inset-0 z-10 overflow-y-auto">
+				<div class="flex min-h-full items-center justify-center p-4">
+					<div
+						class={classNames(
+							'relative transform overflow-hidden rounded-lg bg-surface px-4 pt-5 pb-4 text-left shadow-xl transition-all sm:my-8 sm:w-full sm:max-w-lg sm:p-6',
+							open
+								? 'ease-out duration-300 opacity-100 translate-y-0 sm:scale-100'
+								: 'ease-in duration-200 opacity-0 translate-y-4 sm:translate-y-0 sm:scale-95'
+						)}
+					>
+						<div class="flex">
+							{#if showIcon}
+								<div
+									class={`flex h-12 w-12 items-center justify-center rounded-full ${theme[type].classes.iconWrapper}`}
 								>
+									<Icon class={theme[type].classes.icon} />
+								</div>
 							{/if}
+							<div class={twMerge('ml-0 text-left flex-1 ', showIcon ? 'ml-4' : '')}>
+								<h3 class="text-lg font-medium text-primary">
+									{title}
+								</h3>
+								<div class="mt-2 text-sm text-secondary">
+									{@render children?.()}
+								</div>
+								{#if trashbin}
+									<p class="mt-3 text-xs text-tertiary"
+										>This item will be moved to the trashbin and can be restored by a workspace
+										admin within 3 days.</p
+									>
+								{/if}
+							</div>
+						</div>
+						<div class="flex items-center space-x-2 flex-row-reverse space-x-reverse mt-4">
+							<Button
+								disabled={loading || confirmDisabled}
+								on:click={() => (dispatch('confirmed'), onConfirmed?.())}
+								color={theme[type].color}
+								size="sm"
+								shortCut={{ Icon: CornerDownLeft, hide: !keyListen, withoutModifier: true }}
+								variant="accent"
+								destructive={type === 'danger'}
+							>
+								{#if loading}
+									<Loader2 class="animate-spin" />
+								{/if}
+								<span class="min-w-20">{confirmationText} </span>
+							</Button>
+							<Button
+								disabled={loading}
+								on:click={() => (dispatch('canceled'), onCanceled?.())}
+								variant="default"
+								size="sm"
+								shortCut={{ key: 'Esc', hide: !keyListen, withoutModifier: true }}
+							>
+								Cancel
+							</Button>
 						</div>
-					</div>
-					<div class="flex items-center space-x-2 flex-row-reverse space-x-reverse mt-4">
-						<Button
-							disabled={loading}
-							on:click={() => (dispatch('confirmed'), onConfirmed?.())}
-							color={theme[type].color}
-							size="sm"
-							shortCut={{ Icon: CornerDownLeft, hide: !keyListen, withoutModifier: true }}
-							variant="accent"
-							destructive={type === 'danger'}
-						>
-							{#if loading}
-								<Loader2 class="animate-spin" />
-							{/if}
-							<span class="min-w-20">{confirmationText} </span>
-						</Button>
-						<Button
-							disabled={loading}
-							on:click={() => (dispatch('canceled'), onCanceled?.())}
-							variant="default"
-							size="sm"
-							shortCut={{ key: 'Esc', hide: !keyListen, withoutModifier: true }}
-						>
-							Cancel
-						</Button>
 					</div>
 				</div>
 			</div>
 		</div>
-	</div>
-{/if}
+	{/if}
+</ConditionalPortal>
diff --git a/frontend/src/lib/components/common/contextmenu/ContextMenu.svelte b/frontend/src/lib/components/common/contextmenu/ContextMenu.svelte
index ccab6ef3f0..980acf652a 100644
--- a/frontend/src/lib/components/common/contextmenu/ContextMenu.svelte
+++ b/frontend/src/lib/components/common/contextmenu/ContextMenu.svelte
@@ -1,8 +1,9 @@
 <script lang="ts">
 	import { createContextMenu, melt } from '@melt-ui/svelte'
+	import { overlayPortalTarget } from '$lib/components/common/overlayHost.svelte'
 	import { fly } from 'svelte/transition'
 	import { twMerge } from 'tailwind-merge'
-	import type { Snippet } from 'svelte'
+	import { untrack, type Snippet } from 'svelte'
 	import { pointerDownOutside } from '$lib/utils'
 	import {
 		getContextMenuContainerClass,
@@ -43,15 +44,24 @@
 		closeOnOutsideClick = true
 	}: Props = $props()
 
+	// Overlays belong to the enclosing pane when there is one — see overlayHost.
+	const hostPortal = overlayPortalTarget('body')
+
 	const {
 		elements: { menu: menuElement, item, trigger },
-		states: { open }
+		states: { open },
+		options: { portal: portalOption }
 	} = createContextMenu({
 		positioning: {
 			placement: 'right-start'
 		},
 		preventScroll: true,
-		closeOnOutsideClick: false
+		closeOnOutsideClick: false,
+		portal: untrack(() => hostPortal())
+	})
+
+	$effect(() => {
+		$portalOption = hostPortal()
 	})
 
 	function handleItemClick(menuItem: ContextMenuItem) {
diff --git a/frontend/src/lib/components/common/drawer/ConditionalPortal.svelte b/frontend/src/lib/components/common/drawer/ConditionalPortal.svelte
index 890f3d3468..9c0920a9a3 100644
--- a/frontend/src/lib/components/common/drawer/ConditionalPortal.svelte
+++ b/frontend/src/lib/components/common/drawer/ConditionalPortal.svelte
@@ -5,6 +5,7 @@
 		condition?: boolean
 		target?: string | HTMLElement | undefined
 		name?: string
+		class?: string | undefined
 		children?: import('svelte').Snippet
 	}
 
@@ -12,12 +13,13 @@
 		condition = false,
 		target = undefined,
 		name = 'conditional-portal',
+		class: clazz = undefined,
 		children
 	}: Props = $props()
 </script>
 
 {#if condition}
-	<Portal {name} {target}>{@render children?.()}</Portal>
+	<Portal {name} {target} class={clazz}>{@render children?.()}</Portal>
 {:else}
 	{@render children?.()}
 {/if}
diff --git a/frontend/src/lib/components/common/drawer/Disposable.svelte b/frontend/src/lib/components/common/drawer/Disposable.svelte
index e2898eb9ba..6a27357cf2 100644
--- a/frontend/src/lib/components/common/drawer/Disposable.svelte
+++ b/frontend/src/lib/components/common/drawer/Disposable.svelte
@@ -1,6 +1,4 @@
 <script lang="ts" module>
-	export let openedDrawers: { val: string[] } = $state({ val: [] })
-
 	// When a disposable with minZIndex is open, all disposables use that as
 	// their z-index base so that overlays opened on top (e.g. a Drawer from
 	// inside a Modal) stack correctly above it.
@@ -15,7 +13,11 @@
 
 <script lang="ts">
 	import { zIndexes } from '$lib/zIndexes'
-	import { untrack } from 'svelte'
+	import { onDestroy, untrack } from 'svelte'
+	import { overlayHostActive, overlayStack } from '../overlayHost.svelte'
+
+	const stack = overlayStack()
+	const hostActive = overlayHostActive()
 
 	interface Props {
 		open?: boolean
@@ -59,21 +61,29 @@
 
 	export function openDrawer() {
 		open = true
-		if (openedDrawers.val.includes(id)) {
+		if (stack.val.includes(id)) {
 			return
 		}
-		openedDrawers.val.push(id)
-		offset = initialOffset + openedDrawers.val.length
+		stack.val.push(id)
+		offset = initialOffset + stack.val.length
 		if (minZIndex > 0) {
 			minZIndexEntries[id] = minZIndex
 		}
 	}
 
+	// A disposable can be unmounted while still open, by an ancestor that tears its whole
+	// subtree down. Its id would then sit on the stack forever, and since the topmost entry
+	// arbitrates Escape, every overlay opened afterwards would stop answering it.
+	onDestroy(() => {
+		stack.val = stack.val.filter((drawer) => drawer !== id)
+		delete minZIndexEntries[id]
+	})
+
 	export function closeDrawer() {
 		open = false
 		offset = initialOffset
-		if (openedDrawers.val.includes(id)) {
-			openedDrawers.val = openedDrawers.val.filter((drawer) => drawer !== id)
+		if (stack.val.includes(id)) {
+			stack.val = stack.val.filter((drawer) => drawer !== id)
 			if (minZIndex > 0) {
 				delete minZIndexEntries[id]
 			}
@@ -85,7 +95,7 @@
 	}
 
 	function handleClickAway(e) {
-		const last = openedDrawers.val[openedDrawers.val.length - 1]
+		const last = stack.val[stack.val.length - 1]
 		if (last === id) {
 			e.stopPropagation()
 			closeDrawer()
@@ -93,15 +103,13 @@
 	}
 
 	function onKeyDown(event: KeyboardEvent) {
+		// Hidden hosts stay mounted and still receive window keys — see overlayHost.
+		if (!hostActive()) return
 		if (open) {
 			switch (event.key) {
 				case 'Escape':
-					if (
-						(id == openedDrawers.val[openedDrawers.val.length - 1] ||
-							openedDrawers.val.length == 0) &&
-						!preventEscape
-					) {
-						openedDrawers.val.pop()
+					if ((id == stack.val[stack.val.length - 1] || stack.val.length == 0) && !preventEscape) {
+						stack.val.pop()
 						event.preventDefault()
 						event.stopPropagation()
 						event.stopImmediatePropagation()
@@ -113,8 +121,8 @@
 	}
 
 	if (open) {
-		openedDrawers.val.push(untrack(() => id))
-		offset = untrack(() => initialOffset) + openedDrawers.val.length
+		stack.val.push(untrack(() => id))
+		offset = untrack(() => initialOffset) + stack.val.length
 		if (minZIndex > 0) {
 			minZIndexEntries[untrack(() => id)] = minZIndex
 		}
@@ -145,5 +153,5 @@
 	zIndex,
 	closeDrawer,
 	open,
-	isTop: openedDrawers.val[openedDrawers.val.length - 1] == id
+	isTop: stack.val[stack.val.length - 1] == id
 })}
diff --git a/frontend/src/lib/components/common/drawer/Drawer.svelte b/frontend/src/lib/components/common/drawer/Drawer.svelte
index 7cd89bb79b..d375bf506e 100644
--- a/frontend/src/lib/components/common/drawer/Drawer.svelte
+++ b/frontend/src/lib/components/common/drawer/Drawer.svelte
@@ -1,10 +1,17 @@
+<script lang="ts" module>
+	/** Whether the enclosing drawer is anchored to a pane rather than the viewport. Set by
+	 *  Drawer, read by its content, so the two can never disagree on the answer. */
+	export const DRAWER_ANCHORED = Symbol('drawerAnchored')
+</script>
+
 <script lang="ts">
-	import { onMount, createEventDispatcher, untrack } from 'svelte'
+	import { onMount, createEventDispatcher, setContext, untrack } from 'svelte'
 	import { BROWSER } from 'esm-env'
 	import Disposable from './Disposable.svelte'
 	import ConditionalPortal from './ConditionalPortal.svelte'
 	import { chatState } from '$lib/components/copilot/chat/sharedChatState.svelte'
 	import { useReducedMotion } from '$lib/svelte5Utils.svelte'
+	import { getOverlayHost } from '../overlayHost.svelte'
 
 	interface Props {
 		open?: boolean
@@ -72,8 +79,6 @@
 	let mounted = false
 	const dispatch = createEventDispatcher()
 
-	let style = $derived(`--duration: ${duration}s; --size: ${size};`)
-
 	function scrollLock(open: boolean) {
 		if (BROWSER) {
 			const body = document.querySelector('body')
@@ -103,10 +108,31 @@
 		mounted = true
 	})
 
-	const aiChatOpen = $derived(chatState.size > 0)
+	// An enclosing pane can claim the drawer (see overlayHost): it is then portalled
+	// into that element and positioned against it rather than the viewport. The
+	// global-chat offset is the viewport's business, so it doesn't apply there.
+	const overlayHost = getOverlayHost()
+	const host = $derived(shouldUsePortal ? overlayHost?.el() : undefined)
+	const posClass = $derived(positionClass ?? (host ? '!absolute' : undefined))
+	setContext(DRAWER_ANCHORED, () => !!host)
+
+	// A percentage size follows its container, and a pane is far narrower than the viewport
+	// that percentage was chosen against, so it can leave the drawer unusably thin. Below a
+	// 600px pane this wins over `--size` outright and the drawer covers the pane; that is the
+	// point. Pixel sizes already state their intent, and unhosted drawers are unaffected.
+	const MIN_ANCHORED_SIZE = '600px'
+	const floor = $derived(
+		host && size.trim().endsWith('%') ? `min(${MIN_ANCHORED_SIZE}, 100%)` : '0px'
+	)
+
+	let style = $derived(`--duration: ${duration}s; --size: ${size}; --min-size: ${floor};`)
+
+	const aiChatOpen = $derived(chatState.size > 0 && !host)
 </script>
 
-<ConditionalPortal condition={shouldUsePortal}>
+<!-- `contents` keeps the portal's wrapper from becoming a stray flex item of the
+     host it is appended to; the drawer inside positions against the host itself. -->
+<ConditionalPortal condition={shouldUsePortal} target={host} class={host ? 'contents' : undefined}>
 	<Disposable
 		initialOffset={offset}
 		bind:open
@@ -118,7 +144,7 @@
 		{#snippet children({ handleClickAway, zIndex, isTop })}
 			<aside
 				class="drawer windmill-app windmill-drawer {name ? `windmill-drawer-${name}` : ''} {clazz ??
-					''} {positionClass ?? ''} {aiChatOpen ? 'respect-global-chat' : ''}"
+					''} {posClass ?? ''} {aiChatOpen ? 'respect-global-chat' : ''}"
 				class:open
 				class:close={!open && timeout}
 				class:global-chat-open={aiChatOpen}
@@ -126,8 +152,8 @@
 			>
 				<!-- svelte-ignore a11y_click_events_have_key_events -->
 				<!-- svelte-ignore a11y_no_static_element_interactions -->
-				<div class="overlay {positionClass ?? ''}" onclick={handleClickAway}></div>
-				<div class="panel {placement} {positionClass}" class:size>
+				<div class="overlay {posClass ?? ''}" onclick={handleClickAway}></div>
+				<div class="panel {placement} {posClass ?? ''}" class:size>
 					{#if open || !timeout || alwaysOpen}
 						{@render children_render?.({ open, isTop })}
 					{/if}
@@ -183,6 +209,8 @@
 
 	.drawer.close > .panel {
 		height: 0;
+		/* The size floor must not keep a closed panel expanded. */
+		min-height: 0;
 		overflow: hidden;
 	}
 
@@ -226,11 +254,13 @@
 	.panel.left.size,
 	.panel.right.size {
 		max-width: var(--size);
+		min-width: var(--min-size);
 	}
 
 	.panel.top.size,
 	.panel.bottom.size {
 		max-height: var(--size);
+		min-height: var(--min-size);
 	}
 
 	.drawer.open > .panel {
diff --git a/frontend/src/lib/components/common/drawer/DrawerContent.svelte b/frontend/src/lib/components/common/drawer/DrawerContent.svelte
index dfa7d248c6..ed2ed68519 100644
--- a/frontend/src/lib/components/common/drawer/DrawerContent.svelte
+++ b/frontend/src/lib/components/common/drawer/DrawerContent.svelte
@@ -3,9 +3,10 @@
 	import { classNames } from '$lib/utils'
 	import CloseButton from '../CloseButton.svelte'
 	import { triggerableByAI } from '$lib/actions/triggerableByAI.svelte'
-	import { createEventDispatcher } from 'svelte'
+	import { createEventDispatcher, getContext } from 'svelte'
 	import EEOnly from '$lib/components/EEOnly.svelte'
 	import { enterpriseLicense } from '$lib/stores'
+	import { DRAWER_ANCHORED } from './Drawer.svelte'
 
 	interface Props {
 		aiId?: string | undefined
@@ -53,10 +54,19 @@
 	}: Props = $props()
 
 	const dispatch = createEventDispatcher()
+
+	// A drawer anchored to a pane (see overlayHost) is as tall as that pane, so sizing
+	// against the viewport would overflow it. Asking the drawer rather than the host keeps
+	// this in step with `shouldUsePortal`, which decides whether it is anchored at all.
+	const drawerAnchored = getContext<(() => boolean) | undefined>(DRAWER_ANCHORED)
+	const anchored = $derived(drawerAnchored?.() ?? false)
 </script>
 
 <div
-	class={classNames('flex flex-col divide-y', fullScreen ? 'h-screen max-h-screen' : 'h-full')}
+	class={classNames(
+		'flex flex-col divide-y',
+		fullScreen && !anchored ? 'h-screen max-h-screen' : 'h-full'
+	)}
 	{id}
 >
 	<div class="flex justify-between w-full items-center pl-2 pr-4 py-2 gap-2">
diff --git a/frontend/src/lib/components/common/languageIcons/LanguageIcon.svelte b/frontend/src/lib/components/common/languageIcons/LanguageIcon.svelte
index 09ff1082e6..617f5206dc 100644
--- a/frontend/src/lib/components/common/languageIcons/LanguageIcon.svelte
+++ b/frontend/src/lib/components/common/languageIcons/LanguageIcon.svelte
@@ -27,6 +27,7 @@
 	import RubyIcon from '$lib/components/icons/RubyIcon.svelte'
 	import RIcon from '$lib/components/icons/RIcon.svelte'
 	import ClaudeIcon from '$lib/components/icons/ClaudeIcon.svelte'
+	import DbtIcon from '$lib/components/icons/DbtIcon.svelte'
 
 	interface Props {
 		lang:
@@ -74,6 +75,7 @@
 		java: 'Java',
 		ruby: 'Ruby',
 		rlang: 'R',
+		dbt: 'dbt',
 		claudesandbox: 'Claude Sandbox'
 		// for related places search: ADD_NEW_LANG
 	}
@@ -111,6 +113,7 @@
 		ruby: RubyIcon,
 		rlang: RIcon,
 		duckdb: DuckDbIcon,
+		dbt: DbtIcon,
 		claudesandbox: TypeScriptIcon
 		// for related places search: ADD_NEW_LANG
 	}
diff --git a/frontend/src/lib/components/common/modal/Modal.svelte b/frontend/src/lib/components/common/modal/Modal.svelte
index 1596c2aa9f..20821a33f9 100644
--- a/frontend/src/lib/components/common/modal/Modal.svelte
+++ b/frontend/src/lib/components/common/modal/Modal.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
 	import { createBubbler, stopPropagation } from 'svelte/legacy'
+	import { getOverlayHost, overlayHostActive } from '$lib/components/common/overlayHost.svelte'
 
 	const bubble = createBubbler()
 	import { createEventDispatcher, untrack } from 'svelte'
@@ -8,6 +9,7 @@
 	import { twMerge } from 'tailwind-merge'
 	import CloseButton from '../CloseButton.svelte'
 	import Disposable from '../drawer/Disposable.svelte'
+	import ConditionalPortal from '../drawer/ConditionalPortal.svelte'
 	import { zIndexes } from '$lib/zIndexes'
 	import { chatState } from '$lib/components/copilot/chat/sharedChatState.svelte'
 
@@ -18,6 +20,11 @@
 		style?: string
 		cancelText?: string | undefined
 		kind?: 'button' | 'X'
+		/** Make the dialog fill the height it is anchored to and lay its body out as a flex
+		 * column, so content can size itself with `h-full` / `flex-1 min-h-0`. Off by default:
+		 * the dialog otherwise hugs its content, and percentage heights inside it do not
+		 * resolve (the centering wrapper is `min-h-full`, i.e. height:auto). */
+		fillHeight?: boolean
 		/** Force a minimum z-index base. Defaults to elevating above the AI chat
 		 * side panel when it is open. Pass an explicit value to stack above other
 		 * surfaces (e.g. a modal opened over the /sessions preview-pane editor). */
@@ -34,12 +41,22 @@
 		style = '',
 		cancelText = undefined,
 		kind = 'button',
+		fillHeight = false,
 		minZIndex: minZIndexProp = undefined,
 		settings,
 		children: children_render,
 		actions
 	}: Props = $props()
 
+	// Anchored to the enclosing pane when there is one (see overlayHost): portalled into it
+	// and positioned against it, so the dialog covers that pane rather than the whole app.
+	// Both halves are required — `absolute` resolves against the nearest positioned DOM
+	// ancestor, which without the portal is whatever box the caller happens to sit in.
+	const overlayHost = getOverlayHost()
+	const hostEl = $derived(overlayHost?.el())
+	const posClass = $derived(hostEl ? 'absolute' : 'fixed')
+	const hostActive = overlayHostActive()
+
 	const dispatch = createEventDispatcher()
 
 	let disposable: Disposable | undefined = $state(undefined)
@@ -60,6 +77,8 @@
 	})
 
 	function onKeyDown(event: KeyboardEvent) {
+		// Hidden hosts stay mounted and still receive window keys — see overlayHost.
+		if (!hostActive()) return
 		if (open) {
 			switch (event.key) {
 				case 'Enter':
@@ -85,74 +104,84 @@
 
 <Disposable bind:open bind:this={disposable} preventEscape {minZIndex}>
 	{#snippet children({ zIndex })}
-		{#if open}
-			<!-- svelte-ignore a11y_click_events_have_key_events -->
-			<!-- svelte-ignore a11y_no_noninteractive_element_interactions -->
-			<div
-				onclick={() => (open = false)}
-				transition:fadeFast|local
-				class="fixed top-0 bottom-0 left-0 right-0"
-				style="z-index: {zIndex}"
-				role="dialog"
-				tabindex="-1"
-			>
+		<ConditionalPortal condition={!!hostEl} target={hostEl} class="contents">
+			{#if open}
+				<!-- svelte-ignore a11y_click_events_have_key_events -->
+				<!-- svelte-ignore a11y_no_noninteractive_element_interactions -->
 				<div
-					class={twMerge(
-						'fixed inset-0 bg-gray-500 bg-opacity-75 transition-opacity',
-						open ? 'ease-out duration-300 opacity-100' : 'ease-in duration-200 opacity-0'
-					)}
-				></div>
+					onclick={() => (open = false)}
+					transition:fadeFast|local
+					class="{posClass} top-0 bottom-0 left-0 right-0"
+					style="z-index: {zIndex}"
+					role="dialog"
+					tabindex="-1"
+				>
+					<div
+						class={twMerge(
+							posClass,
+							'inset-0 bg-gray-500 bg-opacity-75 transition-opacity',
+							open ? 'ease-out duration-300 opacity-100' : 'ease-in duration-200 opacity-0'
+						)}
+					></div>
 
-				<div class="fixed inset-0 z-10 overflow-y-auto">
-					<div class="flex min-h-full items-center justify-center p-4">
-						<!-- svelte-ignore a11y_no_static_element_interactions -->
+					<div class="{posClass} inset-0 z-10 overflow-y-auto">
 						<div
-							onclick={stopPropagation(bubble('click'))}
-							class={twMerge(
-								'relative transform overflow-hidden rounded-md bg-surface px-4 pt-5 pb-4 text-left shadow-xl transition-all sm:my-8 sm:w-full sm:max-w-lg sm:p-6',
-								c,
-								open
-									? 'ease-out duration-300 opacity-100 translate-y-0 sm:scale-100'
-									: 'ease-in duration-200 opacity-0 translate-y-4 sm:translate-y-0 sm:scale-95'
-							)}
-							{style}
+							class="flex {fillHeight ? 'h-full' : 'min-h-full'} items-center justify-center p-4"
 						>
-							{#if kind == 'X'}
-								<div class="absolute top-4 right-4"
-									><CloseButton on:close={() => (open = false)} /></div
-								>
-							{/if}
-							<div class="flex">
-								<div class="text-left flex-1">
-									<div class="flex flex-row items-center justify-between">
-										<h3 class="text-emphasis text-lg font-semibold">{title}</h3>
-										{@render settings?.()}
-									</div>
-
-									<div class="mt-4 text-sm text-primary">
-										{@render children_render?.()}
-									</div>
-								</div>
-							</div>
-							{#if kind == 'button'}
-								<div class="flex items-center space-x-2 flex-row-reverse space-x-reverse mt-4">
-									{@render actions?.()}
-									<Button
-										on:click={() => {
-											dispatch('canceled')
-											open = false
-										}}
-										color="light"
-										size="sm"
+							<!-- svelte-ignore a11y_no_static_element_interactions -->
+							<div
+								onclick={stopPropagation(bubble('click'))}
+								class={twMerge(
+									'relative transform overflow-hidden rounded-md bg-surface px-4 pt-5 pb-4 text-left shadow-xl transition-all sm:w-full sm:max-w-lg sm:p-6',
+									// The margins are what keeps a content-sized dialog off the viewport edges; a
+									// filling one takes its inset from the wrapper's padding instead.
+									fillHeight ? 'h-full flex flex-col' : 'sm:my-8',
+									c,
+									open
+										? 'ease-out duration-300 opacity-100 translate-y-0 sm:scale-100'
+										: 'ease-in duration-200 opacity-0 translate-y-4 sm:translate-y-0 sm:scale-95'
+								)}
+								{style}
+							>
+								{#if kind == 'X'}
+									<div class="absolute top-4 right-4"
+										><CloseButton on:close={() => (open = false)} /></div
 									>
-										{cancelText ?? 'Cancel'}
-									</Button>
+								{/if}
+								<div class="flex {fillHeight ? 'flex-1 min-h-0' : ''}">
+									<!-- min-w-0: without it this flex item takes its content's min-content width and
+									     stretches the modal past its max-width instead of letting content shrink. -->
+									<div class="text-left flex-1 min-w-0 {fillHeight ? 'flex flex-col min-h-0' : ''}">
+										<div class="flex flex-row items-center justify-between">
+											<h3 class="text-emphasis text-lg font-semibold">{title}</h3>
+											{@render settings?.()}
+										</div>
+
+										<div class="mt-4 text-sm text-primary {fillHeight ? 'flex-1 min-h-0' : ''}">
+											{@render children_render?.()}
+										</div>
+									</div>
 								</div>
-							{/if}
+								{#if kind == 'button'}
+									<div class="flex items-center space-x-2 flex-row-reverse space-x-reverse mt-4">
+										{@render actions?.()}
+										<Button
+											on:click={() => {
+												dispatch('canceled')
+												open = false
+											}}
+											color="light"
+											size="sm"
+										>
+											{cancelText ?? 'Cancel'}
+										</Button>
+									</div>
+								{/if}
+							</div>
 						</div>
 					</div>
 				</div>
-			</div>
-		{/if}
+			{/if}
+		</ConditionalPortal>
 	{/snippet}
 </Disposable>
diff --git a/frontend/src/lib/components/common/overlayHost.svelte.ts b/frontend/src/lib/components/common/overlayHost.svelte.ts
new file mode 100644
index 0000000000..0e76709cbf
--- /dev/null
+++ b/frontend/src/lib/components/common/overlayHost.svelte.ts
@@ -0,0 +1,74 @@
+import { getContext, setContext } from 'svelte'
+
+export type OverlayStack = { val: string[] }
+
+/** Overlays that answer to the viewport share this one. */
+const globalOverlayStack: OverlayStack = $state({ val: [] })
+
+/** Where overlays opened from this subtree (drawers, modals, popovers) belong. A host that
+ *  embeds an editor in its own box provides one so its overlays stay inside that box — one
+ *  tab's drawer must never cover a sibling tab or the chrome around it. */
+export type OverlayHostContext = {
+	/** Element the overlays anchor to instead of the viewport. */
+	el: () => HTMLElement | undefined
+	/** Stack this host arbitrates Escape and click-away on. */
+	drawers: OverlayStack
+	/** Whether this host is the one on screen. Hosts stay mounted while hidden, and
+	 *  `opacity: 0` / `pointer-events: none` do not stop keyboard events from reaching a
+	 *  `svelte:window` listener — so key handlers must ask before acting. */
+	active: () => boolean
+}
+
+const OVERLAY_HOST_KEY = 'overlayHost'
+
+export function setOverlayHost(host: OverlayHostContext) {
+	setContext<OverlayHostContext>(OVERLAY_HOST_KEY, host)
+}
+
+export function getOverlayHost(): OverlayHostContext | undefined {
+	return getContext<OverlayHostContext | undefined>(OVERLAY_HOST_KEY)
+}
+
+/**
+ * The stack this component's overlays belong to. An enclosing pane keeps its own, because
+ * it stays mounted while hidden: on the shared stack, an overlay left open in a hidden pane
+ * would outrank — and swallow the Escape of — the pane the user is looking at.
+ *
+ * Reads context, so call it during component initialisation.
+ */
+export function overlayStack(): OverlayStack {
+	return getOverlayHost()?.drawers ?? globalOverlayStack
+}
+
+/**
+ * Portal target for an overlay: the caller's own `fallback` container, resolved within the
+ * enclosing host pane when there is one.
+ *
+ * An id fallback such as `#flow-editor` is not unique — a session keeps every visited tab
+ * mounted, so a document-wide querySelector would drop the overlay into whichever editor
+ * came first in the DOM. That tab is `opacity-0 pointer-events-none`, so the overlay
+ * renders invisibly. Scoping the lookup to the host keeps the caller's chosen container
+ * (which sets the overlay's offset parent and clipping) while picking this tab's copy of
+ * it; a fallback that names nothing inside the host, such as `body`, falls back to the
+ * host itself.
+ *
+ * Reads context, so call it during component initialisation; call the returned getter
+ * where the target is used, to stay reactive as the host element mounts.
+ */
+export function overlayPortalTarget(fallback: string): () => HTMLElement | string {
+	const host = getOverlayHost()
+	return () => {
+		const el = host?.el()
+		if (!el) return fallback
+		return el.querySelector<HTMLElement>(fallback) ?? el
+	}
+}
+
+/**
+ * Whether this component's overlays should respond to window-level keys. False only for
+ * overlays living in a host that is currently hidden; true everywhere outside a host.
+ */
+export function overlayHostActive(): () => boolean {
+	const host = getOverlayHost()
+	return () => host?.active() ?? true
+}
diff --git a/frontend/src/lib/components/common/table/AppRow.svelte b/frontend/src/lib/components/common/table/AppRow.svelte
index 4f2c760648..636bd2c9d6 100644
--- a/frontend/src/lib/components/common/table/AppRow.svelte
+++ b/frontend/src/lib/components/common/table/AppRow.svelte
@@ -11,6 +11,7 @@
 	import { createEventDispatcher } from 'svelte'
 	import Button from '../button/Button.svelte'
 	import Row from './Row.svelte'
+	import type { RowSelection } from './rowSelection'
 	import InheritedLabels from '$lib/components/InheritedLabels.svelte'
 	import Badge from '../badge/Badge.svelte'
 	import {
@@ -34,7 +35,8 @@
 	import AppDeploymentHistory from '$lib/components/apps/editor/AppDeploymentHistory.svelte'
 	import { isDeployable } from '$lib/utils_deployable'
 	import { getDeployUiSettings } from '$lib/components/home/deploy_ui'
-	import { buildForkEditUrl, editInForkAllowed, editInForkLabel } from '$lib/utils/editInFork'
+	import { editInForkAllowed, editInForkLabel, onEditInForkClick } from '$lib/utils/editInFork'
+	import EditInForkButton from './EditInForkButton.svelte'
 	import { isCloudHosted } from '$lib/cloud'
 
 	interface Props {
@@ -48,6 +50,7 @@
 		menuOpen?: boolean
 		showEditButton?: boolean
 		keyboardSelected?: boolean
+		rowSelection?: RowSelection
 	}
 
 	let {
@@ -60,7 +63,8 @@
 		depth = 0,
 		menuOpen = $bindable(false),
 		showEditButton = $bindable(true),
-		keyboardSelected = false
+		keyboardSelected = false,
+		rowSelection = undefined
 	}: Props = $props()
 
 	const dispatch = createEventDispatcher()
@@ -112,6 +116,7 @@
 	canFavorite={!app.draft_only}
 	{depth}
 	{keyboardSelected}
+	{rowSelection}
 >
 	{#snippet badges()}
 		{#if app.execution_mode == 'anonymous'}
@@ -170,17 +175,7 @@
 					</div>
 				{/if}
 				{#if !isCloudHosted() && editInForkAllowed($workspaceStore, $userWorkspaces) && (!showEditButton || !app.canWrite)}
-					<div>
-						<Button
-							variant={!showEditButton ? 'default' : 'subtle'}
-							wrapperClasses="w-32"
-							unifiedSize="md"
-							startIcon={{ icon: GitFork }}
-							href={buildForkEditUrl(app.raw_app ? 'raw_app' : 'app', app.path)}
-						>
-							{editInForkLabel($workspaceStore, $userWorkspaces)}
-						</Button>
-					</div>
+					<EditInForkButton itemType={app.raw_app ? 'raw_app' : 'app'} path={app.path} />
 				{/if}
 			{/if}
 		</span>
@@ -235,8 +230,10 @@
 					},
 					{
 						displayName: editInForkLabel($workspaceStore, $userWorkspaces),
-						icon: GitFork,
-						href: buildForkEditUrl(app.raw_app ? 'raw_app' : 'app', path),
+						icon: Pen,
+						// No `href`: the handler resolves the destination asynchronously, and a melt
+						// menu item's anchor navigates before a delegated onclick can preventDefault it.
+						action: (e) => onEditInForkClick(e, app.raw_app ? 'raw_app' : 'app', path),
 						hide:
 							$userStore?.operator ||
 							isCloudHosted() ||
diff --git a/frontend/src/lib/components/common/table/EditInForkButton.svelte b/frontend/src/lib/components/common/table/EditInForkButton.svelte
new file mode 100644
index 0000000000..fe5c6bc193
--- /dev/null
+++ b/frontend/src/lib/components/common/table/EditInForkButton.svelte
@@ -0,0 +1,53 @@
+<script lang="ts">
+	import { Pen } from 'lucide-svelte'
+	import { userWorkspaces, workspaceStore } from '$lib/stores'
+	import {
+		devWorkspaceEditUrl,
+		editInForkLabel,
+		forkWorkspaceUrl,
+		onEditInForkClick,
+		type ItemType
+	} from '$lib/utils/editInFork'
+	import { findCanonicalDevWorkspace } from '$lib/utils/workspaceHierarchy'
+	import Button from '../button/Button.svelte'
+
+	interface Props {
+		itemType: ItemType
+		path: string
+	}
+
+	let { itemType, path }: Props = $props()
+
+	let dev = $derived(findCanonicalDevWorkspace($workspaceStore, $userWorkspaces))
+	let label = $derived(editInForkLabel($workspaceStore, $userWorkspaces))
+	// Built from the reactive `dev` rather than `buildForkEditUrl`, whose store reads are untracked:
+	// the href would otherwise stay frozen at mount while the label kept updating, so a row that
+	// outlives a workspace change would offer to fork a workspace that already has a dev.
+	let href = $derived(
+		dev ? devWorkspaceEditUrl(itemType, path, dev.id) : forkWorkspaceUrl(itemType, path)
+	)
+</script>
+
+<!-- title on the wrapper, not on <Button>: Button renders its `title` prop only in the
+     <button> branch, so the <a> branch taken here (href is set) would silently drop it.
+     On the wrapper it also covers the icon and padding, not just the label text. -->
+<div title={label}>
+	<Button
+		variant="subtle"
+		wrapperClasses="max-w-56"
+		unifiedSize="md"
+		startIcon={{ icon: Pen }}
+		{href}
+		onClick={(e) => onEditInForkClick(e, itemType, path, { hasHref: true })}
+	>
+		{#if dev}
+			<!-- Split so only the workspace name ellipsizes — "Edit in" always stays whole. -->
+			<span class="inline-flex items-center gap-1 min-w-0">
+				<span class="shrink-0">Edit in</span>
+				<span class="truncate">{dev.name}</span>
+			</span>
+		{:else}
+			<span class="truncate">{label}</span>
+		{/if}
+	</Button>
+</div>
diff --git a/frontend/src/lib/components/common/table/FlowRow.svelte b/frontend/src/lib/components/common/table/FlowRow.svelte
index a19715686f..a155ca3a97 100644
--- a/frontend/src/lib/components/common/table/FlowRow.svelte
+++ b/frontend/src/lib/components/common/table/FlowRow.svelte
@@ -14,6 +14,7 @@
 	import Badge from '../badge/Badge.svelte'
 	import Button from '../button/Button.svelte'
 	import Row from './Row.svelte'
+	import type { RowSelection } from './rowSelection'
 	import { sendUserToast } from '$lib/toast'
 	import { copyToClipboard, isOwner } from '$lib/utils'
 	import { isDeployable } from '$lib/utils_deployable'
@@ -36,7 +37,8 @@
 	import FlowHistory from '$lib/components/flows/FlowHistory.svelte'
 	import InheritedLabels from '$lib/components/InheritedLabels.svelte'
 	import { getDeployUiSettings } from '$lib/components/home/deploy_ui'
-	import { buildForkEditUrl, editInForkAllowed, editInForkLabel } from '$lib/utils/editInFork'
+	import { editInForkAllowed, editInForkLabel, onEditInForkClick } from '$lib/utils/editInFork'
+	import EditInForkButton from './EditInForkButton.svelte'
 	import { isCloudHosted } from '$lib/cloud'
 
 	interface Props {
@@ -57,6 +59,7 @@
 		menuOpen?: boolean
 		showEditButton?: boolean
 		keyboardSelected?: boolean
+		rowSelection?: RowSelection
 	}
 
 	let {
@@ -70,7 +73,8 @@
 		depth = 0,
 		menuOpen = $bindable(false),
 		showEditButton = $bindable(true),
-		keyboardSelected = false
+		keyboardSelected = false,
+		rowSelection = undefined
 	}: Props = $props()
 
 	const dispatch = createEventDispatcher()
@@ -135,6 +139,7 @@
 	canFavorite={!flow.draft_only}
 	{depth}
 	{keyboardSelected}
+	{rowSelection}
 >
 	{#snippet badges()}
 		{#if flow.archived}
@@ -191,17 +196,7 @@
 					</div>
 				{/if}
 				{#if !isCloudHosted() && editInForkAllowed($workspaceStore, $userWorkspaces) && (!showEditButton || !flow.canWrite)}
-					<div>
-						<Button
-							variant={!showEditButton ? 'default' : 'subtle'}
-							wrapperClasses="w-32"
-							unifiedSize="md"
-							startIcon={{ icon: GitFork }}
-							href={buildForkEditUrl('flow', flow.path)}
-						>
-							{editInForkLabel($workspaceStore, $userWorkspaces)}
-						</Button>
-					</div>
+					<EditInForkButton itemType="flow" path={flow.path} />
 				{/if}
 			{/if}
 		</span>
@@ -252,8 +247,10 @@
 					},
 					{
 						displayName: editInForkLabel($workspaceStore, $userWorkspaces),
-						icon: GitFork,
-						href: buildForkEditUrl('flow', path),
+						icon: Pen,
+						// No `href`: the handler resolves the destination asynchronously, and a melt
+						// menu item's anchor navigates before a delegated onclick can preventDefault it.
+						action: (e) => onEditInForkClick(e, 'flow', path),
 						hide:
 							$userStore?.operator ||
 							isCloudHosted() ||
diff --git a/frontend/src/lib/components/common/table/Row.svelte b/frontend/src/lib/components/common/table/Row.svelte
index df0e4ce023..849d77e2d9 100644
--- a/frontend/src/lib/components/common/table/Row.svelte
+++ b/frontend/src/lib/components/common/table/Row.svelte
@@ -8,6 +8,7 @@
 	import { triggerableByAI } from '$lib/actions/triggerableByAI.svelte'
 	import Tooltip from '../../meltComponents/Tooltip.svelte'
 	import Checkbox from '../checkbox/Checkbox.svelte'
+	import type { RowSelection } from './rowSelection'
 
 	interface Props {
 		marked: string | undefined
@@ -24,6 +25,9 @@
 		 * children — checkbox, buttons, links) toggles selection. Opt-in so
 		 * existing tables that don't want it are unaffected. */
 		selectOnRowClick?: boolean
+		/** Home-style multi-select: the kind icon doubles as the checkbox instead
+		 * of adding a column, so an unused selection costs the row nothing. */
+		rowSelection?: RowSelection
 		alignWithSelectable?: boolean
 		errorHandlerMuted?: boolean
 		aiId?: string | undefined
@@ -80,6 +84,7 @@
 		isSelectable = false,
 		selectDisabledReason = undefined,
 		selectOnRowClick = false,
+		rowSelection = undefined,
 		alignWithSelectable = false,
 		errorHandlerMuted = false,
 		aiId = undefined,
@@ -113,6 +118,9 @@
 	})
 
 	const clickToSelect = $derived(selectOnRowClick && isSelectable && !disabled)
+	// Once selection mode is on the whole card toggles, and the title stops being
+	// a link so a stray click can't navigate out of the selection.
+	const inSelectionMode = $derived(!!rowSelection?.active)
 
 	// Interactive children that handle their own activation — selecting the row on
 	// top of them would double-fire (mouse) or hijack their keyboard activation.
@@ -121,6 +129,11 @@
 	}
 
 	function handleRowClick(e: MouseEvent) {
+		if (inSelectionMode) {
+			if (fromInteractiveChild(e)) return
+			rowSelection?.onToggle(e)
+			return
+		}
 		if (!clickToSelect) return
 		// Don't double-toggle when the click originated from an interactive child
 		// (the checkbox itself, action buttons, or the title link).
@@ -157,12 +170,18 @@
      with its sibling folder at the same depth. -->
 <div
 	bind:this={rowEl}
+	data-row-selection-key={rowSelection?.key}
+	data-row-keyboard-selected={keyboardSelected ? 'true' : undefined}
 	class={twMerge(
-		'w-full inline-flex items-center gap-4 first-of-type:!border-t-0 first-of-type:rounded-t-md last-of-type:rounded-b-md [*:not(:last-child)]:border-b px-4 py-3 border-b last:border-b-0',
+		'group/row w-full inline-flex items-center gap-4 first-of-type:!border-t-0 first-of-type:rounded-t-md last-of-type:rounded-b-md [*:not(:last-child)]:border-b px-4 py-3 border-b last:border-b-0',
 		depth > 0 ? '!rounded-none' : '',
 		disabled ? 'opacity-25' : 'hover:bg-surface-hover',
-		clickToSelect ? 'cursor-pointer select-none' : '',
-		selected ? 'bg-surface-accent-selected' : keyboardSelected ? 'bg-gray-200 dark:bg-gray-700' : ''
+		clickToSelect || inSelectionMode ? 'cursor-pointer select-none' : '',
+		selected || rowSelection?.selected
+			? 'bg-surface-accent-selected'
+			: keyboardSelected
+				? 'bg-gray-200 dark:bg-gray-700'
+				: ''
 	)}
 	style={depth > 0 ? `padding-left: ${(depth + 1) * 16}px;` : ''}
 	role={clickToSelect ? 'button' : undefined}
@@ -181,16 +200,47 @@
 		<div class="rounded max-w-4 w-full"></div>
 	{/if}
 
-	{#if href}
+	{#if rowSelection}
+		<!-- The icon slot itself: the kind icon until the row is hovered (or
+		     selection mode is on), the checkbox from then on. Both are stacked in a
+		     fixed 16px box and swapped with visibility so nothing shifts. -->
+		<div class="shrink relative w-4 h-4">
+			<div
+				class={twMerge(
+					'absolute inset-0',
+					rowSelection.active ? 'invisible' : 'group-hover/row:invisible'
+				)}
+			>
+				<RowIcon {kind} {triggerKind} />
+			</div>
+			<Checkbox
+				class={twMerge(
+					'absolute inset-0 w-4 h-4',
+					rowSelection.active ? '' : 'invisible group-hover/row:visible'
+				)}
+				checked={rowSelection.selected}
+				title={rowSelection.selected ? 'Deselect' : 'Select (shift-click to select a range)'}
+				onClick={(e) => {
+					// Left unprevented on purpose: the browser's own toggle already lands
+					// on the value we are about to compute, except on a range re-select,
+					// which Checkbox re-asserts. Preventing it would revert the box AFTER
+					// the update and leave every clicked row visually unticked.
+					e.stopPropagation()
+					rowSelection?.onToggle(e)
+				}}
+			/>
+		</div>
+	{/if}
+
+	{#if href && !inSelectionMode}
 		<a
 			{href}
-			data-row-keyboard-selected={keyboardSelected ? 'true' : undefined}
 			class="min-w-0 grow hover:underline decoration-gray-400 inline-flex items-center gap-4"
 		>
-			{@render rowContent()}
+			{@render rowContent(!rowSelection)}
 		</a>
 	{:else}
-		{@render rowContent()}
+		{@render rowContent(!rowSelection)}
 	{/if}
 
 	{#if errorHandlerMuted}
@@ -216,11 +266,13 @@
 	</div>
 </div>
 
-{#snippet rowContent()}
-	<div class="shrink">
-		<RowIcon {kind} {triggerKind} />
-	</div>
-	<div class="grow">
+{#snippet rowContent(withIcon: boolean)}
+	{#if withIcon}
+		<div class="shrink">
+			<RowIcon {kind} {triggerKind} />
+		</div>
+	{/if}
+	<div class="grow min-w-0">
 		<div class="text-emphasis flex-wrap text-left text-xs font-semibold">
 			{#if customSummary}
 				{@render customSummary?.()}
diff --git a/frontend/src/lib/components/common/table/ScriptRow.svelte b/frontend/src/lib/components/common/table/ScriptRow.svelte
index 4891ac8fc3..25b557690e 100644
--- a/frontend/src/lib/components/common/table/ScriptRow.svelte
+++ b/frontend/src/lib/components/common/table/ScriptRow.svelte
@@ -16,6 +16,7 @@
 	import Badge from '../badge/Badge.svelte'
 	import Button from '../button/Button.svelte'
 	import Row from './Row.svelte'
+	import type { RowSelection } from './rowSelection'
 	import { sendUserToast } from '$lib/toast'
 	import { capitalize, copyToClipboard, isOwner } from '$lib/utils'
 	import { isDeployable } from '$lib/utils_deployable'
@@ -46,7 +47,8 @@
 	import Popover from '$lib/components/Popover.svelte'
 	import Tooltip from '$lib/components/Tooltip.svelte'
 	import { getDeployUiSettings } from '$lib/components/home/deploy_ui'
-	import { buildForkEditUrl, editInForkAllowed, editInForkLabel } from '$lib/utils/editInFork'
+	import { editInForkAllowed, editInForkLabel, onEditInForkClick } from '$lib/utils/editInFork'
+	import EditInForkButton from './EditInForkButton.svelte'
 	import { isCloudHosted } from '$lib/cloud'
 
 	interface Props {
@@ -68,6 +70,7 @@
 		menuOpen?: boolean
 		showEditButton?: boolean
 		keyboardSelected?: boolean
+		rowSelection?: RowSelection
 	}
 
 	let {
@@ -82,7 +85,8 @@
 		depth = 0,
 		menuOpen = $bindable(false),
 		showEditButton = $bindable(true),
-		keyboardSelected = false
+		keyboardSelected = false,
+		rowSelection = undefined
 	}: Props = $props()
 
 	const dispatch = createEventDispatcher()
@@ -153,6 +157,7 @@
 	canFavorite={!script.draft_only}
 	{depth}
 	{keyboardSelected}
+	{rowSelection}
 >
 	{#snippet badges()}
 		{#if script.lock_error_logs}
@@ -249,17 +254,7 @@
 					{/if}
 				{/if}
 				{#if !isCloudHosted() && editInForkAllowed($workspaceStore, $userWorkspaces) && (!showEditButton || !script.canWrite)}
-					<div>
-						<Button
-							variant={!showEditButton ? 'default' : 'subtle'}
-							wrapperClasses="w-32"
-							unifiedSize="md"
-							startIcon={{ icon: GitFork }}
-							href={buildForkEditUrl('script', script.path)}
-						>
-							{editInForkLabel($workspaceStore, $userWorkspaces)}
-						</Button>
-					</div>
+					<EditInForkButton itemType="script" path={script.path} />
 				{/if}
 			{/if}
 		</span>
@@ -332,8 +327,10 @@
 					},
 					{
 						displayName: editInForkLabel($workspaceStore, $userWorkspaces),
-						icon: GitFork,
-						href: buildForkEditUrl('script', script.path),
+						icon: Pen,
+						// No `href`: the handler resolves the destination asynchronously, and a melt
+						// menu item's anchor navigates before a delegated onclick can preventDefault it.
+						action: (e) => onEditInForkClick(e, 'script', script.path),
 						hide:
 							$userStore?.operator ||
 							isCloudHosted() ||
diff --git a/frontend/src/lib/components/common/table/rowSelection.ts b/frontend/src/lib/components/common/table/rowSelection.ts
new file mode 100644
index 0000000000..081f29addc
--- /dev/null
+++ b/frontend/src/lib/components/common/table/rowSelection.ts
@@ -0,0 +1,16 @@
+/**
+ * Wiring for a row whose kind icon doubles as a selection control: the icon
+ * swaps to a checkbox on hover, and stays one while a selection is active.
+ * Distinct from `Row`'s `isSelectable`, which adds a permanent leading checkbox
+ * column — this variant leaves the default row untouched until it is used.
+ */
+export type RowSelection = {
+	/** Stable row identity; also emitted as `data-row-selection-key` so a caller
+	 * can read the rendered order back from the DOM (for a shift-click range). */
+	key: string
+	selected: boolean
+	/** Selection mode is on: every row shows its checkbox, and clicking the row
+	 * toggles it instead of opening the item. */
+	active: boolean
+	onToggle: (e: MouseEvent | KeyboardEvent) => void
+}
diff --git a/frontend/src/lib/components/common/tabs/DraggableTabs.svelte b/frontend/src/lib/components/common/tabs/DraggableTabs.svelte
index 9b2d75b132..d89bd37fa6 100644
--- a/frontend/src/lib/components/common/tabs/DraggableTabs.svelte
+++ b/frontend/src/lib/components/common/tabs/DraggableTabs.svelte
@@ -3,6 +3,9 @@
 		/** Stable identifier; used as the `[key]` for dnd and the activeId equality check. */
 		id: string
 		label: string
+		/** Hover title. Labels truncate at 180px, so set this whenever the label can
+		 * be long enough that two tabs would truncate to the same visible text. */
+		title?: string
 		/** Optional lucide-svelte (or compatible) component rendered at 12px before the label. */
 		icon?: any
 		/** Optional class applied to the icon (e.g. `text-accent` to tint it). */
@@ -26,7 +29,6 @@
 	import { X } from 'lucide-svelte'
 	import { twMerge } from 'tailwind-merge'
 	import { untrack } from 'svelte'
-	import ScrollableX from '../ScrollableX.svelte'
 
 	interface Props {
 		tabs: TabItem[]
@@ -38,7 +40,9 @@
 		 * activated via Enter/Space — lets the active tab host a secondary affordance
 		 * (e.g. toggling the breadcrumb picker rendered in `tabAccessory`). */
 		onActiveClick?: (id: string) => void
-		/** Extra classes for the outer tab strip. */
+		/** Extra classes for the outer tab strip. It is 32px tall unless `trailing`
+		 * content is taller; a fixed height here overrides that, and going taller
+		 * pulls the tabs away from the scroll bar, which stays on the bottom edge. */
 		class?: string
 		/** Render inside the scroll row, right after the last tab (e.g. a "+" new-tab
 		 * button) — scrolls with the tabs, unlike `trailing`. */
@@ -85,6 +89,85 @@
 		if (!isDragging) dndMiddle = next
 	})
 
+	// Scroll bar. The native one is hidden (`no-scrollbar`) and redrawn here: its
+	// height is a WebKit-only setting, so Firefox spends 11px of the strip on a
+	// bar there is no room for and clips the tabs. Ours is 4px in every engine and
+	// costs no layout height at all.
+	const MIN_THUMB = 24
+	let scrollEl = $state<HTMLElement | undefined>(undefined)
+	let scrollLeft = $state(0)
+	let viewport = $state(0)
+	let content = $state(0)
+	const scrollable = $derived(Math.max(0, content - viewport))
+	const overflowing = $derived(scrollable > 1)
+	// Clamped to the viewport: a pane dragged shut leaves a few pixels of strip,
+	// and an unclamped minimum-width thumb would hang out of it.
+	const thumbWidth = $derived(
+		overflowing ? Math.min(viewport, Math.max(MIN_THUMB, (viewport / content) * viewport)) : 0
+	)
+	// Clamped at both ends: `scrollLeft` is fractional on HiDPI while the widths
+	// are rounded, so the ratio can tip past 1, and WebKit's elastic overscroll
+	// drives it negative — either way the thumb would leave the track.
+	const thumbLeft = $derived(
+		scrollable > 0
+			? Math.max(
+					0,
+					Math.min(viewport - thumbWidth, (scrollLeft / scrollable) * (viewport - thumbWidth))
+				)
+			: 0
+	)
+
+	function measure() {
+		const el = scrollEl
+		if (!el) return
+		scrollLeft = el.scrollLeft
+		viewport = el.clientWidth
+		content = el.scrollWidth
+	}
+
+	// Both ends move independently: the viewport on a pane resize, the content as
+	// tabs open, close and get renamed.
+	$effect(() => {
+		const el = scrollEl
+		if (!el) return
+		measure()
+		const ro = new ResizeObserver(measure)
+		ro.observe(el)
+		if (el.firstElementChild) ro.observe(el.firstElementChild)
+		return () => ro.disconnect()
+	})
+
+	// Drag the thumb: pointer capture keeps the gesture alive past the strip's
+	// edges, and the ratio maps thumb travel back onto scroll travel. Recomputing
+	// from the anchor each move (rather than accumulating) means clamping at
+	// either end doesn't drift, and reading the travel live keeps a tab opening
+	// mid-drag from scaling every later move against a stale track.
+	function handleThumbPointerDown(e: PointerEvent) {
+		const el = scrollEl
+		// Primary button only: a right-click would open the context menu without
+		// delivering the pointerup that ends the drag.
+		if (!el || e.button !== 0) return
+		e.preventDefault()
+		const target = e.currentTarget as HTMLElement
+		const startX = e.clientX
+		const startScroll = el.scrollLeft
+		target.setPointerCapture(e.pointerId)
+		const onMove = (ev: PointerEvent) => {
+			const travel = viewport - thumbWidth
+			if (travel <= 0) return
+			el.scrollLeft = startScroll + ((ev.clientX - startX) / travel) * scrollable
+		}
+		const onUp = (ev: PointerEvent) => {
+			target.releasePointerCapture(ev.pointerId)
+			target.removeEventListener('pointermove', onMove)
+			target.removeEventListener('pointerup', onUp)
+			target.removeEventListener('pointercancel', onUp)
+		}
+		target.addEventListener('pointermove', onMove)
+		target.addEventListener('pointerup', onUp)
+		target.addEventListener('pointercancel', onUp)
+	}
+
 	function handleConsider(e: CustomEvent<DndEvent<TabItem>>) {
 		isDragging = true
 		dndMiddle = e.detail.items
@@ -97,7 +180,7 @@
 
 	function tabClasses(isActive: boolean) {
 		return twMerge(
-			'group relative inline-flex items-center gap-1.5 px-2.5 h-7 text-xs rounded-md select-none cursor-pointer whitespace-nowrap transition-colors focus:outline-none focus-visible:ring-1 focus-visible:ring-border-selected focus-visible:ring-inset',
+			'group relative inline-flex items-center gap-1.5 px-2.5 h-6 text-xs rounded-md select-none cursor-pointer whitespace-nowrap transition-colors focus:outline-none focus-visible:ring-1 focus-visible:ring-border-selected focus-visible:ring-inset',
 			isActive
 				? 'bg-surface-tertiary text-emphasis'
 				: 'bg-transparent text-hint hover:text-secondary'
@@ -153,6 +236,7 @@
 	<div
 		role="tab"
 		data-tab-id={tab.id}
+		title={tab.title}
 		aria-selected={isActive}
 		tabindex={isActive ? 0 : -1}
 		class={twMerge(tabClasses(isActive), tab.closable !== false && 'pr-1')}
@@ -185,41 +269,69 @@
 	</div>
 {/snippet}
 
-<div bind:this={stripEl} class={twMerge('flex items-center bg-surface', c)}>
-	<!-- 4px bar to match the strip's `pb-1` reserve. -->
-	<ScrollableX class="flex-1 min-w-0 pt-1 pl-1 pb-1" style="--wm-scrollbar-size: 4px;">
-		<div class="flex items-center" role="tablist">
-			{#each pinnedLeft as tab (tab.id)}
-				{@render tabButton(tab)}
-			{/each}
-
-			<div
-				class="flex items-center"
-				use:dndzone={{
-					items: dndMiddle,
-					flipDurationMs: 150,
-					type: dndType,
-					dropTargetStyle: {}
-				}}
-				onconsider={handleConsider}
-				onfinalize={handleFinalize}
-			>
-				{#each dndMiddle as tab (tab.id)}
-					<div>
-						{@render tabButton(tab)}
-					</div>
+<div bind:this={stripEl} class={twMerge('flex items-center bg-surface min-h-8', c)}>
+	<!-- The tabs centre in the full strip and the bar overlays the air under them,
+	     flush with the strip's bottom edge — it takes no height of its own, so the
+	     strip never resizes and the tabs sit at the same place whether or not they
+	     overflow. -->
+	<div class="group/scroll relative flex-1 min-w-0 self-stretch">
+		<div
+			bind:this={scrollEl}
+			onscroll={() => scrollEl && (scrollLeft = scrollEl.scrollLeft)}
+			class="h-full overflow-x-auto overflow-y-hidden no-scrollbar pl-1"
+		>
+			<!-- `w-max`: without it the row is pinned to the viewport width and the tabs
+			     overflow *out* of it, so the ResizeObserver below never sees a tab open
+			     or a label change and the scroll bar goes stale. -->
+			<div class="flex items-center h-full w-max" role="tablist">
+				{#each pinnedLeft as tab (tab.id)}
+					{@render tabButton(tab)}
 				{/each}
+
+				<div
+					class="flex items-center"
+					use:dndzone={{
+						items: dndMiddle,
+						flipDurationMs: 150,
+						type: dndType,
+						dropTargetStyle: {}
+					}}
+					onconsider={handleConsider}
+					onfinalize={handleFinalize}
+				>
+					{#each dndMiddle as tab (tab.id)}
+						<!-- `flex`, not the default block: an inline-flex tab in a block wrapper
+					     sits on a text baseline and rides ~1.5px off the row's centre. -->
+						<div class="flex">
+							{@render tabButton(tab)}
+						</div>
+					{/each}
+				</div>
+
+				{#each pinnedRight as tab (tab.id)}
+					{@render tabButton(tab)}
+				{/each}
+
+				{#if afterTabs}
+					{@render afterTabs()}
+				{/if}
 			</div>
-
-			{#each pinnedRight as tab (tab.id)}
-				{@render tabButton(tab)}
-			{/each}
-
-			{#if afterTabs}
-				{@render afterTabs()}
-			{/if}
 		</div>
-	</ScrollableX>
+
+		{#if overflowing}
+			<!-- Decorative: it mirrors the scroll position and can be dragged, but the
+			     strip is scrollable without it (wheel, trackpad, and the arrow keys that
+			     scroll the focused tab into view), so it stays out of the a11y tree
+			     rather than posing as a control at a 4px hit target. -->
+			<!-- svelte-ignore a11y_no_static_element_interactions -->
+			<div
+				aria-hidden="true"
+				class="absolute bottom-0 left-0 h-1 rounded-full touch-none bg-hint/0 group-hover/scroll:bg-hint/40 hover:!bg-secondary/60 transition-colors"
+				style="width: {thumbWidth}px; transform: translateX({thumbLeft}px);"
+				onpointerdown={handleThumbPointerDown}
+			></div>
+		{/if}
+	</div>
 
 	{#if trailing}
 		<div class="ml-1 pr-1 flex items-center shrink-0">
diff --git a/frontend/src/lib/components/copilot/FlowCopilotInputsModal.svelte b/frontend/src/lib/components/copilot/FlowCopilotInputsModal.svelte
index f3c2489eb9..1f7acbb3e0 100644
--- a/frontend/src/lib/components/copilot/FlowCopilotInputsModal.svelte
+++ b/frontend/src/lib/components/copilot/FlowCopilotInputsModal.svelte
@@ -3,19 +3,21 @@
 	import { Button, Badge } from '../common'
 	import Modal from '../common/modal/Modal.svelte'
 	import Portal from '../Portal.svelte'
-
+	import { overlayPortalTarget } from '$lib/components/common/overlayHost.svelte'
 
 	interface Props {
-		open?: boolean;
-		inputs?: string[];
+		open?: boolean
+		inputs?: string[]
 	}
 
-	let { open = $bindable(false), inputs = [] }: Props = $props();
+	let { open = $bindable(false), inputs = [] }: Props = $props()
 
 	const dispatch = createEventDispatcher()
+
+	const portalTarget = overlayPortalTarget('body')
 </script>
 
-<Portal>
+<Portal target={portalTarget()}>
 	<Modal
 		bind:open
 		on:confirmed={() => {
@@ -32,8 +34,7 @@
 		</ul>
 
 		{#snippet actions()}
-				<Button
-				
+			<Button
 				on:click={() => {
 					open = false
 					dispatch('confirmed')
@@ -43,6 +44,6 @@
 			>
 				<span class="inline-flex gap-2">Add <Badge color="dark-green">Enter</Badge></span>
 			</Button>
-			{/snippet}
+		{/snippet}
 	</Modal>
 </Portal>
diff --git a/frontend/src/lib/components/copilot/FlowInlineScriptAIButton.svelte b/frontend/src/lib/components/copilot/FlowInlineScriptAIButton.svelte
index a27cc36340..29ce045042 100644
--- a/frontend/src/lib/components/copilot/FlowInlineScriptAIButton.svelte
+++ b/frontend/src/lib/components/copilot/FlowInlineScriptAIButton.svelte
@@ -6,15 +6,41 @@
 	import { base } from '$lib/base'
 	import { twMerge } from 'tailwind-merge'
 	import { aiChatManager, AIMode } from './chat/AIChatManager.svelte'
+	import { chatState } from './chat/sharedChatState.svelte'
 	import { copilotInfo } from '$lib/aiStore'
-	import type { ComponentProps } from 'svelte'
+	import { tick, type ComponentProps } from 'svelte'
+	import OpenInSessionButton from '$lib/components/sessions/OpenInSessionButton.svelte'
+	import { getOpenInSessionHandoff } from '$lib/components/sessions/openInSessionContext'
 
 	interface Props {
 		moduleId?: string
+		/** Materializes Monaco's in-flight keystrokes into the draft. This button
+		 * sits in the code editor's own toolbar, so "type, then click" is the
+		 * normal case, and the session preview loads the item from its draft —
+		 * without this the last (sub-second) edits would not be in it. */
+		flushEditor?: () => void
 		btnProps?: ComponentProps<typeof Button>
 	}
 
-	const { moduleId, btnProps }: Props = $props()
+	const { moduleId, flushEditor, btnProps }: Props = $props()
+
+	// The enclosing editor's "Open in AI session" hand-off, opening the preview on
+	// the step this toolbar edits.
+	const handoff = getOpenInSessionHandoff()
+	const sessionSource = $derived.by(() => {
+		const source = handoff?.source({ moduleId })
+		if (!source || !flushEditor) return source
+		return {
+			...source,
+			beforeOpen: async () => {
+				flushEditor()
+				// The flush lands in the draft store through an effect; let it run
+				// before the hand-off persists that store.
+				await tick()
+				await source.beforeOpen?.()
+			}
+		}
+	})
 
 	const aiChatScriptModeClasses = $derived(
 		aiChatManager.mode === AIMode.SCRIPT && aiChatManager.isOpen
@@ -36,37 +62,52 @@
 	/>
 {/snippet}
 
-{#if $copilotInfo.enabled}
-	{@render button(() => {
-		aiChatManager.openChat()
-		const availableContext = aiChatManager.contextManager.getAvailableContext()
-		aiChatManager.contextManager.setSelectedModuleContext(moduleId, availableContext)
-	})}
-{:else}
-	<Popover
-		floatingConfig={{
-			middleware: [
-				autoPlacement({
-					allowedPlacements: ['bottom-start', 'bottom-end', 'top-start', 'top-end', 'top', 'bottom']
-				})
-			]
-		}}
-	>
-		{#snippet trigger()}
-			{@render button()}
-		{/snippet}
-		{#snippet content({ close })}
-			<div class="p-4">
-				<p class="text-sm">
-					Enable Windmill AI in the <a
-						href="{base}/workspace_settings?tab=ai"
-						target="_blank"
-						class="inline-flex flex-row items-center gap-1"
-					>
-						workspace settings <ExternalLink size={16} />
-					</a>
-				</p>
-			</div>
-		{/snippet}
-	</Popover>
-{/if}
+<OpenInSessionButton source={sessionSource} {btnProps}>
+	{#snippet fallback()}
+		<!-- Legacy docked chat: this button only opens that pane, so without one there
+		     is nothing to open and it hides rather than rendering a dead click. -->
+		{#if chatState.dockedChatAvailable}
+			{#if $copilotInfo.enabled}
+				{@render button(() => {
+					aiChatManager.openChat()
+					const availableContext = aiChatManager.contextManager.getAvailableContext()
+					aiChatManager.contextManager.setSelectedModuleContext(moduleId, availableContext)
+				})}
+			{:else}
+				<Popover
+					floatingConfig={{
+						middleware: [
+							autoPlacement({
+								allowedPlacements: [
+									'bottom-start',
+									'bottom-end',
+									'top-start',
+									'top-end',
+									'top',
+									'bottom'
+								]
+							})
+						]
+					}}
+				>
+					{#snippet trigger()}
+						{@render button()}
+					{/snippet}
+					{#snippet content({ close })}
+						<div class="p-4">
+							<p class="text-sm">
+								Enable Windmill AI in the <a
+									href="{base}/workspace_settings?tab=ai"
+									target="_blank"
+									class="inline-flex flex-row items-center gap-1"
+								>
+									workspace settings <ExternalLink size={16} />
+								</a>
+							</p>
+						</div>
+					{/snippet}
+				</Popover>
+			{/if}
+		{/if}
+	{/snippet}
+</OpenInSessionButton>
diff --git a/frontend/src/lib/components/copilot/IteratorGen.svelte b/frontend/src/lib/components/copilot/IteratorGen.svelte
index 8f39a0eff9..908b48dbf9 100644
--- a/frontend/src/lib/components/copilot/IteratorGen.svelte
+++ b/frontend/src/lib/components/copilot/IteratorGen.svelte
@@ -1,10 +1,7 @@
 <script lang="ts">
-	import { Check, Loader2, Wand2 } from 'lucide-svelte'
-	import Button from '../common/button/Button.svelte'
 	import { getNonStreamingMetadataCompletion } from './lib'
 	import { sendUserToast } from '$lib/toast'
 	import type { Flow, InputTransform } from '$lib/gen'
-	import ManualPopover from '../ManualPopover.svelte'
 	import { createEventDispatcher, getContext, untrack } from 'svelte'
 	import type { FlowEditorContext } from '../flows/types'
 	import type { PickableProperties } from '../flows/previousResults'
@@ -14,7 +11,6 @@
 	import { yamlStringifyExceptKeys } from './utils'
 	import { stepInputCompletionEnabled } from '$lib/stores'
 	import { copilotInfo } from '$lib/aiStore'
-	import { twMerge } from 'tailwind-merge'
 
 	let generatedContent = $state('')
 	let loading = $state(false)
@@ -26,8 +22,6 @@
 
 	let { focused = false, arg, pickableProperties = undefined }: Props = $props()
 
-	let btnFocused = $state(false)
-
 	let empty = $derived(
 		Object.keys(arg ?? {}).length === 0 ||
 			(arg.type === 'static' && !arg.value) ||
@@ -111,8 +105,7 @@ Only output the expression, do not explain or discuss.`
 
 	function cancelOnOutOfFocus() {
 		setTimeout(() => {
-			if (!focused && !btnFocused) {
-				// only cancel if out of focus is not due to click on btn
+			if (!focused) {
 				cancel()
 			}
 		}, 150)
@@ -142,60 +135,7 @@ Only output the expression, do not explain or discuss.`
 	$effect(() => {
 		dispatch('showExpr', generatedContent)
 	})
-
-	let out = $state(true) // hack to prevent regenerating answer when accepting the answer due to mouseenter on new icon
 </script>
 
-{#if $copilotInfo.enabled && $stepInputCompletionEnabled}
-	<ManualPopover showTooltip={!empty && generatedContent.length > 0} placement="bottom" class="p-2">
-		<Button
-			size="xs"
-			color="light"
-			btnClasses={twMerge(
-				'text-ai bg-violet-100 dark:bg-gray-700 dark:hover:bg-surface-hover',
-				!loading && generatedContent.length > 0
-					? 'bg-green-100 text-green-800 hover:bg-green-100 dark:text-green-400 dark:bg-green-700 dark:hover:bg-green-700'
-					: ''
-			)}
-			on:click={() => {
-				if (!loading && generatedContent.length > 0) {
-					dispatch('setExpr', generatedContent)
-					generatedContent = ''
-				}
-			}}
-			on:focus={() => {
-				btnFocused = true
-			}}
-			on:blur={() => {
-				btnFocused = false
-			}}
-			on:mouseenter={(ev) => {
-				if (out) {
-					out = false
-					generateIteratorExpr()
-				}
-			}}
-			on:mouseleave={() => {
-				out = true
-				cancel()
-			}}
-			endIcon={{
-				icon: loading ? Loader2 : generatedContent.length > 0 ? Check : Wand2,
-				classes: loading ? 'animate-spin' : ''
-			}}
-		>
-			{#if focused}
-				{#if loading}
-					ESC
-				{:else if generatedContent.length > 0}
-					TAB
-				{/if}
-			{/if}
-		</Button>
-		{#snippet content()}
-			<div class="text-sm text-primary">
-				{generatedContent}
-			</div>
-		{/snippet}
-	</ManualPopover>
-{/if}
+<!-- Headless: the focus effect generates the ghost-text suggestion and
+     `onKeyUp` accepts it with Tab. There is no on-screen trigger. -->
diff --git a/frontend/src/lib/components/copilot/PredicateGen.svelte b/frontend/src/lib/components/copilot/PredicateGen.svelte
index a23735db08..78e9f2f9d1 100644
--- a/frontend/src/lib/components/copilot/PredicateGen.svelte
+++ b/frontend/src/lib/components/copilot/PredicateGen.svelte
@@ -14,6 +14,8 @@
 	import Popover from '$lib/components/meltComponents/Popover.svelte'
 	import type { Flow } from '$lib/gen'
 	import { copilotInfo } from '$lib/aiStore'
+	import { AIBtnClasses } from './chat/AIButtonStyle'
+	import { twMerge } from 'tailwind-merge'
 
 	let loading = $state(false)
 	interface Props {
@@ -94,14 +96,23 @@ Only return the expression without any wrapper. Do not explain or discuss.`
 		contentClasses="p-4 flex w-96"
 	>
 		{#snippet trigger()}
+			<!-- Sized to match FlowPlugConnect: the two sit side by side under every
+			     predicate input, so they have to read as one pair of controls. -->
 			<Button
+				variant="default"
+				size="xs3"
 				color={loading ? 'red' : 'light'}
-				size="xs"
 				nonCaptureEvent={!loading}
 				startIcon={{ icon: Wand2 }}
 				iconOnly
 				title="AI Assistant"
-				btnClasses="min-h-[30px] text-ai bg-violet-100 dark:bg-gray-700"
+				btnClasses={twMerge(AIBtnClasses(), 'bg-surface overflow-clip flex p-0')}
+				wrapperClasses={twMerge(
+					// Revealed by the row it sits in, like the connect plug beside it. A request in
+					// flight keeps it visible so its cancel affordance stays reachable.
+					'h-5 w-8 p-0 group-hover:opacity-100 transition-opacity',
+					loading ? '' : 'opacity-0'
+				)}
 				{loading}
 				clickableWhileLoading
 				on:click={loading ? () => abortController?.abort() : () => {}}
@@ -121,11 +132,11 @@ Only return the expression without any wrapper. Do not explain or discuss.`
 				}}
 			/>
 			<Button
-				size="xs"
+				unifiedSize="sm"
 				color="light"
 				variant="contained"
 				buttonType="button"
-				btnClasses="!p-1 !w-[38px] !ml-2 text-ai bg-violet-100 dark:bg-gray-700"
+				btnClasses={'!ml-2 ' + AIBtnClasses()}
 				title="Generate predicate from prompt"
 				aria-label="Generate"
 				iconOnly
diff --git a/frontend/src/lib/components/copilot/StepInputGen.svelte b/frontend/src/lib/components/copilot/StepInputGen.svelte
index b3b56bac4c..839792c5f0 100644
--- a/frontend/src/lib/components/copilot/StepInputGen.svelte
+++ b/frontend/src/lib/components/copilot/StepInputGen.svelte
@@ -1,12 +1,8 @@
 <script lang="ts">
-	import { run } from 'svelte/legacy'
-
-	import { Check, Loader2, Wand2 } from 'lucide-svelte'
-	import Button from '../common/button/Button.svelte'
 	import { getNonStreamingMetadataCompletion } from './lib'
 	import { sendUserToast } from '$lib/toast'
-	import type { Flow, InputTransform } from '$lib/gen'
-	import { createEventDispatcher, getContext, untrack } from 'svelte'
+	import type { Flow } from '$lib/gen'
+	import { createEventDispatcher, getContext } from 'svelte'
 	import type { FlowEditorContext } from '../flows/types'
 	import type { PickableProperties } from '../flows/previousResults'
 	import YAML from 'yaml'
@@ -17,46 +13,34 @@
 	import { stepInputCompletionEnabled } from '$lib/stores'
 	import type { SchemaProperty } from '$lib/common'
 	import FlowCopilotInputsModal from './FlowCopilotInputsModal.svelte'
-	import { twMerge } from 'tailwind-merge'
 	import { copilotInfo } from '$lib/aiStore'
+	import Button from '../common/button/Button.svelte'
 	import { AIBtnClasses } from './chat/AIButtonStyle'
+	import { Check, Wand2 } from 'lucide-svelte'
+	import { twMerge } from 'tailwind-merge'
 
 	let generatedContent = $state('')
 	let loading = $state(false)
 	interface Props {
+		/** Whether the input this belongs to has focus — a suggestion is only worth keeping
+		 *  while the user is still on that input. */
 		focused?: boolean
-		arg: InputTransform | any
 		schemaProperty: SchemaProperty
 		pickableProperties?: PickableProperties | undefined
 		argName: string
-		btnClass?: string
 	}
 
-	let {
-		focused = false,
-		arg,
-		schemaProperty,
-		pickableProperties = undefined,
-		argName,
-		btnClass = ''
-	}: Props = $props()
-
-	let empty = $state(false)
-	run(() => {
-		empty =
-			Object.keys(arg ?? {}).length === 0 ||
-			(arg.type === 'static' && !arg.value) ||
-			(arg.type === 'javascript' && !arg.expr)
-	})
+	let { focused = false, schemaProperty, pickableProperties = undefined, argName }: Props = $props()
 
+	/** The button takes focus when clicked, which blurs the input — without tracking that,
+	 *  asking for a suggestion would immediately look like leaving the field. */
 	let btnFocused = $state(false)
 
 	let abortController = new AbortController()
 	let newFlowInput = $state('')
 
 	const { flowStore, selectionManager } = getContext<FlowEditorContext>('FlowEditorContext')
-	const { stepInputsLoading, generatedExprs } =
-		getContext<FlowCopilotContext | undefined>('FlowCopilotContext') || {}
+	const { generatedExprs } = getContext<FlowCopilotContext | undefined>('FlowCopilotContext') || {}
 
 	function createFlowInput() {
 		if (!newFlowInput) {
@@ -177,35 +161,18 @@ Only return the expression without any wrapper.`
 		generatedContent = ''
 	}
 
-	function automaticGeneration() {
-		if (empty) {
-			generateStepInput()
-		}
-	}
-
-	function cancelOnOutOfFocus() {
-		setTimeout(() => {
-			if (!focused && !btnFocused) {
-				// only cancel if out of focus is not due to click on btn
+	// Drop a suggestion once the user has moved on, so the accept button can't sit there armed
+	// against an input nobody is editing. Deferred because focus moves through nothing on its
+	// way from the input to the button, and left alone while loading: the click that asked for
+	// the suggestion is itself what blurred the input.
+	$effect(() => {
+		if (focused || btnFocused) return
+		const timer = setTimeout(() => {
+			if (!focused && !btnFocused && !loading) {
 				cancel()
 			}
 		}, 150)
-	}
-
-	$effect(() => {
-		if (!focused) {
-			untrack(() => {
-				cancelOnOutOfFocus()
-			})
-		}
-	})
-
-	$effect(() => {
-		if ($copilotInfo.enabled && $stepInputCompletionEnabled && focused) {
-			untrack(() => {
-				automaticGeneration()
-			})
-		}
+		return () => clearTimeout(timer)
 	})
 
 	$effect(() => {
@@ -216,8 +183,27 @@ Only return the expression without any wrapper.`
 		dispatch('showExpr', $generatedExprs?.[argName] || '')
 	})
 
-	let out = $state(true) // hack to prevent regenerating answer when accepting the answer due to mouseenter on new icon
 	let openInputsModal = $state(false)
+
+	/** A suggestion is waiting to be accepted, rather than waiting to be asked for. */
+	let ready = $derived(!loading && generatedContent.length > 0)
+
+	function accept() {
+		dispatch('setExpr', generatedContent)
+		if (newFlowInput) {
+			openInputsModal = true
+		}
+		generatedContent = ''
+	}
+
+	// A suggestion costs a model call, so nothing generates on its own — this button is the
+	// only trigger, and the same control then accepts what it produced. Blur must not cancel:
+	// clicking here takes focus out of the input, which is the gesture that started the call.
+	function onClick() {
+		if (loading) cancel()
+		else if (ready) accept()
+		else generateStepInput()
+	}
 </script>
 
 {#if $copilotInfo.enabled && $stepInputCompletionEnabled}
@@ -228,54 +214,27 @@ Only return the expression without any wrapper.`
 		bind:open={openInputsModal}
 		inputs={[newFlowInput]}
 	/>
+	<!-- Sized to match FlowPlugConnect: it shares the control row with the connect plug. -->
 	<Button
-		size="xs"
 		variant="default"
+		size="xs3"
+		iconOnly
+		{loading}
+		clickableWhileLoading
+		title={loading ? 'Cancel' : ready ? 'Accept the suggestion' : 'Suggest an expression with AI'}
+		startIcon={{ icon: ready ? Check : Wand2 }}
 		btnClasses={twMerge(
-			AIBtnClasses(!loading && generatedContent.length > 0 ? 'green' : 'default'),
-			btnClass
+			AIBtnClasses(ready ? 'green' : 'default'),
+			'bg-surface overflow-clip flex p-0'
 		)}
-		on:click={() => {
-			if (!loading && generatedContent.length > 0) {
-				dispatch('setExpr', generatedContent)
-				if (newFlowInput) {
-					openInputsModal = true
-				}
-				generatedContent = ''
-			}
-		}}
-		on:mouseenter={(ev) => {
-			if (out) {
-				out = false
-				generateStepInput()
-			}
-		}}
-		on:mouseleave={() => {
-			out = true
-			cancel()
-		}}
-		endIcon={{
-			icon:
-				loading || ($stepInputsLoading && empty)
-					? Loader2
-					: generatedContent.length > 0
-						? Check
-						: Wand2,
-			classes: loading || ($stepInputsLoading && empty) ? 'animate-spin' : ''
-		}}
-		on:focus={() => {
-			btnFocused = true
-		}}
-		on:blur={() => {
-			btnFocused = false
-		}}
-	>
-		{#if focused}
-			{#if loading}
-				ESC
-			{:else if generatedContent.length > 0}
-				TAB
-			{/if}
-		{/if}
-	</Button>
+		wrapperClasses={twMerge(
+			'h-5 w-8 p-0 group-hover:opacity-100 transition-opacity',
+			// Same reveal-on-hover as the connect plug beside it, but a request in flight or a
+			// suggestion waiting to be accepted has to stay reachable once the pointer leaves.
+			loading || ready ? '' : 'opacity-0'
+		)}
+		on:click={onClick}
+		on:focus={() => (btnFocused = true)}
+		on:blur={() => (btnFocused = false)}
+	/>
 {/if}
diff --git a/frontend/src/lib/components/copilot/StepInputsGen.svelte b/frontend/src/lib/components/copilot/StepInputsGen.svelte
index d100ad1c73..99199812b5 100644
--- a/frontend/src/lib/components/copilot/StepInputsGen.svelte
+++ b/frontend/src/lib/components/copilot/StepInputsGen.svelte
@@ -168,10 +168,25 @@ input_name2: expression2
 		}
 	}
 
-	let out = $state(true) // hack to prevent regenerating answer when accepting the answer due to mouseenter on new icon
 	let openInputsModal = $state(false)
 
 	let disabled = $derived(argNames.length === 0)
+
+	/** Suggestions are in hand and waiting to be applied, rather than waiting to be asked for. */
+	let ready = $derived(!loading && Object.keys($generatedExprs || {}).length > 0)
+
+	function cancel() {
+		abortController.abort()
+		generatedExprs?.set({})
+	}
+
+	// Filling every input costs a model call, so it takes a deliberate click — the pointer
+	// merely crossing the button must not spend one. The same control then applies the result.
+	function onClick() {
+		if (loading) cancel()
+		else if (ready) applyExprs()
+		else generateStepInputs()
+	}
 </script>
 
 <div class="flex flex-row justify-end">
@@ -187,37 +202,23 @@ input_name2: expression2
 			size="xs"
 			wrapperClasses="flex-1"
 			variant="default"
-			btnClasses={twMerge(
-				!disabled &&
-					AIBtnClasses(
-						!loading && Object.keys($generatedExprs || {}).length > 0 ? 'green' : 'default'
-					)
-			)}
-			on:mouseenter={(ev) => {
-				if (out) {
-					out = false
-					generateStepInputs()
-				}
-			}}
-			on:mouseleave={() => {
-				out = true
-				abortController.abort()
-				generatedExprs?.set({})
-			}}
-			on:click={() => {
-				if (!loading && Object.keys($generatedExprs || {}).length > 0) {
-					applyExprs()
-				}
+			btnClasses={twMerge(!disabled && AIBtnClasses(ready ? 'green' : 'default'))}
+			on:click={onClick}
+			on:blur={() => {
+				// Suggestions belong to the moment they were asked for; leaving the button drops
+				// them so it can't sit on "Accept" against inputs the user has moved on from.
+				// A request still in flight is left alone — it was asked for deliberately.
+				if (!loading) cancel()
 			}}
 			startIcon={{
-				icon: loading ? Loader2 : Object.keys($generatedExprs || {}).length > 0 ? Check : Wand2,
+				icon: loading ? Loader2 : ready ? Check : Wand2,
 				classes: loading ? 'animate-spin' : ''
 			}}
 			{disabled}
 		>
 			{#if loading}
-				Loading
-			{:else if Object.keys($generatedExprs || {}).length > 0}
+				Cancel
+			{:else if ready}
 				Accept
 			{:else}
 				Fill inputs
diff --git a/frontend/src/lib/components/copilot/chat/AIButton.svelte b/frontend/src/lib/components/copilot/chat/AIButton.svelte
index 7f9ccda715..3fe9acec77 100644
--- a/frontend/src/lib/components/copilot/chat/AIButton.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIButton.svelte
@@ -6,14 +6,19 @@
 	import DarkPopover from '$lib/components/Popover.svelte'
 	import { ExternalLink, MessagesSquare } from 'lucide-svelte'
 	import Button from '$lib/components/common/button/Button.svelte'
+	import type { ComponentProps } from 'svelte'
 
 	let {
 		togglePanel,
 		btnClasses,
+		btnProps,
 		label = 'Open in AI session'
 	}: {
 		togglePanel: () => void
 		btnClasses?: string
+		/** Overrides for the host's button styling (an editor toolbar sizes and
+		 * flattens it to match its neighbours). `btnClasses` still wins. */
+		btnProps?: ComponentProps<typeof Button>
 		/** Tooltip + accessible text of the icon-only button. */
 		label?: string
 	} = $props()
@@ -58,6 +63,7 @@
 		onClick={onPress}
 		startIcon={{ icon: MessagesSquare }}
 		iconOnly
+		{...btnProps}
 		{btnClasses}
 	>
 		{label}
diff --git a/frontend/src/lib/components/copilot/chat/AIChat.svelte b/frontend/src/lib/components/copilot/chat/AIChat.svelte
index 038751f4b6..2a51b1b2e5 100644
--- a/frontend/src/lib/components/copilot/chat/AIChat.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIChat.svelte
@@ -149,7 +149,12 @@
 				{
 					role: 'assistant',
 					content: aiChatManager.currentReply,
-					...(aiChatManager.currentReasoning ? { reasoning: aiChatManager.currentReasoning } : {}),
+					...(aiChatManager.currentReasoning
+						? {
+								reasoning: aiChatManager.currentReasoning,
+								reasoningDurationMs: aiChatManager.currentReasoningDurationMs
+							}
+						: {}),
 					streaming: true,
 					contextElements: aiChatManager.contextManager
 						.getSelectedContext()
diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
index 4bfb6f90df..1faa9c003b 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
@@ -47,7 +47,7 @@ import { sendUserToast } from '$lib/toast'
 import { workspaceAIClients, getNonStreamingCompletion } from '../lib'
 import { logFeatureUsage } from '$lib/utils/featureUsage'
 import { modelSupportsVision } from '../modelConfig'
-import { getKnownModelContextWindow } from '../modelConfig'
+import { getModelContextWindow } from '../modelConfig'
 import {
 	getCompactionSummaryPrompt,
 	formatCompactSummary,
@@ -428,6 +428,44 @@ export class AIChatManager {
 	// a scalar: several workspace/provider pairs can be unavailable at once, and
 	// the chat loop only notifies on first detection per pair.
 	private reasoningSummaryUnavailableFor = $state<string[]>([])
+	// Timed off arrival, not off the typewriter: the reveal paces *display*, so
+	// reading the clock there would report how long the text took to paint.
+	private reasoningStartedAt: number | undefined
+	private reasoningEndedAt: number | undefined
+	/** Set the moment thinking ends, which is mid-turn — the answer is still
+	 * streaming. Reactive so the live message settles to "Thought for X" then,
+	 * rather than waiting for the turn to finalize. */
+	currentReasoningDurationMs = $state<number | undefined>(undefined)
+
+	private markReasoningStarted() {
+		if (this.reasoningStartedAt === undefined) {
+			this.reasoningStartedAt = Date.now()
+			this.currentReasoningDurationMs = undefined
+		}
+	}
+
+	/** Thinking ends at the first answer token; a turn that thinks straight into a
+	 * tool call ends it at the message boundary instead. */
+	private markReasoningEnded() {
+		if (this.reasoningStartedAt !== undefined && this.reasoningEndedAt === undefined) {
+			this.reasoningEndedAt = Date.now()
+			this.currentReasoningDurationMs = this.reasoningEndedAt - this.reasoningStartedAt
+		}
+	}
+
+	private resetReasoningTiming() {
+		this.reasoningStartedAt = undefined
+		this.reasoningEndedAt = undefined
+		this.currentReasoningDurationMs = undefined
+	}
+
+	/** Reads the duration and clears it, so the next reasoning pass of the same
+	 * turn (after a tool call) times itself from scratch. */
+	private takeReasoningDuration(): number | undefined {
+		const duration = this.currentReasoningDurationMs
+		this.resetReasoningTiming()
+		return duration
+	}
 
 	private reasoningSummaryKey(provider: string): string {
 		return `${this.operatingWorkspace ?? ''}:${provider}`
@@ -2931,10 +2969,13 @@ export class AIChatManager {
 			this.currentReply = ''
 			this.currentReasoning = ''
 			this.currentReasoningActive = false
+			this.resetReasoningTiming()
 
-			// Compaction trigger. Without a known context window there is no limit
-			// to enforce, so compaction stays off rather than guessing one.
-			const contextWindow = model ? getKnownModelContextWindow(model.model) : undefined
+			// Compaction trigger. An unrecognized model still gets the conservative
+			// assumed window rather than no limit: without one the context grows
+			// unbounded until the provider (or a proxy in front of it) times out.
+			// Guessing low only compacts earlier, which is always recoverable.
+			const contextWindow = model ? getModelContextWindow(model.model) : undefined
 			if (
 				contextWindow !== undefined &&
 				projectedContextTokens >= contextWindow * COMPACTION_TRIGGER_RATIO
@@ -2996,9 +3037,19 @@ export class AIChatManager {
 				messages: [...this.messages],
 				abortController: this.abortController,
 				callbacks: {
-					onNewToken: (token) => this.replyReveal.push(token),
-					onReasoningDelta: (token) => this.reasoningReveal.push(token),
-					onReasoningStart: () => (this.currentReasoningActive = true),
+					onNewToken: (token) => {
+						this.markReasoningEnded()
+						this.replyReveal.push(token)
+					},
+					// Not every provider fires onReasoningStart, so deltas start the clock too.
+					onReasoningDelta: (token) => {
+						this.markReasoningStarted()
+						this.reasoningReveal.push(token)
+					},
+					onReasoningStart: () => {
+						this.markReasoningStarted()
+						this.currentReasoningActive = true
+					},
 					onMessageEnd: () => {
 						// Drain any un-revealed backlog into currentReply first, so the reads
 						// below see the full text. This funnel covers clean completion, tool
@@ -3006,6 +3057,10 @@ export class AIChatManager {
 						// keeps text from being lost or duplicated on any exit path.
 						this.replyReveal.flush()
 						this.reasoningReveal.flush()
+						// A turn that reasoned straight into a tool call never saw an answer
+						// token, so this is where its thinking stops.
+						this.markReasoningEnded()
+						const reasoningDurationMs = this.takeReasoningDuration()
 						// Keep the streamed text for the abort/error paths. Non-empty only:
 						// parsers flush (and reset) when a tool call starts after text, and
 						// the catch's later empty call would wipe it — stale keeps are
@@ -3019,7 +3074,9 @@ export class AIChatManager {
 								{
 									role: 'assistant',
 									content: this.currentReply,
-									...(this.currentReasoning ? { reasoning: this.currentReasoning } : {}),
+									...(this.currentReasoning
+										? { reasoning: this.currentReasoning, reasoningDurationMs }
+										: {}),
 									contextElements:
 										this.mode === AIMode.SCRIPT
 											? oldSelectedContext.filter((c) => c.type === 'code')
diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
index 4e60c35ef3..adf9130492 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
@@ -1,4 +1,4 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type { FlowAIChatHelpers } from './flow/core'
 import type { PipelineAIChatHelpers } from './pipeline/core'
 import type { CurrentEditor } from '$lib/components/flows/types'
@@ -1928,7 +1928,10 @@ describe('AIChatManager context compaction', () => {
 		expect(manager.contextTokens).toBe(1_290)
 	})
 
-	it('does not compact when the model context window is unknown', async () => {
+	// An unrecognized model gets the conservative assumed 128K window instead of
+	// no limit — otherwise the context grows unbounded until the provider (or a
+	// proxy in front of it) times out the request.
+	it('compacts against the assumed window when the model context window is unknown', async () => {
 		mocks.getCurrentModel.mockReturnValue({ provider: 'custom', model: 'mystery-model-9000' })
 		mocks.tryGetCurrentModel.mockReturnValue({ provider: 'custom', model: 'mystery-model-9000' })
 		const manager = new AIChatManager()
@@ -1941,7 +1944,11 @@ describe('AIChatManager context compaction', () => {
 
 		await manager.sendRequest()
 
-		expect(mocks.runChatLoop.mock.calls[0][0].messages.length).toBe(3)
+		// ~10M projected against the 128K assumption: everything droppable goes,
+		// leaving only the just-pushed user message
+		const sent = mocks.runChatLoop.mock.calls[0][0].messages
+		expect(sent.length).toBe(1)
+		expect(sent[0].role).toBe('user')
 	})
 
 	it('never drops the most recent message', () => {
@@ -3003,3 +3010,90 @@ describe('AIChatManager.waitForPipelineHelpers', () => {
 		await expect(manager.waitForPipelineHelpers(10)).resolves.toBe(false)
 	})
 })
+
+describe('AIChatManager reasoning duration', () => {
+	beforeEach(() => {
+		localStorage.clear()
+		mocks.getCurrentModel.mockReturnValue({ model: 'test-model', provider: 'openai' })
+	})
+
+	// The file-level hook only clears call records, so the clock spy below would
+	// stay installed and freeze time for anything that runs after it.
+	afterEach(() => {
+		nowSpy?.mockRestore()
+		nowSpy = undefined
+	})
+
+	let nowSpy: ReturnType<typeof vi.spyOn> | undefined
+
+	function assistantDurations(manager: AIChatManager): (number | undefined)[] {
+		return manager.displayMessages
+			.filter((m) => m.role === 'assistant')
+			.map((m) => (m as { reasoningDurationMs?: number }).reasoningDurationMs)
+	}
+
+	it('stops the clock at the first answer token, not at the end of the turn', async () => {
+		const manager = new AIChatManager()
+		manager.changeMode(AIMode.ASK)
+		manager.setAiChatInput({ restoreInstructions: vi.fn(), focusInput: vi.fn() } as any)
+
+		let now = 1_000
+		nowSpy = vi.spyOn(Date, 'now').mockImplementation(() => now)
+
+		vi.mocked(runChatLoop).mockImplementation(async (config) => {
+			config.callbacks.onReasoningStart?.()
+			config.callbacks.onReasoningDelta?.('weighing the options')
+			now += 4_000
+			config.callbacks.onNewToken('here is the answer')
+			// The answer keeps streaming well past the end of thinking; none of it
+			// may land in the duration.
+			now += 9_000
+			config.callbacks.onMessageEnd()
+			return {
+				addedMessages: [],
+				tokenUsage: {} as any,
+				lastIterationUsage: null,
+				hitMaxIterations: false
+			}
+		})
+
+		manager.instructions = 'do a thing'
+		await manager.sendRequest()
+
+		expect(assistantDurations(manager)).toEqual([4_000])
+	})
+
+	it('times each reasoning pass of a tool-using turn independently', async () => {
+		const manager = new AIChatManager()
+		manager.changeMode(AIMode.ASK)
+		manager.setAiChatInput({ restoreInstructions: vi.fn(), focusInput: vi.fn() } as any)
+
+		let now = 1_000
+		nowSpy = vi.spyOn(Date, 'now').mockImplementation(() => now)
+
+		vi.mocked(runChatLoop).mockImplementation(async (config) => {
+			// First pass reasons straight into a tool call — no answer token, so the
+			// message boundary is where its thinking stops.
+			config.callbacks.onReasoningDelta?.('which tool do I need')
+			now += 3_000
+			config.callbacks.onMessageEnd()
+			// Tool execution must not be billed to either pass.
+			now += 20_000
+			config.callbacks.onReasoningDelta?.('now what does that result mean')
+			now += 7_000
+			config.callbacks.onNewToken('here is the answer')
+			config.callbacks.onMessageEnd()
+			return {
+				addedMessages: [],
+				tokenUsage: {} as any,
+				lastIterationUsage: null,
+				hitMaxIterations: false
+			}
+		})
+
+		manager.instructions = 'do a thing'
+		await manager.sendRequest()
+
+		expect(assistantDurations(manager)).toEqual([3_000, 7_000])
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/AIChatModelSettings.svelte b/frontend/src/lib/components/copilot/chat/AIChatModelSettings.svelte
index 0a911134b6..d38caf8f0a 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatModelSettings.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIChatModelSettings.svelte
@@ -25,6 +25,7 @@
 	import { base } from '$lib/base'
 	import AIPromptsModal from '$lib/components/settings/AIPromptsModal.svelte'
 	import { getAiChatManager } from './aiChatManagerContext'
+	import { thinkingPreferences } from './thinkingPreferences.svelte'
 	import {
 		getReasoningCapability,
 		resolveEffectiveReasoning,
@@ -377,6 +378,19 @@
 					<div class="text-2xs text-tertiary mt-0.5">Not supported by this model</div>
 				</div>
 			{/if}
+
+			<!-- A reading preference rather than a model parameter: it applies to every
+			     chat in this browser, including thinking already in the transcript. -->
+			<MenuItem
+				{item}
+				class="w-full flex items-center gap-2 px-3 py-1.5 text-left font-normal hover:bg-surface-hover data-[highlighted]:bg-surface-hover rounded-sm transition-colors cursor-pointer"
+				onClick={() => (thinkingPreferences.expandByDefault = !thinkingPreferences.expandByDefault)}
+			>
+				<span class="truncate grow min-w-0 text-2xs text-secondary">Always expand thinking</span>
+				{#if thinkingPreferences.expandByDefault}
+					<Check size={14} class="shrink-0 text-primary" />
+				{/if}
+			</MenuItem>
 		</div>
 	{/snippet}
 </DropdownV2>
diff --git a/frontend/src/lib/components/copilot/chat/AiChatLayout.svelte b/frontend/src/lib/components/copilot/chat/AiChatLayout.svelte
index 89574edf3e..1a9df4816c 100644
--- a/frontend/src/lib/components/copilot/chat/AiChatLayout.svelte
+++ b/frontend/src/lib/components/copilot/chat/AiChatLayout.svelte
@@ -6,7 +6,7 @@
 	import { zIndexes } from '$lib/zIndexes'
 	import { userStore, workspaceStore } from '$lib/stores'
 	import { chatState } from './sharedChatState.svelte'
-	import { loadCopilot } from '$lib/aiStore'
+	import { loadCopilot } from '$lib/components/copilot/loadCopilot'
 	import { aiChatManager } from './AIChatManager.svelte'
 	import { onDestroy } from 'svelte'
 	import Button from '$lib/components/common/button/Button.svelte'
@@ -22,6 +22,13 @@
 		children: any
 		onMenuOpen?: () => void
 		disableAi?: boolean
+		// Whether this layout loads the workspace AI config. It gates far more than
+		// the docked pane (code completion, metadata generation, the "open in AI
+		// session" buttons), so it must not be tied to `disableAi`. Pass false where
+		// another component owns the load for a different workspace — on the sessions
+		// route SessionWrapper loads the session's acting workspace, and both writing
+		// the global store would race.
+		loadAiConfig?: boolean
 		// Only the root layout's docked chat is the "legacy" counterpart of AI
 		// Sessions — SDK wrappers reuse this layout for script/flow chats where
 		// the sessions beta banner would make no sense.
@@ -35,6 +42,7 @@
 		children,
 		onMenuOpen,
 		disableAi,
+		loadAiConfig = true,
 		showSessionsBetaBanner = false
 	}: Props = $props()
 
@@ -43,13 +51,17 @@
 	let contentPadLeft = $derived(noBorder || $userStore?.operator || isMobile ? 0 : sidebarWidth)
 
 	$effect(() => {
+		chatState.dockedChatAvailable = !disableAi
 		if (disableAi) {
 			chatState.size = 0
 		}
+		return () => {
+			chatState.dockedChatAvailable = false
+		}
 	})
 
 	$effect(() => {
-		if ($workspaceStore && !disableAi) {
+		if ($workspaceStore && loadAiConfig) {
 			loadCopilot($workspaceStore)
 		}
 	})
diff --git a/frontend/src/lib/components/copilot/chat/AssistantMessage.svelte b/frontend/src/lib/components/copilot/chat/AssistantMessage.svelte
index 0f3f261f26..787d9ef4fc 100644
--- a/frontend/src/lib/components/copilot/chat/AssistantMessage.svelte
+++ b/frontend/src/lib/components/copilot/chat/AssistantMessage.svelte
@@ -1,10 +1,9 @@
 <script lang="ts">
 	import Markdown from 'svelte-exmarkdown'
 	import { gfmPlugin } from 'svelte-exmarkdown/gfm'
-	import { twMerge } from 'tailwind-merge'
-	import { Brain, ChevronDown, ChevronRight, Loader2 } from 'lucide-svelte'
-	import { slide } from 'svelte/transition'
 	import type { DisplayMessage } from './shared'
+	import ChatCollapsibleCard from './ChatCollapsibleCard.svelte'
+	import { thinkingPreferences } from './thinkingPreferences.svelte'
 	import CodeDisplay from './script/CodeDisplay.svelte'
 	import LinkRenderer from './LinkRenderer.svelte'
 	import { workspaceStore } from '$lib/stores'
@@ -24,15 +23,40 @@
 	const reasoning = $derived(
 		message.role === 'assistant' ? message.reasoning?.trim() || undefined : undefined
 	)
-	// Spinner while the reasoning text streams before the answer. Only the live
+	// Set the moment thinking ends, which is mid-turn on the live message — the
+	// answer streams on afterwards.
+	const reasoningDurationMs = $derived(
+		message.role === 'assistant' ? message.reasoningDurationMs : undefined
+	)
+	// Shimmer while the reasoning text streams before the answer. Only the live
 	// synthetic message carries `streaming` — a finalized reasoning-only message
 	// (thinking that led straight to a tool call) must not look in-progress.
 	const reasoningStreaming = $derived(
-		!!reasoning && message.role === 'assistant' && !!message.streaming && !message.content
+		!!reasoning &&
+			message.role === 'assistant' &&
+			!!message.streaming &&
+			!message.content &&
+			reasoningDurationMs === undefined
 	)
-	// Expand while still thinking, collapse once the answer begins — unless toggled.
+	// Undefined until this block is toggled by hand, so flipping the preference
+	// reaches every block the reader hasn't already made a decision about.
 	let reasoningToggled = $state<boolean | undefined>(undefined)
-	const reasoningExpanded = $derived(reasoningToggled ?? reasoningStreaming)
+	const reasoningExpanded = $derived(reasoningToggled ?? thinkingPreferences.expandByDefault)
+	const reasoningLabel = $derived(
+		reasoningDurationMs !== undefined
+			? `Thought for ${formatThinkingDuration(reasoningDurationMs)}`
+			: reasoningStreaming
+				? 'Thinking...'
+				: 'Thinking'
+	)
+
+	function formatThinkingDuration(ms: number): string {
+		const seconds = Math.max(1, Math.round(ms / 1000))
+		if (seconds < 60) return `${seconds}s`
+		const minutes = Math.floor(seconds / 60)
+		const rest = seconds % 60
+		return rest === 0 ? `${minutes}m` : `${minutes}m ${rest}s`
+	}
 
 	const candidatePaths = $derived(extractCandidatePaths(message.content))
 	const rendererPlugin = {
@@ -74,36 +98,17 @@
 </script>
 
 {#if reasoning}
-	<div class="mb-2 bg-surface border border-border-light rounded-md overflow-hidden text-xs">
-		<button
-			class={twMerge(
-				'w-full p-2 bg-surface-secondary/30 hover:bg-surface-hover transition-colors flex items-center gap-2 text-left',
-				reasoningExpanded ? 'border-b border-border-light' : ''
-			)}
-			onclick={() => (reasoningToggled = !reasoningExpanded)}
-		>
-			{#if reasoningExpanded}
-				<ChevronDown class="w-3 h-3 text-secondary" />
-			{:else}
-				<ChevronRight class="w-3 h-3 text-secondary" />
-			{/if}
-			{#if reasoningStreaming}
-				<Loader2 class="w-3.5 h-3.5 animate-spin text-blue-500" />
-			{:else}
-				<Brain class="w-3.5 h-3.5 text-secondary" />
-			{/if}
-			<span class="text-primary font-medium text-2xs">Thinking</span>
-		</button>
-
-		{#if reasoningExpanded}
-			<div
-				transition:slide={{ duration: 150 }}
-				class="p-2 bg-surface text-secondary {markdownProse.xs}"
-			>
-				<Markdown md={reasoning} plugins={[gfmPlugin()]} />
-			</div>
-		{/if}
-	</div>
+	<ChatCollapsibleCard
+		label={reasoningLabel}
+		expanded={reasoningExpanded}
+		onToggle={() => (reasoningToggled = !reasoningExpanded)}
+		shimmer={reasoningStreaming}
+		class="mb-2"
+		labelClass="truncate"
+		contentClass="font-main text-secondary {markdownProse.xs}"
+	>
+		<Markdown md={reasoning} plugins={[gfmPlugin()]} />
+	</ChatCollapsibleCard>
 {/if}
 
 {#if message.content}
diff --git a/frontend/src/lib/components/copilot/chat/ChatCollapsibleCard.svelte b/frontend/src/lib/components/copilot/chat/ChatCollapsibleCard.svelte
new file mode 100644
index 0000000000..f92e347da9
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/ChatCollapsibleCard.svelte
@@ -0,0 +1,158 @@
+<script lang="ts">
+	import { ChevronRight } from 'lucide-svelte'
+	import { twMerge } from 'tailwind-merge'
+	import { slide } from 'svelte/transition'
+	import type { Snippet } from 'svelte'
+
+	interface Props {
+		label: string
+		expanded: boolean
+		onToggle: () => void
+		// A card with nothing to reveal keeps the header inert (no chevron, no
+		// hover affordance implying a toggle).
+		toggleable?: boolean
+		// Sweeps a highlight across the label while the row is in progress.
+		shimmer?: boolean
+		// Pinned to the right of the header row, outside the toggle button.
+		headerRight?: Snippet
+		// Always-visible content between the header and the expandable body.
+		belowHeader?: Snippet
+		children?: Snippet
+		class?: string
+		headerClass?: string
+		labelClass?: string
+		contentClass?: string
+	}
+
+	let {
+		label,
+		expanded,
+		onToggle,
+		toggleable = true,
+		shimmer = false,
+		headerRight,
+		belowHeader,
+		children,
+		class: className,
+		headerClass,
+		labelClass,
+		contentClass
+	}: Props = $props()
+</script>
+
+<div class={twMerge('font-mono text-xs', className)}>
+	{#snippet labelText(highlight: boolean)}
+		<span
+			class={twMerge(
+				'text-secondary font-medium text-2xs',
+				labelClass,
+				highlight && 'text-emphasis'
+			)}
+		>
+			{label}
+		</span>
+	{/snippet}
+
+	{#snippet headerButton()}
+		<button
+			class={twMerge(
+				'min-w-0 py-0.5 my-0.5 rounded-md hover:bg-surface-hover transition-colors inline-flex items-center gap-2 text-left',
+				headerClass
+			)}
+			onclick={onToggle}
+			disabled={!toggleable}
+		>
+			{#if shimmer}
+				<span class="shimmer inline-flex items-center min-w-0">
+					{@render labelText(false)}
+					<span class="shimmer-band inline-flex items-center min-w-0" aria-hidden="true">
+						{@render labelText(true)}
+					</span>
+				</span>
+			{:else}
+				{@render labelText(false)}
+			{/if}
+			{#if toggleable}
+				<ChevronRight
+					class={twMerge(
+						'w-3 h-3 text-secondary transition-transform duration-150 shrink-0',
+						expanded ? 'rotate-90' : ''
+					)}
+				/>
+			{/if}
+		</button>
+	{/snippet}
+
+	{#if headerRight}
+		<div class="flex items-center justify-between gap-2">
+			{@render headerButton()}
+			{@render headerRight()}
+		</div>
+	{:else}
+		{@render headerButton()}
+	{/if}
+
+	{@render belowHeader?.()}
+
+	{#if expanded && children}
+		<div
+			transition:slide={{ duration: 150 }}
+			class={twMerge('border border-border-light rounded-md bg-surface p-3', contentClass)}
+		>
+			{@render children()}
+		</div>
+	{/if}
+</div>
+
+<style>
+	/* An emphasis-coloured copy of the label sits on top of the muted one and is
+	   revealed through a travelling band, so the highlight is a colour change
+	   rather than an opacity change and the row keeps its own colour underneath. */
+	.shimmer {
+		position: relative;
+	}
+	.shimmer-band {
+		position: absolute;
+		inset: 0;
+		pointer-events: none;
+		--wm-shimmer-band: linear-gradient(
+			100deg,
+			rgba(0, 0, 0, 0.2) 40%,
+			rgba(0, 0, 0, 1) 50%,
+			rgba(0, 0, 0, 0.2) 60%
+		);
+		-webkit-mask-image: var(--wm-shimmer-band);
+		mask-image: var(--wm-shimmer-band);
+		-webkit-mask-size: 250% 100%;
+		mask-size: 250% 100%;
+		-webkit-mask-repeat: no-repeat;
+		mask-repeat: no-repeat;
+		animation: wm-shimmer-sweep 2.6s linear infinite;
+	}
+	/* The travel itself takes 1.5s — the rest of the period holds the band
+	   off-screen, so sweeps are spaced out instead of running back to back.
+	   250% wide is what puts it off-screen at both ends rather than popping at
+	   the edges; the row rests at the gradient's floor in between. */
+	@keyframes wm-shimmer-sweep {
+		0% {
+			-webkit-mask-position: 100% 0;
+			mask-position: 100% 0;
+		}
+		58%,
+		100% {
+			-webkit-mask-position: 0 0;
+			mask-position: 0 0;
+		}
+	}
+	/* The sweep is the only thing marking a row as running, so it degrades to a
+	   flat wash rather than disappearing — otherwise a running tool row would be
+	   indistinguishable from a settled one here. */
+	@media (prefers-reduced-motion: reduce) {
+		.shimmer-band {
+			animation: none;
+			-webkit-mask-image: none;
+			mask-image: none;
+			opacity: 0.35;
+		}
+	}
+</style>
diff --git a/frontend/src/lib/components/copilot/chat/ContextTextarea.svelte b/frontend/src/lib/components/copilot/chat/ContextTextarea.svelte
index f9d5dbf777..2502cd075b 100644
--- a/frontend/src/lib/components/copilot/chat/ContextTextarea.svelte
+++ b/frontend/src/lib/components/copilot/chat/ContextTextarea.svelte
@@ -889,7 +889,7 @@
 		white-space: pre-wrap;
 		word-break: break-words;
 		width: 100%;
-		min-height: 2.25rem;
+		min-height: 1.9rem;
 	}
 
 	/* Hide the textarea's own glyphs (the highlight overlay renders the text)
diff --git a/frontend/src/lib/components/copilot/chat/ContextUsageIndicator.svelte b/frontend/src/lib/components/copilot/chat/ContextUsageIndicator.svelte
index 80b317ba12..a307fad255 100644
--- a/frontend/src/lib/components/copilot/chat/ContextUsageIndicator.svelte
+++ b/frontend/src/lib/components/copilot/chat/ContextUsageIndicator.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
 	import { copilotInfo, copilotSessionModel } from '$lib/aiStore'
-	import { getKnownModelContextWindow } from '../modelConfig'
+	import { getKnownModelContextWindow, getModelContextWindow } from '../modelConfig'
 	import { getAiChatManager } from './aiChatManagerContext'
 	import { AIMode } from './AIChatManager.svelte'
 	import Tooltip from '$lib/components/meltComponents/Tooltip.svelte'
@@ -14,8 +14,14 @@
 	let providerModel = $derived(
 		$copilotSessionModel ?? $copilotInfo.defaultModel ?? $copilotInfo.aiModels[0]
 	)
+	// The same number the compaction trigger uses: the known window when the
+	// model is listed, otherwise the conservative window the trigger assumes.
+	// The tooltip marks the assumed case so the guess never reads as a spec.
 	let contextWindow = $derived(
-		providerModel ? getKnownModelContextWindow(providerModel.model) : undefined
+		providerModel ? getModelContextWindow(providerModel.model) : undefined
+	)
+	let windowIsAssumed = $derived(
+		providerModel !== undefined && getKnownModelContextWindow(providerModel.model) === undefined
 	)
 	// The same number the compaction trigger uses: the provider's report when
 	// one describes the current history (one turn stale by nature), otherwise
@@ -53,9 +59,10 @@
 
 {#if visible}
 	<Tooltip small placement="top">
-		<!-- Only a meter when we know the window: it's a 0–100% reading. With an unknown
-		     window there's no max to measure against, so it's a plain labeled indicator
-		     (the bar is decorative/full and the token count lives in the tooltip). -->
+		<!-- Only a meter when a model is configured: it's a 0–100% reading against the
+		     window compaction enforces (known or assumed). With no model there's no max
+		     to measure against, so it's a plain labeled indicator (the bar is
+		     decorative/full and the token count lives in the tooltip). -->
 		<div
 			class="flex items-center h-5"
 			aria-label="Context window usage"
@@ -74,7 +81,7 @@
 				<p class="font-semibold">Context usage</p>
 				<p class="mt-1 tabular-nums">
 					~{formatTokenCount(usedTokens)}{contextWindow
-						? ` / ${formatTokenCount(contextWindow)}`
+						? ` / ${formatTokenCount(contextWindow)}${windowIsAssumed ? ' assumed' : ''}`
 						: ''}{fillPct !== undefined ? ` (${fillPct}%)` : ''}
 				</p>
 				{#if ratio !== undefined && ratio >= COMPACTION_TRIGGER_RATIO}
diff --git a/frontend/src/lib/components/copilot/chat/ToolExecutionDisplay.svelte b/frontend/src/lib/components/copilot/chat/ToolExecutionDisplay.svelte
index a1ee9984e5..754db1aac0 100644
--- a/frontend/src/lib/components/copilot/chat/ToolExecutionDisplay.svelte
+++ b/frontend/src/lib/components/copilot/chat/ToolExecutionDisplay.svelte
@@ -1,12 +1,11 @@
 <script lang="ts">
-	import { Loader2, ChevronRight, XCircle, Play } from 'lucide-svelte'
+	import { XCircle, Play } from 'lucide-svelte'
 	import { Button } from '$lib/components/common'
 	import { getAiChatManager } from './aiChatManagerContext'
 
 	const aiChatManager = getAiChatManager()
 	import { isActiveUserQuestion, type ToolDisplayMessage } from './shared'
-	import { twMerge } from 'tailwind-merge'
-	import { slide } from 'svelte/transition'
+	import ChatCollapsibleCard from './ChatCollapsibleCard.svelte'
 	import ToolContentDisplay from './ToolContentDisplay.svelte'
 	import ToolMessageActions from './ToolMessageActions.svelte'
 	import ToolPreviewCard from './ToolPreviewCard.svelte'
@@ -33,14 +32,20 @@
 	)
 	const autoCollapseDetails = $derived(message.autoCollapseDetails !== false)
 
+	// Executing right now, as opposed to queued behind another tool or waiting on
+	// the user — the only state that gets the shimmer.
+	const isRunning = $derived(Boolean(message.isLoading && !message.needsConfirmation))
+
 	// An errored tool must be expandable even if it never opted into details,
 	// otherwise the error set on its status would be invisible.
 	const detailsAvailable = $derived(message.showDetails === true || message.error !== undefined)
 
 	let isExpanded = $derived(
-		(detailsAvailable && (!isSuccessful || !autoCollapseDetails)) ||
-			(message.isStreamingArguments && hasParameters) ||
-			(message.isLoading && message.needsConfirmation)
+		Boolean(
+			(detailsAvailable && (!isSuccessful || !autoCollapseDetails)) ||
+				(message.isStreamingArguments && hasParameters) ||
+				(message.isLoading && message.needsConfirmation)
+		)
 	)
 
 	const visibleActions = $derived(
@@ -65,141 +70,109 @@
 {#if activeUserQuestion}
 	<AskUserQuestionDisplay toolCallId={message.tool_call_id} userQuestion={activeUserQuestion} />
 {:else}
-	<!-- Queued calls (waiting their turn behind the executing tool) are faded: the
-	     reduced weight is what says "not started" — no icon, no spinner. -->
-	<div
-		class={twMerge(
-			'font-mono text-xs',
-			message.isQueued && !message.error ? 'opacity-60 hover:opacity-100 transition-opacity' : ''
-		)}
-	>
-		<!-- Collapsible Header -->
-		{#snippet headerButton()}
-			<button
-				class={twMerge(
-					'min-w-0 py-0.5 my-0.5 rounded-md hover:bg-surface-hover transition-colors inline-flex items-center text-left',
-					message.needsConfirmation ? 'opacity-80' : ''
-				)}
-				onclick={() => (isExpanded = !isExpanded)}
-				disabled={!detailsAvailable && !message.isStreamingArguments}
-			>
-				<div class="flex items-center gap-2 min-w-0">
-					{#if message.isLoading && !message.needsConfirmation}
-						<Loader2 class="w-3.5 h-3.5 animate-spin text-blue-500 shrink-0" />
-					{/if}
-					<span
-						class={twMerge('text-primary font-medium text-2xs', showPreviewChip ? 'truncate' : '')}
-					>
-						{message.content}
-					</span>
+	<!-- Discrete preview chip for an item a tool created/updated, pinned to the
+	     right of the header row. Rendered inline (not gated on expand) so it stays
+	     visible after the tool collapses. -->
+	{#snippet previewChip()}
+		{#if message.previewCard}
+			<ToolPreviewCard card={message.previewCard} />
+		{/if}
+	{/snippet}
 
-					{#if detailsAvailable || message.isStreamingArguments}
-						<ChevronRight
-							class={twMerge(
-								'w-3 h-3 text-secondary transition-transform duration-150 shrink-0',
-								isExpanded ? 'rotate-90' : ''
-							)}
-						/>
-					{/if}
+	<!-- The shimmer is the only running indicator, so the states have to read off
+	     weight alone: queued calls (waiting their turn behind the executing tool)
+	     are faded, the running one sweeps, a settled one is plain. -->
+	<ChatCollapsibleCard
+		label={message.content}
+		expanded={isExpanded}
+		onToggle={() => (isExpanded = !isExpanded)}
+		toggleable={detailsAvailable || message.isStreamingArguments === true}
+		shimmer={isRunning}
+		class={message.isQueued && !message.error
+			? 'opacity-60 hover:opacity-100 transition-opacity'
+			: ''}
+		headerClass={message.needsConfirmation ? 'opacity-80' : ''}
+		labelClass={showPreviewChip ? 'truncate' : ''}
+		contentClass="space-y-3"
+		headerRight={showPreviewChip ? previewChip : undefined}
+	>
+		<!-- Image a tool produced (e.g. take_screenshot) — shown inline, not gated on expand. -->
+		{#snippet belowHeader()}
+			{#if message.imageUrl}
+				<div class="my-1">
+					<ExpandableImage
+						src={message.imageUrl}
+						alt="App preview screenshot"
+						class="max-h-48 max-w-full rounded border border-border-light"
+					/>
 				</div>
-			</button>
+			{/if}
 		{/snippet}
 
-		<!-- Discrete preview chip for an item a tool created/updated, pinned to
-		     the right of the header row. Rendered inline (not gated on expand) so it
-		     stays visible after the tool collapses. -->
-		{#if showPreviewChip && message.previewCard}
-			<div class="flex items-center justify-between gap-2">
-				{@render headerButton()}
-				<ToolPreviewCard card={message.previewCard} />
-			</div>
-		{:else}
-			{@render headerButton()}
-		{/if}
-
-		<!-- Image a tool produced (e.g. take_screenshot) — shown inline, not gated on expand. -->
-		{#if message.imageUrl}
-			<div class="my-1">
-				<ExpandableImage
-					src={message.imageUrl}
-					alt="App preview screenshot"
-					class="max-h-48 max-w-full rounded border border-border-light"
+		<!-- Parameters Section - show if we have parameters, or if confirmation is needed (even with empty params) -->
+		{#if hasParameters || message.needsConfirmation}
+			<div class={message.needsConfirmation ? 'opacity-80' : ''}>
+				<ToolContentDisplay
+					title="Parameters"
+					content={message.parameters}
+					streaming={message.isStreamingArguments}
+					toolName={message.toolName}
+					showFade={message.showFade}
 				/>
 			</div>
 		{/if}
 
-		<!-- Expanded Content -->
-		{#if isExpanded}
-			<div
-				transition:slide={{ duration: 150 }}
-				class="border border-border-light rounded-md bg-surface p-3 space-y-3"
-			>
-				<!-- Parameters Section - show if we have parameters, or if confirmation is needed (even with empty params) -->
-				{#if hasParameters || message.needsConfirmation}
-					<div class={message.needsConfirmation ? 'opacity-80' : ''}>
-						<ToolContentDisplay
-							title="Parameters"
-							content={message.parameters}
-							streaming={message.isStreamingArguments}
-							toolName={message.toolName}
-							showFade={message.showFade}
-						/>
-					</div>
-				{/if}
-
-				<!-- Confirmation Footer -->
-				{#if message.needsConfirmation}
-					<div class="flex flex-row items-center justify-end gap-2">
-						<Button
-							variant="default"
-							size="xs"
-							on:click={() => {
-								if (message.tool_call_id) {
-									aiChatManager.handleToolConfirmation(message.tool_call_id, false)
-								}
-							}}
-							startIcon={{ icon: XCircle }}
-							destructive
-						></Button>
-						<Button
-							variant="accent"
-							size="xs"
-							on:click={() => {
-								if (message.tool_call_id) {
-									aiChatManager.handleToolConfirmation(message.tool_call_id, true)
-								}
-							}}
-							startIcon={{ icon: Play }}
-						>
-							Run
-						</Button>
-					</div>
-
-					<!-- Logs and Result - hide while streaming -->
-				{:else if !message.isStreamingArguments}
-					<ToolContentDisplay
-						title="Logs"
-						content={message.logs}
-						loading={message.isLoading}
-						showWhileLoading={false}
-						showFade={message.showFade}
-					/>
-
-					{#if visibleActions.length > 0}
-						<ToolMessageActions actions={visibleActions} />
-					{:else if message.webSearchSources?.length && !message.error}
-						<WebSearchSourcesDisplay sources={message.webSearchSources} />
-					{:else}
-						<ToolContentDisplay
-							title="Result"
-							content={message.result}
-							error={message.error}
-							loading={message.isLoading}
-							showFade={message.showFade}
-						/>
-					{/if}
-				{/if}
+		<!-- Confirmation Footer -->
+		{#if message.needsConfirmation}
+			<div class="flex flex-row items-center justify-end gap-2">
+				<Button
+					variant="default"
+					size="xs"
+					on:click={() => {
+						if (message.tool_call_id) {
+							aiChatManager.handleToolConfirmation(message.tool_call_id, false)
+						}
+					}}
+					startIcon={{ icon: XCircle }}
+					destructive
+				></Button>
+				<Button
+					variant="accent"
+					size="xs"
+					on:click={() => {
+						if (message.tool_call_id) {
+							aiChatManager.handleToolConfirmation(message.tool_call_id, true)
+						}
+					}}
+					startIcon={{ icon: Play }}
+				>
+					Run
+				</Button>
 			</div>
+
+			<!-- Logs and Result - hide while streaming -->
+		{:else if !message.isStreamingArguments}
+			<ToolContentDisplay
+				title="Logs"
+				content={message.logs}
+				loading={message.isLoading}
+				showWhileLoading={false}
+				showFade={message.showFade}
+			/>
+
+			{#if visibleActions.length > 0}
+				<ToolMessageActions actions={visibleActions} />
+			{:else if message.webSearchSources?.length && !message.error}
+				<WebSearchSourcesDisplay sources={message.webSearchSources} />
+			{:else}
+				<ToolContentDisplay
+					title="Result"
+					content={message.result}
+					error={message.error}
+					loading={message.isLoading}
+					showFade={message.showFade}
+				/>
+			{/if}
 		{/if}
-	</div>
+	</ChatCollapsibleCard>
 {/if}
diff --git a/frontend/src/lib/components/copilot/chat/artifacts/ArtifactVersionPicker.svelte b/frontend/src/lib/components/copilot/chat/artifacts/ArtifactVersionPicker.svelte
new file mode 100644
index 0000000000..e305d3a80f
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/artifacts/ArtifactVersionPicker.svelte
@@ -0,0 +1,109 @@
+<script lang="ts">
+	import Popover from '$lib/components/meltComponents/Popover.svelte'
+	import TimeAgo from '$lib/components/TimeAgo.svelte'
+	import { ChevronDown } from 'lucide-svelte'
+	import { displayDate } from '$lib/utils'
+	import { currentVersion, type ArtifactVersion, type PersistedArtifact } from './artifactsDB'
+	import type { SessionArtifactsStore } from './artifactsState.svelte'
+
+	interface Props {
+		artifact: PersistedArtifact
+		store: SessionArtifactsStore
+		/** Version being shown, or undefined for the current one. */
+		selected: number | undefined
+		onSelect: (version: number | undefined) => void
+	}
+
+	let { artifact, store, selected, onSelect }: Props = $props()
+
+	const latest = $derived(currentVersion(artifact))
+	const shown = $derived(selected ?? latest)
+
+	let open = $state(false)
+	let versions = $state<ArtifactVersion[]>([])
+
+	// Loaded on open, not on mount: a snapshot row carries its whole content, so listing
+	// twenty of them is far more than the trigger needs to know that history exists.
+	// Reloaded on every later version too, since the assistant can write one while the menu
+	// is open — the rows would then contradict the count in the header.
+	$effect(() => {
+		// Reads `latest` only while open, which is exactly when a reload is worth doing.
+		if (open && latest) void load()
+	})
+
+	// Reopening the menu while the assistant is writing puts two loads in flight. Only the
+	// last one asked for may win: an earlier list landing last would be rendered under a
+	// header counted against the newer `latest`, claiming history had been pruned when it
+	// had not.
+	let loadSeq = 0
+	async function load() {
+		const seq = ++loadSeq
+		const loaded = await store.listVersions(artifact.id)
+		if (seq === loadSeq) versions = loaded
+	}
+
+	// v1 was created; anything later was edited — a missing note must not claim otherwise.
+	function noteLabel(v: ArtifactVersion): string {
+		return v.note ?? (v.version === 1 ? 'Created' : 'Edited')
+	}
+
+	function pick(version: number) {
+		open = false
+		onSelect(version === latest ? undefined : version)
+	}
+</script>
+
+<Popover
+	bind:isOpen={open}
+	placement="bottom-start"
+	closeOnOtherPopoverOpen
+	contentClasses="!bg-surface"
+	triggerAttrs={{ 'aria-label': `Version ${shown} of ${latest}`, 'aria-haspopup': 'listbox' }}
+	class="shrink-0"
+>
+	{#snippet trigger()}
+		<span
+			class="flex items-center gap-1 rounded px-1.5 py-0.5 text-2xs font-normal tabular-nums
+				{selected !== undefined
+				? 'bg-orange-100 text-orange-800 dark:bg-orange-950 dark:text-orange-300'
+				: 'bg-surface-secondary text-secondary hover:text-emphasis'}"
+		>
+			v{shown}
+			<ChevronDown size={11} />
+		</span>
+	{/snippet}
+
+	{#snippet content()}
+		<div class="flex w-80 flex-col text-xs">
+			<!-- Version numbers run 1..latest, so a count says nothing the rows don't — until
+			     pruning drops the oldest, which is the one thing the list cannot show. -->
+			<div class="px-3 pt-2 pb-1 text-2xs text-hint">
+				{#if versions.length > 0 && versions.length < latest}
+					{versions.length} most recent of {latest} versions
+				{:else}
+					Versions
+				{/if}
+			</div>
+			<div class="max-h-[min(20rem,60vh)] overflow-y-auto py-1" role="listbox" tabindex="-1">
+				{#each versions as v (v.version)}
+					<button
+						type="button"
+						role="option"
+						aria-selected={v.version === shown}
+						title={noteLabel(v)}
+						class="flex w-full flex-col gap-0.5 px-3 py-1.5 text-left font-normal
+							{v.version === shown ? 'bg-surface-accent-selected' : 'hover:bg-surface-hover'}"
+						onclick={() => pick(v.version)}
+					>
+						<span class="line-clamp-2 w-full text-primary">
+							{noteLabel(v)}
+						</span>
+						<span class="text-2xs tabular-nums text-hint" title={displayDate(new Date(v.savedAt))}>
+							v{v.version} · <TimeAgo date={new Date(v.savedAt).toISOString()} compact /> ago
+						</span>
+					</button>
+				{/each}
+			</div>
+		</div>
+	{/snippet}
+</Popover>
diff --git a/frontend/src/lib/components/copilot/chat/artifacts/ArtifactViewer.svelte b/frontend/src/lib/components/copilot/chat/artifacts/ArtifactViewer.svelte
index 2aadcca63d..1ce7fe1d35 100644
--- a/frontend/src/lib/components/copilot/chat/artifacts/ArtifactViewer.svelte
+++ b/frontend/src/lib/components/copilot/chat/artifacts/ArtifactViewer.svelte
@@ -9,14 +9,68 @@
 	import { copyToClipboard, download } from '$lib/utils'
 	import CodeDisplay from '../script/CodeDisplay.svelte'
 	import LinkRenderer from '../LinkRenderer.svelte'
-	import { artifactFilename, artifactMimeType, type PersistedArtifact } from './artifactsDB'
+	import {
+		artifactFilename,
+		artifactMimeType,
+		currentVersion,
+		type ArtifactVersion,
+		type PersistedArtifact
+	} from './artifactsDB'
 	import { markdownProse } from '$lib/components/markdownProse'
+	import ArtifactVersionPicker from './ArtifactVersionPicker.svelte'
+	import type { SessionArtifactsStore } from './artifactsState.svelte'
+	import { History } from 'lucide-svelte'
+	import TimeAgo from '$lib/components/TimeAgo.svelte'
 
 	interface Props {
 		artifact: PersistedArtifact
+		store: SessionArtifactsStore
 	}
 
-	let { artifact }: Props = $props()
+	let { artifact, store }: Props = $props()
+
+	const latest = $derived(currentVersion(artifact))
+	// Nothing to pick between until a second version exists.
+	const hasHistory = $derived(latest > 1)
+
+	// undefined = following the current version. An explicit pick survives later edits, so
+	// the AI writing v8 does not yank the reader out of the v3 they chose to read.
+	let pinned = $state<number | undefined>(undefined)
+	let pinnedContent = $state<ArtifactVersion | undefined>(undefined)
+
+	// The store hands us a fresh object on every edit, so this effect reruns constantly.
+	// Compare the id against the last one seen: clearing on every rerun would drop the
+	// reader's pin the moment the assistant writes a new version.
+	let pinnedFor: string | undefined
+	$effect(() => {
+		if (artifact.id === pinnedFor) return
+		pinnedFor = artifact.id
+		pinned = undefined
+	})
+
+	$effect(() => {
+		const version = pinned
+		if (version === undefined) {
+			pinnedContent = undefined
+			return
+		}
+		const id = artifact.id
+		void store.getVersion(id, version).then((snapshot) => {
+			if (pinned !== version || artifact.id !== id) return
+			// Pruned out from under the pin (history is capped): fall back to current rather
+			// than showing an empty document.
+			if (!snapshot) {
+				pinned = undefined
+				return
+			}
+			pinnedContent = snapshot
+		})
+	})
+
+	const shown = $derived(pinnedContent ?? artifact)
+	// Label from the snapshot that is rendered, not from the one just requested: the read is
+	// async, so `pinned` names a version the body has not swapped to yet.
+	const shownVersion = $derived(pinnedContent?.version)
 
 	// Markdown is the only rendered kind in v1; anything else shows source only.
 	const canPreview = $derived(artifact.kind === 'md')
@@ -25,12 +79,16 @@
 
 	let copied = $state(false)
 	async function copyRaw() {
-		if (!(await copyToClipboard(artifact.content))) return
+		if (!(await copyToClipboard(shown.content))) return
 		copied = true
 		setTimeout(() => (copied = false), 1500)
 	}
 	function downloadFile() {
-		download(artifactFilename(artifact), artifact.content, artifactMimeType(artifact.kind))
+		download(
+			artifactFilename({ name: shown.name, kind: artifact.kind }),
+			shown.content,
+			artifactMimeType(artifact.kind)
+		)
 	}
 
 	const plugins = [gfmPlugin(), { renderer: { pre: CodeDisplay, a: LinkRenderer } }]
@@ -40,9 +98,17 @@
 	<div class="flex items-center justify-between gap-2 px-8 py-2">
 		<div class="flex items-center gap-1.5 min-w-0 flex-1">
 			<FileText size={14} class="shrink-0 text-secondary" />
-			<span class="truncate text-xs font-normal text-emphasis" title={artifact.name}>
-				{artifact.name}
+			<span class="truncate text-xs font-normal text-emphasis" title={shown.name}>
+				{shown.name}
 			</span>
+			{#if hasHistory}
+				<ArtifactVersionPicker
+					{artifact}
+					{store}
+					selected={shownVersion}
+					onSelect={(v) => (pinned = v)}
+				/>
+			{/if}
 		</div>
 		<div class="flex items-center gap-2 shrink-0">
 			<!-- Copy raw markdown, with a dropdown for the download-as-file variant. -->
@@ -78,11 +144,31 @@
 		</div>
 	</div>
 
+	{#if pinnedContent}
+		<!-- Everything below is stale text; say so where it cannot be scrolled past unnoticed. -->
+		<div
+			class="flex items-center gap-2 px-8 py-1 text-2xs font-normal
+				bg-orange-100 text-orange-800 dark:bg-orange-950 dark:text-orange-300"
+		>
+			<History size={12} class="shrink-0" />
+			<span class="truncate">
+				<!-- compact renders the magnitude only ("8m"); the phrasing belongs to the sentence. -->
+				Viewing v{shownVersion} of {latest} · saved
+				<TimeAgo date={new Date(pinnedContent.savedAt).toISOString()} compact /> ago
+			</span>
+			<div class="ml-auto shrink-0">
+				<Button unifiedSize="xs" variant="default" onClick={() => (pinned = undefined)}>
+					Back to latest
+				</Button>
+			</div>
+		</div>
+	{/if}
+
 	<div class="flex-1 min-h-0 overflow-auto px-8">
 		{#if source}
 			<!-- key: SimpleEditor reads `code` only on init; remount on id or content change. -->
-			{#key `${artifact.id}:${artifact.updatedAt}`}
-				<SimpleEditor lang="markdown" code={artifact.content} readOnly class="h-full" />
+			{#key `${artifact.id}:${pinnedContent ? `v${pinnedContent.version}` : artifact.updatedAt}`}
+				<SimpleEditor lang="markdown" code={shown.content} readOnly class="h-full" />
 			{/key}
 		{:else}
 			<!-- Pinned under the header, fades scrolled-under content instead of hard-clipping it.
@@ -90,7 +176,7 @@
 			<div class="sticky top-0 z-10 h-4 -mb-4 bg-gradient-to-b from-surface-tertiary to-transparent"
 			></div>
 			<div class="pb-4 pt-2 {markdownProse.doc}">
-				<Markdown md={artifact.content} {plugins} />
+				<Markdown md={shown.content} {plugins} />
 			</div>
 		{/if}
 	</div>
diff --git a/frontend/src/lib/components/copilot/chat/artifacts/ArtifactsSegment.svelte b/frontend/src/lib/components/copilot/chat/artifacts/ArtifactsSegment.svelte
index 96412d9b3c..d90c1c6edb 100644
--- a/frontend/src/lib/components/copilot/chat/artifacts/ArtifactsSegment.svelte
+++ b/frontend/src/lib/components/copilot/chat/artifacts/ArtifactsSegment.svelte
@@ -5,7 +5,12 @@
 	import { Download, Trash2 } from 'lucide-svelte'
 	import { download, displayDate } from '$lib/utils'
 	import { getAiChatManager } from '../aiChatManagerContext'
-	import { artifactFilename, artifactMimeType, type PersistedArtifact } from './artifactsDB'
+	import {
+		artifactFilename,
+		artifactMimeType,
+		currentVersion,
+		type PersistedArtifact
+	} from './artifactsDB'
 
 	const aiChatManager = getAiChatManager()
 	const artifacts = $derived(aiChatManager.artifacts.artifacts)
@@ -36,7 +41,8 @@
 			class="min-w-[4.5rem] shrink-0 text-right text-2xs font-normal text-hint"
 			title={displayDate(new Date(a.updatedAt))}
 		>
-			<TimeAgo date={new Date(a.updatedAt).toISOString()} noSeconds />
+			{#if currentVersion(a) > 1}<span class="tabular-nums">v{currentVersion(a)}</span> ·{/if}
+			<TimeAgo date={new Date(a.updatedAt).toISOString()} compact />
 		</span>
 	{/snippet}
 	{#snippet actions(a)}
diff --git a/frontend/src/lib/components/copilot/chat/artifacts/artifactTools.test.ts b/frontend/src/lib/components/copilot/chat/artifacts/artifactTools.test.ts
index 0660708001..69a7689b09 100644
--- a/frontend/src/lib/components/copilot/chat/artifacts/artifactTools.test.ts
+++ b/frontend/src/lib/components/copilot/chat/artifacts/artifactTools.test.ts
@@ -107,13 +107,21 @@ describe('artifact tools', () => {
 
 	it('update_artifact overwrites content and persists', async () => {
 		const a = JSON.parse(await ctx.call('create_artifact', { name: 'A', content: 'v1' }))
-		const res = JSON.parse(await ctx.call('update_artifact', { id: a.id, content: 'v2' }))
+		const res = JSON.parse(
+			await ctx.call('update_artifact', {
+				id: a.id,
+				content: 'v2',
+				change_note: 'Reworded the intro'
+			})
+		)
 		expect(res.success).toBe(true)
 		expect((await ctx.dbMod.getArtifact(a.id))?.content).toBe('v2')
 	})
 
 	it('update_artifact reports a missing id', async () => {
-		const res = JSON.parse(await ctx.call('update_artifact', { id: 'nope', content: 'x' }))
+		const res = JSON.parse(
+			await ctx.call('update_artifact', { id: 'nope', content: 'x', change_note: 'n/a' })
+		)
 		expect(res.success).toBe(false)
 		expect(res.error).toMatch(/No artifact/)
 	})
@@ -123,6 +131,55 @@ describe('artifact tools', () => {
 		expect(res.success).toBe(false)
 	})
 
+	it('exposes the version history and reads an earlier version by number', async () => {
+		const a = JSON.parse(await ctx.call('create_artifact', { name: 'A', content: 'v1' }))
+		await ctx.call('update_artifact', {
+			id: a.id,
+			content: 'v2',
+			change_note: 'Reworded the intro'
+		})
+
+		const versions = JSON.parse(await ctx.call('list_artifact_versions', { id: a.id }))
+		expect(versions.map((v: any) => [v.version, v.current, v.note])).toEqual([
+			[2, true, 'Reworded the intro'],
+			// A first version has no note — the picker labels it itself.
+			[1, false, undefined]
+		])
+		expect(JSON.parse(await ctx.call('read_artifact', { id: a.id, version: 1 })).content).toBe('v1')
+		// Omitting the version, and naming the current one, both read the live content.
+		expect(JSON.parse(await ctx.call('read_artifact', { id: a.id })).content).toBe('v2')
+		expect(JSON.parse(await ctx.call('read_artifact', { id: a.id, version: 2 })).content).toBe('v2')
+	})
+
+	it('stores an overlong change note truncated rather than failing the update', async () => {
+		const a = JSON.parse(await ctx.call('create_artifact', { name: 'A', content: 'v1' }))
+		const res = JSON.parse(
+			await ctx.call('update_artifact', { id: a.id, content: 'v2', change_note: 'x'.repeat(300) })
+		)
+		// The content edit must land: the note is a label, not a reason to reject the write.
+		expect(res.success).toBe(true)
+		expect((await ctx.dbMod.getArtifact(a.id))?.content).toBe('v2')
+		const [latest] = await ctx.store.listVersions(a.id)
+		expect(latest.note).toHaveLength(120)
+	})
+
+	it('stores a blank change note as absent so the picker can label it', async () => {
+		const a = JSON.parse(await ctx.call('create_artifact', { name: 'A', content: 'v1' }))
+		// Whitespace-only survives zod's `z.string()`; "" is not nullish, so it would slip
+		// past the picker's fallback and render a row with no label at all.
+		await ctx.call('update_artifact', { id: a.id, content: 'v2', change_note: '   ' })
+
+		const [latest] = await ctx.store.listVersions(a.id)
+		expect(latest.note).toBeUndefined()
+	})
+
+	it('read_artifact reports a version that was never saved or has been pruned', async () => {
+		const a = JSON.parse(await ctx.call('create_artifact', { name: 'A', content: 'v1' }))
+		const res = JSON.parse(await ctx.call('read_artifact', { id: a.id, version: 7 }))
+		expect(res.success).toBe(false)
+		expect(res.error).toMatch(/list_artifact_versions/)
+	})
+
 	it('rejects content over the size cap without persisting', async () => {
 		const huge = 'x'.repeat(256 * 1024 + 1)
 		const res = JSON.parse(await ctx.call('create_artifact', { name: 'Big', content: huge }))
@@ -133,8 +190,16 @@ describe('artifact tools', () => {
 
 	it('reports unavailable when there is no session', async () => {
 		const noSession = await fresh(undefined)
-		for (const name of ['create_artifact', 'list_artifacts', 'update_artifact', 'read_artifact']) {
-			const res = JSON.parse(await noSession.call(name, { id: 'x', name: 'A', content: 'a' }))
+		for (const name of [
+			'create_artifact',
+			'list_artifacts',
+			'update_artifact',
+			'read_artifact',
+			'list_artifact_versions'
+		]) {
+			const res = JSON.parse(
+				await noSession.call(name, { id: 'x', name: 'A', content: 'a', change_note: 'n/a' })
+			)
 			expect(res.success).toBe(false)
 			expect(res.error).toMatch(/inside an AI session/)
 		}
@@ -154,7 +219,9 @@ describe('artifact tools', () => {
 		})
 		const read = JSON.parse(await ctx.call('read_artifact', { id: 'other' }))
 		expect(read.success).toBe(false)
-		const updated = JSON.parse(await ctx.call('update_artifact', { id: 'other', content: 'x' }))
+		const updated = JSON.parse(
+			await ctx.call('update_artifact', { id: 'other', content: 'x', change_note: 'n/a' })
+		)
 		expect(updated.success).toBe(false)
 		// The other session's content is untouched.
 		expect((await ctx.dbMod.getArtifact('other'))?.content).toBe('secret')
diff --git a/frontend/src/lib/components/copilot/chat/artifacts/artifactTools.ts b/frontend/src/lib/components/copilot/chat/artifacts/artifactTools.ts
index 2716793a56..b1f37cb75b 100644
--- a/frontend/src/lib/components/copilot/chat/artifacts/artifactTools.ts
+++ b/frontend/src/lib/components/copilot/chat/artifacts/artifactTools.ts
@@ -1,5 +1,6 @@
 import { z } from 'zod'
 import { createToolDef, type Tool } from '../shared'
+import { currentVersion } from './artifactsDB'
 import type { SessionArtifactsStore } from './artifactsState.svelte'
 
 // The subset of GlobalToolHelpers these tools read. Kept local (not imported from
@@ -14,6 +15,11 @@ type ArtifactToolHelpers = {
 
 const MAX_ARTIFACT_BYTES = 256 * 1024
 
+// Bounds what a snapshot stores and replays to the model. Enforced by truncation rather
+// than by the schema: rejecting the call would throw away a real content update over a
+// cosmetic label, and the model would have to resend the whole document to recover.
+const MAX_NOTE_CHARS = 120
+
 const createArtifactSchema = z.object({
 	name: z.string().describe('Short display title for the artifact.'),
 	content: z.string().describe('Full markdown content of the artifact.')
@@ -22,13 +28,26 @@ const createArtifactSchema = z.object({
 const updateArtifactSchema = z.object({
 	id: z.string().describe('Id of the artifact to update, from create_artifact or list_artifacts.'),
 	content: z.string().describe('New full markdown content, replacing the previous content.'),
-	name: z.string().optional().describe('New display title. Omit to keep the current one.')
+	name: z.string().optional().describe('New display title. Omit to keep the current one.'),
+	change_note: z
+		.string()
+		.describe(
+			'What this edit changes, as a short label the user will read in the version picker: under 60 characters, no trailing period, starting with a verb — "Added rollback section", "Tightened the phase 2 wording".'
+		)
 })
 
 const listArtifactsSchema = z.object({})
 
 const readArtifactSchema = z.object({
-	id: z.string().describe('Id of the artifact to read.')
+	id: z.string().describe('Id of the artifact to read.'),
+	version: z
+		.number()
+		.optional()
+		.describe('Version to read, from list_artifact_versions. Omit for the current content.')
+})
+
+const listArtifactVersionsSchema = z.object({
+	id: z.string().describe('Id of the artifact whose history to list.')
 })
 
 function tooLarge(content: string): string | undefined {
@@ -93,7 +112,13 @@ export const artifactTools: Tool<{}>[] = [
 			}
 			const updated = await h.artifacts.update(
 				parsed.id,
-				{ content: parsed.content, name: parsed.name },
+				{
+					content: parsed.content,
+					name: parsed.name,
+					// Blank collapses to undefined, not "": an empty string is not nullish, so it
+					// would slip past the picker's fallback and render a row with no label.
+					note: parsed.change_note.trim().slice(0, MAX_NOTE_CHARS) || undefined
+				},
 				{ sessionId }
 			)
 			if (!updated) {
@@ -134,7 +159,7 @@ export const artifactTools: Tool<{}>[] = [
 		def: createToolDef(
 			readArtifactSchema,
 			'read_artifact',
-			"Read an artifact's full markdown content by id."
+			"Read an artifact's full markdown content by id, at its current or an earlier version."
 		),
 		fn: async ({ args, toolId, toolCallbacks, helpers }) => {
 			const parsed = readArtifactSchema.parse(args)
@@ -151,13 +176,70 @@ export const artifactTools: Tool<{}>[] = [
 				toolCallbacks.setToolStatus(toolId, { content: error, error })
 				return JSON.stringify({ success: false, error })
 			}
+			if (parsed.version !== undefined && parsed.version !== currentVersion(artifact)) {
+				const snapshot = await h.artifacts.getVersion(parsed.id, parsed.version, { sessionId })
+				if (!snapshot) {
+					// Pruned or never existed; either way the model should re-list rather than retry.
+					const error = `Artifact "${artifact.name}" has no version ${parsed.version}. Call list_artifact_versions for the versions still kept.`
+					toolCallbacks.setToolStatus(toolId, { content: error, error })
+					return JSON.stringify({ success: false, error })
+				}
+				toolCallbacks.setToolStatus(toolId, {
+					content: `Read artifact "${artifact.name}" (v${snapshot.version})`
+				})
+				return JSON.stringify({
+					id: artifact.id,
+					name: snapshot.name,
+					kind: artifact.kind,
+					version: snapshot.version,
+					savedAt: new Date(snapshot.savedAt).toISOString(),
+					content: snapshot.content
+				})
+			}
 			toolCallbacks.setToolStatus(toolId, { content: `Read artifact "${artifact.name}"` })
 			return JSON.stringify({
 				id: artifact.id,
 				name: artifact.name,
 				kind: artifact.kind,
+				version: currentVersion(artifact),
 				content: artifact.content
 			})
 		}
+	},
+	{
+		def: createToolDef(
+			listArtifactVersionsSchema,
+			'list_artifact_versions',
+			"List an artifact's saved versions, newest first. Read one with read_artifact's version argument."
+		),
+		fn: async ({ args, toolId, toolCallbacks, helpers }) => {
+			const parsed = listArtifactVersionsSchema.parse(args)
+			const h = helpers as ArtifactToolHelpers
+			const sessionId = h.sessionId
+			if (!h.artifacts || !sessionId) {
+				toolCallbacks.setToolStatus(toolId, { content: UNAVAILABLE, error: UNAVAILABLE })
+				return JSON.stringify({ success: false, error: UNAVAILABLE })
+			}
+			const artifact = await h.artifacts.get(parsed.id)
+			if (!artifact || artifact.sessionId !== sessionId) {
+				const error = `No artifact found with id "${parsed.id}".`
+				toolCallbacks.setToolStatus(toolId, { content: error, error })
+				return JSON.stringify({ success: false, error })
+			}
+			const versions = await h.artifacts.listVersions(parsed.id, { sessionId })
+			const current = currentVersion(artifact)
+			toolCallbacks.setToolStatus(toolId, {
+				content: `Listed ${versions.length} version${versions.length === 1 ? '' : 's'} of "${artifact.name}"`
+			})
+			return JSON.stringify(
+				versions.map((v) => ({
+					version: v.version,
+					current: v.version === current,
+					name: v.name,
+					savedAt: new Date(v.savedAt).toISOString(),
+					...(v.note ? { note: v.note } : {})
+				}))
+			)
+		}
 	}
 ]
diff --git a/frontend/src/lib/components/copilot/chat/artifacts/artifactsDB.test.ts b/frontend/src/lib/components/copilot/chat/artifacts/artifactsDB.test.ts
index 442d9ea080..82d8e4ecb8 100644
--- a/frontend/src/lib/components/copilot/chat/artifacts/artifactsDB.test.ts
+++ b/frontend/src/lib/components/copilot/chat/artifacts/artifactsDB.test.ts
@@ -1,6 +1,6 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { IDBFactory } from 'fake-indexeddb'
-import type { PersistedArtifact } from './artifactsDB'
+import type { ArtifactVersion, PersistedArtifact } from './artifactsDB'
 
 // The user-scoping subscription is BROWSER-gated; the node test env reports false.
 vi.mock('esm-env', async (orig) => ({
@@ -47,6 +47,17 @@ beforeEach(async () => {
 	db = await freshDb()
 })
 
+function version(v: number, artifactId = 'a1'): ArtifactVersion {
+	return {
+		key: `${artifactId}:${v}`,
+		artifactId,
+		version: v,
+		name: 'Doc',
+		content: `body ${v}`,
+		savedAt: v
+	}
+}
+
 describe('artifactsDB', () => {
 	it('derives filename and mime type from the artifact kind', () => {
 		expect(db.artifactFilename({ name: 'Plan', kind: 'md' })).toBe('Plan.md')
@@ -94,6 +105,81 @@ describe('artifactsDB', () => {
 		expect((await db.listArtifactsForSession('s2')).map((a) => a.id)).toEqual(['c'])
 	})
 
+	it('upgrades a version-1 database in place, keeping the artifacts already in it', async () => {
+		vi.resetModules()
+		;(globalThis as any).indexedDB = new IDBFactory()
+		const store = (await import('$lib/stores')).userStore as unknown as {
+			set: (v: unknown) => void
+		}
+		store.set({ email: 'a@x.com' })
+
+		// The schema exactly as it shipped before version history: `items` and nothing else.
+		// Every existing user's database looks like this, and the upgrade runs over it — the
+		// path no other test reaches, because they all start from an empty IDBFactory.
+		const { openDB } = await import('idb')
+		const v1 = (await openDB('copilot-artifacts::a@x.com', 1, {
+			upgrade(database) {
+				const items = (database as any).createObjectStore('items', { keyPath: 'id' })
+				items.createIndex('by-session', 'sessionId')
+			}
+		})) as any
+		await v1.put('items', artifact({ id: 'old', sessionId: 's1', content: 'written at v1' }))
+		v1.close()
+
+		const upgraded = await import('./artifactsDB')
+		// A ConstraintError here would reject the open, and a rejected open degrades silently
+		// — every pre-existing artifact would just quietly stop existing.
+		expect((await upgraded.getArtifact('old'))?.content).toBe('written at v1')
+		expect((await upgraded.listArtifactsForSession('s1')).map((a) => a.id)).toEqual(['old'])
+		// The store the upgrade added works on the upgraded database, not just a fresh one.
+		await upgraded.putArtifactWithVersions(artifact({ id: 'old' }), [version(1, 'old')])
+		expect((await upgraded.listArtifactVersions('old')).map((v) => v.version)).toEqual([1])
+	})
+
+	it('keeps only the most recent versions of an artifact', async () => {
+		const total = db.MAX_VERSIONS_PER_ARTIFACT + 5
+		for (let v = 1; v <= total; v++)
+			await db.putArtifactWithVersions(artifact({ id: 'a1' }), [version(v)])
+
+		const kept = await db.listArtifactVersions('a1')
+		expect(kept).toHaveLength(db.MAX_VERSIONS_PER_ARTIFACT)
+		// Newest first, and the pruned tail is the numerically — not lexicographically —
+		// oldest, which is what separates v9 from v10 surviving.
+		expect(kept[0].version).toBe(total)
+		expect(kept.at(-1)?.version).toBe(total - db.MAX_VERSIONS_PER_ARTIFACT + 1)
+	})
+
+	it('keeps fewer versions of a large artifact, but never fewer than the minimum', async () => {
+		// Big enough that the char budget, not the count, decides — a plain count cap would
+		// let one document's history run to several MB.
+		const big = 'x'.repeat(db.MAX_VERSION_CHARS_PER_ARTIFACT / 4)
+		for (let v = 1; v <= 8; v++)
+			await db.putArtifactWithVersions(artifact({ id: 'a1' }), [{ ...version(v), content: big }])
+
+		const kept = await db.listArtifactVersions('a1')
+		expect(kept).toHaveLength(4)
+		expect(kept[0].version).toBe(8)
+
+		// A single snapshot larger than the whole budget still leaves a usable history.
+		const huge = 'x'.repeat(db.MAX_VERSION_CHARS_PER_ARTIFACT * 2)
+		await db.putArtifactWithVersions(artifact({ id: 'a1' }), [{ ...version(9), content: huge }])
+		expect(await db.listArtifactVersions('a1')).toHaveLength(db.MIN_VERSIONS_PER_ARTIFACT)
+	})
+
+	it('deleting an artifact, or a whole session, drops the versions with it', async () => {
+		await db.putArtifact(artifact({ id: 'a1', sessionId: 's1' }))
+		await db.putArtifact(artifact({ id: 'a2', sessionId: 's1' }))
+		await db.putArtifactWithVersions(artifact({ id: 'a1', sessionId: 's1' }), [version(1)])
+		await db.putArtifactWithVersions(artifact({ id: 'a2', sessionId: 's1' }), [version(1, 'a2')])
+
+		await db.deleteArtifact('a1')
+		expect(await db.listArtifactVersions('a1')).toEqual([])
+		expect(await db.listArtifactVersions('a2')).toHaveLength(1)
+
+		await db.deleteArtifactsForSession('s1')
+		expect(await db.listArtifactVersions('a2')).toEqual([])
+	})
+
 	it('isolates artifacts between users on the same browser', async () => {
 		await db.putArtifact(artifact({ id: 'a', sessionId: 's1' }))
 		// A different user sees an empty, separate database...
diff --git a/frontend/src/lib/components/copilot/chat/artifacts/artifactsDB.ts b/frontend/src/lib/components/copilot/chat/artifacts/artifactsDB.ts
index ad10ddb216..e937b170bf 100644
--- a/frontend/src/lib/components/copilot/chat/artifacts/artifactsDB.ts
+++ b/frontend/src/lib/components/copilot/chat/artifacts/artifactsDB.ts
@@ -1,6 +1,6 @@
 // Scoped by sessionId (fixed for the session's life), not chatId: a session follows its
 // active chat's rotation, so chatId-keying would drop artifacts on each new conversation.
-import { type DBSchema as IDBSchema } from 'idb'
+import { type DBSchema as IDBSchema, type IDBPObjectStore } from 'idb'
 import { userScopedDb } from '$lib/userScopedDb'
 
 export type ArtifactKind = 'md' | 'html'
@@ -14,6 +14,48 @@ export interface PersistedArtifact {
 	content: string
 	createdAt: number
 	updatedAt: number
+	/** Absent on artifacts written before history existed — read it through currentVersion(). */
+	version?: number
+}
+
+/** A content snapshot taken every time an artifact's content changes. */
+export interface ArtifactVersion {
+	/** versionKey(artifactId, version) — the store's keyPath. */
+	key: string
+	artifactId: string
+	version: number
+	name: string
+	content: string
+	savedAt: number
+	/** What this edit changed, in the editor's words. Absent on a first version. */
+	note?: string
+}
+
+/** Oldest snapshots past this are dropped: history is bounded, IndexedDB quota is not. */
+export const MAX_VERSIONS_PER_ARTIFACT = 20
+
+/**
+ * A count alone does not bound storage — twenty snapshots of a max-size artifact would be
+ * ~5 MB of history for one document — so a large artifact keeps proportionally fewer.
+ * Sized from the incoming snapshot rather than from the whole history, which would mean
+ * deserializing every stored version's content on each write just to total it up.
+ */
+export const MAX_VERSION_CHARS_PER_ARTIFACT = 1024 * 1024
+
+/** However large the artifact, keep enough history for the picker to be worth opening. */
+export const MIN_VERSIONS_PER_ARTIFACT = 3
+
+function versionsToKeep(chars: number): number {
+	const affordable = Math.floor(MAX_VERSION_CHARS_PER_ARTIFACT / Math.max(1, chars))
+	return Math.min(MAX_VERSIONS_PER_ARTIFACT, Math.max(MIN_VERSIONS_PER_ARTIFACT, affordable))
+}
+
+export function currentVersion(a: Pick<PersistedArtifact, 'version'>): number {
+	return a.version ?? 1
+}
+
+export function versionKey(artifactId: string, version: number): string {
+	return `${artifactId}:${version}`
 }
 
 export function artifactFilename(a: Pick<PersistedArtifact, 'name' | 'kind'>): string {
@@ -30,15 +72,28 @@ interface ArtifactsSchema extends IDBSchema {
 		value: PersistedArtifact
 		indexes: { 'by-session': string }
 	}
+	versions: {
+		key: string
+		value: ArtifactVersion
+		indexes: { 'by-artifact': string }
+	}
 }
 
 // User-scoped like the chat-history store these are keyed against: no cross-user
 // co-residency on a shared browser.
 const dbh = userScopedDb<ArtifactsSchema>('copilot-artifacts', {
-	version: 1,
+	version: 2,
+	// Runs for a fresh database and for the v1 upgrade alike, so create each store only
+	// when it is missing.
 	upgrade(db) {
-		const store = db.createObjectStore('items', { keyPath: 'id' })
-		store.createIndex('by-session', 'sessionId')
+		if (!db.objectStoreNames.contains('items')) {
+			const store = db.createObjectStore('items', { keyPath: 'id' })
+			store.createIndex('by-session', 'sessionId')
+		}
+		if (!db.objectStoreNames.contains('versions')) {
+			const store = db.createObjectStore('versions', { keyPath: 'key' })
+			store.createIndex('by-artifact', 'artifactId')
+		}
 	}
 })
 
@@ -80,11 +135,88 @@ export async function listArtifactsForSession(sessionId: string): Promise<Persis
 	}
 }
 
+/**
+ * Write an artifact and the snapshots that edit produced in one transaction.
+ *
+ * Never as two writes: a row stamped version N whose snapshot is missing still *reads*
+ * as complete, because listVersions synthesizes N from the row itself — until the next
+ * edit overwrites that row, at which point N's content is gone and the history has a
+ * hole nothing can back-fill.
+ */
+export async function putArtifactWithVersions(
+	artifact: PersistedArtifact,
+	snapshots: ArtifactVersion[]
+): Promise<void> {
+	const db = await getDB()
+	if (!db) return
+	try {
+		const tx = db.transaction(['items', 'versions'], 'readwrite')
+		const versions = tx.objectStore('versions')
+		await tx.objectStore('items').put(artifact)
+		for (const entry of snapshots) await versions.put(entry)
+		const newest = snapshots.at(-1)
+		if (newest) await pruneVersionsIn(versions, artifact.id, newest.content.length)
+		await tx.done
+	} catch (err) {
+		// A rejected write (most likely QuotaExceededError) leaves the artifact usable for the
+		// session but unpersisted — degrade like the reads rather than throwing at the caller.
+		console.error('Could not persist artifact', err)
+	}
+}
+
+async function pruneVersionsIn(
+	store: VersionsStore,
+	artifactId: string,
+	newestChars: number
+): Promise<void> {
+	const keys = await store.index('by-artifact').getAllKeys(artifactId)
+	const keep = versionsToKeep(newestChars)
+	if (keys.length <= keep) return
+	// Keys sort lexicographically, which puts ":10" before ":2" — order by the parsed
+	// number so pruning drops the genuinely oldest snapshots.
+	const oldest = keys.sort((a, b) => versionOf(a) - versionOf(b)).slice(0, keys.length - keep)
+	for (const key of oldest) await store.delete(key)
+}
+
+function versionOf(key: string): number {
+	return Number(key.slice(key.lastIndexOf(':') + 1))
+}
+
+/** The artifact's snapshots, newest first. */
+export async function listArtifactVersions(artifactId: string): Promise<ArtifactVersion[]> {
+	const db = await getDB()
+	if (!db) return []
+	try {
+		const items = await db.getAllFromIndex('versions', 'by-artifact', artifactId)
+		return items.sort((a, b) => b.version - a.version)
+	} catch (err) {
+		console.error('Could not read artifact versions', err)
+		return []
+	}
+}
+
+export async function getArtifactVersion(
+	artifactId: string,
+	version: number
+): Promise<ArtifactVersion | undefined> {
+	const db = await getDB()
+	if (!db) return undefined
+	try {
+		return await db.get('versions', versionKey(artifactId, version))
+	} catch (err) {
+		console.error('Could not read artifact version', err)
+		return undefined
+	}
+}
+
 export async function deleteArtifact(id: string): Promise<void> {
 	const db = await getDB()
 	if (!db) return
 	try {
-		await db.delete('items', id)
+		const tx = db.transaction(['items', 'versions'], 'readwrite')
+		await tx.objectStore('items').delete(id)
+		await deleteVersionsIn(tx.objectStore('versions'), id)
+		await tx.done
 	} catch (err) {
 		console.error('Could not delete artifact', err)
 	}
@@ -94,15 +226,31 @@ export async function deleteArtifactsForSession(sessionId: string): Promise<void
 	const db = await getDB()
 	if (!db) return
 	try {
-		const tx = db.transaction('items', 'readwrite')
-		const index = tx.store.index('by-session')
-		let cursor = await index.openCursor(sessionId)
-		while (cursor) {
-			await cursor.delete()
-			cursor = await cursor.continue()
+		const tx = db.transaction(['items', 'versions'], 'readwrite')
+		const items = tx.objectStore('items')
+		const versions = tx.objectStore('versions')
+		// Collect the ids up front rather than deleting from a live cursor: interleaving
+		// another store's requests between continue() calls is what breaks a cursor walk.
+		const ids = await items.index('by-session').getAllKeys(sessionId)
+		for (const id of ids) {
+			await items.delete(id)
+			await deleteVersionsIn(versions, id)
 		}
 		await tx.done
 	} catch (err) {
 		console.error('Could not delete artifacts for session', err)
 	}
 }
+
+type VersionsStore = IDBPObjectStore<
+	ArtifactsSchema,
+	('items' | 'versions')[],
+	'versions',
+	'readwrite'
+>
+
+async function deleteVersionsIn(store: VersionsStore, artifactId: string): Promise<void> {
+	for (const key of await store.index('by-artifact').getAllKeys(artifactId)) {
+		await store.delete(key)
+	}
+}
diff --git a/frontend/src/lib/components/copilot/chat/artifacts/artifactsState.svelte.ts b/frontend/src/lib/components/copilot/chat/artifacts/artifactsState.svelte.ts
index 43e6bbe72a..9a54fd8f83 100644
--- a/frontend/src/lib/components/copilot/chat/artifacts/artifactsState.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/artifacts/artifactsState.svelte.ts
@@ -1,10 +1,15 @@
 import { randomUUID } from '$lib/utils/uuid'
 import {
+	currentVersion,
 	deleteArtifact,
 	getArtifact,
+	getArtifactVersion,
+	listArtifactVersions,
 	listArtifactsForSession,
-	putArtifact,
+	putArtifactWithVersions,
+	versionKey,
 	type ArtifactKind,
+	type ArtifactVersion,
 	type PersistedArtifact
 } from './artifactsDB'
 
@@ -18,6 +23,8 @@ export interface CreateArtifactInput {
 export interface UpdateArtifactInput {
 	name?: string
 	content?: string
+	/** Recorded on the snapshot this update produces; ignored if content is unchanged. */
+	note?: string
 }
 
 /**
@@ -87,9 +94,10 @@ export class SessionArtifactsStore {
 			name: input.name,
 			content: input.content,
 			createdAt: now,
-			updatedAt: now
+			updatedAt: now,
+			version: 1
 		}
-		await putArtifact(artifact)
+		await putArtifactWithVersions(artifact, [snapshotOf(artifact, 1)])
 		if (sessionId === this.#sessionId) {
 			this.#applyWrite(sortByUpdatedDesc([artifact, ...this.artifacts]))
 		}
@@ -108,19 +116,69 @@ export class SessionArtifactsStore {
 		const existing = this.artifacts.find((a) => a.id === id) ?? (await getArtifact(id))
 		if (!existing) return undefined
 		if (opts?.sessionId !== undefined && existing.sessionId !== opts.sessionId) return undefined
+		// Only a content change earns a version: a rename or an identical rewrite would
+		// otherwise fill the picker with entries the user cannot tell apart.
+		const contentChanged = input.content !== undefined && input.content !== existing.content
+		const version = currentVersion(existing) + (contentChanged ? 1 : 0)
 		const updated: PersistedArtifact = {
 			...existing,
 			name: input.name ?? existing.name,
 			content: input.content ?? existing.content,
-			updatedAt: Date.now()
+			updatedAt: Date.now(),
+			version
 		}
-		await putArtifact(updated)
+		const snapshots: ArtifactVersion[] = []
+		// An artifact written before history existed has no snapshot of its current content,
+		// so capture one on *any* update, not just a content change: this write stamps
+		// `version`, and nothing afterwards would recognise it as pre-history.
+		if (existing.version === undefined) {
+			snapshots.push(snapshotOf(existing, currentVersion(existing)))
+		}
+		if (contentChanged) {
+			snapshots.push(snapshotOf(updated, version, input.note))
+		}
+		await putArtifactWithVersions(updated, snapshots)
 		if (updated.sessionId === this.#sessionId) {
 			this.#applyWrite(sortByUpdatedDesc(this.artifacts.map((a) => (a.id === id ? updated : a))))
 		}
 		return updated
 	}
 
+	/**
+	 * Every snapshot of an artifact, newest first. Empty if `id` is unknown, or if
+	 * `opts.sessionId` is given and the artifact belongs to a different session — snapshots
+	 * carry the document's full text, so this scopes like update() rather than trusting
+	 * every caller to check first.
+	 */
+	async listVersions(id: string, opts?: { sessionId?: string }): Promise<ArtifactVersion[]> {
+		const artifact = await this.get(id)
+		if (opts?.sessionId !== undefined && artifact?.sessionId !== opts.sessionId) return []
+		const stored = await listArtifactVersions(id)
+		if (!artifact) return stored
+		const version = currentVersion(artifact)
+		// An artifact written before history existed has no snapshot of its current
+		// content, so stand one in — the picker must never show a document as absent
+		// from its own history.
+		if (!stored.some((v) => v.version === version)) {
+			return [snapshotOf(artifact, version), ...stored]
+		}
+		return stored
+	}
+
+	/** One snapshot; scoped by `opts.sessionId` like listVersions when it is given. */
+	async getVersion(
+		id: string,
+		version: number,
+		opts?: { sessionId?: string }
+	): Promise<ArtifactVersion | undefined> {
+		const artifact = await this.get(id)
+		if (opts?.sessionId !== undefined && artifact?.sessionId !== opts.sessionId) return undefined
+		const stored = await getArtifactVersion(id, version)
+		if (stored) return stored
+		if (artifact && currentVersion(artifact) === version) return snapshotOf(artifact, version)
+		return undefined
+	}
+
 	async remove(id: string): Promise<void> {
 		await deleteArtifact(id)
 		// Guard on presence: a no-op remove must not invalidate an in-flight load.
@@ -129,6 +187,18 @@ export class SessionArtifactsStore {
 	}
 }
 
+function snapshotOf(a: PersistedArtifact, version: number, note?: string): ArtifactVersion {
+	return {
+		key: versionKey(a.id, version),
+		artifactId: a.id,
+		version,
+		name: a.name,
+		content: a.content,
+		savedAt: a.updatedAt,
+		note
+	}
+}
+
 function sortByUpdatedDesc(items: PersistedArtifact[]): PersistedArtifact[] {
 	return [...items].sort((a, b) => b.updatedAt - a.updatedAt)
 }
diff --git a/frontend/src/lib/components/copilot/chat/artifacts/artifactsState.test.ts b/frontend/src/lib/components/copilot/chat/artifacts/artifactsState.test.ts
index 6558d158dd..7036c16f2f 100644
--- a/frontend/src/lib/components/copilot/chat/artifacts/artifactsState.test.ts
+++ b/frontend/src/lib/components/copilot/chat/artifacts/artifactsState.test.ts
@@ -191,6 +191,70 @@ describe('SessionArtifactsStore', () => {
 		expect((await store.update(created.id, { content: '' }))?.content).toBe('')
 	})
 
+	it('snapshots a version per content change, and none for a rename', async () => {
+		await store.setSession('s1')
+		const created = await store.create('s1', { name: 'Plan', content: 'v1' })
+
+		await store.update(created.id, { content: 'v2', note: 'Added a rollback step' })
+		// Neither a rename nor a rewrite to the identical content is a new version.
+		await store.update(created.id, { name: 'Renamed', note: 'ignored' })
+		await store.update(created.id, { content: 'v2', note: 'ignored' })
+
+		const versions = await store.listVersions(created.id)
+		expect(versions.map((v) => [v.version, v.content, v.note])).toEqual([
+			[2, 'v2', 'Added a rollback step'],
+			[1, 'v1', undefined]
+		])
+		expect((await store.get(created.id))?.version).toBe(2)
+		expect((await store.getVersion(created.id, 1))?.content).toBe('v1')
+	})
+
+	it('persists a row and the snapshots it produced in one write', async () => {
+		await store.setSession('s1')
+		const created = await store.create('s1', { name: 'Doc', content: 'c1' })
+
+		const spy = vi.spyOn(dbMod, 'putArtifactWithVersions')
+		await store.update(created.id, { content: 'c2', note: 'second' })
+
+		// Split into two writes, a stamped version can outlive the snapshot that failed to
+		// land beside it. That state still reads as complete, because listVersions
+		// synthesizes the current version from the row — right up until the next edit
+		// overwrites the row, which is the only copy of that content left.
+		expect(spy).toHaveBeenCalledTimes(1)
+		expect(spy.mock.calls[0][1].map((v) => v.version)).toEqual([2])
+		spy.mockRestore()
+
+		const row = await dbMod.getArtifact(created.id)
+		const stored = await dbMod.listArtifactVersions(created.id)
+		expect(stored.some((v) => v.version === row!.version)).toBe(true)
+	})
+
+	it('keeps a legacy v1 when a rename lands before the first content edit', async () => {
+		await dbMod.putArtifact(mk({ id: 'legacy', content: 'original' }))
+		await store.setSession('s1')
+
+		// The rename stamps `version`, after which nothing else would recognise this as a
+		// pre-history artifact — so its v1 has to be captured here or it is lost for good.
+		await store.update('legacy', { name: 'Renamed' })
+		await store.update('legacy', { content: 'edited', note: 'Rewrote it' })
+
+		expect((await store.listVersions('legacy')).map((v) => [v.version, v.content])).toEqual([
+			[2, 'edited'],
+			[1, 'original']
+		])
+	})
+
+	it('reads an artifact stored before history existed as its own version 1', async () => {
+		await dbMod.putArtifact(mk({ id: 'legacy', content: 'only' }))
+		await store.setSession('s1')
+
+		expect(await store.listVersions('legacy')).toMatchObject([{ version: 1, content: 'only' }])
+		expect((await store.getVersion('legacy', 1))?.content).toBe('only')
+		// Its first edit still lands as v2, so version numbers stay monotonic.
+		await store.update('legacy', { content: 'edited' })
+		expect((await store.listVersions('legacy')).map((v) => v.version)).toEqual([2, 1])
+	})
+
 	it('remove deletes from the DB and the loaded list', async () => {
 		await store.setSession('s1')
 		const created = await store.create('s1', { name: 'Plan', content: 'x' })
diff --git a/frontend/src/lib/components/copilot/chat/chatLoop.test.ts b/frontend/src/lib/components/copilot/chat/chatLoop.test.ts
index b0bfa8b8ca..2c4eb466e9 100644
--- a/frontend/src/lib/components/copilot/chat/chatLoop.test.ts
+++ b/frontend/src/lib/components/copilot/chat/chatLoop.test.ts
@@ -10,6 +10,7 @@ const mocks = vi.hoisted(() => ({
 	providerSupportsWebSearch: vi.fn(),
 	getOpenAIResponsesCompletion: vi.fn(),
 	parseOpenAIResponsesCompletion: vi.fn(),
+	buildPromptCacheKey: vi.fn(),
 	getAnthropicCompletion: vi.fn(),
 	parseAnthropicCompletion: vi.fn(),
 	resolveRequestReasoning: vi.fn(),
@@ -29,7 +30,8 @@ vi.mock('../reasoningRegistry', () => ({
 
 vi.mock('./openai-responses', () => ({
 	getOpenAIResponsesCompletion: mocks.getOpenAIResponsesCompletion,
-	parseOpenAIResponsesCompletion: mocks.parseOpenAIResponsesCompletion
+	parseOpenAIResponsesCompletion: mocks.parseOpenAIResponsesCompletion,
+	buildPromptCacheKey: mocks.buildPromptCacheKey
 }))
 
 vi.mock('./anthropic', () => ({
@@ -423,6 +425,76 @@ describe('runChatLoop reasoning summary fallback', () => {
 	})
 })
 
+describe('runChatLoop prompt cache key fallback', () => {
+	beforeEach(() => {
+		vi.resetAllMocks()
+		mocks.providerSupportsWebSearch.mockReturnValue(false)
+		mocks.resolveRequestReasoning.mockReturnValue(undefined)
+		mocks.resolveEffectiveReasoning.mockReturnValue(undefined)
+		mocks.parseOpenAIResponsesCompletion.mockResolvedValue({
+			shouldContinue: false,
+			tokenUsage
+		})
+		mocks.parseOpenAICompletion.mockResolvedValue({
+			shouldContinue: false,
+			tokenUsage
+		})
+	})
+
+	it('retries once without the key when the endpoint rejects it, and caches that', async () => {
+		const workspace = `workspace-${randomUUID()}`
+		const modelProvider: ReasoningProviderModel = { provider: 'openai', model: 'gpt-5.6' }
+		const promptCacheKey = `${workspace}:openai:gpt-5.6:chat`
+		mocks.buildPromptCacheKey.mockReturnValue(promptCacheKey)
+
+		mocks.getOpenAIResponsesCompletion
+			.mockRejectedValueOnce(
+				Object.assign(new Error('Unrecognized request argument supplied: prompt_cache_key'), {
+					status: 400,
+					param: 'prompt_cache_key'
+				})
+			)
+			.mockResolvedValue({})
+
+		await runChatLoop(createConfig({ workspace, modelProvider }))
+
+		expect(mocks.getOpenAIResponsesCompletion).toHaveBeenCalledTimes(2)
+		expect(mocks.getOpenAIResponsesCompletion.mock.calls[0][3]).toEqual(
+			expect.objectContaining({ promptCacheKey })
+		)
+		expect(mocks.getOpenAIResponsesCompletion.mock.calls[1][3]).toEqual(
+			expect.objectContaining({ promptCacheKey: undefined })
+		)
+		// The rejection belongs to the endpoint, so a later run skips the key outright
+		// rather than paying the failed round-trip again.
+		expect(mocks.getCompletion).not.toHaveBeenCalled()
+
+		await runChatLoop(createConfig({ workspace, modelProvider }))
+
+		expect(mocks.getOpenAIResponsesCompletion).toHaveBeenCalledTimes(3)
+		expect(mocks.getOpenAIResponsesCompletion.mock.calls[2][3]).toEqual(
+			expect.objectContaining({ promptCacheKey: undefined })
+		)
+	})
+
+	it('does not treat an unrelated 400 as a prompt cache key rejection', async () => {
+		const workspace = `workspace-${randomUUID()}`
+		const modelProvider: ReasoningProviderModel = { provider: 'openai', model: 'gpt-5.6' }
+		mocks.buildPromptCacheKey.mockReturnValue(`${workspace}:openai:gpt-5.6:chat`)
+
+		mocks.getOpenAIResponsesCompletion.mockRejectedValue(
+			Object.assign(new Error('context_length_exceeded'), { status: 400 })
+		)
+		mocks.getCompletion.mockResolvedValue({})
+
+		await runChatLoop(createConfig({ workspace, modelProvider }))
+
+		// Falls through to the Completions API instead of burning a retry on the key.
+		expect(mocks.getOpenAIResponsesCompletion).toHaveBeenCalledTimes(1)
+		expect(mocks.getCompletion).toHaveBeenCalledTimes(1)
+	})
+})
+
 describe('runChatLoop lastIterationUsage', () => {
 	beforeEach(() => {
 		vi.resetAllMocks()
diff --git a/frontend/src/lib/components/copilot/chat/chatLoop.ts b/frontend/src/lib/components/copilot/chat/chatLoop.ts
index 49afb03a55..cc963e4b25 100644
--- a/frontend/src/lib/components/copilot/chat/chatLoop.ts
+++ b/frontend/src/lib/components/copilot/chat/chatLoop.ts
@@ -14,7 +14,11 @@ import {
 import { getAnthropicCompletion, parseAnthropicCompletion } from './anthropic'
 import { modelSupportsVision, usesAnthropicMessagesApi } from '../modelConfig'
 import { boundImagePartBytes, stripImagePartsFromMessages } from './imageUtils'
-import { getOpenAIResponsesCompletion, parseOpenAIResponsesCompletion } from './openai-responses'
+import {
+	buildPromptCacheKey,
+	getOpenAIResponsesCompletion,
+	parseOpenAIResponsesCompletion
+} from './openai-responses'
 import type { Tool, ToolCallbacks } from './shared'
 import { sanitizeToolCallArguments } from './toolCallArguments'
 import { addChatTokenUsage, emptyChatTokenUsage, type ChatTokenUsage } from './tokenUsage'
@@ -130,6 +134,11 @@ const WEB_SEARCH_UNAVAILABLE_STATUS_CODES = new Set([400, 403, 404])
 const unsupportedReasoningSummaryCache = new Set<string>()
 const REASONING_SUMMARY_UNAVAILABLE_STATUS_CODES = new Set([400, 403])
 
+// A gateway that validates the request body strictly rejects `prompt_cache_key`
+// outright, so it is a property of the endpoint the credentials point at, not of the
+// model. Same in-memory reasoning as above: a reload re-probes.
+const unsupportedPromptCacheKeyCache = new Set<string>()
+
 function getWebSearchCacheKey(workspace: string, modelProvider: ReasoningProviderModel): string {
 	return [workspace, modelProvider.provider, modelProvider.model].join(':')
 }
@@ -141,6 +150,15 @@ function getReasoningSummaryCacheKey(
 	return [workspace, modelProvider.provider].join(':')
 }
 
+// Keyed without the model, like the reasoning-summary probe: a body-validation refusal
+// belongs to the endpoint, so switching models must not re-pay the failed round trip.
+function getPromptCacheKeySupportKey(
+	workspace: string,
+	modelProvider: ReasoningProviderModel
+): string {
+	return [workspace, modelProvider.provider].join(':')
+}
+
 function isRecord(value: unknown): value is Record<string, unknown> {
 	return typeof value === 'object' && value !== null
 }
@@ -251,6 +269,25 @@ function shouldRetryWithoutReasoningSummary(err: unknown): boolean {
 	)
 }
 
+// An OpenAI-compatible gateway that validates the body strictly names the offending
+// field, whether it calls it an unrecognized argument or an unexpected additional
+// property.
+function shouldRetryWithoutPromptCacheKey(err: unknown): boolean {
+	const status = getErrorStatus(err)
+	if (status !== undefined && status !== 400) {
+		return false
+	}
+	if (getErrorParam(err) === 'prompt_cache_key') {
+		return true
+	}
+	return getErrorText(err).includes('prompt_cache_key')
+}
+
+function markPromptCacheKeyUnsupported(cacheKey: string, err: unknown) {
+	unsupportedPromptCacheKeyCache.add(cacheKey)
+	console.warn('prompt_cache_key rejected; retrying without prompt caching hints:', err)
+}
+
 function markReasoningSummaryUnsupported(
 	cacheKey: string,
 	err: unknown,
@@ -360,6 +397,13 @@ export async function runChatLoop(config: ChatLoopConfig): Promise<ChatLoopResul
 				resolveEffectiveReasoning(modelProvider) !== undefined &&
 				!unsupportedReasoningSummaryCache.has(reasoningSummaryCacheKey)
 
+			// One key for the whole chat surface: every iteration opens with the same
+			// system prompt and tool definitions, and each one extends the previous
+			// iteration's prefix, so they all belong on the same cache.
+			const promptCacheKey = buildPromptCacheKey('chat', modelProvider, workspace)
+			const promptCacheSupportKey = getPromptCacheKeySupportKey(workspace, modelProvider)
+			let usePromptCacheKey = !unsupportedPromptCacheKeyCache.has(promptCacheSupportKey)
+
 			const runOpenAIResponses = async (useWebSearch: boolean): Promise<boolean> => {
 				const completion = await getOpenAIResponsesCompletion(
 					messageParams,
@@ -370,7 +414,8 @@ export async function runChatLoop(config: ChatLoopConfig): Promise<ChatLoopResul
 						openaiClient: clients.openai,
 						webSearch: useWebSearch,
 						reasoningEffort,
-						reasoningSummary
+						reasoningSummary,
+						promptCacheKey: usePromptCacheKey ? promptCacheKey : undefined
 					}
 				)
 				const continueCompletion = await parseOpenAIResponsesCompletion(
@@ -389,9 +434,10 @@ export async function runChatLoop(config: ChatLoopConfig): Promise<ChatLoopResul
 			let useCompletionsApi = skipResponsesApi
 			if (!skipResponsesApi) {
 				// Retry the Responses call disabling whichever optional feature the
-				// provider rejected (reasoning summary, web search) in the order the
-				// errors arrive — a turn can hit both, either one first. Each retry
-				// permanently disables one feature, so this loops at most twice.
+				// provider rejected (reasoning summary, web search, prompt cache key) in
+				// the order the errors arrive — a turn can hit several, any one first.
+				// Each retry permanently disables one feature, so this loops at most
+				// once per feature.
 				let useWebSearch = webSearch
 				let outcome: 'break' | 'continue' | undefined
 				let fallbackError: unknown
@@ -409,6 +455,9 @@ export async function runChatLoop(config: ChatLoopConfig): Promise<ChatLoopResul
 						} else if (useWebSearch && shouldRetryWithoutWebSearch(err)) {
 							markWebSearchUnsupported(webSearchCacheKey, err, config.onWebSearchUnavailable)
 							useWebSearch = false
+						} else if (usePromptCacheKey && shouldRetryWithoutPromptCacheKey(err)) {
+							markPromptCacheKeyUnsupported(promptCacheSupportKey, err)
+							usePromptCacheKey = false
 						} else {
 							fallbackError = err
 							break
@@ -501,7 +550,8 @@ export async function runChatLoop(config: ChatLoopConfig): Promise<ChatLoopResul
 			const completion = await getCompletion(messageParams, abortController, toolDefs, {
 				forceModelProvider: modelProvider,
 				openaiClient: clients.openai,
-				reasoningEffort
+				reasoningEffort,
+				promptCaching: true
 			})
 			if (completion) {
 				const continueCompletion = await parseOpenAICompletion(
diff --git a/frontend/src/lib/components/copilot/chat/flow/FlowAIChat.svelte b/frontend/src/lib/components/copilot/chat/flow/FlowAIChat.svelte
index e8e3207e05..47a6b0b169 100644
--- a/frontend/src/lib/components/copilot/chat/flow/FlowAIChat.svelte
+++ b/frontend/src/lib/components/copilot/chat/flow/FlowAIChat.svelte
@@ -157,7 +157,9 @@
 		},
 
 		selectStep: (id) => {
-			selectionManager.selectId(id)
+			// The step's editor must actually be on screen for the user to see what the
+			// assistant is working on.
+			selectionManager.selectId(id, { openPanel: true })
 		},
 
 		testFlow: async (args, conversationId) => {
@@ -175,8 +177,9 @@
 				return { errorCount: 0, warningCount: 0, errors: [], warnings: [] }
 			}
 
-			// Focus the module first
-			selectionManager.selectId(moduleId)
+			// Lint is read off the mounted editor, so the panel has to be open — with it
+			// closed the poll below would time out and report a clean script.
+			selectionManager.selectId(moduleId, { openPanel: true })
 
 			// Poll until editor exists
 			const maxWait = 3000
diff --git a/frontend/src/lib/components/copilot/chat/flow/assetKind.test.ts b/frontend/src/lib/components/copilot/chat/flow/assetKind.test.ts
new file mode 100644
index 0000000000..7da70a2cc1
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/flow/assetKind.test.ts
@@ -0,0 +1,35 @@
+import { describe, expect, it } from 'vitest'
+import { flowModulesSchema } from './openFlowZod.gen'
+
+// Guards against the generated copilot flow Zod schema (openFlowZod.gen.ts)
+// drifting from the asset `kind` enum in openflow.openapi.yaml. A missing kind
+// here rejects the whole flow module in the copilot editing path
+// (validateFlowModules -> flowModulesSchema), so an unrelated AI edit to a flow
+// containing a step that reads a warehouse table would fail.
+function rawScriptModuleWithAssetKind(kind: string) {
+	return {
+		id: 'a',
+		value: {
+			type: 'rawscript',
+			language: 'bun',
+			content: 'export async function main() {}',
+			input_transforms: {},
+			assets: [{ path: 'analytics.stg_orders', kind, access_type: 'r' }]
+		}
+	}
+}
+
+describe('copilot flow module validation - asset kind', () => {
+	it('accepts table (and the s3object baseline)', () => {
+		expect(flowModulesSchema.safeParse([rawScriptModuleWithAssetKind('s3object')]).success).toBe(
+			true
+		)
+		expect(flowModulesSchema.safeParse([rawScriptModuleWithAssetKind('dbt')]).success).toBe(true)
+	})
+
+	it('still rejects a kind the API does not define', () => {
+		expect(flowModulesSchema.safeParse([rawScriptModuleWithAssetKind('warehouse')]).success).toBe(
+			false
+		)
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/flow/openFlow.json b/frontend/src/lib/components/copilot/chat/flow/openFlow.json
index 0aeb9019f8..da7dd9da5b 100644
--- a/frontend/src/lib/components/copilot/chat/flow/openFlow.json
+++ b/frontend/src/lib/components/copilot/chat/flow/openFlow.json
@@ -1 +1 @@
-{"openapi":"3.0.3","info":{"version":"1.771.1","title":"OpenFlow Spec","contact":{"name":"Ruben Fiszel","email":"ruben@windmill.dev","url":"https://windmill.dev"},"license":{"name":"Apache 2.0","url":"https://www.apache.org/licenses/LICENSE-2.0.html"}},"paths":{},"externalDocs":{"description":"documentation portal","url":"https://windmill.dev"},"components":{"schemas":{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"The flow will be run with the permissions of the user with this email."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"preserve_step_tags":{"type":"boolean","description":"If true and the flow runs on a custom worker tag, steps that declare their own non-empty tag run on it instead of inheriting the flow tag. Steps without their own tag still inherit the flow tag."},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff (delay doubles each time)","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Initial delay in seconds"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note (e.g., \"yellow\", \"#ffff00\")"},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes, 'group' for notes that group other nodes"},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution — modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor"}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."},"error_include_result":{"type":"boolean","description":"When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type"}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"},"reasoning_effort":{"type":"string","description":"Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default."}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type"}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryAuto":{"type":"object","description":"Automatic context management","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","description":"Explicit message history","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Conversation memory configuration","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind"}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type"}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"}],"discriminator":{"propertyName":"type"}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw",null]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw",null]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"Short description of what this tool does (shown to the AI)"},"description":{"type":"string","description":"Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script."},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}]},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\nValid values: 'text' (default) - plain text response, 'image' - image generation\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with flow.input syntax."},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\nFormat: Array<{ bucket: string, key: string }> - S3 object references\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\nRange: 0.0 to 2.0 (provider-dependent)\n- 0.0 = deterministic, focused responses\n- 0.7 = balanced (common default)\n- 1.0+ = more creative/random\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\nRange: 1-1000.\n"}},"required":["user_message"]},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default `flow`)"},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"agent":{"type":"string","description":"Path of a reusable `ai_agent` resource (hybrid linking). When set, the agent brain\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\nthat resource; the module's input_transforms then only carry the flow-local inputs\n(user_message/user_attachments).\n"},"tool_inputs":{"type":"object","description":"Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\nshared resource; overlaid onto the tools' input_transforms at runtime — including when\n`agent` is unset, since a step forked for editing keeps these overrides until it is saved\nback or unlinked.\n","additionalProperties":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}}},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}}}
\ No newline at end of file
+{"openapi":"3.0.3","info":{"version":"1.775.2","title":"OpenFlow Spec","contact":{"name":"Ruben Fiszel","email":"ruben@windmill.dev","url":"https://windmill.dev"},"license":{"name":"Apache 2.0","url":"https://www.apache.org/licenses/LICENSE-2.0.html"}},"paths":{},"externalDocs":{"description":"documentation portal","url":"https://windmill.dev"},"components":{"schemas":{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"Address of the account the flow runs on behalf of. Derived from on_behalf_of on read; accepted on write, where it is resolved to the account it names."},"on_behalf_of":{"type":"string","description":"The flow runs with the permissions of this identity: u/{username}, g/{group}, or a bare email when the username is itself email-shaped. The only stored half of the identity; on_behalf_of_email is derived from it. Omit it when writing and it is resolved from that address instead."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"preserve_step_tags":{"type":"boolean","description":"If true and the flow runs on a custom worker tag, steps that declare their own non-empty tag run on it instead of inheriting the flow tag. Steps without their own tag still inherit the flow tag."},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff (delay doubles each time)","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Initial delay in seconds"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note (e.g., \"yellow\", \"#ffff00\")"},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes, 'group' for notes that group other nodes"},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution — modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor"}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."},"error_include_result":{"type":"boolean","description":"When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type"}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"},"reasoning_effort":{"type":"string","description":"Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default."}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type"}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryAuto":{"type":"object","description":"Automatic context management","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","description":"Explicit message history","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Conversation memory configuration","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind"}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type"}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"}],"discriminator":{"propertyName":"type"}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw",null]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw",null]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"Short description of what this tool does (shown to the AI)"},"description":{"type":"string","description":"Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script."},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}]},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\nValid values: 'text' (default) - plain text response, 'image' - image generation\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with flow.input syntax."},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\nFormat: Array<{ bucket: string, key: string }> - S3 object references\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\nRange: 0.0 to 2.0 (provider-dependent)\n- 0.0 = deterministic, focused responses\n- 0.7 = balanced (common default)\n- 1.0+ = more creative/random\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\nRange: 1-1000.\n"}},"required":["user_message"]},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default `flow`)"},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"agent":{"type":"string","description":"Path of a reusable `ai_agent` resource (hybrid linking). When set, the agent brain\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\nthat resource; the module's input_transforms then only carry the flow-local inputs\n(user_message/user_attachments).\n"},"tool_inputs":{"type":"object","description":"Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\nshared resource; overlaid onto the tools' input_transforms at runtime — including when\n`agent` is unset, since a step forked for editing keeps these overrides until it is saved\nback or unlinked.\n","additionalProperties":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}}},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}}}
\ No newline at end of file
diff --git a/frontend/src/lib/components/copilot/chat/flow/openFlowZod.gen.ts b/frontend/src/lib/components/copilot/chat/flow/openFlowZod.gen.ts
index 64cabda2bb..854b768479 100644
--- a/frontend/src/lib/components/copilot/chat/flow/openFlowZod.gen.ts
+++ b/frontend/src/lib/components/copilot/chat/flow/openFlowZod.gen.ts
@@ -1,6 +1,6 @@
 import { z } from "zod"
 
-export const flowModuleValueSchema = z.discriminatedUnion("type", [z.object({ "input_transforms": z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs")).describe("Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments"), "content": z.string().describe("The script source code. Should export a 'main' function"), "language": z.enum(["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]).describe("Programming language for this script"), "path": z.string().describe("Optional path for saving this script").optional(), "lock": z.string().describe("Lock file content for dependencies").optional(), "type": z.literal("rawscript"), "tag": z.string().describe("Worker group tag for execution routing").optional(), "concurrent_limit": z.number().describe("Maximum concurrent executions of this script").optional(), "concurrency_time_window_s": z.number().describe("Time window for concurrent_limit").optional(), "custom_concurrency_key": z.string().describe("Custom key for grouping concurrent executions").optional(), "is_trigger": z.boolean().describe("If true, this script is a trigger that can start the flow").optional(), "assets": z.array(z.object({ "path": z.string().describe("Path to the asset"), "kind": z.enum(["s3object","resource","ducklake","datatable","volume"]).describe("Type of asset"), "access_type": z.union([z.literal("r"), z.literal("w"), z.literal("rw"), z.literal(null)]).nullable().describe("Access level for this asset").optional(), "alt_access_type": z.union([z.literal("r"), z.literal("w"), z.literal("rw"), z.literal(null)]).nullable().describe("Alternative access level").optional() })).describe("External resources this script accesses (S3 objects, resources, etc.)").optional() }).describe("Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms"), z.object({ "input_transforms": z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs")).describe("Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments"), "path": z.string().describe("Path to the script in the workspace (e.g., 'f/scripts/send_email')"), "hash": z.string().describe("Optional specific version hash of the script to use").optional(), "type": z.literal("script"), "tag_override": z.string().describe("Override the script's default worker group tag").optional(), "is_trigger": z.boolean().describe("If true, this script is a trigger that can start the flow").optional() }).describe("Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code"), z.object({ "input_transforms": z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs")).describe("Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments"), "path": z.string().describe("Path to the flow in the workspace (e.g., 'f/flows/process_user')"), "type": z.literal("flow") }).describe("Reference to an existing flow by path. Use this to call another flow as a subflow"), z.object({ "modules": z.array(z.object({ "id": z.string().describe("Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"), "value": z.lazy(() => flowModuleValueSchema), "stop_after_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "stop_after_all_iters_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "skip_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'") }).describe("Conditionally skip this step based on previous results or flow inputs").optional(), "sleep": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "cache_ttl": z.number().describe("Cache duration in seconds for this step's results").optional(), "cache_ignore_s3_path": z.boolean().optional(), "timeout": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "delete_after_secs": z.number().int().describe("If set, delete the step's args, result and logs after this many seconds following job completion").optional(), "summary": z.string().describe("Short description of what this step does").optional(), "mock": z.object({ "enabled": z.boolean().describe("If true, return mock value instead of executing").optional(), "return_value": z.any().describe("Value to return when mocked").optional() }).describe("Mock configuration for testing without executing the actual step").optional(), "suspend": z.object({ "required_events": z.number().int().describe("Number of approvals required before continuing").optional(), "timeout": z.number().int().describe("Timeout in seconds before auto-continuing or canceling").optional(), "resume_form": z.object({ "schema": z.record(z.string(), z.any()).describe("JSON Schema for the resume form").optional() }).describe("Form schema for collecting input when resuming").optional(), "user_auth_required": z.boolean().describe("If true, only authenticated users can approve").optional(), "user_groups_required": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "self_approval_disabled": z.boolean().describe("If true, the user who started the flow cannot approve").optional(), "hide_cancel": z.boolean().describe("If true, hide the cancel button on the approval form").optional(), "continue_on_disapprove_timeout": z.boolean().describe("If true, continue flow on timeout instead of canceling").optional() }).describe("Configuration for approval/resume steps that wait for user input").optional(), "priority": z.number().describe("Execution priority for this step (higher numbers run first)").optional(), "continue_on_error": z.boolean().describe("If true, flow continues even if this step fails").optional(), "retry": z.object({ "constant": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "seconds": z.number().int().describe("Seconds to wait between retries").optional() }).describe("Retry with constant delay between attempts").optional(), "exponential": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(), "seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(), "random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional() }).describe("Retry with exponential backoff (delay doubles each time)").optional(), "retry_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables") }).describe("Conditional retry based on error or result").optional() }).describe("Retry configuration for failed module executions").optional(), "debouncing": z.object({ "debounce_delay_s": z.number().int().describe("Delay in seconds to debounce this step's executions across flow runs").optional(), "debounce_key": z.string().describe("Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>").optional(), "debounce_args_to_accumulate": z.array(z.string()).describe("Array-type arguments to accumulate across debounced executions").optional(), "max_total_debouncing_time": z.number().int().describe("Maximum total time in seconds before forced execution").optional(), "max_total_debounces_amount": z.number().int().describe("Maximum number of debounces before forced execution").optional() }).describe("Debounce configuration for this step (EE only)").optional() }).describe("A single step in a flow. Can be a script, subflow, loop, or branch")).describe("Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'"), "iterator": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs"), "skip_failures": z.boolean().describe("If true, iteration failures don't stop the loop. Failed iterations return null"), "type": z.literal("forloopflow"), "parallel": z.boolean().describe("If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency").optional(), "parallelism": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "squash": z.boolean().optional() }).describe("Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations"), z.object({ "modules": z.array(z.object({ "id": z.string().describe("Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"), "value": z.lazy(() => flowModuleValueSchema), "stop_after_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "stop_after_all_iters_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "skip_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'") }).describe("Conditionally skip this step based on previous results or flow inputs").optional(), "sleep": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "cache_ttl": z.number().describe("Cache duration in seconds for this step's results").optional(), "cache_ignore_s3_path": z.boolean().optional(), "timeout": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "delete_after_secs": z.number().int().describe("If set, delete the step's args, result and logs after this many seconds following job completion").optional(), "summary": z.string().describe("Short description of what this step does").optional(), "mock": z.object({ "enabled": z.boolean().describe("If true, return mock value instead of executing").optional(), "return_value": z.any().describe("Value to return when mocked").optional() }).describe("Mock configuration for testing without executing the actual step").optional(), "suspend": z.object({ "required_events": z.number().int().describe("Number of approvals required before continuing").optional(), "timeout": z.number().int().describe("Timeout in seconds before auto-continuing or canceling").optional(), "resume_form": z.object({ "schema": z.record(z.string(), z.any()).describe("JSON Schema for the resume form").optional() }).describe("Form schema for collecting input when resuming").optional(), "user_auth_required": z.boolean().describe("If true, only authenticated users can approve").optional(), "user_groups_required": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "self_approval_disabled": z.boolean().describe("If true, the user who started the flow cannot approve").optional(), "hide_cancel": z.boolean().describe("If true, hide the cancel button on the approval form").optional(), "continue_on_disapprove_timeout": z.boolean().describe("If true, continue flow on timeout instead of canceling").optional() }).describe("Configuration for approval/resume steps that wait for user input").optional(), "priority": z.number().describe("Execution priority for this step (higher numbers run first)").optional(), "continue_on_error": z.boolean().describe("If true, flow continues even if this step fails").optional(), "retry": z.object({ "constant": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "seconds": z.number().int().describe("Seconds to wait between retries").optional() }).describe("Retry with constant delay between attempts").optional(), "exponential": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(), "seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(), "random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional() }).describe("Retry with exponential backoff (delay doubles each time)").optional(), "retry_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables") }).describe("Conditional retry based on error or result").optional() }).describe("Retry configuration for failed module executions").optional(), "debouncing": z.object({ "debounce_delay_s": z.number().int().describe("Delay in seconds to debounce this step's executions across flow runs").optional(), "debounce_key": z.string().describe("Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>").optional(), "debounce_args_to_accumulate": z.array(z.string()).describe("Array-type arguments to accumulate across debounced executions").optional(), "max_total_debouncing_time": z.number().int().describe("Maximum total time in seconds before forced execution").optional(), "max_total_debounces_amount": z.number().int().describe("Maximum number of debounces before forced execution").optional() }).describe("Debounce configuration for this step (EE only)").optional() }).describe("A single step in a flow. Can be a script, subflow, loop, or branch")).describe("Steps to execute in each iteration"), "skip_failures": z.boolean().describe("If true, iteration failures don't stop the loop. Failed iterations return null"), "type": z.literal("whileloopflow"), "parallel": z.boolean().describe("If true, iterations run concurrently (use with caution in while loops)").optional(), "parallelism": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "squash": z.boolean().optional() }).describe("Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result"), z.object({ "branches": z.array(z.object({ "summary": z.string().describe("Short description of this branch condition").optional(), "expr": z.string().describe("JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"), "modules": z.array(z.object({ "id": z.string().describe("Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"), "value": z.lazy(() => flowModuleValueSchema), "stop_after_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "stop_after_all_iters_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "skip_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'") }).describe("Conditionally skip this step based on previous results or flow inputs").optional(), "sleep": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "cache_ttl": z.number().describe("Cache duration in seconds for this step's results").optional(), "cache_ignore_s3_path": z.boolean().optional(), "timeout": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "delete_after_secs": z.number().int().describe("If set, delete the step's args, result and logs after this many seconds following job completion").optional(), "summary": z.string().describe("Short description of what this step does").optional(), "mock": z.object({ "enabled": z.boolean().describe("If true, return mock value instead of executing").optional(), "return_value": z.any().describe("Value to return when mocked").optional() }).describe("Mock configuration for testing without executing the actual step").optional(), "suspend": z.object({ "required_events": z.number().int().describe("Number of approvals required before continuing").optional(), "timeout": z.number().int().describe("Timeout in seconds before auto-continuing or canceling").optional(), "resume_form": z.object({ "schema": z.record(z.string(), z.any()).describe("JSON Schema for the resume form").optional() }).describe("Form schema for collecting input when resuming").optional(), "user_auth_required": z.boolean().describe("If true, only authenticated users can approve").optional(), "user_groups_required": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "self_approval_disabled": z.boolean().describe("If true, the user who started the flow cannot approve").optional(), "hide_cancel": z.boolean().describe("If true, hide the cancel button on the approval form").optional(), "continue_on_disapprove_timeout": z.boolean().describe("If true, continue flow on timeout instead of canceling").optional() }).describe("Configuration for approval/resume steps that wait for user input").optional(), "priority": z.number().describe("Execution priority for this step (higher numbers run first)").optional(), "continue_on_error": z.boolean().describe("If true, flow continues even if this step fails").optional(), "retry": z.object({ "constant": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "seconds": z.number().int().describe("Seconds to wait between retries").optional() }).describe("Retry with constant delay between attempts").optional(), "exponential": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(), "seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(), "random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional() }).describe("Retry with exponential backoff (delay doubles each time)").optional(), "retry_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables") }).describe("Conditional retry based on error or result").optional() }).describe("Retry configuration for failed module executions").optional(), "debouncing": z.object({ "debounce_delay_s": z.number().int().describe("Delay in seconds to debounce this step's executions across flow runs").optional(), "debounce_key": z.string().describe("Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>").optional(), "debounce_args_to_accumulate": z.array(z.string()).describe("Array-type arguments to accumulate across debounced executions").optional(), "max_total_debouncing_time": z.number().int().describe("Maximum total time in seconds before forced execution").optional(), "max_total_debounces_amount": z.number().int().describe("Maximum number of debounces before forced execution").optional() }).describe("Debounce configuration for this step (EE only)").optional() }).describe("A single step in a flow. Can be a script, subflow, loop, or branch")).describe("Steps to execute if this branch's expr is true") })).describe("Array of branches to evaluate in order. The first branch with expr evaluating to true executes"), "default": z.array(z.object({ "id": z.string().describe("Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"), "value": z.lazy(() => flowModuleValueSchema), "stop_after_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "stop_after_all_iters_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "skip_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'") }).describe("Conditionally skip this step based on previous results or flow inputs").optional(), "sleep": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "cache_ttl": z.number().describe("Cache duration in seconds for this step's results").optional(), "cache_ignore_s3_path": z.boolean().optional(), "timeout": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "delete_after_secs": z.number().int().describe("If set, delete the step's args, result and logs after this many seconds following job completion").optional(), "summary": z.string().describe("Short description of what this step does").optional(), "mock": z.object({ "enabled": z.boolean().describe("If true, return mock value instead of executing").optional(), "return_value": z.any().describe("Value to return when mocked").optional() }).describe("Mock configuration for testing without executing the actual step").optional(), "suspend": z.object({ "required_events": z.number().int().describe("Number of approvals required before continuing").optional(), "timeout": z.number().int().describe("Timeout in seconds before auto-continuing or canceling").optional(), "resume_form": z.object({ "schema": z.record(z.string(), z.any()).describe("JSON Schema for the resume form").optional() }).describe("Form schema for collecting input when resuming").optional(), "user_auth_required": z.boolean().describe("If true, only authenticated users can approve").optional(), "user_groups_required": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "self_approval_disabled": z.boolean().describe("If true, the user who started the flow cannot approve").optional(), "hide_cancel": z.boolean().describe("If true, hide the cancel button on the approval form").optional(), "continue_on_disapprove_timeout": z.boolean().describe("If true, continue flow on timeout instead of canceling").optional() }).describe("Configuration for approval/resume steps that wait for user input").optional(), "priority": z.number().describe("Execution priority for this step (higher numbers run first)").optional(), "continue_on_error": z.boolean().describe("If true, flow continues even if this step fails").optional(), "retry": z.object({ "constant": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "seconds": z.number().int().describe("Seconds to wait between retries").optional() }).describe("Retry with constant delay between attempts").optional(), "exponential": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(), "seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(), "random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional() }).describe("Retry with exponential backoff (delay doubles each time)").optional(), "retry_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables") }).describe("Conditional retry based on error or result").optional() }).describe("Retry configuration for failed module executions").optional(), "debouncing": z.object({ "debounce_delay_s": z.number().int().describe("Delay in seconds to debounce this step's executions across flow runs").optional(), "debounce_key": z.string().describe("Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>").optional(), "debounce_args_to_accumulate": z.array(z.string()).describe("Array-type arguments to accumulate across debounced executions").optional(), "max_total_debouncing_time": z.number().int().describe("Maximum total time in seconds before forced execution").optional(), "max_total_debounces_amount": z.number().int().describe("Maximum number of debounces before forced execution").optional() }).describe("Debounce configuration for this step (EE only)").optional() }).describe("A single step in a flow. Can be a script, subflow, loop, or branch")).describe("Steps to execute if no branch expressions match"), "type": z.literal("branchone") }).describe("Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes"), z.object({ "branches": z.array(z.object({ "summary": z.string().describe("Short description of this branch's purpose").optional(), "skip_failure": z.boolean().describe("If true, failure in this branch doesn't fail the entire flow").optional(), "modules": z.array(z.object({ "id": z.string().describe("Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"), "value": z.lazy(() => flowModuleValueSchema), "stop_after_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "stop_after_all_iters_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "skip_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'") }).describe("Conditionally skip this step based on previous results or flow inputs").optional(), "sleep": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "cache_ttl": z.number().describe("Cache duration in seconds for this step's results").optional(), "cache_ignore_s3_path": z.boolean().optional(), "timeout": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "delete_after_secs": z.number().int().describe("If set, delete the step's args, result and logs after this many seconds following job completion").optional(), "summary": z.string().describe("Short description of what this step does").optional(), "mock": z.object({ "enabled": z.boolean().describe("If true, return mock value instead of executing").optional(), "return_value": z.any().describe("Value to return when mocked").optional() }).describe("Mock configuration for testing without executing the actual step").optional(), "suspend": z.object({ "required_events": z.number().int().describe("Number of approvals required before continuing").optional(), "timeout": z.number().int().describe("Timeout in seconds before auto-continuing or canceling").optional(), "resume_form": z.object({ "schema": z.record(z.string(), z.any()).describe("JSON Schema for the resume form").optional() }).describe("Form schema for collecting input when resuming").optional(), "user_auth_required": z.boolean().describe("If true, only authenticated users can approve").optional(), "user_groups_required": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "self_approval_disabled": z.boolean().describe("If true, the user who started the flow cannot approve").optional(), "hide_cancel": z.boolean().describe("If true, hide the cancel button on the approval form").optional(), "continue_on_disapprove_timeout": z.boolean().describe("If true, continue flow on timeout instead of canceling").optional() }).describe("Configuration for approval/resume steps that wait for user input").optional(), "priority": z.number().describe("Execution priority for this step (higher numbers run first)").optional(), "continue_on_error": z.boolean().describe("If true, flow continues even if this step fails").optional(), "retry": z.object({ "constant": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "seconds": z.number().int().describe("Seconds to wait between retries").optional() }).describe("Retry with constant delay between attempts").optional(), "exponential": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(), "seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(), "random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional() }).describe("Retry with exponential backoff (delay doubles each time)").optional(), "retry_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables") }).describe("Conditional retry based on error or result").optional() }).describe("Retry configuration for failed module executions").optional(), "debouncing": z.object({ "debounce_delay_s": z.number().int().describe("Delay in seconds to debounce this step's executions across flow runs").optional(), "debounce_key": z.string().describe("Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>").optional(), "debounce_args_to_accumulate": z.array(z.string()).describe("Array-type arguments to accumulate across debounced executions").optional(), "max_total_debouncing_time": z.number().int().describe("Maximum total time in seconds before forced execution").optional(), "max_total_debounces_amount": z.number().int().describe("Maximum number of debounces before forced execution").optional() }).describe("Debounce configuration for this step (EE only)").optional() }).describe("A single step in a flow. Can be a script, subflow, loop, or branch")).describe("Steps to execute in this branch") })).describe("Array of branches that all execute (either in parallel or sequentially)"), "type": z.literal("branchall"), "parallel": z.boolean().describe("If true, all branches execute concurrently. If false, they execute sequentially").optional() }).describe("Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently"), z.object({ "type": z.literal("identity"), "flow": z.boolean().describe("If true, marks this as a flow identity (special handling)").optional() }).describe("Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder"), z.object({ "input_transforms": z.object({ "provider": z.discriminatedUnion("type", [z.object({ "value": z.object({ "kind": z.enum(["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]).describe("Supported AI provider types"), "resource": z.string().describe("Resource reference in format '$res:{resource_path}' pointing to provider credentials"), "model": z.string().describe("Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"), "reasoning_effort": z.string().describe("Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default.").optional() }).describe("Complete AI provider configuration with resource reference and model selection"), "type": z.literal("static") }).describe("Static provider configuration passed directly to the AI agent"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined").optional(), "output_type": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Output format type.\nValid values: 'text' (default) - plain text response, 'image' - image generation\n").optional(), "user_message": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("The user's prompt/message to the AI agent. Supports variable interpolation with flow.input syntax."), "system_prompt": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("System instructions that guide the AI's behavior, persona, and response style. Optional.").optional(), "streaming": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Boolean. If true, stream the AI response incrementally.\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\n").optional(), "memory": z.discriminatedUnion("type", [z.object({ "value": z.discriminatedUnion("kind", [z.object({ "kind": z.literal("off") }).describe("No conversation memory/context"), z.object({ "kind": z.literal("auto"), "context_length": z.number().int().describe("Maximum number of messages to retain in context").optional(), "memory_id": z.string().describe("Identifier for persistent memory across agent invocations").optional() }).describe("Automatic context management"), z.object({ "kind": z.literal("manual"), "messages": z.array(z.object({ "role": z.enum(["user","assistant","system"]), "content": z.string() }).describe("A single message in conversation history")) }).describe("Explicit message history")]).describe("Conversation memory configuration"), "type": z.literal("static") }).describe("Static memory configuration passed directly to the AI agent"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined").optional(), "output_schema": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\n").optional(), "user_attachments": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Array of file references (images or PDFs) for the AI agent.\nFormat: Array<{ bucket: string, key: string }> - S3 object references\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\n").optional(), "max_completion_tokens": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Integer. Maximum number of tokens the AI will generate in its response.\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\n").optional(), "temperature": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Float. Controls randomness/creativity of responses.\nRange: 0.0 to 2.0 (provider-dependent)\n- 0.0 = deterministic, focused responses\n- 0.7 = balanced (common default)\n- 1.0+ = more creative/random\n").optional(), "max_iterations": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Number. Limits how many times the agent can loop through reasoning and tool use.\nRange: 1-1000.\n").optional() }).describe("Input parameters for the AI agent mapped to their values"), "tools": z.array(z.object({ "id": z.string().describe("Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"), "summary": z.string().describe("Short description of what this tool does (shown to the AI)").optional(), "description": z.string().describe("Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script.").optional(), "value": z.any().superRefine((x, ctx) => {
+export const flowModuleValueSchema = z.discriminatedUnion("type", [z.object({ "input_transforms": z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs")).describe("Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments"), "content": z.string().describe("The script source code. Should export a 'main' function"), "language": z.enum(["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]).describe("Programming language for this script"), "path": z.string().describe("Optional path for saving this script").optional(), "lock": z.string().describe("Lock file content for dependencies").optional(), "type": z.literal("rawscript"), "tag": z.string().describe("Worker group tag for execution routing").optional(), "concurrent_limit": z.number().describe("Maximum concurrent executions of this script").optional(), "concurrency_time_window_s": z.number().describe("Time window for concurrent_limit").optional(), "custom_concurrency_key": z.string().describe("Custom key for grouping concurrent executions").optional(), "is_trigger": z.boolean().describe("If true, this script is a trigger that can start the flow").optional(), "assets": z.array(z.object({ "path": z.string().describe("Path to the asset"), "kind": z.enum(["s3object","resource","ducklake","datatable","volume","dbt"]).describe("Type of asset"), "access_type": z.union([z.literal("r"), z.literal("w"), z.literal("rw"), z.literal(null)]).nullable().describe("Access level for this asset").optional(), "alt_access_type": z.union([z.literal("r"), z.literal("w"), z.literal("rw"), z.literal(null)]).nullable().describe("Alternative access level").optional() })).describe("External resources this script accesses (S3 objects, resources, etc.)").optional() }).describe("Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms"), z.object({ "input_transforms": z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs")).describe("Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments"), "path": z.string().describe("Path to the script in the workspace (e.g., 'f/scripts/send_email')"), "hash": z.string().describe("Optional specific version hash of the script to use").optional(), "type": z.literal("script"), "tag_override": z.string().describe("Override the script's default worker group tag").optional(), "is_trigger": z.boolean().describe("If true, this script is a trigger that can start the flow").optional() }).describe("Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code"), z.object({ "input_transforms": z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs")).describe("Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments"), "path": z.string().describe("Path to the flow in the workspace (e.g., 'f/flows/process_user')"), "type": z.literal("flow") }).describe("Reference to an existing flow by path. Use this to call another flow as a subflow"), z.object({ "modules": z.array(z.object({ "id": z.string().describe("Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"), "value": z.lazy(() => flowModuleValueSchema), "stop_after_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "stop_after_all_iters_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "skip_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'") }).describe("Conditionally skip this step based on previous results or flow inputs").optional(), "sleep": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "cache_ttl": z.number().describe("Cache duration in seconds for this step's results").optional(), "cache_ignore_s3_path": z.boolean().optional(), "timeout": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "delete_after_secs": z.number().int().describe("If set, delete the step's args, result and logs after this many seconds following job completion").optional(), "summary": z.string().describe("Short description of what this step does").optional(), "mock": z.object({ "enabled": z.boolean().describe("If true, return mock value instead of executing").optional(), "return_value": z.any().describe("Value to return when mocked").optional() }).describe("Mock configuration for testing without executing the actual step").optional(), "suspend": z.object({ "required_events": z.number().int().describe("Number of approvals required before continuing").optional(), "timeout": z.number().int().describe("Timeout in seconds before auto-continuing or canceling").optional(), "resume_form": z.object({ "schema": z.record(z.string(), z.any()).describe("JSON Schema for the resume form").optional() }).describe("Form schema for collecting input when resuming").optional(), "user_auth_required": z.boolean().describe("If true, only authenticated users can approve").optional(), "user_groups_required": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "self_approval_disabled": z.boolean().describe("If true, the user who started the flow cannot approve").optional(), "hide_cancel": z.boolean().describe("If true, hide the cancel button on the approval form").optional(), "continue_on_disapprove_timeout": z.boolean().describe("If true, continue flow on timeout instead of canceling").optional() }).describe("Configuration for approval/resume steps that wait for user input").optional(), "priority": z.number().describe("Execution priority for this step (higher numbers run first)").optional(), "continue_on_error": z.boolean().describe("If true, flow continues even if this step fails").optional(), "retry": z.object({ "constant": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "seconds": z.number().int().describe("Seconds to wait between retries").optional() }).describe("Retry with constant delay between attempts").optional(), "exponential": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(), "seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(), "random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional() }).describe("Retry with exponential backoff (delay doubles each time)").optional(), "retry_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables") }).describe("Conditional retry based on error or result").optional() }).describe("Retry configuration for failed module executions").optional(), "debouncing": z.object({ "debounce_delay_s": z.number().int().describe("Delay in seconds to debounce this step's executions across flow runs").optional(), "debounce_key": z.string().describe("Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>").optional(), "debounce_args_to_accumulate": z.array(z.string()).describe("Array-type arguments to accumulate across debounced executions").optional(), "max_total_debouncing_time": z.number().int().describe("Maximum total time in seconds before forced execution").optional(), "max_total_debounces_amount": z.number().int().describe("Maximum number of debounces before forced execution").optional() }).describe("Debounce configuration for this step (EE only)").optional() }).describe("A single step in a flow. Can be a script, subflow, loop, or branch")).describe("Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'"), "iterator": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs"), "skip_failures": z.boolean().describe("If true, iteration failures don't stop the loop. Failed iterations return null"), "type": z.literal("forloopflow"), "parallel": z.boolean().describe("If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency").optional(), "parallelism": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "squash": z.boolean().optional() }).describe("Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations"), z.object({ "modules": z.array(z.object({ "id": z.string().describe("Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"), "value": z.lazy(() => flowModuleValueSchema), "stop_after_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "stop_after_all_iters_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "skip_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'") }).describe("Conditionally skip this step based on previous results or flow inputs").optional(), "sleep": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "cache_ttl": z.number().describe("Cache duration in seconds for this step's results").optional(), "cache_ignore_s3_path": z.boolean().optional(), "timeout": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "delete_after_secs": z.number().int().describe("If set, delete the step's args, result and logs after this many seconds following job completion").optional(), "summary": z.string().describe("Short description of what this step does").optional(), "mock": z.object({ "enabled": z.boolean().describe("If true, return mock value instead of executing").optional(), "return_value": z.any().describe("Value to return when mocked").optional() }).describe("Mock configuration for testing without executing the actual step").optional(), "suspend": z.object({ "required_events": z.number().int().describe("Number of approvals required before continuing").optional(), "timeout": z.number().int().describe("Timeout in seconds before auto-continuing or canceling").optional(), "resume_form": z.object({ "schema": z.record(z.string(), z.any()).describe("JSON Schema for the resume form").optional() }).describe("Form schema for collecting input when resuming").optional(), "user_auth_required": z.boolean().describe("If true, only authenticated users can approve").optional(), "user_groups_required": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "self_approval_disabled": z.boolean().describe("If true, the user who started the flow cannot approve").optional(), "hide_cancel": z.boolean().describe("If true, hide the cancel button on the approval form").optional(), "continue_on_disapprove_timeout": z.boolean().describe("If true, continue flow on timeout instead of canceling").optional() }).describe("Configuration for approval/resume steps that wait for user input").optional(), "priority": z.number().describe("Execution priority for this step (higher numbers run first)").optional(), "continue_on_error": z.boolean().describe("If true, flow continues even if this step fails").optional(), "retry": z.object({ "constant": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "seconds": z.number().int().describe("Seconds to wait between retries").optional() }).describe("Retry with constant delay between attempts").optional(), "exponential": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(), "seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(), "random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional() }).describe("Retry with exponential backoff (delay doubles each time)").optional(), "retry_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables") }).describe("Conditional retry based on error or result").optional() }).describe("Retry configuration for failed module executions").optional(), "debouncing": z.object({ "debounce_delay_s": z.number().int().describe("Delay in seconds to debounce this step's executions across flow runs").optional(), "debounce_key": z.string().describe("Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>").optional(), "debounce_args_to_accumulate": z.array(z.string()).describe("Array-type arguments to accumulate across debounced executions").optional(), "max_total_debouncing_time": z.number().int().describe("Maximum total time in seconds before forced execution").optional(), "max_total_debounces_amount": z.number().int().describe("Maximum number of debounces before forced execution").optional() }).describe("Debounce configuration for this step (EE only)").optional() }).describe("A single step in a flow. Can be a script, subflow, loop, or branch")).describe("Steps to execute in each iteration"), "skip_failures": z.boolean().describe("If true, iteration failures don't stop the loop. Failed iterations return null"), "type": z.literal("whileloopflow"), "parallel": z.boolean().describe("If true, iterations run concurrently (use with caution in while loops)").optional(), "parallelism": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "squash": z.boolean().optional() }).describe("Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result"), z.object({ "branches": z.array(z.object({ "summary": z.string().describe("Short description of this branch condition").optional(), "expr": z.string().describe("JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"), "modules": z.array(z.object({ "id": z.string().describe("Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"), "value": z.lazy(() => flowModuleValueSchema), "stop_after_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "stop_after_all_iters_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "skip_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'") }).describe("Conditionally skip this step based on previous results or flow inputs").optional(), "sleep": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "cache_ttl": z.number().describe("Cache duration in seconds for this step's results").optional(), "cache_ignore_s3_path": z.boolean().optional(), "timeout": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "delete_after_secs": z.number().int().describe("If set, delete the step's args, result and logs after this many seconds following job completion").optional(), "summary": z.string().describe("Short description of what this step does").optional(), "mock": z.object({ "enabled": z.boolean().describe("If true, return mock value instead of executing").optional(), "return_value": z.any().describe("Value to return when mocked").optional() }).describe("Mock configuration for testing without executing the actual step").optional(), "suspend": z.object({ "required_events": z.number().int().describe("Number of approvals required before continuing").optional(), "timeout": z.number().int().describe("Timeout in seconds before auto-continuing or canceling").optional(), "resume_form": z.object({ "schema": z.record(z.string(), z.any()).describe("JSON Schema for the resume form").optional() }).describe("Form schema for collecting input when resuming").optional(), "user_auth_required": z.boolean().describe("If true, only authenticated users can approve").optional(), "user_groups_required": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "self_approval_disabled": z.boolean().describe("If true, the user who started the flow cannot approve").optional(), "hide_cancel": z.boolean().describe("If true, hide the cancel button on the approval form").optional(), "continue_on_disapprove_timeout": z.boolean().describe("If true, continue flow on timeout instead of canceling").optional() }).describe("Configuration for approval/resume steps that wait for user input").optional(), "priority": z.number().describe("Execution priority for this step (higher numbers run first)").optional(), "continue_on_error": z.boolean().describe("If true, flow continues even if this step fails").optional(), "retry": z.object({ "constant": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "seconds": z.number().int().describe("Seconds to wait between retries").optional() }).describe("Retry with constant delay between attempts").optional(), "exponential": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(), "seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(), "random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional() }).describe("Retry with exponential backoff (delay doubles each time)").optional(), "retry_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables") }).describe("Conditional retry based on error or result").optional() }).describe("Retry configuration for failed module executions").optional(), "debouncing": z.object({ "debounce_delay_s": z.number().int().describe("Delay in seconds to debounce this step's executions across flow runs").optional(), "debounce_key": z.string().describe("Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>").optional(), "debounce_args_to_accumulate": z.array(z.string()).describe("Array-type arguments to accumulate across debounced executions").optional(), "max_total_debouncing_time": z.number().int().describe("Maximum total time in seconds before forced execution").optional(), "max_total_debounces_amount": z.number().int().describe("Maximum number of debounces before forced execution").optional() }).describe("Debounce configuration for this step (EE only)").optional() }).describe("A single step in a flow. Can be a script, subflow, loop, or branch")).describe("Steps to execute if this branch's expr is true") })).describe("Array of branches to evaluate in order. The first branch with expr evaluating to true executes"), "default": z.array(z.object({ "id": z.string().describe("Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"), "value": z.lazy(() => flowModuleValueSchema), "stop_after_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "stop_after_all_iters_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "skip_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'") }).describe("Conditionally skip this step based on previous results or flow inputs").optional(), "sleep": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "cache_ttl": z.number().describe("Cache duration in seconds for this step's results").optional(), "cache_ignore_s3_path": z.boolean().optional(), "timeout": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "delete_after_secs": z.number().int().describe("If set, delete the step's args, result and logs after this many seconds following job completion").optional(), "summary": z.string().describe("Short description of what this step does").optional(), "mock": z.object({ "enabled": z.boolean().describe("If true, return mock value instead of executing").optional(), "return_value": z.any().describe("Value to return when mocked").optional() }).describe("Mock configuration for testing without executing the actual step").optional(), "suspend": z.object({ "required_events": z.number().int().describe("Number of approvals required before continuing").optional(), "timeout": z.number().int().describe("Timeout in seconds before auto-continuing or canceling").optional(), "resume_form": z.object({ "schema": z.record(z.string(), z.any()).describe("JSON Schema for the resume form").optional() }).describe("Form schema for collecting input when resuming").optional(), "user_auth_required": z.boolean().describe("If true, only authenticated users can approve").optional(), "user_groups_required": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "self_approval_disabled": z.boolean().describe("If true, the user who started the flow cannot approve").optional(), "hide_cancel": z.boolean().describe("If true, hide the cancel button on the approval form").optional(), "continue_on_disapprove_timeout": z.boolean().describe("If true, continue flow on timeout instead of canceling").optional() }).describe("Configuration for approval/resume steps that wait for user input").optional(), "priority": z.number().describe("Execution priority for this step (higher numbers run first)").optional(), "continue_on_error": z.boolean().describe("If true, flow continues even if this step fails").optional(), "retry": z.object({ "constant": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "seconds": z.number().int().describe("Seconds to wait between retries").optional() }).describe("Retry with constant delay between attempts").optional(), "exponential": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(), "seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(), "random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional() }).describe("Retry with exponential backoff (delay doubles each time)").optional(), "retry_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables") }).describe("Conditional retry based on error or result").optional() }).describe("Retry configuration for failed module executions").optional(), "debouncing": z.object({ "debounce_delay_s": z.number().int().describe("Delay in seconds to debounce this step's executions across flow runs").optional(), "debounce_key": z.string().describe("Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>").optional(), "debounce_args_to_accumulate": z.array(z.string()).describe("Array-type arguments to accumulate across debounced executions").optional(), "max_total_debouncing_time": z.number().int().describe("Maximum total time in seconds before forced execution").optional(), "max_total_debounces_amount": z.number().int().describe("Maximum number of debounces before forced execution").optional() }).describe("Debounce configuration for this step (EE only)").optional() }).describe("A single step in a flow. Can be a script, subflow, loop, or branch")).describe("Steps to execute if no branch expressions match"), "type": z.literal("branchone") }).describe("Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes"), z.object({ "branches": z.array(z.object({ "summary": z.string().describe("Short description of this branch's purpose").optional(), "skip_failure": z.boolean().describe("If true, failure in this branch doesn't fail the entire flow").optional(), "modules": z.array(z.object({ "id": z.string().describe("Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"), "value": z.lazy(() => flowModuleValueSchema), "stop_after_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "stop_after_all_iters_if": z.object({ "skip_if_stopped": z.boolean().describe("If true, following steps are skipped when this condition triggers").optional(), "expr": z.string().describe("JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"), "error_message": z.string().nullable().describe("Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.").optional(), "error_include_result": z.boolean().describe("When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false.").optional() }).describe("Early termination condition for a module").optional(), "skip_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'") }).describe("Conditionally skip this step based on previous results or flow inputs").optional(), "sleep": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "cache_ttl": z.number().describe("Cache duration in seconds for this step's results").optional(), "cache_ignore_s3_path": z.boolean().optional(), "timeout": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "delete_after_secs": z.number().int().describe("If set, delete the step's args, result and logs after this many seconds following job completion").optional(), "summary": z.string().describe("Short description of what this step does").optional(), "mock": z.object({ "enabled": z.boolean().describe("If true, return mock value instead of executing").optional(), "return_value": z.any().describe("Value to return when mocked").optional() }).describe("Mock configuration for testing without executing the actual step").optional(), "suspend": z.object({ "required_events": z.number().int().describe("Number of approvals required before continuing").optional(), "timeout": z.number().int().describe("Timeout in seconds before auto-continuing or canceling").optional(), "resume_form": z.object({ "schema": z.record(z.string(), z.any()).describe("JSON Schema for the resume form").optional() }).describe("Form schema for collecting input when resuming").optional(), "user_auth_required": z.boolean().describe("If true, only authenticated users can approve").optional(), "user_groups_required": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "self_approval_disabled": z.boolean().describe("If true, the user who started the flow cannot approve").optional(), "hide_cancel": z.boolean().describe("If true, hide the cancel button on the approval form").optional(), "continue_on_disapprove_timeout": z.boolean().describe("If true, continue flow on timeout instead of canceling").optional() }).describe("Configuration for approval/resume steps that wait for user input").optional(), "priority": z.number().describe("Execution priority for this step (higher numbers run first)").optional(), "continue_on_error": z.boolean().describe("If true, flow continues even if this step fails").optional(), "retry": z.object({ "constant": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "seconds": z.number().int().describe("Seconds to wait between retries").optional() }).describe("Retry with constant delay between attempts").optional(), "exponential": z.object({ "attempts": z.number().int().describe("Number of retry attempts").optional(), "multiplier": z.number().int().describe("Multiplier for exponential backoff").optional(), "seconds": z.number().int().gte(1).describe("Initial delay in seconds").optional(), "random_factor": z.number().int().gte(0).lte(100).describe("Random jitter percentage (0-100) to avoid thundering herd").optional() }).describe("Retry with exponential backoff (delay doubles each time)").optional(), "retry_if": z.object({ "expr": z.string().describe("JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables") }).describe("Conditional retry based on error or result").optional() }).describe("Retry configuration for failed module executions").optional(), "debouncing": z.object({ "debounce_delay_s": z.number().int().describe("Delay in seconds to debounce this step's executions across flow runs").optional(), "debounce_key": z.string().describe("Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>").optional(), "debounce_args_to_accumulate": z.array(z.string()).describe("Array-type arguments to accumulate across debounced executions").optional(), "max_total_debouncing_time": z.number().int().describe("Maximum total time in seconds before forced execution").optional(), "max_total_debounces_amount": z.number().int().describe("Maximum number of debounces before forced execution").optional() }).describe("Debounce configuration for this step (EE only)").optional() }).describe("A single step in a flow. Can be a script, subflow, loop, or branch")).describe("Steps to execute in this branch") })).describe("Array of branches that all execute (either in parallel or sequentially)"), "type": z.literal("branchall"), "parallel": z.boolean().describe("If true, all branches execute concurrently. If false, they execute sequentially").optional() }).describe("Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently"), z.object({ "type": z.literal("identity"), "flow": z.boolean().describe("If true, marks this as a flow identity (special handling)").optional() }).describe("Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder"), z.object({ "input_transforms": z.object({ "provider": z.discriminatedUnion("type", [z.object({ "value": z.object({ "kind": z.enum(["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]).describe("Supported AI provider types"), "resource": z.string().describe("Resource reference in format '$res:{resource_path}' pointing to provider credentials"), "model": z.string().describe("Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"), "reasoning_effort": z.string().describe("Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default.").optional() }).describe("Complete AI provider configuration with resource reference and model selection"), "type": z.literal("static") }).describe("Static provider configuration passed directly to the AI agent"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined").optional(), "output_type": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Output format type.\nValid values: 'text' (default) - plain text response, 'image' - image generation\n").optional(), "user_message": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("The user's prompt/message to the AI agent. Supports variable interpolation with flow.input syntax."), "system_prompt": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("System instructions that guide the AI's behavior, persona, and response style. Optional.").optional(), "streaming": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Boolean. If true, stream the AI response incrementally.\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\n").optional(), "memory": z.discriminatedUnion("type", [z.object({ "value": z.discriminatedUnion("kind", [z.object({ "kind": z.literal("off") }).describe("No conversation memory/context"), z.object({ "kind": z.literal("auto"), "context_length": z.number().int().describe("Maximum number of messages to retain in context").optional(), "memory_id": z.string().describe("Identifier for persistent memory across agent invocations").optional() }).describe("Automatic context management"), z.object({ "kind": z.literal("manual"), "messages": z.array(z.object({ "role": z.enum(["user","assistant","system"]), "content": z.string() }).describe("A single message in conversation history")) }).describe("Explicit message history")]).describe("Conversation memory configuration"), "type": z.literal("static") }).describe("Static memory configuration passed directly to the AI agent"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined").optional(), "output_schema": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\n").optional(), "user_attachments": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Array of file references (images or PDFs) for the AI agent.\nFormat: Array<{ bucket: string, key: string }> - S3 object references\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\n").optional(), "max_completion_tokens": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Integer. Maximum number of tokens the AI will generate in its response.\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\n").optional(), "temperature": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Float. Controls randomness/creativity of responses.\nRange: 0.0 to 2.0 (provider-dependent)\n- 0.0 = deterministic, focused responses\n- 0.7 = balanced (common default)\n- 1.0+ = more creative/random\n").optional(), "max_iterations": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Number. Limits how many times the agent can loop through reasoning and tool use.\nRange: 1-1000.\n").optional() }).describe("Input parameters for the AI agent mapped to their values"), "tools": z.array(z.object({ "id": z.string().describe("Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"), "summary": z.string().describe("Short description of what this tool does (shown to the AI)").optional(), "description": z.string().describe("Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script.").optional(), "value": z.any().superRefine((x, ctx) => {
     const schemas = [z.intersection(z.object({ "tool_type": z.literal("flowmodule") }), z.lazy(() => flowModuleValueSchema)).describe("A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module"), z.object({ "tool_type": z.literal("mcp"), "resource_path": z.string().describe("Path to the MCP resource/server configuration"), "include_tools": z.array(z.string()).describe("Whitelist of specific tools to include from this MCP server").optional(), "exclude_tools": z.array(z.string()).describe("Blacklist of tools to exclude from this MCP server").optional() }).describe("Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers"), z.object({ "tool_type": z.literal("websearch") }).describe("A tool implemented as a websearch tool. The AI can call this like any other websearch tool")];
     const errors = schemas.reduce<z.ZodError[]>(
       (errors, schema) =>
@@ -20,7 +20,7 @@ export const flowModuleValueSchema = z.discriminatedUnion("type", [z.object({ "i
   }).describe("The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference") }).describe("A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool")).describe("Array of tools the agent can use. The agent decides which tools to call based on the task").optional(), "type": z.literal("aiagent"), "tag": z.string().describe("Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default `flow`)").optional(), "omit_output_from_conversation": z.boolean().describe("If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled.").default(false), "agent": z.string().describe("Path of a reusable `ai_agent` resource (hybrid linking). When set, the agent brain\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\nthat resource; the module's input_transforms then only carry the flow-local inputs\n(user_message/user_attachments).\n").optional(), "tool_inputs": z.record(z.string(), z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs"))).describe("Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\nshared resource; overlaid onto the tools' input_transforms at runtime — including when\n`agent` is unset, since a step forked for editing keeps these overrides until it is saved\nback or unlinked.\n").optional(), "parallel": z.boolean().describe("If true, the agent can execute multiple tool calls in parallel").optional() }).describe("AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task")]).describe("The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type")
 
 
-export const flowModuleSchema = z.object({ "id": z.string().describe("Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"), "value": z.discriminatedUnion("type", [z.object({ "input_transforms": z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs")).describe("Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments"), "content": z.string().describe("The script source code. Should export a 'main' function"), "language": z.enum(["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]).describe("Programming language for this script"), "path": z.string().describe("Optional path for saving this script").optional(), "lock": z.string().describe("Lock file content for dependencies").optional(), "type": z.literal("rawscript"), "tag": z.string().describe("Worker group tag for execution routing").optional(), "concurrent_limit": z.number().describe("Maximum concurrent executions of this script").optional(), "concurrency_time_window_s": z.number().describe("Time window for concurrent_limit").optional(), "custom_concurrency_key": z.string().describe("Custom key for grouping concurrent executions").optional(), "is_trigger": z.boolean().describe("If true, this script is a trigger that can start the flow").optional(), "assets": z.array(z.object({ "path": z.string().describe("Path to the asset"), "kind": z.enum(["s3object","resource","ducklake","datatable","volume"]).describe("Type of asset"), "access_type": z.union([z.literal("r"), z.literal("w"), z.literal("rw"), z.literal(null)]).nullable().describe("Access level for this asset").optional(), "alt_access_type": z.union([z.literal("r"), z.literal("w"), z.literal("rw"), z.literal(null)]).nullable().describe("Alternative access level").optional() })).describe("External resources this script accesses (S3 objects, resources, etc.)").optional() }).describe("Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms"), z.object({ "input_transforms": z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs")).describe("Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments"), "path": z.string().describe("Path to the script in the workspace (e.g., 'f/scripts/send_email')"), "hash": z.string().describe("Optional specific version hash of the script to use").optional(), "type": z.literal("script"), "tag_override": z.string().describe("Override the script's default worker group tag").optional(), "is_trigger": z.boolean().describe("If true, this script is a trigger that can start the flow").optional() }).describe("Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code"), z.object({ "input_transforms": z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs")).describe("Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments"), "path": z.string().describe("Path to the flow in the workspace (e.g., 'f/flows/process_user')"), "type": z.literal("flow") }).describe("Reference to an existing flow by path. Use this to call another flow as a subflow"), z.object({ "modules": z.array(z.lazy(() => flowModuleSchema)).describe("Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'"), "iterator": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs"), "skip_failures": z.boolean().describe("If true, iteration failures don't stop the loop. Failed iterations return null"), "type": z.literal("forloopflow"), "parallel": z.boolean().describe("If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency").optional(), "parallelism": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "squash": z.boolean().optional() }).describe("Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations"), z.object({ "modules": z.array(z.lazy(() => flowModuleSchema)).describe("Steps to execute in each iteration"), "skip_failures": z.boolean().describe("If true, iteration failures don't stop the loop. Failed iterations return null"), "type": z.literal("whileloopflow"), "parallel": z.boolean().describe("If true, iterations run concurrently (use with caution in while loops)").optional(), "parallelism": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "squash": z.boolean().optional() }).describe("Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result"), z.object({ "branches": z.array(z.object({ "summary": z.string().describe("Short description of this branch condition").optional(), "expr": z.string().describe("JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"), "modules": z.array(z.lazy(() => flowModuleSchema)).describe("Steps to execute if this branch's expr is true") })).describe("Array of branches to evaluate in order. The first branch with expr evaluating to true executes"), "default": z.array(z.lazy(() => flowModuleSchema)).describe("Steps to execute if no branch expressions match"), "type": z.literal("branchone") }).describe("Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes"), z.object({ "branches": z.array(z.object({ "summary": z.string().describe("Short description of this branch's purpose").optional(), "skip_failure": z.boolean().describe("If true, failure in this branch doesn't fail the entire flow").optional(), "modules": z.array(z.lazy(() => flowModuleSchema)).describe("Steps to execute in this branch") })).describe("Array of branches that all execute (either in parallel or sequentially)"), "type": z.literal("branchall"), "parallel": z.boolean().describe("If true, all branches execute concurrently. If false, they execute sequentially").optional() }).describe("Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently"), z.object({ "type": z.literal("identity"), "flow": z.boolean().describe("If true, marks this as a flow identity (special handling)").optional() }).describe("Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder"), z.object({ "input_transforms": z.object({ "provider": z.discriminatedUnion("type", [z.object({ "value": z.object({ "kind": z.enum(["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]).describe("Supported AI provider types"), "resource": z.string().describe("Resource reference in format '$res:{resource_path}' pointing to provider credentials"), "model": z.string().describe("Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"), "reasoning_effort": z.string().describe("Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default.").optional() }).describe("Complete AI provider configuration with resource reference and model selection"), "type": z.literal("static") }).describe("Static provider configuration passed directly to the AI agent"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined").optional(), "output_type": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Output format type.\nValid values: 'text' (default) - plain text response, 'image' - image generation\n").optional(), "user_message": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("The user's prompt/message to the AI agent. Supports variable interpolation with flow.input syntax."), "system_prompt": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("System instructions that guide the AI's behavior, persona, and response style. Optional.").optional(), "streaming": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Boolean. If true, stream the AI response incrementally.\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\n").optional(), "memory": z.discriminatedUnion("type", [z.object({ "value": z.discriminatedUnion("kind", [z.object({ "kind": z.literal("off") }).describe("No conversation memory/context"), z.object({ "kind": z.literal("auto"), "context_length": z.number().int().describe("Maximum number of messages to retain in context").optional(), "memory_id": z.string().describe("Identifier for persistent memory across agent invocations").optional() }).describe("Automatic context management"), z.object({ "kind": z.literal("manual"), "messages": z.array(z.object({ "role": z.enum(["user","assistant","system"]), "content": z.string() }).describe("A single message in conversation history")) }).describe("Explicit message history")]).describe("Conversation memory configuration"), "type": z.literal("static") }).describe("Static memory configuration passed directly to the AI agent"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined").optional(), "output_schema": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\n").optional(), "user_attachments": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Array of file references (images or PDFs) for the AI agent.\nFormat: Array<{ bucket: string, key: string }> - S3 object references\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\n").optional(), "max_completion_tokens": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Integer. Maximum number of tokens the AI will generate in its response.\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\n").optional(), "temperature": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Float. Controls randomness/creativity of responses.\nRange: 0.0 to 2.0 (provider-dependent)\n- 0.0 = deterministic, focused responses\n- 0.7 = balanced (common default)\n- 1.0+ = more creative/random\n").optional(), "max_iterations": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Number. Limits how many times the agent can loop through reasoning and tool use.\nRange: 1-1000.\n").optional() }).describe("Input parameters for the AI agent mapped to their values"), "tools": z.array(z.object({ "id": z.string().describe("Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"), "summary": z.string().describe("Short description of what this tool does (shown to the AI)").optional(), "description": z.string().describe("Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script.").optional(), "value": z.any().superRefine((x, ctx) => {
+export const flowModuleSchema = z.object({ "id": z.string().describe("Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"), "value": z.discriminatedUnion("type", [z.object({ "input_transforms": z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs")).describe("Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments"), "content": z.string().describe("The script source code. Should export a 'main' function"), "language": z.enum(["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]).describe("Programming language for this script"), "path": z.string().describe("Optional path for saving this script").optional(), "lock": z.string().describe("Lock file content for dependencies").optional(), "type": z.literal("rawscript"), "tag": z.string().describe("Worker group tag for execution routing").optional(), "concurrent_limit": z.number().describe("Maximum concurrent executions of this script").optional(), "concurrency_time_window_s": z.number().describe("Time window for concurrent_limit").optional(), "custom_concurrency_key": z.string().describe("Custom key for grouping concurrent executions").optional(), "is_trigger": z.boolean().describe("If true, this script is a trigger that can start the flow").optional(), "assets": z.array(z.object({ "path": z.string().describe("Path to the asset"), "kind": z.enum(["s3object","resource","ducklake","datatable","volume","dbt"]).describe("Type of asset"), "access_type": z.union([z.literal("r"), z.literal("w"), z.literal("rw"), z.literal(null)]).nullable().describe("Access level for this asset").optional(), "alt_access_type": z.union([z.literal("r"), z.literal("w"), z.literal("rw"), z.literal(null)]).nullable().describe("Alternative access level").optional() })).describe("External resources this script accesses (S3 objects, resources, etc.)").optional() }).describe("Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms"), z.object({ "input_transforms": z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs")).describe("Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments"), "path": z.string().describe("Path to the script in the workspace (e.g., 'f/scripts/send_email')"), "hash": z.string().describe("Optional specific version hash of the script to use").optional(), "type": z.literal("script"), "tag_override": z.string().describe("Override the script's default worker group tag").optional(), "is_trigger": z.boolean().describe("If true, this script is a trigger that can start the flow").optional() }).describe("Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code"), z.object({ "input_transforms": z.record(z.string(), z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs")).describe("Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments"), "path": z.string().describe("Path to the flow in the workspace (e.g., 'f/flows/process_user')"), "type": z.literal("flow") }).describe("Reference to an existing flow by path. Use this to call another flow as a subflow"), z.object({ "modules": z.array(z.lazy(() => flowModuleSchema)).describe("Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'"), "iterator": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs"), "skip_failures": z.boolean().describe("If true, iteration failures don't stop the loop. Failed iterations return null"), "type": z.literal("forloopflow"), "parallel": z.boolean().describe("If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency").optional(), "parallelism": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "squash": z.boolean().optional() }).describe("Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations"), z.object({ "modules": z.array(z.lazy(() => flowModuleSchema)).describe("Steps to execute in each iteration"), "skip_failures": z.boolean().describe("If true, iteration failures don't stop the loop. Failed iterations return null"), "type": z.literal("whileloopflow"), "parallel": z.boolean().describe("If true, iterations run concurrently (use with caution in while loops)").optional(), "parallelism": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").optional(), "squash": z.boolean().optional() }).describe("Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result"), z.object({ "branches": z.array(z.object({ "summary": z.string().describe("Short description of this branch condition").optional(), "expr": z.string().describe("JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"), "modules": z.array(z.lazy(() => flowModuleSchema)).describe("Steps to execute if this branch's expr is true") })).describe("Array of branches to evaluate in order. The first branch with expr evaluating to true executes"), "default": z.array(z.lazy(() => flowModuleSchema)).describe("Steps to execute if no branch expressions match"), "type": z.literal("branchone") }).describe("Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes"), z.object({ "branches": z.array(z.object({ "summary": z.string().describe("Short description of this branch's purpose").optional(), "skip_failure": z.boolean().describe("If true, failure in this branch doesn't fail the entire flow").optional(), "modules": z.array(z.lazy(() => flowModuleSchema)).describe("Steps to execute in this branch") })).describe("Array of branches that all execute (either in parallel or sequentially)"), "type": z.literal("branchall"), "parallel": z.boolean().describe("If true, all branches execute concurrently. If false, they execute sequentially").optional() }).describe("Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently"), z.object({ "type": z.literal("identity"), "flow": z.boolean().describe("If true, marks this as a flow identity (special handling)").optional() }).describe("Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder"), z.object({ "input_transforms": z.object({ "provider": z.discriminatedUnion("type", [z.object({ "value": z.object({ "kind": z.enum(["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]).describe("Supported AI provider types"), "resource": z.string().describe("Resource reference in format '$res:{resource_path}' pointing to provider credentials"), "model": z.string().describe("Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"), "reasoning_effort": z.string().describe("Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default.").optional() }).describe("Complete AI provider configuration with resource reference and model selection"), "type": z.literal("static") }).describe("Static provider configuration passed directly to the AI agent"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined").optional(), "output_type": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Output format type.\nValid values: 'text' (default) - plain text response, 'image' - image generation\n").optional(), "user_message": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("The user's prompt/message to the AI agent. Supports variable interpolation with flow.input syntax."), "system_prompt": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("System instructions that guide the AI's behavior, persona, and response style. Optional.").optional(), "streaming": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Boolean. If true, stream the AI response incrementally.\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\n").optional(), "memory": z.discriminatedUnion("type", [z.object({ "value": z.discriminatedUnion("kind", [z.object({ "kind": z.literal("off") }).describe("No conversation memory/context"), z.object({ "kind": z.literal("auto"), "context_length": z.number().int().describe("Maximum number of messages to retain in context").optional(), "memory_id": z.string().describe("Identifier for persistent memory across agent invocations").optional() }).describe("Automatic context management"), z.object({ "kind": z.literal("manual"), "messages": z.array(z.object({ "role": z.enum(["user","assistant","system"]), "content": z.string() }).describe("A single message in conversation history")) }).describe("Explicit message history")]).describe("Conversation memory configuration"), "type": z.literal("static") }).describe("Static memory configuration passed directly to the AI agent"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined").optional(), "output_schema": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\n").optional(), "user_attachments": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Array of file references (images or PDFs) for the AI agent.\nFormat: Array<{ bucket: string, key: string }> - S3 object references\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\n").optional(), "max_completion_tokens": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Integer. Maximum number of tokens the AI will generate in its response.\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\n").optional(), "temperature": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Float. Controls randomness/creativity of responses.\nRange: 0.0 to 2.0 (provider-dependent)\n- 0.0 = deterministic, focused responses\n- 0.7 = balanced (common default)\n- 1.0+ = more creative/random\n").optional(), "max_iterations": z.discriminatedUnion("type", [z.object({ "value": z.any().describe("The static value. For resources, use format '$res:path/to/resource'").optional(), "type": z.literal("static") }).describe("Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'"), z.object({ "expr": z.string().describe("JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"), "type": z.literal("javascript") }).describe("JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')"), z.object({ "type": z.literal("ai") }).describe("Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.")]).describe("Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs").describe("Number. Limits how many times the agent can loop through reasoning and tool use.\nRange: 1-1000.\n").optional() }).describe("Input parameters for the AI agent mapped to their values"), "tools": z.array(z.object({ "id": z.string().describe("Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"), "summary": z.string().describe("Short description of what this tool does (shown to the AI)").optional(), "description": z.string().describe("Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script.").optional(), "value": z.any().superRefine((x, ctx) => {
     const schemas = [z.intersection(z.object({ "tool_type": z.literal("flowmodule") }), z.lazy(() => flowModuleValueSchema)).describe("A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module"), z.object({ "tool_type": z.literal("mcp"), "resource_path": z.string().describe("Path to the MCP resource/server configuration"), "include_tools": z.array(z.string()).describe("Whitelist of specific tools to include from this MCP server").optional(), "exclude_tools": z.array(z.string()).describe("Blacklist of tools to exclude from this MCP server").optional() }).describe("Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers"), z.object({ "tool_type": z.literal("websearch") }).describe("A tool implemented as a websearch tool. The AI can call this like any other websearch tool")];
     const errors = schemas.reduce<z.ZodError[]>(
       (errors, schema) =>
diff --git a/frontend/src/lib/components/copilot/chat/global/core.test.ts b/frontend/src/lib/components/copilot/chat/global/core.test.ts
index 9e8cec8b1e..4ddf8d3d36 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.test.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.test.ts
@@ -204,7 +204,8 @@ vi.mock('$lib/gen', async () => {
 				throw new Error('getResource mock not configured')
 			}),
 			createResource: vi.fn(async () => 'created'),
-			updateResource: vi.fn(async () => 'updated')
+			updateResource: vi.fn(async () => 'updated'),
+			deleteResource: vi.fn(async () => 'deleted')
 		}),
 		VariableService: wrapService(actual.VariableService, {
 			existsVariable: vi.fn(async () => false),
@@ -441,6 +442,183 @@ describe('global AI tools', () => {
 		expect(names).toContain('list_runs')
 	})
 
+	it('keeps the trigger config schemas out of the tool definitions', async () => {
+		const def = JSON.stringify(getGlobalTool('write_trigger').def)
+		expect(def.length).toBeLessThan(2000)
+		expect(def).not.toContain('kafka_resource_path')
+
+		const kafka = await callGlobalTool('get_trigger_schema', { kind: 'kafka' })
+		expect(JSON.parse(kafka).properties).toMatchObject({
+			kafka_resource_path: expect.anything(),
+			group_id: expect.anything(),
+			topics: expect.anything()
+		})
+	})
+
+	// The rare schedule fields reach the draft through `advanced` instead of the tool
+	// definition, so the merge back into the persisted value is what has to hold.
+	it('folds advanced schedule options into the draft', async () => {
+		const advanced = JSON.parse(await callGlobalTool('get_schedule_schema', {}))
+		expect(Object.keys(advanced.properties)).toEqual(
+			expect.arrayContaining(['retry', 'paused_until', 'no_flow_overlap'])
+		)
+		expect(advanced.properties).not.toHaveProperty('schedule')
+
+		await callGlobalTool('write_schedule', {
+			path: 'f/schedules/adv',
+			schedule: '0 0 9 * * *',
+			timezone: 'UTC',
+			script_path: 'f/scripts/run',
+			is_flow: false,
+			args: {},
+			advanced: { no_flow_overlap: true, tag: 'nightly' }
+		})
+
+		const draft = getBackendDraft<any>('trigger_schedule', 'f/schedules/adv', {
+			workspace: WORKSPACE
+		})
+		expect(draft).toMatchObject({ no_flow_overlap: true, tag: 'nightly' })
+		expect(draft).not.toHaveProperty('advanced')
+	})
+
+	// A duplicate inside `advanced` must not quietly outrank the named argument.
+	it('lets a real schedule argument win over the same key inside advanced', async () => {
+		await callGlobalTool('write_schedule', {
+			path: 'f/schedules/prec',
+			schedule: '0 0 9 * * *',
+			timezone: 'UTC',
+			script_path: 'f/scripts/run',
+			is_flow: false,
+			args: {},
+			advanced: { timezone: 'Europe/Paris', tag: 'nightly' }
+		})
+
+		const draft = getBackendDraft<any>('trigger_schedule', 'f/schedules/prec', {
+			workspace: WORKSPACE
+		})
+		expect(draft).toMatchObject({ timezone: 'UTC', tag: 'nightly' })
+	})
+
+	// Every sub-field of `retry` is optional, so a guessed shape validates clean and
+	// strips to `{}`. Saving a schedule with no retry policy and reporting success is
+	// the failure the on-demand schema makes reachable.
+	it('refuses to save a mis-shaped advanced schedule option', async () => {
+		await expect(
+			callGlobalTool('write_schedule', {
+				path: 'f/schedules/badretry',
+				schedule: '0 0 6 * * *',
+				timezone: 'UTC',
+				script_path: 'f/scripts/run',
+				is_flow: false,
+				args: {},
+				advanced: { retry: { attempts: 2, seconds: 30 } }
+			})
+		).rejects.toThrow(/get_schedule_schema/)
+
+		// A misspelled key beside a valid sibling leaves `retry` non-empty, so only a
+		// recursive check catches it. The backend would default the lost delay to zero.
+		await expect(
+			callGlobalTool('write_schedule', {
+				path: 'f/schedules/badretry',
+				schedule: '0 0 6 * * *',
+				timezone: 'UTC',
+				script_path: 'f/scripts/run',
+				is_flow: false,
+				args: {},
+				advanced: { retry: { constant: { attempts: 2, seconds_typo: 30 } } }
+			})
+		).rejects.toThrow(/retry\.constant\.seconds_typo/)
+
+		expect(
+			getBackendDraft('trigger_schedule', 'f/schedules/badretry', { workspace: WORKSPACE })
+		).toBeUndefined()
+	})
+
+	// The same option is legal at the top level, where the bag-only check never saw it.
+	it('catches a stripped schedule option passed outside advanced', async () => {
+		await expect(
+			callGlobalTool('write_schedule', {
+				path: 'f/schedules/toplevel',
+				schedule: '0 0 6 * * *',
+				timezone: 'UTC',
+				script_path: 'f/scripts/run',
+				is_flow: false,
+				args: {},
+				retry: { constant: { attempts: 2, seconds_typo: 30 } }
+			})
+		).rejects.toThrow(/retry\.constant\.seconds_typo/)
+	})
+
+	// A non-object `advanced` spreads to index keys that zod strips, so the options the
+	// model meant to set vanish. Rejecting beats writing a schedule missing all of them.
+	it('rejects a non-object advanced container', async () => {
+		await expect(
+			callGlobalTool('write_schedule', {
+				path: 'f/schedules/strbag',
+				schedule: '0 0 6 * * *',
+				timezone: 'UTC',
+				script_path: 'f/scripts/run',
+				is_flow: false,
+				args: {},
+				advanced: 'retry=2'
+			})
+		).rejects.toThrow(/not schedule fields/)
+	})
+
+	// A key that is not a schedule field cannot be explained by the lookup, so the error
+	// must not send the model there for it.
+	it('separates unknown keys from mis-shaped schedule options', async () => {
+		const error = await callGlobalTool('write_schedule', {
+			path: 'f/schedules/mixed',
+			schedule: '0 0 6 * * *',
+			timezone: 'UTC',
+			script_path: 'f/scripts/run',
+			is_flow: false,
+			args: {},
+			advanced: { retry: { constant: { seconds_typo: 1 } }, not_a_field: true }
+		}).catch((err) => (err as Error).message)
+
+		expect(error).toMatch(/retry\.constant\.seconds_typo.*get_schedule_schema/s)
+		expect(error).toMatch(/not schedule fields: not_a_field/)
+	})
+
+	// `args` is a real object-valued argument, not an advanced option: repeating it must
+	// not be reported as a dropped option just because the named one outranks the bag.
+	it('does not flag a duplicated object argument as dropped', async () => {
+		await callGlobalTool('write_schedule', {
+			path: 'f/schedules/dupargs',
+			schedule: '0 0 6 * * *',
+			timezone: 'UTC',
+			script_path: 'f/scripts/run',
+			is_flow: false,
+			args: { a: 1 },
+			advanced: { args: { b: 2 }, tag: 'nightly' }
+		})
+
+		const draft = getBackendDraft<any>('trigger_schedule', 'f/schedules/dupargs', {
+			workspace: WORKSPACE
+		})
+		expect(draft).toMatchObject({ args: { a: 1 }, tag: 'nightly' })
+	})
+
+	it('rejects a trigger config that does not match the declared kind', async () => {
+		const error = await callGlobalTool('write_trigger', {
+			kind: 'kafka',
+			config: {
+				path: 'u/admin/wrong_kind',
+				script_path: 'f/scripts/handler',
+				is_flow: false,
+				route_path: 'api/wrong',
+				http_method: 'get'
+			}
+		}).catch((err) => err as Error)
+
+		expect(error).toBeInstanceOf(Error)
+		// What the model actually receives is capped at MAX_TOOL_ERROR_LENGTH by
+		// formatToolError, so the recovery instruction has to survive that cap.
+		expect((error as Error).message.slice(0, 2000)).toContain('get_trigger_schema')
+	})
+
 	it('lists recent runs with compact summaries and forwarded filters', async () => {
 		const result = await callGlobalTool('list_runs', {
 			path: 'f/team/runner',
@@ -1222,6 +1400,63 @@ describe('global AI tools', () => {
 		).toBeUndefined()
 	})
 
+	// "Create a resource, then never mind": delete_workspace_item must reject a path
+	// that was never deployed, before the confirmation card — otherwise the user
+	// confirms a workspace mutation that 404s past the draft cleanup, leaving the
+	// draft they asked to be rid of.
+	it('rejects deleting a draft-only item and names discard_local_draft', async () => {
+		await callGlobalTool('write_resource', {
+			path: 'u/admin/never_mind_db',
+			value: { host: 'db.example.com', port: 5432 },
+			resource_type: 'postgresql'
+		})
+
+		const error = await getGlobalTool('delete_workspace_item').validateBeforeConfirmation?.({
+			args: { type: 'resource', path: 'u/admin/never_mind_db' },
+			workspace: WORKSPACE,
+			helpers: {}
+		})
+
+		expect(error).toMatch(/only exists as a draft/)
+		expect(error).toMatch(/discard_local_draft/)
+		expect(ResourceService.deleteResource).not.toHaveBeenCalled()
+		expect(
+			getBackendDraft('resource', 'u/admin/never_mind_db', { workspace: WORKSPACE })
+		).toBeDefined()
+	})
+
+	it('lets delete_workspace_item through when the item is deployed', async () => {
+		vi.mocked(ResourceService.existsResource).mockResolvedValueOnce(true)
+
+		await expect(
+			getGlobalTool('delete_workspace_item').validateBeforeConfirmation?.({
+				args: { type: 'resource', path: 'u/admin/deployed_db' },
+				workspace: WORKSPACE,
+				helpers: {}
+			})
+		).resolves.toBeUndefined()
+	})
+
+	// existsScriptByPath filters archived=false but deleteScriptByPath does not, so
+	// probing with it alone would make an archived script undeletable via the chat.
+	it('lets delete_workspace_item through for an archived script', async () => {
+		vi.mocked(ScriptService.existsScriptByPath).mockResolvedValueOnce(false)
+		vi.mocked(ScriptService.getScriptByPath).mockResolvedValueOnce({
+			path: 'f/scripts/archived_one',
+			content: 'export async function main() {}',
+			language: 'bun',
+			archived: true
+		} as any)
+
+		await expect(
+			getGlobalTool('delete_workspace_item').validateBeforeConfirmation?.({
+				args: { type: 'script', path: 'f/scripts/archived_one' },
+				workspace: WORKSPACE,
+				helpers: {}
+			})
+		).resolves.toBeUndefined()
+	})
+
 	// Covers the conflict-on-save / override branch of `persistGlobalDraft`
 	// directly: a non-force save whose recorded baseline is older than the
 	// server row is rejected with `status:'conflict'`, and `override` (force)
@@ -4002,7 +4237,7 @@ describe('prepareGlobalSystemMessage', () => {
 
 		expect(content).toContain('Draft tools create or update drafts only')
 		expect(content).toContain(
-			'Use discard_local_draft to remove a draft, including the matching open editor draft'
+			'To undo something you created or changed in this chat, use discard_local_draft'
 		)
 		expect(content).toContain(
 			'After creating or editing a script or flow draft, run test_run_script, test_run_flow, or test_run_step'
@@ -4117,10 +4352,10 @@ describe('prepareGlobalSystemMessage', () => {
 		const deleteItem = getGlobalTool('delete_workspace_item')
 
 		expect(discard.def.function.description).toBe(
-			'Discard a draft only. Does not mutate deployed workspace items, but clears the matching open editor draft if one is mounted.'
+			'Discard a draft only — the tool to undo an item you created or edited in this chat and have not deployed. Does not mutate deployed workspace items, but clears the matching open editor draft if one is mounted.'
 		)
 		expect(deleteItem.def.function.description).toBe(
-			'Delete a deployed workspace item. Mutates the workspace.'
+			'Delete an item that is already deployed in the workspace. Mutates the workspace. FAILS if the path has no deployed item, so never call it to undo something you created in this chat — that is a draft; use discard_local_draft instead.'
 		)
 		expect(discard.requiresConfirmation).toBe(true)
 		expect(deleteItem.requiresConfirmation).toBe(true)
diff --git a/frontend/src/lib/components/copilot/chat/global/core.ts b/frontend/src/lib/components/copilot/chat/global/core.ts
index 1034dcb62a..4bcbbca778 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.ts
@@ -84,8 +84,14 @@ import type {
 	ChatCompletionUserMessageParam
 } from 'openai/resources/chat/completions.mjs'
 import { z } from 'zod'
+import {
+	advancedScheduleShape,
+	buildScheduleToolSchema,
+	describeDroppedScheduleOptions
+} from '../scheduleToolSchema'
 import {
 	createToolDef,
+	droppedOptionKeys,
 	createSearchHubScriptsTool,
 	executeFlowStepTestRun,
 	executeTestRun,
@@ -559,28 +565,33 @@ function flowDraftAsEditableInput(flowDraft: FlowDraftValue): {
 
 const writeScheduleSchema = scheduleRequestSchema.extend({ override: draftOverrideField })
 
+const writeScheduleToolSchema = buildScheduleToolSchema().extend({ override: draftOverrideField })
+
+// The tool definition keeps `config` open-ended on purpose. Inlining the eleven
+// per-kind request schemas serializes to ~44k characters of JSON Schema, on its own
+// more than a third of every chat request, resent on every iteration whether or not
+// triggers ever come up. The model fetches the single schema it needs through
+// get_trigger_schema, and the call is validated against that same schema below.
 const writeTriggerSchema = z.object({
 	kind: triggerKindSchema.describe('Trigger kind. Determines which fields are valid in config.'),
 	config: z
-		.union([
-			triggerRequestSchemas.http,
-			triggerRequestSchemas.websocket,
-			triggerRequestSchemas.kafka,
-			triggerRequestSchemas.nats,
-			triggerRequestSchemas.postgres,
-			triggerRequestSchemas.mqtt,
-			triggerRequestSchemas.amqp,
-			triggerRequestSchemas.sqs,
-			triggerRequestSchemas.gcp,
-			triggerRequestSchemas.azure,
-			triggerRequestSchemas.email
-		])
+		.record(z.string(), z.any())
 		.describe(
-			'Full trigger configuration. Must include path, script_path, is_flow plus the kind-specific fields.'
+			'Full trigger configuration: path, script_path, is_flow plus the kind-specific fields. Call get_trigger_schema with the same kind first to get its exact fields.'
 		),
 	override: draftOverrideField
 })
 
+const getTriggerSchemaSchema = z.object({
+	kind: triggerKindSchema.describe('Trigger kind whose configuration schema to return.')
+})
+
+function triggerConfigJsonSchema(kind: TriggerKind): string {
+	const schema = z.toJSONSchema(triggerRequestSchemas[kind]) as Record<string, unknown>
+	delete schema.$schema
+	return JSON.stringify(schema, null, 2)
+}
+
 const writeResourceSchema = resourceRequestSchema.extend({ override: draftOverrideField })
 
 const writeVariableSchema = variableRequestSchema.extend({ override: draftOverrideField })
@@ -1181,10 +1192,10 @@ Rules:
 - Use list_workspace_items to find items and read_workspace_item before changing an existing item. For triggers, pass trigger_kind.
 - If the user message includes an ACTIVE EDITOR section, treat it as the currently open item and use it for references like "this", "current", or "open editor".
 - Use deploy_workspace_item only after the user explicitly asks to deploy. It persists a draft to the workspace.
-- Use discard_local_draft to remove a draft, including the matching open editor draft. Use delete_workspace_item only to delete a deployed workspace item.
+- To undo something you created or changed in this chat, use discard_local_draft: everything you write is a draft until it is explicitly deployed, so "delete it" / "never mind" / "remove that" about your own work means discarding the draft (it also clears the matching open editor draft). Use delete_workspace_item only to remove an item that is already deployed in the workspace; it mutates the workspace and fails if nothing is deployed at that path.
 - Use diff to review changes — before deploying, or when the user asks what changed. It is read-only: without arguments it lists every draft in the workspace with its change status; with type+path it returns that item's unified diff (for multi-file apps, pass file to read one file's diff). In a fork, pass against="parent_workspace" to compare the deployed fork with its parent workspace instead. Pass search to grep changed lines across all diffs.
 - Variable values are never readable. For secrets, create a secret variable and reference it from resources as "$var:path/to/variable".
-- Use search_resource_types before write_resource.
+- Use search_resource_types before write_resource, and get_trigger_schema before write_trigger: the trigger config fields differ per kind and are not listed in the write_trigger definition.
 - When script or raw app code needs an external npm package you are not fully familiar with, use search_npm_packages to find it and get its documentation and type definitions. Link the package documentation in your answer when you rely on it.
 - Hub scripts are prebuilt integrations for third-party services, hosted outside the workspace under \`hub/<version>/<app>/<name>\` paths. Use search_hub_scripts to find one before hand-writing an integration, then read_workspace_item with type "script" and the returned hub path to get its code, language, and input schema.
 - Use get_db_schema with a database resource path to fetch its tables and columns before writing SQL (or a script querying that database).
@@ -1218,7 +1229,7 @@ ${
 		: `- When the user raises how a raw app looks (something is off, or they want the design or layout improved) and their description alone isn't specific enough to pinpoint the problem, ask them to paste or drop a screenshot of it into the chat before changing anything.`
 }
 - open_page opens its page as a tab in the side-panel preview next to the chat — the only way to show one of these pages there (open_preview only handles editable items). Changing filters on a page already open updates that same tab; only pass new_tab when the user explicitly asks for a separate tab.
-- create_artifact saves a persistent markdown document (a planning doc, design write-up, spec, or other longer structured output) shown in the session preview panel. Prefer it over a long inline reply for content the user will revisit; keep brief answers inline. To revise one, call list_artifacts then read_artifact for the current content, then update_artifact to overwrite it — never create a second artifact for the same document.`
+- create_artifact saves a persistent markdown document (a planning doc, design write-up, spec, or other longer structured output) shown in the session preview panel. Prefer it over a long inline reply for content the user will revisit; keep brief answers inline. To revise one, call list_artifacts then read_artifact for the current content, then update_artifact to overwrite it — never create a second artifact for the same document. Each content change is saved as a version, keeping the most recent ones: use list_artifact_versions and read_artifact's version argument to recover earlier wording the user asks to go back to, rather than rewriting it from memory. list_artifact_versions is the source of truth for what is still available — do not assume a version that is not listed.`
 			: ''
 	}
 
@@ -2925,7 +2936,7 @@ export const globalTools: Tool<{}>[] = [
 	},
 	{
 		def: createToolDef(
-			writeScheduleSchema,
+			writeScheduleToolSchema,
 			'write_schedule',
 			'Create or overwrite a draft schedule.',
 			{ strict: false }
@@ -2934,7 +2945,17 @@ export const globalTools: Tool<{}>[] = [
 		streamArguments: true,
 		showFade: true,
 		fn: async (ctx) => {
-			const parsed = writeScheduleSchema.parse(ctx.args)
+			const { advanced, ...rest } = (ctx.args ?? {}) as Record<string, unknown>
+			// `advanced` carries what the definition does not list, so a named argument
+			// outranks a duplicate of the same key inside the bag. The whole merged object
+			// is checked for stripped keys, not just the bag: an advanced option passed at
+			// the top level instead would otherwise be dropped without a word.
+			const merged = { ...((advanced as Record<string, unknown>) ?? {}), ...rest }
+			const parsed = writeScheduleSchema.parse(merged)
+			const dropped = droppedOptionKeys(merged, parsed)
+			if (dropped.length) {
+				throw new Error(describeDroppedScheduleOptions(dropped))
+			}
 			return writeScheduleDraft(parsed, ctx)
 		}
 	},
@@ -2950,9 +2971,40 @@ export const globalTools: Tool<{}>[] = [
 		showFade: true,
 		fn: async (ctx) => {
 			const parsed = writeTriggerSchema.parse(ctx.args)
-			return writeTriggerDraft(parsed, ctx)
+			// writeTriggerDraft dispatches on `kind`, so a config belonging to another kind
+			// has to be rejected here rather than reaching the API as a corrupt draft. The
+			// recovery instruction leads because formatToolError caps the message at 2k and
+			// a long issue list would otherwise push it out of what the model receives.
+			const config = triggerRequestSchemas[parsed.kind].safeParse(parsed.config)
+			if (!config.success) {
+				throw new Error(
+					`Invalid config for a "${parsed.kind}" trigger. Call get_trigger_schema with kind "${parsed.kind}" for its exact fields. Issues: ${config.error.issues
+						.map((i) => `${i.path.join('.') || '<root>'}: ${i.message}`)
+						.join('; ')}`
+				)
+			}
+			return writeTriggerDraft({ ...parsed, config: config.data }, ctx)
 		}
 	},
+	{
+		def: createToolDef(
+			getTriggerSchemaSchema,
+			'get_trigger_schema',
+			'Get the configuration schema for one trigger kind. Call before write_trigger.'
+		),
+		fn: async (ctx) => {
+			const { kind } = getTriggerSchemaSchema.parse(ctx.args)
+			return triggerConfigJsonSchema(kind)
+		}
+	},
+	{
+		def: createToolDef(
+			z.object({}),
+			'get_schedule_schema',
+			"Get the shape of write_schedule's `advanced` object: retry, pausing, tags, and error-handler tuning."
+		),
+		fn: async () => JSON.stringify(advancedScheduleShape(), null, 2)
+	},
 	{
 		def: createToolDef(
 			editScriptSchema,
@@ -3182,12 +3234,13 @@ export const globalTools: Tool<{}>[] = [
 		def: createToolDef(
 			deleteWorkspaceItemSchema,
 			'delete_workspace_item',
-			'Delete a deployed workspace item. Mutates the workspace.'
+			'Delete an item that is already deployed in the workspace. Mutates the workspace. FAILS if the path has no deployed item, so never call it to undo something you created in this chat — that is a draft; use discard_local_draft instead.'
 		),
 		showDetails: true,
 		showFade: true,
 		requiresConfirmation: true,
 		confirmationMessage: 'Delete workspace item',
+		validateBeforeConfirmation: validateDeleteWorkspaceItemTarget,
 		fn: async (ctx) => {
 			const parsed = deleteWorkspaceItemSchema.parse(ctx.args)
 			return deleteWorkspaceItem(parsed, ctx)
@@ -3197,7 +3250,7 @@ export const globalTools: Tool<{}>[] = [
 		def: createToolDef(
 			discardLocalDraftSchema,
 			'discard_local_draft',
-			'Discard a draft only. Does not mutate deployed workspace items, but clears the matching open editor draft if one is mounted.'
+			'Discard a draft only — the tool to undo an item you created or edited in this chat and have not deployed. Does not mutate deployed workspace items, but clears the matching open editor draft if one is mounted.'
 		),
 		showDetails: true,
 		showFade: true,
@@ -3594,7 +3647,8 @@ export const SESSION_PREVIEW_TOOL_NAMES = new Set([
 	'create_artifact',
 	'update_artifact',
 	'list_artifacts',
-	'read_artifact'
+	'read_artifact',
+	'list_artifact_versions'
 ])
 
 /**
@@ -6014,8 +6068,8 @@ function formatForkIndexEntry(e: ForkDiffEntryView): string {
 	switch (e.status) {
 		case 'only_in_fork':
 			return `- ${name} — only in fork (${e.patchLineCount} lines)${draftFlag}`
-		case 'deleted_in_fork':
-			return `- ${name} — deleted in fork, still in parent${draftFlag}`
+		case 'only_in_parent':
+			return `- ${name} — only in parent, not in fork${draftFlag}`
 		case 'modified':
 			return `- ${name} — differs (${aheadBehind}; ${e.patchLineCount} diff lines)${draftFlag}`
 		case 'unchanged':
@@ -6193,8 +6247,8 @@ function renderForkEntrySection(
 	const header =
 		entry.status === 'only_in_fork'
 			? `${entry.kind} "${path}" exists only in the fork — not in parent "${parent}". Full content:\n\n`
-			: entry.status === 'deleted_in_fork'
-				? `${entry.kind} "${path}" was deleted in the fork but still exists in parent "${parent}". Removed content:\n\n`
+			: entry.status === 'only_in_parent'
+				? `${entry.kind} "${path}" exists only in parent "${parent}" — not in the fork. Parent content:\n\n`
 				: `Fork changes vs parent "${parent}" for ${entry.kind} "${path}":\n\n`
 	if (args.file !== undefined && !entry.files) {
 		throw new Error(
@@ -6722,6 +6776,67 @@ async function deployDraft(
 	)
 }
 
+// Undoing something created in this chat means discarding a draft, not deleting a
+// deploy. Must stay in validateBeforeConfirmation, not the tool body: otherwise the
+// user is asked to confirm a workspace mutation that cannot apply, and the delete
+// API 404s before the draft cleanup runs, leaving the draft they wanted gone.
+async function validateDeleteWorkspaceItemTarget(args: {
+	args: unknown
+	workspace: string
+}): Promise<string | undefined> {
+	// These are the raw tool arguments; the schema parse runs later in the tool body.
+	// Wave a malformed call through so it still fails with the canonical schema error.
+	const parsed = deleteWorkspaceItemSchema.safeParse(args.args)
+	if (!parsed.success) return undefined
+	const { type, path, trigger_kind: triggerKind } = parsed.data
+	if (type === 'trigger' && !triggerKind) return undefined
+
+	const { workspace } = args
+	if (await deployedItemExists(workspace, type, path, triggerKind)) return undefined
+
+	const draft = await getGlobalDraft(workspace, type, path, triggerKind)
+	return draft
+		? `No deployed ${type} at "${path}" — it only exists as a draft, so there is nothing to delete ` +
+				`from the workspace. Call discard_local_draft with the same arguments to remove the draft.`
+		: `No ${type} at "${path}": neither a deployed item nor a draft. Nothing to delete.`
+}
+
+async function deployedItemExists(
+	workspace: string,
+	type: WorkspaceItemType,
+	path: string,
+	triggerKind: TriggerKind | undefined
+): Promise<boolean> {
+	switch (type) {
+		case 'script':
+			// existsScriptByPath is the only probe that filters archived=false, while
+			// deleteScriptByPath removes every row at the path. Fall back to the
+			// archived-inclusive read so an archived script stays deletable.
+			if (await ScriptService.existsScriptByPath({ workspace, path })) return true
+			try {
+				await ScriptService.getScriptByPath({ workspace, path })
+				return true
+			} catch (e) {
+				// Only a 404 means "no script here". Let any other failure propagate rather
+				// than reporting a transient error as a missing item.
+				if ((e as { status?: number } | null | undefined)?.status === 404) return false
+				throw e
+			}
+		case 'flow':
+			return FlowService.existsFlowByPath({ workspace, path })
+		case 'schedule':
+			return ScheduleService.existsSchedule({ workspace, path })
+		case 'trigger':
+			return triggerServices[triggerKind!].exists({ workspace, path })
+		case 'resource':
+			return ResourceService.existsResource({ workspace, path })
+		case 'variable':
+			return VariableService.existsVariable({ workspace, path })
+		case 'app':
+			return AppService.existsApp({ workspace, path })
+	}
+}
+
 async function deleteWorkspaceItem(
 	args: { type: WorkspaceItemType; path: string; trigger_kind?: TriggerKind },
 	ctx: WriteDraftCtx
diff --git a/frontend/src/lib/components/copilot/chat/global/diffSnapshot.test.ts b/frontend/src/lib/components/copilot/chat/global/diffSnapshot.test.ts
index 76aed58b7c..7c8253684d 100644
--- a/frontend/src/lib/components/copilot/chat/global/diffSnapshot.test.ts
+++ b/frontend/src/lib/components/copilot/chat/global/diffSnapshot.test.ts
@@ -465,7 +465,7 @@ describe('fork mode', () => {
 		expect(byPath['f/a/b'].status).toBe('modified')
 		expect(byPath['f/a/new'].status).toBe('only_in_fork')
 		expect(byPath['f/a/new'].patch).not.toContain('parent-ws')
-		expect(byPath['f/a/gone'].status).toBe('deleted_in_fork')
+		expect(byPath['f/a/gone'].status).toBe('only_in_parent')
 		// One-sided entries fetch only the existing side: 2 + 1 + 1 calls.
 		expect(getItemValue).toHaveBeenCalledTimes(4)
 	})
diff --git a/frontend/src/lib/components/copilot/chat/global/diffSnapshot.ts b/frontend/src/lib/components/copilot/chat/global/diffSnapshot.ts
index f8a685af60..7b7d9ec1fd 100644
--- a/frontend/src/lib/components/copilot/chat/global/diffSnapshot.ts
+++ b/frontend/src/lib/components/copilot/chat/global/diffSnapshot.ts
@@ -620,7 +620,7 @@ const FORK_COMPARISON_REUSE_MS = 30_000
 export type ForkDiffStatus =
 	| 'modified'
 	| 'only_in_fork'
-	| 'deleted_in_fork'
+	| 'only_in_parent'
 	| 'unchanged'
 	| 'pending'
 	| 'error'
@@ -657,7 +657,7 @@ export interface ForkDiffIndexView {
 }
 
 interface ForkMaterialized {
-	status: 'modified' | 'only_in_fork' | 'deleted_in_fork' | 'unchanged' | 'error'
+	status: 'modified' | 'only_in_fork' | 'only_in_parent' | 'unchanged' | 'error'
 	patch: string
 	lineCount: number
 	files?: Record<string, DiffFileView>
@@ -1023,7 +1023,7 @@ async function materializeFork(
 			const forkValue = forkSide?.value
 			const valueMasked = parentSide?.valueMasked === true || forkSide?.valueMasked === true
 			const oneSidedStatus = !entry.existsInFork
-				? 'deleted_in_fork'
+				? 'only_in_parent'
 				: !entry.existsInParent
 					? 'only_in_fork'
 					: undefined
diff --git a/frontend/src/lib/components/copilot/chat/openai-responses.test.ts b/frontend/src/lib/components/copilot/chat/openai-responses.test.ts
index d93e383db1..276084a171 100644
--- a/frontend/src/lib/components/copilot/chat/openai-responses.test.ts
+++ b/frontend/src/lib/components/copilot/chat/openai-responses.test.ts
@@ -1,18 +1,28 @@
 import { describe, expect, it, vi } from 'vitest'
-import { openAIWebSearchDetails, toResponsesContent } from './openai-responses'
+import {
+	buildPromptCacheKey,
+	getOpenAIResponsesCompletion,
+	openAIWebSearchDetails,
+	toResponsesContent
+} from './openai-responses'
+
+const mocks = vi.hoisted(() => ({
+	getProviderAndCompletionConfig: vi.fn(),
+	applyReasoningToConfig: vi.fn()
+}))
 
 // openai-responses.ts pulls in the chat client/registry layer at import time; the
 // helper under test is pure, so stub those side-effecting modules away.
 vi.mock('../lib', () => ({
 	createOpenAIProxyClient: vi.fn(),
 	getAiProxyBaseURL: vi.fn(),
-	getProviderAndCompletionConfig: vi.fn(),
+	getProviderAndCompletionConfig: mocks.getProviderAndCompletionConfig,
 	providerSupportsWebSearch: vi.fn(),
 	workspaceAIClients: {}
 }))
 
 vi.mock('../reasoningRegistry', () => ({
-	applyReasoningToConfig: vi.fn()
+	applyReasoningToConfig: mocks.applyReasoningToConfig
 }))
 
 vi.mock('./shared', () => ({
@@ -38,6 +48,92 @@ describe('toResponsesContent', () => {
 	})
 })
 
+describe('buildPromptCacheKey', () => {
+	it('composes workspace, provider, model and surface', () => {
+		expect(buildPromptCacheKey('chat', { provider: 'openai', model: 'gpt-5.6' }, 'admins')).toBe(
+			'admins:openai:gpt-5.6:chat'
+		)
+	})
+
+	// Over 64 characters OpenAI rejects the key outright, and an Azure deployment name
+	// is user-chosen, so the model segment can be arbitrarily long.
+	it('stays within the provider length bound for a long deployment name', () => {
+		const key = buildPromptCacheKey(
+			'chat',
+			{ provider: 'azure_openai', model: 'our-very-long-production-deployment-name-for-gpt-5-6' },
+			'some-customer-workspace'
+		)
+
+		expect(key.length).toBeLessThanOrEqual(64)
+		expect(key.startsWith('some-customer-workspace:azure_openai:')).toBe(true)
+	})
+
+	// A max-length workspace on the longest provider name leaves no room for the model
+	// or surface, so only the digest can keep those keys apart.
+	it('keeps distinct models and surfaces apart when the workspace fills the bound', () => {
+		const workspace = 'w'.repeat(50)
+		const keys = [
+			buildPromptCacheKey('chat', { provider: 'azure_openai', model: 'gpt-5.6' }, workspace),
+			buildPromptCacheKey('chat', { provider: 'azure_openai', model: 'gpt-5.1' }, workspace),
+			buildPromptCacheKey('script', { provider: 'azure_openai', model: 'gpt-5.6' }, workspace)
+		]
+
+		for (const key of keys) {
+			expect(key.length).toBeLessThanOrEqual(64)
+		}
+		expect(new Set(keys).size).toBe(3)
+		// Stable, or every turn would land on a different cache.
+		expect(keys[0]).toBe(
+			buildPromptCacheKey('chat', { provider: 'azure_openai', model: 'gpt-5.6' }, workspace)
+		)
+	})
+})
+
+describe('getOpenAIResponsesCompletion prompt cache key', () => {
+	function stubClient() {
+		const stream = vi.fn().mockReturnValue({})
+		return { client: { responses: { stream } } as any, stream }
+	}
+
+	function stubConfig() {
+		mocks.getProviderAndCompletionConfig.mockReturnValue({
+			provider: 'openai',
+			config: { model: 'gpt-5.6' }
+		})
+		// The reasoning layer rebuilds the config object; keep it a pass-through so the
+		// assertion is about the body this module produces.
+		mocks.applyReasoningToConfig.mockImplementation((config) => config)
+	}
+
+	// `gpt-5.6` and later only match a cached prefix reliably when the request carries
+	// the routing key, so dropping it from the body silently forfeits the cache.
+	it('puts the caller key on the request body', async () => {
+		stubConfig()
+		const { client, stream } = stubClient()
+
+		await getOpenAIResponsesCompletion([], new AbortController(), undefined, {
+			openaiClient: client,
+			promptCacheKey: 'admins:openai:gpt-5.6:chat'
+		})
+
+		expect(stream.mock.calls[0][0]).toEqual(
+			expect.objectContaining({ prompt_cache_key: 'admins:openai:gpt-5.6:chat' })
+		)
+	})
+
+	it('omits the field entirely when the caller withdrew the key', async () => {
+		stubConfig()
+		const { client, stream } = stubClient()
+
+		await getOpenAIResponsesCompletion([], new AbortController(), undefined, {
+			openaiClient: client,
+			promptCacheKey: undefined
+		})
+
+		expect(stream.mock.calls[0][0]).not.toHaveProperty('prompt_cache_key')
+	})
+})
+
 describe('openAIWebSearchDetails', () => {
 	it('prefers the queries array over the deprecated singular query', () => {
 		expect(
diff --git a/frontend/src/lib/components/copilot/chat/openai-responses.ts b/frontend/src/lib/components/copilot/chat/openai-responses.ts
index cf7bcd3b4a..19efff2cd4 100644
--- a/frontend/src/lib/components/copilot/chat/openai-responses.ts
+++ b/frontend/src/lib/components/copilot/chat/openai-responses.ts
@@ -179,13 +179,54 @@ function convertMessagesToResponsesInput(messages: ChatCompletionMessageParam[])
 	}
 }
 
+/** OpenAI rejects a key over 64 characters, and an Azure deployment name is user-chosen. */
+const MAX_PROMPT_CACHE_KEY_LENGTH = 64
+
+/** FNV-1a. A routing key needs to be stable and distinct, not cryptographic. */
+function shortHash(value: string): string {
+	let h = 0x811c9dc5
+	for (let i = 0; i < value.length; i++) {
+		h ^= value.charCodeAt(i)
+		h = Math.imul(h, 0x01000193) >>> 0
+	}
+	return h.toString(16).padStart(8, '0')
+}
+
+/**
+ * Routing key for the provider's prompt cache. Built only from what fixes the prompt
+ * prefix (the surface, plus the model) and never from anything per-request, since
+ * requests sharing a prefix must reuse one key to land on the same cache. Workspace
+ * splits traffic across the ~15 requests/minute one key sustains before it starts
+ * missing again.
+ */
+export function buildPromptCacheKey(
+	surface: string,
+	modelProvider: { provider: string; model: string },
+	workspace: string
+): string {
+	const key = [workspace, modelProvider.provider, modelProvider.model, surface].join(':')
+	if (key.length <= MAX_PROMPT_CACHE_KEY_LENGTH) {
+		return key
+	}
+	// Same shape as the backend's `bounded_prompt_cache_key`: a readable head keeps the
+	// key traceable, and the digest carries every distinction the head lost. Truncating
+	// alone would collapse a long workspace's models and surfaces onto one key.
+	const suffix = shortHash(key)
+	return `${key.slice(0, MAX_PROMPT_CACHE_KEY_LENGTH - suffix.length - 1)}:${suffix}`
+}
+
 function convertCompletionConfigToResponsesConfig(
-	config: ChatCompletionCreateParams
+	config: ChatCompletionCreateParams,
+	promptCacheKey?: string
 ): Record<string, any> {
 	const responsesConfig: Record<string, any> = {
 		model: config.model
 	}
 
+	if (promptCacheKey) {
+		responsesConfig.prompt_cache_key = promptCacheKey
+	}
+
 	// Map max_tokens or max_completion_tokens to max_output_tokens
 	if ('max_completion_tokens' in config && config.max_completion_tokens) {
 		responsesConfig.max_output_tokens = config.max_completion_tokens
@@ -223,6 +264,7 @@ export async function getOpenAIResponsesCompletion(
 		webSearch?: boolean
 		reasoningEffort?: string
 		reasoningSummary?: boolean
+		promptCacheKey?: string
 	}
 ) {
 	const { provider, config } = getProviderAndCompletionConfig({
@@ -233,7 +275,7 @@ export async function getOpenAIResponsesCompletion(
 	})
 	const { instructions, input } = convertMessagesToResponsesInput(messages)
 	const responsesConfig = applyReasoningToConfig(
-		convertCompletionConfigToResponsesConfig(config),
+		convertCompletionConfigToResponsesConfig(config, options?.promptCacheKey),
 		'responses',
 		options?.reasoningEffort
 	)
@@ -291,6 +333,10 @@ export async function* getOpenAIResponsesCompletionStream(
 		forceModelProvider: options?.forceModelProvider
 	})
 	const { instructions, input } = convertMessagesToResponsesInput(messages)
+	// No prompt cache key here: a rejected key has to be retried without it, and this is
+	// an async generator, so the caller's try/catch never sees the failure (invoking a
+	// generator runs none of its body). One-shot generations have no repeated prefix to
+	// route anyway; the chat loop is the surface that does, and it can retry.
 	const responsesConfig = applyReasoningToConfig(
 		convertCompletionConfigToResponsesConfig(config),
 		'responses',
@@ -575,6 +621,7 @@ export async function getNonStreamingOpenAIResponsesCompletion(
 	})
 
 	const { instructions, input } = convertMessagesToResponsesInput(messages)
+	// No prompt cache key, for the same reason as the streaming variant above.
 	const responsesConfig = convertCompletionConfigToResponsesConfig(config)
 
 	const fetchOptions: {
diff --git a/frontend/src/lib/components/copilot/chat/pipeline/core.ts b/frontend/src/lib/components/copilot/chat/pipeline/core.ts
index f689699dd5..0793359d24 100644
--- a/frontend/src/lib/components/copilot/chat/pipeline/core.ts
+++ b/frontend/src/lib/components/copilot/chat/pipeline/core.ts
@@ -340,6 +340,7 @@ Data Pipeline editor (ACTIVE):
 - \`materialize\` (the managed output): \`// materialize <asset-uri>\` means the runtime writes the node's output table FOR you — write the body as a single SELECT and the runtime wraps it in the create/replace, so do NOT also write your own CREATE TABLE / INSERT. IMPORTANT: \`// materialize\` is **DuckDB-only** and its target MUST be a DuckLake table (\`ducklake://<name>/<table>\`) — deploy rejects it on any other language or target. For a \`python3\`/\`bun\`/\`postgresql\` node, do NOT use \`// materialize\`; write the output via the SDK instead (e.g. \`wmill.writeS3File(...)\`, a \`CREATE TABLE\` in postgresql, or \`wmill.databaseUrlFromResource\`/ducklake helpers) and let the output be inferred. Reach for \`duckdb\` when a node should materialize a DuckLake table. Write strategy: with no option it REPLACES the whole table each run (full refresh; the only mode whose output columns may change); \`// materialize <uri> append\` INSERT-appends rows (incremental); \`// materialize <uri> key=<col>\` merges/upserts on \`<col>\`. \`// materialize manual <uri>\` opts OUT of managed writes — the script writes its own DDL and the annotation only records the output asset for lineage. \`materialize\` is paired with partitioning for incremental pipelines: a \`// partitioned <daily|hourly|weekly|monthly|dynamic>\` node runs once per partition (append/merge into a fixed-schema table), and the \`{partition}\` token — usable in any asset URI AND in the body SQL — is substituted with the current partition's IDENTITY string at run time. To filter the source to the active slice on a time grain, use the runtime-injected macro: \`WHERE wm_partition(<ts_col>) = {partition}\`. \`wm_partition(ts)\` buckets a timestamp with the exact identity format the runtime used (daily/hourly/weekly/monthly), so it always matches and you never hand-write a \`strftime\` format. Do NOT write \`= TIMESTAMP {partition}\`: the identity string is not a valid timestamp literal for hourly/weekly/monthly and errors at runtime. For \`dynamic\` partitioning the identity is your caller-supplied key (not a timestamp, no macro), so filter on it directly: \`WHERE <your_key_col> = {partition}\`. \`materialize\` is an output DECLARATION on the node — it is not a command; there is no "materialize run".
 - \`measure\` / \`dimension\` (declared metrics): on a node that materializes a DuckLake table, \`// measure <name> = <aggregate> [where <predicate>]\` names the canonical way to aggregate that table (e.g. \`// measure revenue = sum(amount) where not is_refund\`), and \`// dimension <name> = <expr>\` names a way to slice it (e.g. \`// dimension region = region\`, \`// dimension month = date_trunc('month', ordered_at)\`). They execute nothing: they are catalogued at deploy so the editor and other agents can reuse the definition instead of re-deriving it and silently disagreeing. Keep the predicate in the \`where\` clause rather than folding it into the aggregate: it is rendered as \`<agg> FILTER (WHERE <pred>)\`, which is what lets two measures with different predicates sit under one GROUP BY. DuckLake-only, and only meaningful next to \`// materialize\`. Declare one when a number carries a judgement call someone else would get wrong (refunds excluded, test rows dropped, which column is the amount); do NOT blanket every table with measures, an obvious \`count(*)\` earns nothing. To USE a metric another node declares, read that node with read_pipeline_node and reuse its exact expression rather than guessing it.
 - Use get_pipeline_graph to see the current nodes/assets/triggers, and read_pipeline_node before editing one.
+- Every node of this pipeline lives at \`f/${ctx.folder}/<node_name>\` — \`${ctx.folder}\` is the folder name and \`f/\` is the owner prefix every workspace path carries, so write it exactly once (never \`f/f/…\`, and never a bare \`<node_name>\`).
 - Build new nodes with build_pipeline_node and edit existing ones with edit_pipeline_node. These apply directly as unsaved drafts on the canvas (like the flow/script editor applies AI edits) — they DO NOT deploy. There is no separate Accept/Reject step. Prefer these over the generic write_script/edit_script draft tools while a pipeline is open.
 - Reuse existing asset paths from the graph when wiring a downstream node to an upstream one (read the upstream's write asset, then \`// on\` that same URI).
 - Only deploy when the user explicitly asks; the user deploys drafts from the canvas.`
diff --git a/frontend/src/lib/components/copilot/chat/scheduleToolSchema.ts b/frontend/src/lib/components/copilot/chat/scheduleToolSchema.ts
new file mode 100644
index 0000000000..6f74d52e89
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/scheduleToolSchema.ts
@@ -0,0 +1,78 @@
+import { z } from 'zod'
+import { scheduleRequestSchema } from './workspaceToolsZod.gen'
+
+// Fields common enough that a lookup round trip would cost more than carrying them.
+// The rest reach the same validation through `advanced`, whose shape get_schedule_schema
+// serves on demand: `retry` alone is a quarter of this schema and is asked for far more
+// rarely than a plain cron.
+const COMMON_SCHEDULE_FIELDS = [
+	'path',
+	'schedule',
+	'timezone',
+	'script_path',
+	'is_flow',
+	'args',
+	'enabled',
+	'summary',
+	'description',
+	'on_failure',
+	'on_recovery',
+	'on_success'
+] as const
+
+/** Fields the caller supplies itself, so the model must neither set nor see them. */
+export type ScheduleToolOptions = { hidden?: readonly string[] }
+
+function commonFields({ hidden = [] }: ScheduleToolOptions): string[] {
+	return COMMON_SCHEDULE_FIELDS.filter((field) => !hidden.includes(field))
+}
+
+/** The `advanced` shape get_schedule_schema serves: everything not already inline. */
+export function advancedScheduleShape(opts: ScheduleToolOptions = {}) {
+	const inline = new Set([...commonFields(opts), ...(opts.hidden ?? [])])
+	const full = z.toJSONSchema(scheduleRequestSchema) as { properties?: Record<string, unknown> }
+	return {
+		type: 'object',
+		properties: Object.fromEntries(
+			Object.entries(full.properties ?? {}).filter(([field]) => !inline.has(field))
+		)
+	}
+}
+
+export function buildScheduleToolSchema(opts: ScheduleToolOptions = {}) {
+	const advancedNames = Object.keys(advancedScheduleShape(opts).properties).join(', ')
+	return scheduleRequestSchema
+		.pick(Object.fromEntries(commonFields(opts).map((f) => [f, true])) as any)
+		.extend({
+			advanced: z
+				.record(z.string(), z.any())
+				.optional()
+				.describe(
+					`Less common schedule options (${advancedNames}). Call get_schedule_schema for their exact shape.`
+				)
+		})
+}
+
+/**
+ * Explains keys a strip-mode parse discarded. A mis-shaped real field is recoverable by
+ * fetching its schema; a key that is not a schedule field at all is not, and pointing
+ * the model at the lookup for it would send it somewhere with no answer.
+ */
+export function describeDroppedScheduleOptions(dropped: string[]): string {
+	const fields = new Set(
+		Object.keys(
+			(z.toJSONSchema(scheduleRequestSchema) as { properties?: Record<string, unknown> })
+				.properties ?? {}
+		)
+	)
+	const misshaped = dropped.filter((path) => fields.has(path.split('.')[0]))
+	const unknown = dropped.filter((path) => !fields.has(path.split('.')[0]))
+	return [
+		misshaped.length
+			? `These schedule options do not match their schema and would have been dropped: ${misshaped.join(', ')}. Call get_schedule_schema for their exact shape.`
+			: '',
+		unknown.length ? `These are not schedule fields: ${unknown.join(', ')}.` : ''
+	]
+		.filter(Boolean)
+		.join(' ')
+}
diff --git a/frontend/src/lib/components/copilot/chat/script/MermaidDisplay.svelte b/frontend/src/lib/components/copilot/chat/script/MermaidDisplay.svelte
index dda1892baa..60687efcce 100644
--- a/frontend/src/lib/components/copilot/chat/script/MermaidDisplay.svelte
+++ b/frontend/src/lib/components/copilot/chat/script/MermaidDisplay.svelte
@@ -35,6 +35,13 @@
 				startOnLoad: false,
 				theme: dark ? 'dark' : 'default',
 				securityLevel: 'strict',
+				// Mermaid writes this stack into a <style> block inside the SVG, so the app's font
+				// never reaches a diagram: the bundled vector emoji font has to be named here or
+				// emoji fall back to the platform bitmap one, which ignores the zoom transform
+				// (app.css). Inter sits last before it because the emoji font also covers digits,
+				// # and *; on a box without the MS core fonts those would otherwise render as its
+				// keycap glyphs. Keeping Inter behind them leaves diagram typography unchanged.
+				fontFamily: '"trebuchet ms", verdana, arial, Inter, "Noto Color Emoji", sans-serif',
 				// Throw on parse errors instead of injecting an orphan error diagram into the DOM.
 				suppressErrorRendering: true
 			})
@@ -43,6 +50,17 @@
 			if (seq !== renderSeq) return
 			svg = result.svg
 			renderedCode = source
+			// Mermaid sizes each node by measuring its label, so a font still in flight yields
+			// boxes cut to fallback metrics that the real glyphs then overflow. Drawing the
+			// diagram is itself what asks for the fonts its glyphs need — including the emoji
+			// subsets — so let them settle and lay it out again against the true metrics.
+			if (document.fonts?.status === 'loading') {
+				await document.fonts.ready
+				if (seq !== renderSeq) return
+				const settled = await mermaid.render(`mermaid-${randomUUID()}`, source)
+				if (seq !== renderSeq) return
+				svg = settled.svg
+			}
 		} catch {
 			// Parse failure (often a partial block still streaming in): fall back to the
 			// raw source. `showSvg` already hides any previous diagram since `renderedCode`
@@ -145,7 +163,7 @@
 		</div>
 	</div>
 
-	<Modal bind:open={expanded} title="Diagram" kind="X" class="sm:max-w-none w-[92vw]">
+	<Modal bind:open={expanded} title="Diagram" kind="X" fillHeight class="sm:max-w-none w-[92vw]">
 		{#snippet settings()}
 			<div class="flex flex-row gap-1 mr-8">
 				<Button
@@ -183,7 +201,7 @@
 			</div>
 		{/snippet}
 		<div
-			class="relative w-full h-[78vh] overflow-hidden rounded border cursor-grab bg-surface-secondary"
+			class="relative w-full h-full overflow-hidden rounded border cursor-grab bg-surface-secondary"
 		>
 			{#if expanded}
 				<div use:panzoomAction class="w-full h-full flex items-center justify-center">
diff --git a/frontend/src/lib/components/copilot/chat/shared.test.ts b/frontend/src/lib/components/copilot/chat/shared.test.ts
index 719638d700..db89021328 100644
--- a/frontend/src/lib/components/copilot/chat/shared.test.ts
+++ b/frontend/src/lib/components/copilot/chat/shared.test.ts
@@ -91,7 +91,9 @@ describe('createToolDef', () => {
 		expect(parameters?.oneOf).toBeUndefined()
 		expect(parameters?.allOf).toBeUndefined()
 		expect(parameters?.properties?.kind?.enum).toContain('http')
-		expect(parameters?.properties?.config?.anyOf?.length).toBeGreaterThan(1)
+		// config stays open-ended; get_trigger_schema serves the per-kind schemas instead.
+		expect(parameters?.properties?.config?.anyOf).toBeUndefined()
+		expect(JSON.stringify(toolDef).length).toBeLessThan(2000)
 	})
 
 	it('disables strict mode for schemas with optional properties', async () => {
@@ -129,19 +131,34 @@ describe('createToolDef', () => {
 
 	it('does not expose runnable target fields on workspace mutation tools', async () => {
 		const { createWorkspaceMutationTools } = await import('./workspaceTools')
-		const [scheduleTool, triggerTool] = createWorkspaceMutationTools()
+		const { triggerConfigSchemas } = await import('./workspaceToolsZod.gen')
+		const [scheduleTool] = createWorkspaceMutationTools()
 
 		const scheduleParameters = scheduleTool.def.function.parameters as any
 		expect(scheduleParameters?.properties?.script_path).toBeUndefined()
 		expect(scheduleParameters?.properties?.is_flow).toBeUndefined()
 
-		const triggerParameters = triggerTool.def.function.parameters as any
-		const triggerConfigVariants = triggerParameters?.properties?.config?.anyOf ?? []
-		expect(triggerConfigVariants.length).toBeGreaterThan(1)
-		for (const variant of triggerConfigVariants) {
-			expect(variant?.properties?.script_path).toBeUndefined()
-			expect(variant?.properties?.is_flow).toBeUndefined()
+		// These come from the runnable the chat is editing, so the model must not see them
+		// on any kind, including in the schemas get_trigger_schema serves on demand.
+		const getTriggerSchema = createWorkspaceMutationTools().find(
+			(tool) => tool.def.function.name === 'get_trigger_schema'
+		)!
+		for (const kind of Object.keys(triggerConfigSchemas)) {
+			const served = JSON.parse(await getTriggerSchema.fn({ args: { kind } } as any))
+			expect(served.properties?.script_path).toBeUndefined()
+			expect(served.properties?.is_flow).toBeUndefined()
+			expect(served.properties?.path).toBeUndefined()
 		}
+
+		// Same for the schedule options served on demand. The runnable target still wins
+		// on merge, so this is about not advertising a field the model cannot influence.
+		const getScheduleSchema = createWorkspaceMutationTools().find(
+			(tool) => tool.def.function.name === 'get_schedule_schema'
+		)!
+		const schedule = JSON.parse(await getScheduleSchema.fn({ args: {} } as any))
+		expect(schedule.properties?.script_path).toBeUndefined()
+		expect(schedule.properties?.is_flow).toBeUndefined()
+		expect(schedule.properties).toHaveProperty('retry')
 	})
 })
 
@@ -412,6 +429,89 @@ describe('processToolCall', () => {
 		expect(requestConfirmation).not.toHaveBeenCalled()
 	})
 
+	// create_schedule duplicates the global `advanced` merge and guard, so it needs its
+	// own coverage: the fold must reach the request body and a mis-shape must stop the
+	// write rather than create a schedule with an inert policy.
+	it('folds advanced schedule options into create_schedule and refuses a mis-shaped one', async () => {
+		const gen = (await import('$lib/gen')) as any
+		const { processToolCall } = await import('./shared')
+		const { createWorkspaceMutationTools } = await import('./workspaceTools')
+		const workspaceMutationTools = createWorkspaceMutationTools()
+
+		gen.ScheduleService.previewSchedule.mockReset()
+		gen.ScheduleService.createSchedule.mockReset()
+		gen.ScheduleService.previewSchedule.mockResolvedValue({})
+		gen.ScheduleService.createSchedule.mockResolvedValue('schedule-created')
+
+		const target = {
+			getWorkspaceMutationTarget: () => ({
+				kind: 'script' as const,
+				path: 'f/scripts/current',
+				deployed: true
+			})
+		}
+		const callbacks = () => ({
+			setToolStatus: vi.fn(),
+			removeToolStatus: vi.fn(),
+			requestConfirmation: vi.fn().mockResolvedValue(true)
+		})
+
+		await processToolCall({
+			tools: workspaceMutationTools,
+			toolCall: {
+				id: 'call_adv',
+				type: 'function',
+				function: {
+					name: 'create_schedule',
+					arguments: JSON.stringify({
+						path: 'f/schedules/adv',
+						schedule: '0 0 12 * * *',
+						timezone: 'UTC',
+						args: null,
+						advanced: { tag: 'nightly', retry: { constant: { attempts: 2, seconds: 30 } } }
+					})
+				}
+			},
+			helpers: target,
+			workspace: 'test-workspace',
+			toolCallbacks: callbacks()
+		})
+
+		expect(gen.ScheduleService.createSchedule).toHaveBeenCalledWith({
+			workspace: 'test-workspace',
+			requestBody: expect.objectContaining({
+				tag: 'nightly',
+				retry: { constant: { attempts: 2, seconds: 30 } }
+			})
+		})
+
+		gen.ScheduleService.createSchedule.mockReset()
+		const badStatus = vi.fn()
+		await processToolCall({
+			tools: workspaceMutationTools,
+			toolCall: {
+				id: 'call_bad',
+				type: 'function',
+				function: {
+					name: 'create_schedule',
+					arguments: JSON.stringify({
+						path: 'f/schedules/bad',
+						schedule: '0 0 12 * * *',
+						timezone: 'UTC',
+						args: null,
+						advanced: { retry: { constant: { attempts: 2, seconds_typo: 30 } } }
+					})
+				}
+			},
+			helpers: target,
+			workspace: 'test-workspace',
+			toolCallbacks: { ...callbacks(), setToolStatus: badStatus }
+		})
+
+		expect(gen.ScheduleService.createSchedule).not.toHaveBeenCalled()
+		expect(JSON.stringify(badStatus.mock.calls)).toContain('get_schedule_schema')
+	})
+
 	it('injects runnable target fields into schedule and trigger requests', async () => {
 		const gen = (await import('$lib/gen')) as any
 		const { processToolCall } = await import('./shared')
diff --git a/frontend/src/lib/components/copilot/chat/shared.ts b/frontend/src/lib/components/copilot/chat/shared.ts
index 131392a665..c7c29926df 100644
--- a/frontend/src/lib/components/copilot/chat/shared.ts
+++ b/frontend/src/lib/components/copilot/chat/shared.ts
@@ -5,6 +5,11 @@ import type {
 } from 'openai/resources/chat/completions.mjs'
 import type { UserDraftItemKind } from '$lib/gen'
 
+// The tool modules that import this one (workspaceTools, flow/core, global/core, ...)
+// call createToolDef and read SPECIAL_MODULE_IDS at *module scope*, so if a chunk cycle
+// ever reaches this file they evaluate against uninitialized bindings and the app dies
+// on load. Keep the import list here shallow. See docs/frontend-import-cycles.md.
+
 /**
  * Special module IDs used throughout the flow system
  */
@@ -601,6 +606,9 @@ export type AssistantDisplayMessage = BaseDisplayMessage & {
 	role: 'assistant'
 	/** Summarized reasoning/thinking text streamed before the answer (Anthropic + compat providers). */
 	reasoning?: string
+	/** Wall time the model spent reasoning, from the first thinking token to the
+	 * first answer token. Absent on messages finalized before it was recorded. */
+	reasoningDurationMs?: number
 	/**
 	 * True only on the synthetic live message appended while tokens stream
 	 * (see AIChat.svelte). Finalized messages never set it — without the flag,
@@ -712,6 +720,28 @@ async function callTool<T>({
 
 type MaybePromise<T> = T | Promise<T>
 
+/**
+ * Key paths present in `supplied` that a strip-mode parse discarded. Sub-fields of a
+ * schedule's `retry` are all optional, so a guessed shape validates clean, loses the
+ * misspelled keys and saves a policy that does nothing. Recursive because dropping one
+ * nested key leaves the parent non-empty.
+ */
+export function droppedOptionKeys(
+	supplied: unknown,
+	parsed: unknown,
+	prefix = ''
+): string[] {
+	if (supplied === null || typeof supplied !== 'object' || Array.isArray(supplied)) {
+		return parsed === undefined && prefix ? [prefix] : []
+	}
+	if (parsed === null || typeof parsed !== 'object') {
+		return Object.keys(supplied).length && prefix ? [prefix] : []
+	}
+	return Object.entries(supplied).flatMap(([key, value]) =>
+		droppedOptionKeys(value, (parsed as Record<string, unknown>)[key], prefix ? `${prefix}.${key}` : key)
+	)
+}
+
 const MAX_TOOL_ERROR_LENGTH = 2000
 
 /** ApiError from the generated client carries the server's message in `body`,
diff --git a/frontend/src/lib/components/copilot/chat/sharedChatState.svelte.ts b/frontend/src/lib/components/copilot/chat/sharedChatState.svelte.ts
index 6c94756b21..330ee95c7d 100644
--- a/frontend/src/lib/components/copilot/chat/sharedChatState.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/sharedChatState.svelte.ts
@@ -13,9 +13,15 @@ export const DEFAULT_SIZE = 22
 
 type ChatState = {
 	size: number
+	// Whether a docked chat pane is mounted (set by AiChatLayout). False in AI
+	// Sessions mode, where the root layout renders no pane: aiChatManager.openChat()
+	// only writes `size`, so a button that opens the pane without checking this is a
+	// silent no-op. Entry points that can't fall back to a session must hide instead.
+	dockedChatAvailable: boolean
 }
 
 // we first check BROWSER before localStorage to avoid SSR issues when using Drawer in a SvelteKit app (chatState is imported in Drawer.svelte)
 export const chatState = $state<ChatState>({
-	size: BROWSER && localStorage.getItem('ai-chat-open') === 'true' ? DEFAULT_SIZE : 0
+	size: BROWSER && localStorage.getItem('ai-chat-open') === 'true' ? DEFAULT_SIZE : 0,
+	dockedChatAvailable: false
 })
diff --git a/frontend/src/lib/components/copilot/chat/thinkingPreferences.svelte.ts b/frontend/src/lib/components/copilot/chat/thinkingPreferences.svelte.ts
new file mode 100644
index 0000000000..098e39f7cd
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/thinkingPreferences.svelte.ts
@@ -0,0 +1,19 @@
+import { BROWSER } from 'esm-env'
+import { getLocalSetting, storeLocalSetting } from '$lib/utils'
+
+const EXPAND_THINKING_SETTING = 'ai-chat-expand-thinking'
+
+// How the reader wants to read, not anything about the conversation — so it
+// lives per browser rather than in chat history or workspace settings, and
+// applies to every chat at once.
+let expandByDefault = $state(BROWSER && getLocalSetting(EXPAND_THINKING_SETTING) === 'true')
+
+export const thinkingPreferences = {
+	get expandByDefault() {
+		return expandByDefault
+	},
+	set expandByDefault(value: boolean) {
+		expandByDefault = value
+		storeLocalSetting(EXPAND_THINKING_SETTING, value ? 'true' : undefined)
+	}
+}
diff --git a/frontend/src/lib/components/copilot/chat/workspaceTools.ts b/frontend/src/lib/components/copilot/chat/workspaceTools.ts
index dabe63b5bc..18c3687701 100644
--- a/frontend/src/lib/components/copilot/chat/workspaceTools.ts
+++ b/frontend/src/lib/components/copilot/chat/workspaceTools.ts
@@ -28,11 +28,18 @@ import {
 import {
 	createTriggerToolSchema,
 	scheduleRequestSchema,
+	triggerConfigSchemas,
 	triggerRequestSchemas
 } from './workspaceToolsZod.gen'
 import { z } from 'zod'
+import {
+	advancedScheduleShape,
+	buildScheduleToolSchema,
+	describeDroppedScheduleOptions
+} from './scheduleToolSchema'
 import {
 	createToolDef,
+	droppedOptionKeys,
 	formatToolError,
 	type CreatedResourceTriggerKind,
 	type Tool,
@@ -68,7 +75,20 @@ type WorkspaceMutationHelpers = {
 	getWorkspaceMutationTarget?: () => WorkspaceMutationTarget
 }
 
-const createScheduleToolSchema = scheduleRequestSchema.omit({ script_path: true, is_flow: true })
+// script_path/is_flow come from the runnable being edited, so they are hidden from the
+// model in both the tool schema and what get_schedule_schema serves.
+const SCHEDULE_TOOL_OPTIONS = { hidden: ['script_path', 'is_flow'] } as const
+
+const createScheduleToolSchema = buildScheduleToolSchema(SCHEDULE_TOOL_OPTIONS)
+
+const getScheduleSchemaTool: Tool<any> = {
+	def: createToolDef(
+		z.object({}),
+		'get_schedule_schema',
+		"Get the shape of create_schedule's `advanced` object: retry, pausing, tags, and error-handler tuning."
+	),
+	fn: async () => JSON.stringify(advancedScheduleShape(SCHEDULE_TOOL_OPTIONS), null, 2)
+}
 
 function getWorkspaceMutationTarget(helpers: unknown): WorkspaceMutationTarget | undefined {
 	return (helpers as WorkspaceMutationHelpers | undefined)?.getWorkspaceMutationTarget?.()
@@ -114,17 +134,35 @@ function getWorkspaceMutationTargetFields(
 const createScheduleToolDef = createToolDef(
 	createScheduleToolSchema,
 	'create_schedule',
-	'Create a schedule for the current script or flow.',
+	'Create a schedule for the current script or flow. For anything beyond a plain cron (retry, pausing, tags, error-handler tuning), call get_schedule_schema first and pass those through `advanced`.',
 	{ strict: false }
 )
 
 const createTriggerToolDef = createToolDef(
 	createTriggerToolSchema,
 	'create_trigger',
-	'Create a trigger for the current script or flow. For an email trigger (kind "email"), config.local_part is the local part of the receiving address (before the @); the tool reports the full address on success. Email triggers require email triggering to be configured on the instance — if it is not, the tool returns setup guidance instead of creating one.',
+	'Create a trigger for the current script or flow. Call get_trigger_schema with the same kind first: the config fields differ per kind and are not listed here. For an email trigger (kind "email"), config.local_part is the local part of the receiving address (before the @); the tool reports the full address on success. Email triggers require email triggering to be configured on the instance — if it is not, the tool returns setup guidance instead of creating one.',
 	{ strict: false }
 )
 
+const getTriggerSchemaToolSchema = z.object({
+	kind: z.enum(Object.keys(triggerConfigSchemas) as [TriggerKind, ...TriggerKind[]])
+})
+
+const getTriggerSchemaTool: Tool<any> = {
+	def: createToolDef(
+		getTriggerSchemaToolSchema,
+		'get_trigger_schema',
+		'Get the configuration schema for one trigger kind. Call before create_trigger.'
+	),
+	fn: async ({ args }) => {
+		const { kind } = parseWithExplicitErrors(getTriggerSchemaToolSchema, args, 'Trigger kind')
+		const schema = z.toJSONSchema(triggerConfigSchemas[kind]) as Record<string, unknown>
+		delete schema.$schema
+		return JSON.stringify(schema, null, 2)
+	}
+}
+
 const triggerConfigs = {
 	http: {
 		label: 'HTTP trigger',
@@ -277,14 +315,27 @@ const createScheduleTool: Tool<any> = {
 	validateBeforeConfirmation: ({ helpers }) => validateWorkspaceMutationTarget(helpers),
 	fn: async ({ args, workspace, helpers, toolCallbacks, toolId }) => {
 		try {
+			const { advanced, ...rest } = (args ?? {}) as Record<string, unknown>
+			// `advanced` carries what the definition does not list: a named argument outranks
+			// a duplicate inside the bag, and the runnable target outranks both. The whole
+			// merged object is checked for stripped keys, not just the bag: an advanced option
+			// passed at the top level instead would otherwise be dropped without a word.
+			const merged = {
+				...((advanced as Record<string, unknown>) ?? {}),
+				...rest,
+				...getWorkspaceMutationTargetFields(helpers)
+			}
 			const requestBody = parseWithExplicitErrors(
 				scheduleRequestSchema as z.ZodType<NewSchedule>,
-				{
-					...args,
-					...getWorkspaceMutationTargetFields(helpers)
-				},
+				merged,
 				'Schedule'
 			)
+			const dropped = droppedOptionKeys(merged, requestBody)
+			if (dropped.length) {
+				throw new Error(
+					describeDroppedScheduleOptions(dropped)
+				)
+			}
 
 			toolCallbacks.setToolStatus(toolId, {
 				content: `Validating schedule "${requestBody.path}"...`
@@ -453,7 +504,12 @@ const createTriggerTool: Tool<any> = {
 	}
 }
 
-const workspaceMutationTools = [createScheduleTool, createTriggerTool]
+const workspaceMutationTools = [
+	createScheduleTool,
+	createTriggerTool,
+	getTriggerSchemaTool,
+	getScheduleSchemaTool
+]
 
 export function createWorkspaceMutationTools<T>(): Tool<T>[] {
 	return workspaceMutationTools as Tool<T>[]
diff --git a/frontend/src/lib/components/copilot/chat/workspaceToolsZod.gen.ts b/frontend/src/lib/components/copilot/chat/workspaceToolsZod.gen.ts
index 6aa40bce75..0518fde90b 100644
--- a/frontend/src/lib/components/copilot/chat/workspaceToolsZod.gen.ts
+++ b/frontend/src/lib/components/copilot/chat/workspaceToolsZod.gen.ts
@@ -500,6 +500,24 @@ export const triggerRequestSchemas = {
 
 const triggerPathSchema = z.string().min(1).describe("The unique Windmill path for this trigger. Must be of the form `u/<user>/<path>` or `f/<folder>/<path>`. This is the trigger object path, not the HTTP route path.")
 
+// The kind-specific fields of a trigger config, with the three the tool supplies
+// itself removed. Fetched one at a time through get_trigger_schema rather than
+// inlined into create_trigger: as a union of all eleven this serialized to ~39k
+// characters of JSON Schema, resent on every request of every chat.
+export const triggerConfigSchemas = {
+	http: httpTriggerRequestSchema.omit({ path: true, script_path: true, is_flow: true }),
+	websocket: websocketTriggerRequestSchema.omit({ path: true, script_path: true, is_flow: true }),
+	kafka: kafkaTriggerRequestSchema.omit({ path: true, script_path: true, is_flow: true }),
+	nats: natsTriggerRequestSchema.omit({ path: true, script_path: true, is_flow: true }),
+	postgres: postgresTriggerRequestSchema.omit({ path: true, script_path: true, is_flow: true }),
+	mqtt: mqttTriggerRequestSchema.omit({ path: true, script_path: true, is_flow: true }),
+	amqp: amqpTriggerRequestSchema.omit({ path: true, script_path: true, is_flow: true }),
+	sqs: sqsTriggerRequestSchema.omit({ path: true, script_path: true, is_flow: true }),
+	gcp: gcpTriggerRequestSchema.omit({ path: true, script_path: true, is_flow: true }),
+	azure: azureTriggerRequestSchema.omit({ path: true, script_path: true, is_flow: true }),
+	email: emailTriggerRequestSchema.omit({ path: true, script_path: true, is_flow: true }),
+} as const
+
 export const createTriggerToolSchema = z.object({
 	kind: z.enum([
 		"http",
@@ -515,17 +533,9 @@ export const createTriggerToolSchema = z.object({
 		"email",
 	]),
 	path: triggerPathSchema,
-	config: z.union([
-		httpTriggerRequestSchema.omit({ path: true, script_path: true, is_flow: true }),
-		websocketTriggerRequestSchema.omit({ path: true, script_path: true, is_flow: true }),
-		kafkaTriggerRequestSchema.omit({ path: true, script_path: true, is_flow: true }),
-		natsTriggerRequestSchema.omit({ path: true, script_path: true, is_flow: true }),
-		postgresTriggerRequestSchema.omit({ path: true, script_path: true, is_flow: true }),
-		mqttTriggerRequestSchema.omit({ path: true, script_path: true, is_flow: true }),
-		amqpTriggerRequestSchema.omit({ path: true, script_path: true, is_flow: true }),
-		sqsTriggerRequestSchema.omit({ path: true, script_path: true, is_flow: true }),
-		gcpTriggerRequestSchema.omit({ path: true, script_path: true, is_flow: true }),
-		azureTriggerRequestSchema.omit({ path: true, script_path: true, is_flow: true }),
-		emailTriggerRequestSchema.omit({ path: true, script_path: true, is_flow: true }),
-	])
+	config: z
+		.record(z.string(), z.any())
+		.describe(
+			'The kind-specific trigger configuration. Call get_trigger_schema with the same kind first to get its exact fields.'
+		)
 })
diff --git a/frontend/src/lib/components/copilot/lib.anthropicRouting.test.ts b/frontend/src/lib/components/copilot/lib.anthropicRouting.test.ts
index e295aa6b28..ae2451d49d 100644
--- a/frontend/src/lib/components/copilot/lib.anthropicRouting.test.ts
+++ b/frontend/src/lib/components/copilot/lib.anthropicRouting.test.ts
@@ -247,3 +247,52 @@ describe('Anthropic Messages API routing', () => {
 		expect(fetchSpy).not.toHaveBeenCalled()
 	})
 })
+
+// Without an explicit breakpoint Anthropic charges the full prompt on every iteration,
+// and the tool definitions alone are the largest part of a chat request. OpenRouter
+// forwards the field only for Anthropic-backed models, hence the model-level gate.
+describe('OpenRouter prompt caching', () => {
+	const conversation: ChatCompletionMessageParam[] = [
+		{ role: 'system', content: 'system prompt' },
+		{ role: 'user', content: 'first' },
+		{ role: 'assistant', content: 'answer' },
+		{ role: 'tool', tool_call_id: 't1', content: 'tool output' }
+	]
+
+	// The `~` form is OpenRouter's own floating alias for the same vendor, so it has
+	// to reach the same gate — a prefix match on the raw id silently misses it and
+	// puts the chat back on full price every turn.
+	it.each(['anthropic/claude-sonnet-5', '~anthropic/claude-sonnet-latest'])(
+		'breaks on the system prompt and the newest user turn for %s',
+		async (model) => {
+			const { getCompletion } = await import('./lib')
+			h.currentModel = { provider: 'openrouter', model }
+
+			await getCompletion([...conversation], new AbortController(), undefined, {
+				promptCaching: true
+			})
+
+			const sent = openaiCreate.mock.calls[0][0].messages
+			const ephemeral = { type: 'ephemeral' }
+			expect(sent[0].content).toEqual([
+				{ type: 'text', text: 'system prompt', cache_control: ephemeral }
+			])
+			expect(sent[1].content).toEqual([{ type: 'text', text: 'first', cache_control: ephemeral }])
+			expect(sent[3].content).toBe('tool output')
+			// The chat replays this same history through the Anthropic path, which rejects
+			// unknown fields on its own blocks, so the originals must come back untouched.
+			expect(conversation[0].content).toBe('system prompt')
+		}
+	)
+
+	it('leaves other OpenRouter upstreams alone', async () => {
+		const { getCompletion } = await import('./lib')
+		h.currentModel = { provider: 'openrouter', model: 'openai/gpt-5.1' }
+
+		await getCompletion([...conversation], new AbortController(), undefined, {
+			promptCaching: true
+		})
+
+		expect(openaiCreate.mock.calls[0][0].messages[0].content).toBe('system prompt')
+	})
+})
diff --git a/frontend/src/lib/components/copilot/lib.test.ts b/frontend/src/lib/components/copilot/lib.test.ts
index 17a7ad6508..55e0e92c60 100644
--- a/frontend/src/lib/components/copilot/lib.test.ts
+++ b/frontend/src/lib/components/copilot/lib.test.ts
@@ -217,7 +217,12 @@ describe('model context windows', () => {
 		expect(getKnownModelContextWindow('claude-sonnet-4-6')).toBe(1000000)
 		expect(getKnownModelContextWindow('claude-opus-4-6')).toBe(1000000)
 		expect(getKnownModelContextWindow('claude-opus-4-8')).toBe(1000000)
+		expect(getKnownModelContextWindow('claude-opus-5')).toBe(1000000)
+		expect(getKnownModelContextWindow('claude-sonnet-5')).toBe(1000000)
 		expect(getKnownModelContextWindow('anthropic.claude-sonnet-4-6-v1:0')).toBe(1000000)
+		// OpenRouter dot-versions the same models; both spellings must resolve
+		expect(getKnownModelContextWindow('anthropic/claude-sonnet-4.6')).toBe(1000000)
+		expect(getKnownModelContextWindow('anthropic/claude-opus-4.8')).toBe(1000000)
 	})
 
 	it('keeps Haiku and older Claude models at 200K', () => {
@@ -242,6 +247,17 @@ describe('model context windows', () => {
 		expect(getKnownModelContextWindow('gpt-5.5')).toBe(1000000)
 	})
 
+	it('does not let a version entry claim a longer version number', () => {
+		// `gpt-4.1` and `gpt-4-1106-preview` collapse to the same prefix, but the
+		// latter is a 128K model and must stay unlisted
+		expect(getKnownModelContextWindow('gpt-4-1106-preview')).toBeUndefined()
+		expect(getKnownModelContextWindow('gpt-4.1-mini')).toBe(1000000)
+		// family fallbacks still catch a version welded onto the name (Ollama ids),
+		// which is what keeps compaction on for them
+		expect(getKnownModelContextWindow('llama3.1')).toBe(128000)
+		expect(getKnownModelContextWindow('llama3-70b-8192')).toBe(128000)
+	})
+
 	it('maps recent Gemini and DeepSeek models to the 1M window', () => {
 		expect(getKnownModelContextWindow('gemini-3.1-pro')).toBe(1000000)
 		expect(getKnownModelContextWindow('gemini-3-flash')).toBe(1000000)
@@ -251,6 +267,15 @@ describe('model context windows', () => {
 		expect(getKnownModelContextWindow('deepseek-reasoner')).toBe(1000000)
 	})
 
+	it('maps Qwen3-Max to 256K and leaves other Qwen ids to the assumed window', () => {
+		expect(getKnownModelContextWindow('qwen3-max')).toBe(256000)
+		expect(getKnownModelContextWindow('qwen3-max-2025-09-23')).toBe(256000)
+		// a version between "qwen3" and "-max" must not claim the 256K entry, and
+		// there is deliberately no qwen family entry (variant windows range 8K–1M)
+		expect(getKnownModelContextWindow('qwen3.8-max')).toBeUndefined()
+		expect(getModelContextWindow('qwen3.8-max')).toBe(128000)
+	})
+
 	it('returns undefined for unrecognized models, 128K via the defaulting wrapper', () => {
 		expect(getKnownModelContextWindow('some-custom-model')).toBeUndefined()
 		expect(getModelContextWindow('some-custom-model')).toBe(128000)
diff --git a/frontend/src/lib/components/copilot/lib.ts b/frontend/src/lib/components/copilot/lib.ts
index 89154880c0..fc2cb0abd2 100644
--- a/frontend/src/lib/components/copilot/lib.ts
+++ b/frontend/src/lib/components/copilot/lib.ts
@@ -14,7 +14,11 @@ import Anthropic from '@anthropic-ai/sdk'
 import { get, type Writable } from 'svelte/store'
 import { OpenAPI, ResourceService, type Script } from '../../gen'
 import { EDIT_CONFIG, FIX_CONFIG, GEN_CONFIG } from './prompts'
-import { requiresMaxCompletionTokens, usesAnthropicMessagesApi } from './modelConfig'
+import {
+	requiresMaxCompletionTokens,
+	usesAnthropicMessagesApi,
+	usesOpenRouterPromptCaching
+} from './modelConfig'
 import { applyReasoningToConfig } from './reasoningRegistry'
 import { formatResourceTypes } from './utils'
 import {
@@ -359,7 +363,68 @@ function getModelSpecificConfig(
 	}
 }
 
-function prepareMessages(aiProvider: AIProvider, messages: ChatCompletionMessageParam[]) {
+const EPHEMERAL_CACHE_CONTROL = { type: 'ephemeral' } as const
+
+// Returns a copy carrying a cache breakpoint on its last text part. The message objects
+// are the live chat history and are also replayed through the Anthropic path, so they
+// must not be mutated. Parts other than text (images) are left alone: only text blocks
+// are documented to carry the field over the OpenAI-compatible surface.
+function withCacheBreakpoint(message: ChatCompletionMessageParam): ChatCompletionMessageParam {
+	const content = message.content
+	if (typeof content === 'string') {
+		if (!content) return message
+		return {
+			...message,
+			// `cache_control` is an OpenRouter passthrough field, absent from the OpenAI types.
+			content: [{ type: 'text', text: content, cache_control: EPHEMERAL_CACHE_CONTROL } as any]
+		} as ChatCompletionMessageParam
+	}
+	if (!Array.isArray(content)) return message
+	let last = -1
+	for (let i = content.length - 1; i >= 0; i--) {
+		if ((content[i] as { type?: string }).type === 'text') {
+			last = i
+			break
+		}
+	}
+	if (last < 0) return message
+	return {
+		...message,
+		content: content.map((part, i) =>
+			i === last ? { ...part, cache_control: EPHEMERAL_CACHE_CONTROL } : part
+		)
+	} as ChatCompletionMessageParam
+}
+
+// Anthropic caches the whole prefix up to a breakpoint, ordered tools -> system ->
+// messages, so the one on the system message also covers the tool definitions, by far
+// the largest static block of a chat request. The second covers the settled conversation
+// up to the newest user turn. Tool results appended after it inside an agent loop stay
+// outside the cached prefix: reaching those needs a breakpoint on a `tool` message, and
+// OpenRouter documents the field on text content blocks only. Two of a budget of four.
+function withOpenRouterCacheBreakpoints(
+	messages: ChatCompletionMessageParam[]
+): ChatCompletionMessageParam[] {
+	const prepared = [...messages]
+	const system = prepared.findIndex((m) => m.role === 'system')
+	if (system >= 0) prepared[system] = withCacheBreakpoint(prepared[system])
+	for (let i = prepared.length - 1; i > system; i--) {
+		if (prepared[i].role === 'user') {
+			prepared[i] = withCacheBreakpoint(prepared[i])
+			break
+		}
+	}
+	return prepared
+}
+
+function prepareMessages(
+	aiProvider: AIProvider,
+	messages: ChatCompletionMessageParam[],
+	{ model, promptCaching }: { model: string; promptCaching?: boolean }
+) {
+	if (promptCaching && usesOpenRouterPromptCaching(aiProvider, model)) {
+		return withOpenRouterCacheBreakpoints(messages)
+	}
 	switch (aiProvider) {
 		case 'googleai':
 			// system messages are not supported by gemini
@@ -798,13 +863,17 @@ export function getProviderAndCompletionConfig<K extends boolean>({
 	stream,
 	tools,
 	forceModelProvider,
-	maxTokensCap
+	maxTokensCap,
+	promptCaching
 }: {
 	messages: ChatCompletionMessageParam[]
 	stream: K
 	tools?: OpenAI.Chat.Completions.ChatCompletionTool[]
 	forceModelProvider?: AIProviderModel
 	maxTokensCap?: number
+	// Opt-in: a cache write costs more than an uncached read, so it only pays off where
+	// the same prefix is sent again. True for the chat loop, false for one-shot calls.
+	promptCaching?: boolean
 }): {
 	provider: AIProvider
 	config: K extends true
@@ -813,7 +882,10 @@ export function getProviderAndCompletionConfig<K extends boolean>({
 } {
 	const modelProvider = forceModelProvider ?? getCurrentModel()
 	const providerConfig = PROVIDER_COMPLETION_CONFIG_MAP[modelProvider.provider]
-	const processedMessages = prepareMessages(modelProvider.provider, messages)
+	const processedMessages = prepareMessages(modelProvider.provider, messages, {
+		model: modelProvider.model,
+		promptCaching
+	})
 	return {
 		provider: modelProvider.provider,
 		config: {
@@ -993,6 +1065,7 @@ export async function getCompletion(
 		forceModelProvider?: AIProviderModel
 		openaiClient?: OpenAI
 		reasoningEffort?: string
+		promptCaching?: boolean
 	}
 ): Promise<Stream<ChatCompletionChunk>> {
 	const modelProvider = options?.forceModelProvider ?? getCurrentModel()
@@ -1005,7 +1078,8 @@ export async function getCompletion(
 		messages,
 		stream: true,
 		tools,
-		forceModelProvider: options?.forceModelProvider
+		forceModelProvider: options?.forceModelProvider,
+		promptCaching: options?.promptCaching
 	})
 
 	// Use Responses API for OpenAI and Azure OpenAI
diff --git a/frontend/src/lib/components/copilot/loadCopilot.test.ts b/frontend/src/lib/components/copilot/loadCopilot.test.ts
new file mode 100644
index 0000000000..f255295afc
--- /dev/null
+++ b/frontend/src/lib/components/copilot/loadCopilot.test.ts
@@ -0,0 +1,53 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { get } from 'svelte/store'
+
+vi.mock('./lib', () => ({
+	workspaceAIClients: { init: () => {} }
+}))
+
+let requests: { workspace: string; resolve: (config: any) => void }[] = []
+
+vi.mock('$lib/gen', () => ({
+	WorkspaceService: {
+		getCopilotInfo: ({ workspace }: { workspace: string }) =>
+			new Promise((resolve) => requests.push({ workspace, resolve }))
+	}
+}))
+
+import { loadCopilot } from './loadCopilot'
+import { copilotWorkspace } from '$lib/aiStore'
+
+const config = { providers: { anthropic: { resource_path: 'u/admin/anthropic', models: ['m'] } } }
+
+describe('loadCopilot', () => {
+	beforeEach(() => {
+		requests = []
+		copilotWorkspace.set(undefined)
+	})
+
+	it('shares one request between callers loading the same workspace', async () => {
+		const first = loadCopilot('ws')
+		const second = loadCopilot('ws')
+
+		expect(requests.map((r) => r.workspace)).toEqual(['ws'])
+		requests[0].resolve(config)
+		await Promise.all([first, second])
+		expect(get(copilotWorkspace)).toBe('ws')
+	})
+
+	it('lets a re-requested workspace win back over the one that superseded it', async () => {
+		const a1 = loadCopilot('a')
+		const b = loadCopilot('b')
+		// A per-workspace cache would hand back `a1` here — which has already lost the
+		// apply race to `b`, so `a` would silently never be written.
+		const a2 = loadCopilot('a')
+		expect(requests.map((r) => r.workspace)).toEqual(['a', 'b', 'a'])
+
+		requests[0].resolve(config)
+		requests[1].resolve(config)
+		requests[2].resolve(config)
+		await Promise.all([a1, b, a2])
+
+		expect(get(copilotWorkspace)).toBe('a')
+	})
+})
diff --git a/frontend/src/lib/components/copilot/loadCopilot.ts b/frontend/src/lib/components/copilot/loadCopilot.ts
new file mode 100644
index 0000000000..4634833b0b
--- /dev/null
+++ b/frontend/src/lib/components/copilot/loadCopilot.ts
@@ -0,0 +1,48 @@
+import { WorkspaceService } from '$lib/gen'
+import { copilotWorkspace, setCopilotInfo } from '$lib/aiStore'
+import { workspaceAIClients } from './lib'
+
+// Lives here, not in $lib/aiStore, purely so that module needs no import of the AI
+// client — it is the one thing that wanted both. Moving it back recreates the
+// aiStore -> copilot/lib -> copilot/chat/shared -> aiStore cycle.
+
+// copilotInfo/copilotSessionModel are global, so concurrent loads (e.g. a fast
+// session switch between workspaces) race: an earlier call resolving last would
+// clobber the active workspace's config. Apply only the most recent call's
+// result via a monotonic token — last invocation wins regardless of resolution
+// order. init() is synchronous so its ordering already matches.
+let loadCopilotToken = 0
+
+// Consumers load the config for the workspace they operate on rather than trusting an
+// ancestor to have done it, and they mount together — so share the in-flight request
+// instead of firing one GET each. Only ever hold the newest request here: an older one
+// has lost the token, so handing it back would leave its workspace never applied.
+let inFlight: { workspace: string; promise: Promise<void> } | undefined
+
+export function loadCopilot(workspace: string): Promise<void> {
+	if (inFlight?.workspace === workspace) {
+		return inFlight.promise
+	}
+	const promise = fetchAndApply(workspace, ++loadCopilotToken).finally(() => {
+		if (inFlight?.promise === promise) {
+			inFlight = undefined
+		}
+	})
+	inFlight = { workspace, promise }
+	return promise
+}
+
+async function fetchAndApply(workspace: string, token: number) {
+	workspaceAIClients.init(workspace)
+	try {
+		const info = await WorkspaceService.getCopilotInfo({ workspace })
+		if (token !== loadCopilotToken) return
+		setCopilotInfo(info)
+		copilotWorkspace.set(workspace)
+	} catch (err) {
+		if (token !== loadCopilotToken) return
+		setCopilotInfo({})
+		copilotWorkspace.set(workspace)
+		console.error('Could not get copilot info', err)
+	}
+}
diff --git a/frontend/src/lib/components/copilot/modelConfig.ts b/frontend/src/lib/components/copilot/modelConfig.ts
index 62e5a3542a..ee034f0500 100644
--- a/frontend/src/lib/components/copilot/modelConfig.ts
+++ b/frontend/src/lib/components/copilot/modelConfig.ts
@@ -1,5 +1,34 @@
 import type { AIProvider } from '$lib/gen'
 
+export type ParsedModelId = {
+	/** Vendor namespace when the id carries one (`anthropic/claude-sonnet-5`). */
+	vendor: string | undefined
+	/** Bare model id: no vendor prefix, no variant suffix. */
+	base: string
+}
+
+/**
+ * Split a model id into the parts the predicates below match on. Gateways decorate
+ * the vendor's id in ways a raw substring check misses: OpenRouter marks its own
+ * floating aliases with a `~` prefix (`~anthropic/claude-sonnet-latest`, distinct
+ * from the vendor-pinned `anthropic/claude-sonnet-5`) and appends `:variant`
+ * suffixes (`:free`, `:thinking`). Match on the parsed parts, never on the raw id.
+ *
+ * `base` is the last `/` segment: the deprecated `<model>/thinking` selection puts
+ * its marker where a gateway puts the model, so callers that must resolve one of
+ * those ids first run it through `stripLegacyThinkingSuffix`.
+ */
+export function parseModelId(model: string): ParsedModelId {
+	const normalized = model.toLowerCase().replace(/^~/, '')
+	const segments = normalized.split('/')
+	const last = segments[segments.length - 1]
+	const colon = last.indexOf(':')
+	return {
+		vendor: segments.length > 1 ? segments[0] : undefined,
+		base: colon > 0 ? last.slice(0, colon) : last
+	}
+}
+
 // Azure AI Foundry fronts multiple model families under one resource. Claude
 // deployments are served only through the Anthropic Messages API, so the chat must
 // route them like the native Anthropic provider (Anthropic SDK, message format)
@@ -12,29 +41,41 @@ export function usesAnthropicMessagesApi(provider: AIProvider, model: string): b
 	)
 }
 
+// Anthropic bills a cached prefix at a tenth of the input rate, but only creates one
+// where an explicit `cache_control` breakpoint sits. With no breakpoint the whole
+// prompt is charged in full on every iteration of a chat. The native Anthropic path
+// sets its own breakpoints; OpenRouter forwards them over the OpenAI-compatible surface
+// but only documents them for Anthropic-backed models, so the gate is on the routed
+// model rather than the provider alone.
+export function usesOpenRouterPromptCaching(provider: AIProvider, model: string): boolean {
+	return provider === 'openrouter' && parseModelId(model).vendor === 'anthropic'
+}
+
 // gpt-5+ and o-series reasoning models reject the legacy `max_tokens` field on
 // the OpenAI/Azure Chat Completions API and require `max_completion_tokens`
-// instead. The check strips any provider prefix (e.g. OpenRouter's "openai/o3")
-// so it matches the bare model id, and the o-series match requires a digit after
-// the "o" (o1/o3/o4-mini) so it does not catch unrelated ids like Mistral's
-// "open-mistral-*" or "optimus-*".
+// instead. The check runs on the bare model id (so OpenRouter's "openai/o3"
+// matches), and the o-series match requires a digit after the "o" (o1/o3/o4-mini)
+// so it does not catch unrelated ids like Mistral's "open-mistral-*" or "optimus-*".
 export function requiresMaxCompletionTokens(model: string) {
-	const normalizedModel = model.toLowerCase()
-	const baseModel = normalizedModel.split('/').pop() ?? normalizedModel
+	const baseModel = parseModelId(model).base
 	return baseModel.startsWith('gpt-5') || /^o\d/.test(baseModel)
 }
 
 // Context windows of the models we know, most specific entry first — the first
-// name included in the model id wins, so provider-prefixed and date-suffixed
+// name found in the bare model id wins, so vendor-namespaced and date-suffixed
 // ids (anthropic.claude-sonnet-4-6-...-v1:0, gpt-5.2-2026-01-01) still resolve.
 // Conservative family fallbacks sit below the explicit entries; models not
-// listed at all resolve to undefined, which disables auto-trimming and the
-// indicator denominator.
+// listed at all resolve to undefined. Consumers that need a number regardless
+// (trim/compaction, the usage indicator) go through getModelContextWindow,
+// whose conservative 128K fallback keeps a limit enforced and is surfaced to
+// the user as an assumed window.
 const MODEL_CONTEXT_WINDOWS: [name: string, contextWindow: number][] = [
 	// Anthropic — Sonnet/Opus 4.6+ ship a 1M window at standard pricing (GA);
 	// Haiku, older Claude models (3.x, 4.0, 4.1, 4.5) and date-suffixed Claude 4
 	// base ids (claude-sonnet-4-20250514) fall through to 200K
 	['claude-fable-5', 1_000_000],
+	['claude-opus-5', 1_000_000],
+	['claude-sonnet-5', 1_000_000],
 	['claude-opus-4-8', 1_000_000],
 	['claude-opus-4-7', 1_000_000],
 	['claude-opus-4-6', 1_000_000],
@@ -59,13 +100,37 @@ const MODEL_CONTEXT_WINDOWS: [name: string, contextWindow: number][] = [
 	['deepseek-chat', 1_000_000],
 	['deepseek-reasoner', 1_000_000],
 	['deepseek', 128_000],
+	// Alibaba — Qwen3-Max is 256K. No qwen family fallback: variant windows range
+	// from 8K (character models) to 1M, too wide for even a conservative guess
+	['qwen3-max', 256_000],
 	// Others
 	['llama', 128_000],
 	['codestral', 32_000]
 ]
 
+// Version separators differ by route to the same model: Anthropic writes
+// `claude-opus-4-8`, OpenRouter writes `anthropic/claude-opus-4.8`. Collapsing
+// dots to dashes on both sides keeps one table entry covering every route —
+// without it a dot-versioned id falls through to a coarser family entry.
+function normalizeVersionSeparators(model: string): string {
+	return model.replace(/\./g, '-')
+}
+
+// An entry that ends on a version digit must not run into a longer version:
+// `gpt-4.1` collapses to `gpt-4-1`, which would otherwise claim the 128K
+// `gpt-4-1106-preview` as a 1M model. Suffixes that continue with a separator
+// (`claude-opus-4-8` in `...-4-8-v1`, `gpt-5` in `gpt-5-mini`) still match.
+// Family fallbacks ending on a letter get no such guard — a version welded
+// straight onto the name (`llama3.1`) is exactly what they exist to catch.
+const MODEL_CONTEXT_WINDOW_MATCHERS: [matcher: RegExp, contextWindow: number][] =
+	MODEL_CONTEXT_WINDOWS.map(([name, contextWindow]) => {
+		const pattern = normalizeVersionSeparators(name).replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+		return [new RegExp(/\d$/.test(pattern) ? `${pattern}(?!\\d)` : pattern), contextWindow]
+	})
+
 export function getKnownModelContextWindow(model: string): number | undefined {
-	return MODEL_CONTEXT_WINDOWS.find(([name]) => model.includes(name))?.[1]
+	const id = normalizeVersionSeparators(parseModelId(model).base)
+	return MODEL_CONTEXT_WINDOW_MATCHERS.find(([matcher]) => matcher.test(id))?.[1]
 }
 
 export function getModelContextWindow(model: string) {
diff --git a/frontend/src/lib/components/copilot/reasoningRegistry.ts b/frontend/src/lib/components/copilot/reasoningRegistry.ts
index 519c1a4021..581715882d 100644
--- a/frontend/src/lib/components/copilot/reasoningRegistry.ts
+++ b/frontend/src/lib/components/copilot/reasoningRegistry.ts
@@ -1,5 +1,5 @@
 import type { AIProvider, AIProviderModel } from '$lib/gen'
-import { usesAnthropicMessagesApi } from './modelConfig'
+import { parseModelId, usesAnthropicMessagesApi } from './modelConfig'
 
 /**
  * Reasoning effort is provider/model-specific. We never normalize a single
@@ -35,8 +35,7 @@ export function stripLegacyThinkingSuffix(model: string): string {
 
 /** Bare model id without any provider/gateway prefix (e.g. OpenRouter's `openai/o3`). */
 function baseModelId(model: string): string {
-	const normalized = model.toLowerCase()
-	return normalized.split('/').pop() ?? normalized
+	return parseModelId(model).base
 }
 
 /**
diff --git a/frontend/src/lib/components/custom_ui.ts b/frontend/src/lib/components/custom_ui.ts
index 041c2dd23a..9771521bf4 100644
--- a/frontend/src/lib/components/custom_ui.ts
+++ b/frontend/src/lib/components/custom_ui.ts
@@ -1,6 +1,8 @@
 import type { SupportedLanguage } from '$lib/common'
 
 export type FlowBuilderWhitelabelCustomUi = {
+	/** Opt out of FlowEditor's `modalPanel` to keep the classic always-docked pane. */
+	modalPanel?: boolean
 	topBar?: {
 		path?: boolean
 		editablePath?: boolean
diff --git a/frontend/src/lib/components/dbManagerTag.svelte.ts b/frontend/src/lib/components/dbManagerTag.svelte.ts
new file mode 100644
index 0000000000..edcded19ea
--- /dev/null
+++ b/frontend/src/lib/components/dbManagerTag.svelte.ts
@@ -0,0 +1,49 @@
+import { getLocalSetting, storeLocalSetting } from '$lib/utils'
+import type { DbInput } from './dbTypes'
+
+/**
+ * Every database manager operation runs as a job on the language's native tag
+ * (`postgresql`, `duckdb`, …). A database reachable only from one worker group
+ * (private network, VPC) needs those jobs on that group's tag instead, and it
+ * needs it on every visit — hence local storage rather than component state.
+ */
+function tagKey(workspace: string | undefined, input: DbInput | undefined): string | undefined {
+	if (!workspace || !input) return undefined
+	const path = input.type === 'ducklake' ? `ducklake://${input.ducklake}` : input.resourcePath
+	return `dbManagerWorkerTag:${workspace}:${path}`
+}
+
+/** Tags set this session, shared by every caller: local storage is not reactive, so a
+ * per-instance cache would leave a second drawer open on the same database deriving —
+ * and running its jobs on — the tag the first one just replaced. `null` is an explicit
+ * clear, absent means "not set here, read local storage". */
+const overrides = $state<Record<string, string | null>>({})
+
+export interface DbManagerTagState {
+	/** Tag override for this database's jobs; undefined runs them on the language default. */
+	tag: string | undefined
+}
+
+export function useDbManagerTag(
+	getWorkspace: () => string | undefined,
+	getInput: () => DbInput | undefined
+): DbManagerTagState {
+	let key = $derived(tagKey(getWorkspace(), getInput()))
+	let tag = $derived.by(() => {
+		if (!key) return undefined
+		const set = overrides[key]
+		return (set === undefined ? getLocalSetting(key) : set) ?? undefined
+	})
+	return {
+		get tag() {
+			return tag
+		},
+		set tag(v: string | undefined) {
+			const k = key
+			if (!k) return
+			const value = v ? v : undefined
+			overrides[k] = value ?? null
+			storeLocalSetting(k, value)
+		}
+	}
+}
diff --git a/frontend/src/lib/components/dbOps.ts b/frontend/src/lib/components/dbOps.ts
index 21a6386478..a89abf4374 100644
--- a/frontend/src/lib/components/dbOps.ts
+++ b/frontend/src/lib/components/dbOps.ts
@@ -5,6 +5,7 @@ import {
 	type TableMetadata
 } from './apps/components/display/dbtable/utils'
 import { runScriptAndPollResult } from './jobs/utils'
+import { writingJobOptions } from './jobs/writingJob'
 import type { DBSchema, SQLSchema } from '$lib/stores'
 import { stringifySchema } from './copilot/lib'
 import type { DbInput, DbType } from './dbTypes'
@@ -50,7 +51,8 @@ export function dbTableOpsWithPreviewScripts({
 	colDefs,
 	workspace,
 	whereClause,
-	version
+	version,
+	tag
 }: {
 	input: DbInput
 	tableKey: string
@@ -62,6 +64,8 @@ export function dbTableOpsWithPreviewScripts({
 	// DuckLake time-travel: when set, reads are pinned to this catalog snapshot
 	// via `AT (VERSION => n)` (DuckDB/ducklake only). Read-only by nature.
 	version?: number
+	// Overrides the language's native worker tag.
+	tag?: string
 }): IDbTableOps {
 	const dbType = getDbType(input)
 	const language = getLanguageByResourceType(dbType)
@@ -86,7 +90,7 @@ export function dbTableOpsWithPreviewScripts({
 			})
 			const result = await runScriptAndPollResult({
 				workspace,
-				requestBody: { args: { ...dbArg, quicksearch }, language, content }
+				requestBody: { args: { ...dbArg, quicksearch }, language, content, tag }
 			})
 			const count = result?.[0].count as number
 			return count
@@ -101,7 +105,7 @@ export function dbTableOpsWithPreviewScripts({
 			})
 			let items = (await runScriptAndPollResult({
 				workspace,
-				requestBody: { args: { ...dbArg, ...params }, language, content }
+				requestBody: { args: { ...dbArg, ...params }, language, content, tag }
 			})) as unknown[]
 			if (!items || !Array.isArray(items)) {
 				throw 'items is not an array'
@@ -114,28 +118,32 @@ export function dbTableOpsWithPreviewScripts({
 				column: colDef,
 				columns: colDefs
 			})
-			await runScriptAndPollResult({
-				workspace,
-				requestBody: {
-					args: { ...dbArg, value_to_update: newValue, ...values },
-					language,
-					content
-				}
-			})
+			await runScriptAndPollResult(
+				{
+					workspace,
+					requestBody: {
+						args: { ...dbArg, value_to_update: newValue, ...values },
+						language,
+						content,
+						tag
+					}
+				},
+				writingJobOptions
+			)
 		},
 		onDelete: async ({ values }) => {
 			const content = makeMarker('DELETE', { table: tableKey, columns: colDefs })
-			await runScriptAndPollResult({
-				workspace,
-				requestBody: { args: { ...dbArg, ...values }, language, content }
-			})
+			await runScriptAndPollResult(
+				{ workspace, requestBody: { args: { ...dbArg, ...values }, language, content, tag } },
+				writingJobOptions
+			)
 		},
 		onInsert: async ({ values }) => {
 			const content = makeMarker('INSERT', { table: tableKey, columns: colDefs })
-			await runScriptAndPollResult({
-				workspace,
-				requestBody: { args: { ...dbArg, ...values }, language, content }
-			})
+			await runScriptAndPollResult(
+				{ workspace, requestBody: { args: { ...dbArg, ...values }, language, content, tag } },
+				writingJobOptions
+			)
 		}
 	}
 }
@@ -256,13 +264,18 @@ export class MigrationRunCancelled extends Error {
 export function dbSchemaOpsWithPreviewScripts({
 	workspace,
 	input,
-	confirmRunOutOfOrder
+	confirmRunOutOfOrder,
+	tag
 }: {
 	workspace: string
 	input: DbInput
 	/** Asked before running a just-created migration ahead of `pendingCount`
 	 * still-pending earlier ones. Return false to abort (throws MigrationRunCancelled). */
 	confirmRunOutOfOrder?: (pendingCount: number) => Promise<boolean>
+	// Overrides the language's native worker tag, for a database only reachable from
+	// a specific worker group. Data table migrations are run by the server, which
+	// picks their tag itself, so they are unaffected.
+	tag?: string
 }): IDbSchemaOps {
 	const dbType = getDbType(input)
 	const dbArg = getDatabaseArg(input)
@@ -340,7 +353,10 @@ export function dbSchemaOpsWithPreviewScripts({
 			? await WorkspaceService.getDatatableMigrationsStatus({ workspace, datatableName })
 			: undefined
 		if (!datatableName || !status?.enabled) {
-			await runScriptAndPollResult({ workspace, requestBody: { args: dbArg, content, language } })
+			await runScriptAndPollResult(
+				{ workspace, requestBody: { args: dbArg, content, language, tag } },
+				writingJobOptions
+			)
 			return
 		}
 		// The new migration gets the highest timestamp, so any still-pending
@@ -449,7 +465,7 @@ export function dbSchemaOpsWithPreviewScripts({
 					const fkContent = makeMarker('FOREIGN_KEYS', { table, schema })
 					const fkResult = await runScriptAndPollResult({
 						workspace,
-						requestBody: { args: dbArg, content: fkContent, language }
+						requestBody: { args: dbArg, content: fkContent, language, tag }
 					})
 
 					let rawForeignKeys: RawForeignKey[]
@@ -482,7 +498,7 @@ export function dbSchemaOpsWithPreviewScripts({
 					const pkContent = makeMarker('PRIMARY_KEY_CONSTRAINT', { table, schema })
 					const pkResult = (await runScriptAndPollResult({
 						workspace,
-						requestBody: { args: dbArg, content: pkContent, language }
+						requestBody: { args: dbArg, content: pkContent, language, tag }
 					})) as { constraint_name?: string; CONSTRAINT_NAME?: string }[]
 
 					if (pkResult && Array.isArray(pkResult) && pkResult.length > 0) {
@@ -506,17 +522,20 @@ export function dbSchemaOpsWithPreviewScripts({
 
 export async function getDucklakeSchema({
 	workspace,
-	ducklake
+	ducklake,
+	tag
 }: {
 	workspace: string
 	ducklake: string
+	tag?: string
 }): Promise<DBSchema> {
 	let result = await runScriptAndPollResult({
 		workspace,
 		requestBody: {
 			language: 'duckdb',
 			content: `ATTACH 'ducklake://${ducklake}' AS __ducklake__; ${DUCKLAKE_GET_SCHEMA_QUERY}`,
-			args: {}
+			args: {},
+			tag
 		}
 	})
 	let schemas = Array.isArray(result) && result.length && (result?.[0]?.['result'] ?? {})
@@ -569,6 +588,12 @@ export function getDbType(input: DbInput): DbType {
 	}
 }
 
+/** Tag the database's jobs carry with no override: for every DB the manager
+ * supports, the language of its queries is also the name of its native tag. */
+export function getDefaultDbTag(input: DbInput): string {
+	return getLanguageByResourceType(getDbType(input))
+}
+
 export function getDatabaseArg(input: DbInput | undefined) {
 	if (input?.type === 'database') {
 		if (input.resourcePath.startsWith('datatable://')) {
diff --git a/frontend/src/lib/components/dbt/DbtEditor.svelte b/frontend/src/lib/components/dbt/DbtEditor.svelte
new file mode 100644
index 0000000000..2f4fb998d6
--- /dev/null
+++ b/frontend/src/lib/components/dbt/DbtEditor.svelte
@@ -0,0 +1,557 @@
+<script lang="ts">
+	// The editor for a dbt script, which is a PROJECT rather than a body of code:
+	// a file tree, a descriptor, run arguments and a model graph.
+	//
+	// The generic script editor accommodated all four by bolting a tree onto its
+	// module tab strip, but its premise — one file, one signature, one body — is
+	// the wrong one here: dbt resolves `ref()` project-wide and cannot run a
+	// single file, so the arguments, the run and the graph are all the project's
+	// whichever file happens to be open.
+	import { untrack } from 'svelte'
+	import { createEventDispatcher, onDestroy } from 'svelte'
+	import type { Schema, SupportedLanguage } from '$lib/common'
+	import type { Preview, ScriptModule } from '$lib/gen'
+	import { workspaceStore } from '$lib/stores'
+	import { emptySchema } from '$lib/utils'
+	import { inferArgs } from '$lib/infer'
+	import { Pane, Splitpanes } from 'svelte-splitpanes'
+	import Editor from '../Editor.svelte'
+	import SplitPanesWrapper from '../splitPanes/SplitPanesWrapper.svelte'
+	import SchemaForm from '../SchemaForm.svelte'
+	import LogPanel from '../scriptEditor/LogPanel.svelte'
+	import JobLoader from '../JobLoader.svelte'
+	import { Button } from '../common'
+	import WindmillIcon from '../icons/WindmillIcon.svelte'
+	import Popover from '../meltComponents/Popover.svelte'
+	import DbtProjectPanel from './DbtProjectPanel.svelte'
+	import DbtModelGraph from './DbtModelGraph.svelte'
+	import DbtModelDetails from './DbtModelDetails.svelte'
+	import type { DbtPreviewBuffer } from './previewRows'
+	import type {
+		AssetGraphNodeData,
+		DbtAssetProvenance
+	} from '$lib/components/assets/AssetGraph/types'
+	import {
+		DBT_DESCRIPTOR,
+		DBT_MODULE_EXTENSIONS,
+		dbtDefaultContent,
+		dbtDescriptorSummary,
+		dbtFileLang,
+		dbtModelSelector,
+		dbtModuleLang,
+		dbtModulePath,
+		dbtPathError
+	} from './projectFiles'
+	import { ChevronDown, CornerDownLeft, Play, Plus } from 'lucide-svelte'
+	import type { ScriptEditorWhitelabelCustomUi } from '../custom_ui'
+	import { processSecretArgs } from '../secretArgUtils'
+
+	let {
+		schema = $bindable(),
+		code = $bindable(),
+		args = $bindable(),
+		modules = $bindable(),
+		editor = $bindable(),
+		path,
+		tag,
+		timeout = undefined,
+		customUi = undefined,
+		/** The deployed version, when the script has one. The Models panel draws it
+		 *  until a refresh replaces it with the buffer's own. */
+		deployedHash = undefined,
+		onTestJob,
+		workspaceOverride = undefined
+	}: {
+		schema?: Schema | any
+		code: string
+		args: Record<string, any>
+		modules?: { [key: string]: ScriptModule } | null
+		editor?: Editor | undefined
+		path: string | undefined
+		tag: string | undefined
+		timeout?: number
+		customUi?: ScriptEditorWhitelabelCustomUi | undefined
+		deployedHash?: string | number
+		onTestJob?: (e: { jobId: string }) => void
+		workspaceOverride?: string
+	} = $props()
+
+	const dispatch = createEventDispatcher()
+	let opWs = $derived(workspaceOverride ?? $workspaceStore)
+
+	/** The open file, or `null` for the descriptor at the project root. */
+	let openFile = $state<string | null>(null)
+	/** What the editor shows: the descriptor, or one project file. */
+	let editorCode = $state(code)
+	let lastSyncedCode = code
+
+	// The content prop moves under the editor on a template seed, a draft restore
+	// or an AI edit. Only meaningful while the descriptor is what is open — a
+	// project file's content lives in `modules`.
+	$effect.pre(() => {
+		if (openFile === null && code !== lastSyncedCode) {
+			editorCode = code
+			lastSyncedCode = code
+			editor?.setCode(editorCode)
+			untrack(() => inferSchema(code))
+		}
+	})
+
+	function flushOpenFile() {
+		if (openFile !== null && modules?.[openFile]) {
+			modules[openFile] = { ...modules[openFile], content: editorCode }
+		}
+	}
+
+	function open(file: string | null) {
+		flushOpenFile()
+		openFile = file
+		editorCode = file === null ? code : (modules?.[file]?.content ?? '')
+		if (file === null) lastSyncedCode = code
+		editor?.setCode(editorCode)
+	}
+
+	// The whole surface ScriptBuilder drives an editor through. `flushModuleState`
+	// and `disableCollaboration` are the two it calls before saving and on
+	// language change.
+	export function setArgs(nargs: Record<string, any>) {
+		args = nargs
+	}
+	export function updateArgs(nargs: Record<string, any>) {
+		args = { ...args, ...nargs }
+	}
+	export function flushModuleState() {
+		flushOpenFile()
+	}
+	/** A dbt project is a bundle of files, and the collaborative session only ever
+	 *  covered a single body, so this editor opens none to disable. Kept because
+	 *  the builder calls it before switching language. */
+	export function disableCollaboration() {}
+
+	/** The run form's arguments, which are the DESCRIPTOR's: the command block and
+	 *  one entry per `{{ placeholder }}` it interpolates. Derived from the
+	 *  descriptor whatever file is open, because that is what a run takes.
+	 *
+	 *  `nlang` is honored rather than assumed to be dbt: the builder calls this on
+	 *  the editor that is still mounted when the language CHANGES, so the content
+	 *  here can already be the next language's template. */
+	export async function inferSchema(
+		content: string,
+		{ nlang, resetArgs = false }: { nlang?: SupportedLanguage; resetArgs?: boolean } = {}
+	) {
+		// Before the parse, not after it: a reset means the arguments describe a
+		// script that no longer exists, and leaving them for a parse to clear
+		// hands dbt's command block to whatever editor mounts next when it fails.
+		if (resetArgs) args = {}
+		let nschema = schema ?? emptySchema()
+		try {
+			await inferArgs(nlang ?? 'dbt', content, nschema)
+			validDescriptor = true
+			descriptorError = undefined
+			schema = nschema
+		} catch (e) {
+			validDescriptor = false
+			// `inferArgs` reports a dbt parse failure with an empty message, so what
+			// it says is kept only when there is something to say and the deploy
+			// remains where the reason comes from.
+			const said = e instanceof Error ? e.message : String(e)
+			descriptorError = said.trim() || undefined
+		}
+	}
+
+	let validDescriptor = $state(true)
+	let descriptorError = $state<string | undefined>(undefined)
+	let summary = $derived(dbtDescriptorSummary(code))
+
+	// The selector a run would narrow to, when the open file is a model. Macros,
+	// analyses and singular tests are `.sql` too and none is selectable by name,
+	// so those fall back to building the project.
+	let selected = $derived.by(() => {
+		const file = openFile
+		if (!file) return undefined
+		const selector = dbtModelSelector(modules ?? {}, file)
+		if (!selector) return undefined
+		return {
+			selector,
+			name: file
+				.split('/')
+				.pop()!
+				.replace(/\.(sql|py)$/, '')
+		}
+	})
+
+	// Whether the run arguments still say what the descriptor does. Only the
+	// command block counts: a `{{ placeholder }}` is a value the project asks for
+	// on every run, not an override of anything.
+	let argsOverridden = $derived.by(() => {
+		const cmd = args?.command as Record<string, unknown> | undefined
+		if (!cmd) return false
+		const dflt = (schema?.properties?.command?.default ?? {}) as Record<string, unknown>
+		return Object.keys(cmd).some((k) => JSON.stringify(cmd[k]) !== JSON.stringify(dflt[k]))
+	})
+
+	// Neither history nor tracing belongs beside a dbt build: the run form's own
+	// history is the deployed script's, and a build is one invocation rather than
+	// a flow with steps to trace. With those gone `LogPanel` is a single tab, and
+	// it drops its own tab strip rather than showing a bar of one.
+	let logPanelUi = $derived({
+		...(customUi?.previewPanel ?? {}),
+		disableHistory: true,
+		disableTracing: true
+	})
+
+	// The node picked on the graph, if any. It decides what the bottom section is:
+	// a model's details while one is selected, the run's logs otherwise. Held here
+	// rather than in the graph because closing the details has to deselect, and
+	// both halves are this component's to place.
+	let graphSelection = $state<AssetGraphNodeData | undefined>(undefined)
+	let selectedAsset = $derived(graphSelection?.kind === 'asset' ? graphSelection : undefined)
+	let selectedDbt = $state<DbtAssetProvenance | undefined>(undefined)
+	// Set when the selected node came from a buffer parse: the project that parse
+	// ran on, which is the one its rows must come from. Undefined for a node off
+	// the deployed graph, which previews by version instead. Either way the rows
+	// come from the project whose SQL is displayed above them.
+	let selectedBuffer = $state<DbtPreviewBuffer | undefined>(undefined)
+
+	let jobLoader: JobLoader | undefined = $state(undefined)
+	let testJob: any = $state(undefined)
+	let testIsLoading = $state(false)
+	let logPanel: LogPanel | undefined = $state(undefined)
+
+	// The options are the generic editor's, so the two stay interchangeable to the
+	// builder. Neither applies here: a dbt run dispatches nothing to cascade, and
+	// a descriptor holds no DDL to guard.
+	export async function runTest(_opts?: { cascade?: boolean; skipDdlGuard?: boolean }) {
+		flushOpenFile()
+		const testArgs = await processSecretArgs(args ?? {}, schema, opWs)
+		// Building with a model open builds THAT model: `dbt build --select
+		// <model>` is dbt's own inner loop, and running the whole project to check
+		// one file is the thing a dbt developer never does. Its tests come along,
+		// because `build` interleaves them.
+		if (selected) {
+			testArgs.command = {
+				...((testArgs.command as object) ?? {}),
+				label: 'build',
+				select: [selected.selector]
+			}
+		}
+		const job = await jobLoader?.runPreview(
+			path,
+			code,
+			'dbt' as Preview['language'],
+			testArgs,
+			tag,
+			undefined,
+			undefined,
+			undefined,
+			undefined,
+			// The whole bundle, always: it IS the project, and without it the run
+			// finds no `dbt_project.yml` whichever file happens to be open.
+			modules,
+			undefined,
+			timeout
+		)
+		if (job) onTestJob?.({ jobId: job })
+		logPanel?.setFocusToLogs()
+		return job
+	}
+
+	let newFile = $state('')
+	let newFileError = $state<string | undefined>(undefined)
+	let newFileInput: HTMLInputElement | undefined = $state(undefined)
+	let addOpen = $state(false)
+
+	function createFile() {
+		// Keyed by the CANONICAL path, so `./models/x.sql` and `models/x.sql`
+		// cannot become two keys for one file in the bundle the worker writes.
+		const resolved = dbtModulePath(newFile, modules ?? undefined)
+		if ('error' in resolved) {
+			newFileError = resolved.error
+			return
+		}
+		const p = resolved.path
+		modules = {
+			...(modules ?? {}),
+			[p]: { content: dbtDefaultContent(p), language: dbtModuleLang(p)! }
+		}
+		newFile = ''
+		newFileError = undefined
+		addOpen = false
+		open(p)
+	}
+
+	function removeFile(p: string) {
+		if (!modules?.[p]) return
+		const { [p]: _dropped, ...rest } = modules
+		modules = rest
+		if (openFile === p) open(null)
+	}
+
+	function onKeyDown(e: KeyboardEvent) {
+		if ((e.ctrlKey || e.metaKey) && e.key === 'Enter') {
+			e.preventDefault()
+			void runTest()
+		}
+	}
+
+	onDestroy(() => {
+		flushOpenFile()
+	})
+
+	let fileLang = $derived<Preview['language']>(openFile ? dbtFileLang(openFile) : 'ansible')
+</script>
+
+<JobLoader
+	noCode={true}
+	workspaceOverride={opWs}
+	bind:this={jobLoader}
+	bind:isLoading={testIsLoading}
+	bind:job={testJob}
+/>
+
+<svelte:window onkeydown={onKeyDown} />
+
+<div class="border-b shadow-sm px-2 py-1 flex items-center gap-3 text-2xs">
+	<span class="font-mono text-secondary truncate">{path ?? ''}__dbt/</span>
+	<span class="text-tertiary shrink-0">{summary.engine}</span>
+	<span
+		class="text-tertiary shrink-0"
+		title="The workspace warehouse this project's assets are keyed on"
+		>warehouse: {summary.warehouse}</span
+	>
+	{#if !validDescriptor}
+		<!-- The descriptor drives warehouse writes, so an unknown field is refused
+		     rather than defaulted — and a deploy or a refresh would fail on it. -->
+		<span class="text-red-500 truncate" title={descriptorError}>
+			{descriptorError ? `descriptor: ${descriptorError}` : 'descriptor is not valid'}
+		</span>
+	{/if}
+	<div class="ml-auto shrink-0 flex items-center gap-2">
+		{#if testIsLoading}
+			<Button on:click={() => jobLoader?.cancelJob()} unifiedSize="sm">
+				<WindmillIcon white={true} class="mr-2 text-white" height="16px" width="20px" spin="fast" />
+				Cancel
+			</Button>
+		{:else}
+			<div class="flex items-center">
+				<Button
+					on:click={() => runTest()}
+					unifiedSize="sm"
+					variant="accent-secondary"
+					startIcon={{ icon: Play, classes: 'animate-none' }}
+					shortCut={{ Icon: CornerDownLeft }}
+					btnClasses="!rounded-r-none"
+				>
+					<!-- Named, because a run that silently narrowed to whichever file happens
+					     to be open is the kind of surprise a warehouse bill discovers. -->
+					{selected ? `Build ${selected.name}` : 'Build project'}
+				</Button>
+				<!-- The command block lives here rather than in the panel: it is a run
+				     CONFIGURATION, set once and then built from repeatedly, and it was
+				     taking permanent vertical space from the two things you actually
+				     watch. The dot says it is no longer the descriptor's own. -->
+				<!-- The Popover renders its OWN `<button>`, so the trigger is styled
+				     rather than filled with another one: a nested button is invalid and
+				     swallows the click. `h-7` is the accent-secondary `sm` Button's
+				     height, which is what makes the pair read as one control. -->
+				<Popover
+					placement="bottom-end"
+					contentClasses="p-3 w-[30rem] max-h-[70vh] overflow-auto"
+					class="relative h-7 px-1.5 flex items-center rounded-r-md border border-l-0 border-blue-500/60 text-blue-600 dark:text-blue-400 hover:bg-blue-50 dark:hover:bg-blue-950/40"
+					triggerAttrs={{ title: 'Build arguments' }}
+				>
+					{#snippet trigger()}
+						<ChevronDown size={14} />
+						{#if argsOverridden}
+							<span
+								class="pointer-events-none absolute top-0.5 right-0.5 w-1.5 h-1.5 rounded-full bg-blue-500"
+							></span>
+						{/if}
+					{/snippet}
+					{#snippet content()}
+						{#if schema}
+							<SchemaForm {schema} bind:args noVariablePicker={false} showSchemaExplorer />
+						{:else}
+							<p class="text-2xs text-tertiary">This descriptor takes no arguments.</p>
+						{/if}
+					{/snippet}
+				</Popover>
+			</div>
+		{/if}
+	</div>
+</div>
+
+<SplitPanesWrapper>
+	<Splitpanes class="!overflow-visible">
+		<Pane size={62} minSize={20} class="!overflow-visible">
+			<div class="h-full flex flex-row bg-surface dark:bg-surface-secondary !overflow-visible">
+				<DbtProjectPanel
+					modules={modules ?? {}}
+					scriptPath={path ?? ''}
+					descriptorName={DBT_DESCRIPTOR}
+					selected={openFile}
+					onSelect={open}
+					onDelete={removeFile}
+				>
+					{#snippet addFile()}
+						<Popover
+							bind:isOpen={addOpen}
+							placement="bottom-end"
+							openFocus={newFileInput}
+							contentClasses="p-3 w-72"
+						>
+							{#snippet trigger()}
+								<div class="p-0.5 rounded hover:bg-surface-hover" title="New file">
+									<Plus size={12} />
+								</div>
+							{/snippet}
+							{#snippet content({ close })}
+								<div class="flex flex-col gap-2">
+									<label for="dbt-new-file" class="text-xs font-semibold text-emphasis">
+										File name
+									</label>
+									<input
+										id="dbt-new-file"
+										type="text"
+										class="border rounded px-2 py-1.5 text-sm bg-surface"
+										bind:this={newFileInput}
+										bind:value={newFile}
+										placeholder="models/staging/stg_orders.sql"
+										oninput={() => (newFileError = dbtPathError(newFile, modules ?? undefined))}
+										onkeydown={(e) => {
+											if (e.key === 'Enter') createFile()
+											if (e.key === 'Escape') close()
+										}}
+									/>
+									{#if newFileError}
+										<p class="text-red-500 text-2xs">{newFileError}</p>
+									{/if}
+									<p class="text-tertiary text-2xs">
+										Anywhere in the project, e.g. <code class="text-2xs">macros/cents.sql</code>.
+										{DBT_MODULE_EXTENSIONS.join(', ')}
+									</p>
+									<div class="flex justify-end gap-2">
+										<Button
+											variant="default"
+											size="xs"
+											onclick={() => {
+												newFile = ''
+												newFileError = undefined
+												close()
+											}}>Cancel</Button
+										>
+										<Button
+											variant="accent"
+											size="xs"
+											onclick={createFile}
+											disabled={!newFile.trim() || !!newFileError}>Add</Button
+										>
+									</div>
+								</div>
+							{/snippet}
+						</Popover>
+					{/snippet}
+				</DbtProjectPanel>
+				<div class="relative flex-1 min-h-0 min-w-0 !overflow-visible">
+					{#key fileLang}
+						<Editor
+							lineNumbersMinChars={4}
+							folding
+							{path}
+							bind:code={editorCode}
+							bind:this={editor}
+							on:change={() => {
+								if (openFile === null) {
+									code = editorCode
+									lastSyncedCode = code
+									inferSchema(editorCode)
+								} else {
+									flushOpenFile()
+								}
+							}}
+							on:saveDraft
+							cmdEnterAction={async () => {
+								if (openFile === null) await inferSchema(editorCode)
+								runTest()
+							}}
+							formatAction={async () => {
+								if (openFile === null) await inferSchema(editorCode)
+								dispatch('format')
+							}}
+							class="flex flex-1 h-full !overflow-visible"
+							scriptLang={fileLang}
+							automaticLayout={true}
+							fixedOverflowWidgets={true}
+							{args}
+							customTag={tag}
+						/>
+					{/key}
+				</div>
+			</div>
+		</Pane>
+		<Pane size={38} minSize={20}>
+			<!-- One pane, not two tabs. A build's models are what you want to watch
+			     while it runs, and a tab makes seeing the graph and the run a choice
+			     between them; the graph colours from the build instead. -->
+			<Splitpanes horizontal class="h-full">
+				<Pane size={50} minSize={20}>
+					<DbtModelGraph
+						workspace={opWs}
+						scriptPath={path ?? ''}
+						descriptor={code}
+						modules={modules ?? undefined}
+						{args}
+						{tag}
+						{timeout}
+						{deployedHash}
+						testJobId={testJob?.id}
+						testRunning={testIsLoading}
+						testResult={testJob?.result}
+						selection={graphSelection}
+						onSelect={(sel, dbt, buffer) => {
+							graphSelection = sel
+							selectedDbt = dbt
+							selectedBuffer = buffer
+						}}
+					/>
+				</Pane>
+				<Pane size={50} minSize={15} class="relative">
+					<!-- Selecting a node takes this whole section: a model's relation,
+					     its declared columns and tests, its SQL and its actual rows do
+					     not fit under the canvas, and the close button is what puts the
+					     logs back — deselecting the node with it. The log panel is kept
+					     MOUNTED underneath so a build running while a node is selected
+					     does not lose its stream. -->
+					{#if selectedAsset && selectedDbt}
+						<DbtModelDetails
+							workspace={opWs}
+							scriptPath={path ?? ''}
+							assetPath={selectedAsset.path}
+							dbt={selectedDbt}
+							scriptHash={deployedHash}
+							buffer={selectedBuffer}
+							{args}
+							fileInBundle={!!selectedDbt.original_file_path &&
+								!!modules?.[selectedDbt.original_file_path]}
+							onOpenFile={open}
+							onClose={() => (graphSelection = undefined)}
+						/>
+					{/if}
+					<div class="h-full" class:hidden={selectedAsset && selectedDbt}>
+						<LogPanel
+							bind:this={logPanel}
+							workspace={opWs}
+							lang={'dbt' as Preview['language']}
+							previewJob={testJob}
+							previewIsLoading={testIsLoading}
+							{editor}
+							{args}
+							showCaptures={false}
+							customUi={logPanelUi}
+						/>
+					</div>
+				</Pane>
+			</Splitpanes>
+		</Pane>
+	</Splitpanes>
+</SplitPanesWrapper>
diff --git a/frontend/src/lib/components/dbt/DbtModelDetails.svelte b/frontend/src/lib/components/dbt/DbtModelDetails.svelte
new file mode 100644
index 0000000000..2d25dbdc00
--- /dev/null
+++ b/frontend/src/lib/components/dbt/DbtModelDetails.svelte
@@ -0,0 +1,323 @@
+<script lang="ts">
+	// One model, in the space the log panel otherwise occupies.
+	//
+	// The graph answers "what is in this project"; this answers "what is this
+	// node" — the relation it writes, what dbt says about it, the transform
+	// behind it and the rows it actually holds. It takes the whole bottom section
+	// because a strip under the canvas could show none of that without scrolling,
+	// and because selecting a node is a deliberate act with an obvious way back.
+	import { Button } from '$lib/components/common'
+	import Badge from '$lib/components/common/badge/Badge.svelte'
+	import HighlightCode from '$lib/components/HighlightCode.svelte'
+	import { ClipboardCopy, Code2, FileCode2, Loader2, TableProperties, X } from 'lucide-svelte'
+	import { copyToClipboard } from '$lib/utils'
+	import type { DbtAssetProvenance } from '$lib/components/assets/AssetGraph/types'
+	import { previewDbtRows, type DbtPreview, type DbtPreviewBuffer } from './previewRows'
+	import { nodeSelector } from './parseDbtRun'
+
+	let {
+		workspace,
+		scriptPath,
+		/** The relation this node writes, which is the asset path. */
+		assetPath,
+		dbt,
+		/** Pins a preview to a deployed version, when the graph on screen is one.
+		 *  Ignored when `buffer` is set — see it. */
+		scriptHash,
+		/** Set when the graph on screen was parsed from the editor, in which case
+		 *  the rows have to come from that same buffer: the SQL shown above them
+		 *  is the buffer's, and there may be no deployed version to run at all. */
+		buffer,
+		/** The run form's arguments: a `dbt show` is an invocation of this same
+		 *  project, so a descriptor with a required `{{ }}` var needs them. Used
+		 *  for a deployed graph; a buffer preview takes its parse's own instead. */
+		args,
+		/** Whether this model's file is in the bundle being edited. */
+		fileInBundle = false,
+		onOpenFile,
+		onClose
+	}: {
+		workspace: string | undefined
+		scriptPath: string
+		assetPath: string
+		dbt: DbtAssetProvenance
+		scriptHash?: string | number
+		buffer?: DbtPreviewBuffer
+		args?: Record<string, unknown>
+		fileInBundle?: boolean
+		onOpenFile?: (path: string) => void
+		onClose?: () => void
+	} = $props()
+
+	// Vars come from the snapshot when there is one: they decide `enabled`,
+	// schemas and aliases, so they are what the graph on screen was drawn under,
+	// and later ones could point `dbt show` at a relation it never described.
+	let previewVars = $derived((((buffer ? buffer.args : args) as any)?.command as any)?.vars ?? {})
+	// Placeholders come from the form, always. A parse runs `strict: false` and
+	// drops a `{{ }}` only a run can fill, so a graph refreshed before the form
+	// was filled carries empty ones — replaying those would fail every preview on
+	// a value the run form is already holding.
+	function placeholdersOf(a: Record<string, unknown> | undefined): Record<string, any> {
+		const { command: _cmd, ...rest } = (a ?? {}) as Record<string, any>
+		return rest
+	}
+	let previewPlaceholders = $derived(placeholdersOf(args))
+	// Cached per model AND per inputs, so flipping between nodes does not re-spend
+	// a worker slot, while an edited placeholder previews its own rows rather than
+	// returning the last ones.
+	let previews = $state<Record<string, DbtPreview>>({})
+	let previewKey = $derived(
+		`${dbt.unique_id}|${JSON.stringify(previewVars)}|${JSON.stringify(previewPlaceholders)}`
+	)
+	let preview = $derived(previews[previewKey])
+	let previewing = $derived(preview != undefined && 'pending' in preview)
+	// Which pane is showing. Keyed by the preview's own key so moving to another
+	// node returns to the SQL without anything having to reset it.
+	let rowsFor = $state<string | undefined>(undefined)
+	let showRows = $derived(rowsFor === previewKey && preview != undefined)
+
+	let destroyed = false
+	$effect(() => () => (destroyed = true))
+
+	async function runPreview() {
+		if (!workspace) return
+		const key = previewKey
+		rowsFor = key
+		const cached = previews[key]
+		// A cached FAILURE must not stick: it would leave the button dead for that
+		// model until reload. Only a result or an in-flight run blocks a re-run.
+		if (cached != undefined && !('error' in cached)) return
+		previews = { ...previews, [key]: { pending: true } }
+		const next = await previewDbtRows({
+			workspace,
+			scriptPath,
+			scriptHash,
+			buffer,
+			// Scoped to the node's package: a dependency package can ship a model
+			// whose name the project also uses.
+			model: nodeSelector(dbt.unique_id),
+			vars: previewVars,
+			args: previewPlaceholders,
+			stillWanted: () => !destroyed
+		})
+		if (!next || destroyed) return
+		previews = { ...previews, [key]: next }
+	}
+
+	// A column can hold an array or an object, whose default stringification is
+	// `[object Object]` — which tells the reader nothing about the value.
+	function cellText(v: unknown): string {
+		if (v == undefined) return ''
+		return typeof v === 'object' ? JSON.stringify(v) : String(v)
+	}
+
+	let columns = $derived(Object.entries(dbt.columns ?? {}))
+	// `dbt show` SELECTs from the node's own relation and the worker intersects
+	// the selector with `resource_type:model`, so offering it on a seed, snapshot
+	// or source only ever produces a failed job.
+	let previewable = $derived(dbt.resource_type === 'model')
+	// Both channels reach relation identity — a var directly, a placeholder through
+	// the descriptor var it fills — but only placeholders stay live, so only they
+	// can make these rows describe another project. Kept apart because the two say
+	// opposite things to a reader, and the pinned one is a guarantee, not a risk.
+	let stalePlaceholders = $derived(
+		buffer != undefined &&
+			JSON.stringify(placeholdersOf(buffer.args)) !== JSON.stringify(previewPlaceholders)
+	)
+	let staleVars = $derived(
+		buffer != undefined &&
+			JSON.stringify(previewVars) !== JSON.stringify((args?.command as any)?.vars ?? {})
+	)
+</script>
+
+<div class="h-full flex flex-col min-h-0">
+	<div
+		class="shrink-0 flex items-center gap-2 px-2 py-1 border-b bg-surface-secondary text-2xs text-secondary"
+	>
+		<span class="font-mono font-semibold text-primary truncate">{assetPath.split('/').pop()}</span>
+		{#if dbt.materialized}
+			<Badge color="gray" verySmall>{dbt.materialized}</Badge>
+		{/if}
+		{#if dbt.resource_type !== 'model'}
+			<Badge color="blue" verySmall>{dbt.resource_type}</Badge>
+		{/if}
+		{#each dbt.tags ?? [] as t (t)}
+			<Badge color="indigo" verySmall>{t}</Badge>
+		{/each}
+		<div class="ml-auto shrink-0 flex items-center gap-1">
+			{#if previewable}
+				{#if showRows && preview && !('error' in preview)}
+					<Button
+						unifiedSize="2xs"
+						variant="subtle"
+						startIcon={{ icon: Code2 }}
+						on:click={() => (rowsFor = undefined)}
+						title="Show the model's SQL">SQL</Button
+					>
+				{:else}
+					<Button
+						unifiedSize="2xs"
+						variant="subtle"
+						startIcon={{
+							icon: previewing ? Loader2 : TableProperties,
+							classes: previewing ? 'animate-spin' : undefined
+						}}
+						disabled={previewing}
+						on:click={runPreview}
+						title="Run `dbt show` against this model and display the rows"
+						>{previewing ? 'Previewing…' : 'Preview rows'}</Button
+					>
+				{/if}
+			{/if}
+			{#if fileInBundle && dbt.original_file_path && onOpenFile}
+				<Button
+					unifiedSize="2xs"
+					variant="subtle"
+					startIcon={{ icon: FileCode2 }}
+					on:click={() => onOpenFile?.(dbt.original_file_path!)}
+					title="Open this model's file">Edit</Button
+				>
+			{/if}
+			<Button
+				unifiedSize="2xs"
+				variant="subtle"
+				startIcon={{ icon: ClipboardCopy }}
+				iconOnly
+				on:click={() => copyToClipboard(assetPath)}
+				title="Copy the relation"
+			/>
+			<!-- Labelled and bordered rather than a subtle icon: this is how you get
+			     the logs back, and an icon among four other icons did not read as the
+			     way out. Clicking the canvas background does the same. -->
+			<Button
+				unifiedSize="2xs"
+				variant="default"
+				startIcon={{ icon: X }}
+				on:click={() => onClose?.()}
+				title="Close and deselect"
+				btnClasses="ml-1">Close</Button
+			>
+		</div>
+	</div>
+
+	{#if stalePlaceholders}
+		<div class="shrink-0 px-2 py-1 border-b text-2xs text-secondary bg-surface-secondary">
+			The run arguments have changed since this graph was parsed, so these rows need not
+			describe the models on screen — arguments reach schemas, aliases and which models exist
+			at all. Refresh the models to draw and preview them under the current ones.
+		</div>
+	{:else if staleVars}
+		<div class="shrink-0 px-2 py-1 border-b text-2xs text-secondary bg-surface-secondary">
+			The run form's vars have changed since this graph was parsed. Rows are previewed under
+			the vars it was parsed with, so they still describe the models on screen — refresh the
+			models to draw and preview them under the current ones.
+		</div>
+	{/if}
+
+	<div class="flex-1 min-h-0 overflow-auto">
+		<div class="px-2 py-1.5 border-b text-2xs text-secondary flex flex-col gap-1">
+			<div class="flex items-center gap-2">
+				<span class="text-tertiary shrink-0">relation</span>
+				<span class="font-mono truncate">{assetPath}</span>
+			</div>
+			{#if dbt.original_file_path}
+				<div class="flex items-center gap-2">
+					<span class="text-tertiary shrink-0">file</span>
+					<span class="font-mono truncate">{dbt.original_file_path}</span>
+				</div>
+			{/if}
+			{#if dbt.description}
+				<div class="flex items-start gap-2">
+					<span class="text-tertiary shrink-0">description</span>
+					<span>{dbt.description}</span>
+				</div>
+			{/if}
+		</div>
+
+		{#if columns.length > 0 || (dbt.data_tests?.length ?? 0) > 0}
+			<div class="px-2 py-1.5 border-b flex flex-col gap-1.5">
+				{#if columns.length > 0}
+					<div class="text-2xs">
+						<div class="text-tertiary mb-0.5">columns declared</div>
+						<div class="flex flex-col gap-0.5">
+							{#each columns as [name, desc] (name)}
+								<div class="flex gap-2">
+									<span class="font-mono text-primary shrink-0">{name}</span>
+									<span class="text-secondary truncate">{desc}</span>
+								</div>
+							{/each}
+						</div>
+						<!-- dbt's manifest carries no column-to-column edges, so this is a
+						     declared column SET rather than lineage. -->
+						<div class="text-tertiary mt-0.5">
+							Declared metadata — dbt reports no column-level lineage.
+						</div>
+					</div>
+				{/if}
+				{#if (dbt.data_tests?.length ?? 0) > 0}
+					<div class="text-2xs">
+						<div class="text-tertiary mb-0.5">tests</div>
+						<div class="flex flex-wrap gap-1">
+							{#each dbt.data_tests ?? [] as t, i (i)}
+								<Badge color={t.severity === 'warn' ? 'yellow' : 'red'} verySmall>
+									{t.kind}{t.column ? ` · ${t.column}` : ''}
+								</Badge>
+							{/each}
+						</div>
+					</div>
+				{/if}
+			</div>
+		{/if}
+
+		{#if showRows && preview}
+			{#if 'error' in preview}
+				<div class="p-2 text-2xs text-secondary">{preview.error}</div>
+				{#if dbt.raw_code}
+					<HighlightCode language="sql" code={dbt.raw_code} />
+				{/if}
+			{:else if 'pending' in preview}
+				<div class="flex items-center gap-2 p-2 text-2xs text-secondary">
+					<Loader2 size={12} class="animate-spin" />
+					Running `dbt show` — this is a job, so it waits on a worker and the engine.
+				</div>
+			{:else}
+				{@const cols = Object.keys(preview.rows[0] ?? {})}
+				{#if cols.length === 0}
+					<div class="p-2 text-2xs text-secondary">The model returned no rows.</div>
+				{:else}
+					<table class="w-full text-2xs font-mono">
+						<thead class="sticky top-0 bg-surface-secondary text-secondary">
+							<tr>
+								{#each cols as c (c)}
+									<th class="text-left font-semibold px-2 py-1 border-b">{c}</th>
+								{/each}
+							</tr>
+						</thead>
+						<tbody>
+							{#each preview.rows as row, i (i)}
+								<tr class="border-b border-surface-selected">
+									{#each cols as c (c)}
+										<td class="px-2 py-0.5 truncate max-w-56">{cellText(row[c])}</td>
+									{/each}
+								</tr>
+							{/each}
+						</tbody>
+					</table>
+					<div class="px-2 py-1 text-3xs text-tertiary">
+						{preview.rows.length} rows in {(preview.tookMs / 1000).toFixed(1)}s{preview.node
+							? ` · ${preview.node}`
+							: ''}
+					</div>
+				{/if}
+			{/if}
+		{:else if dbt.raw_code}
+			<HighlightCode language="sql" code={dbt.raw_code} />
+		{:else}
+			<div class="p-2 text-2xs text-secondary">
+				{dbt.resource_type === 'source'
+					? 'A source is declared rather than built, so it has no transform of its own.'
+					: 'No SQL stored for this node.'}
+			</div>
+		{/if}
+	</div>
+</div>
diff --git a/frontend/src/lib/components/dbt/DbtModelGraph.svelte b/frontend/src/lib/components/dbt/DbtModelGraph.svelte
new file mode 100644
index 0000000000..e6d948d926
--- /dev/null
+++ b/frontend/src/lib/components/dbt/DbtModelGraph.svelte
@@ -0,0 +1,504 @@
+<script lang="ts">
+	// The dbt editor's model graph, refreshed on demand.
+	//
+	// dbt's own DAG, drawn from a manifest dbt itself produced — at deploy, or by
+	// a `parse` of the buffer being edited. Never from a `ref()` scan of our own:
+	// that yields names without relations (a node is
+	// `dbt://<warehouse>/<schema>/<table>`, and schema, database and alias come
+	// from configs layered with the profile) and disagrees with dbt about
+	// `enabled`, macro-built refs, loops and packages.
+	//
+	// Explicit, because a refresh costs a worker job: engine provisioning is
+	// cached per (version, adapter) and `dbt deps` per lock digest, so a warm
+	// refresh is seconds and a cold one is a download.
+	import { onDestroy, untrack } from 'svelte'
+	import { JobService, OpenAPI, type ScriptModule } from '$lib/gen'
+	import { Button } from '$lib/components/common'
+	import { Loader2, RefreshCw } from 'lucide-svelte'
+	import { displayDate } from '$lib/utils'
+	import { base } from '$lib/base'
+	import AssetGraphCanvas from '$lib/components/assets/AssetGraph/AssetGraphCanvas.svelte'
+	import type { DbtPreviewBuffer } from './previewRows'
+	import type {
+		AssetGraphNodeData,
+		AssetGraphResponse,
+		DbtAssetProvenance
+	} from '$lib/components/assets/AssetGraph/types'
+	import { useDbtRunStatus } from './runStatus.svelte'
+
+	let {
+		workspace,
+		scriptPath,
+		/** The descriptor buffer. It is the script's content, and what a parse of
+		 *  it runs with. */
+		descriptor,
+		/** The project. It travels inline as `_MODULES`, the same way a Test does:
+		 *  the bundle IS the project, and dbt cannot parse a subset of it. */
+		modules,
+		/** The run form's arguments. A descriptor interpolating `{{ day }}` takes
+		 *  one, and a parse uses whatever has been filled in — it tolerates the
+		 *  rest being absent, as the deploy's own parse does. */
+		args,
+		/** The script's worker tag and timeout. A parse is a real dbt invocation:
+		 *  a project reaching a private network parses only on the worker that can
+		 *  reach it, and a slow one must get the same budget a run would. */
+		tag,
+		timeout,
+		/** The deployed version, when there is one. Its graph is what the panel
+		 *  shows before anything has been parsed from the buffer. */
+		deployedHash,
+		/** The build the editor is running, so the models it touches colour while
+		 *  it walks the DAG — the reason this is one pane and not a tab beside the
+		 *  run. `dbt-core-1x` reports per node live; the other engines settle every
+		 *  relation from the result at the end. */
+		testJobId,
+		testRunning = false,
+		testResult,
+		/** The node picked on the canvas, owned by the parent: it decides what the
+		 *  bottom section shows, and closing that has to clear it. Reported rather
+		 *  than bound — the provenance travels with it, since resolving that needs
+		 *  the graph response, which is this component's. */
+		selection,
+		onSelect
+	}: {
+		workspace: string | undefined
+		scriptPath: string
+		descriptor: string
+		modules: Record<string, ScriptModule> | undefined
+		args: Record<string, unknown> | undefined
+		tag?: string
+		timeout?: number
+		deployedHash?: string | number
+		testJobId?: string
+		testRunning?: boolean
+		testResult?: unknown
+		selection?: AssetGraphNodeData | undefined
+		onSelect?: (
+			selection: AssetGraphNodeData | undefined,
+			dbt: DbtAssetProvenance | undefined,
+			/** The project this node was parsed from, when that was the editor's
+			 *  buffer rather than a deployed version — as submitted, not as the
+			 *  editor holds it now. Sent with the selection rather than exposed on
+			 *  its own so it can never disagree with the SQL the parent shows. */
+			buffer: DbtPreviewBuffer | undefined
+		) => void
+	} = $props()
+
+	/** The last parse of the buffer. Component state on purpose: it describes a
+	 *  buffer, and a reload has a different one. */
+	let refreshJob = $state<string | undefined>(undefined)
+	let refreshing = $state(false)
+	// The project the pinned graph was parsed FROM, kept as submitted. Every node
+	// on screen describes this snapshot, so anything run against those nodes has
+	// to run against it too — reading the live buffer instead would preview one
+	// project under another one's SQL from the next keystroke onward.
+	let parsedBuffer = $state<DbtPreviewBuffer | undefined>(undefined)
+	let refreshError = $state<{ message: string; job?: string } | undefined>(undefined)
+	/** A parse still running well past the point one normally takes, so its job is
+	 *  reachable while it waits. Not an error — it may still land. */
+	let refreshPending = $state<string | undefined>(undefined)
+
+	let raw = $state<AssetGraphResponse | undefined>(undefined)
+	let loading = $state(true)
+	let failed = $state(false)
+
+	// The graph endpoint is folder-scoped; a script outside `f/` has no folder and
+	// falls back to the whole workspace, which the scoping below narrows anyway.
+	let folder = $derived(scriptPath.startsWith('f/') ? scriptPath.split('/')[1] : undefined)
+	let graphKey = $derived(
+		`${workspace ?? ''}|${folder ?? ''}|${deployedHash ?? ''}|${refreshJob ?? ''}`
+	)
+
+	// Two loads can overlap — a refresh landing while the deployed one is still in
+	// flight — and nothing orders two requests to one endpoint. The older answers
+	// with the deployed graph, so landing second it would replace the parse the
+	// user just asked for.
+	let graphSeq = 0
+	let destroyed = false
+	onDestroy(() => (destroyed = true))
+
+	async function load() {
+		if (!workspace) return
+		const seq = ++graphSeq
+		const current = () => seq === graphSeq && !destroyed
+		try {
+			const params = new URLSearchParams({ asset_kinds: 'dbt' })
+			if (folder) params.set('folder', folder)
+			// Through the parse JOB when there is one: its graph belongs to that job
+			// and is reachable no other way. Otherwise the deployed version's, by
+			// hash, so an editor open on an older version draws that one.
+			const path = refreshJob
+				? `/w/${workspace}/jobs/dbt_graph/${refreshJob}`
+				: `/w/${workspace}/assets/graph`
+			if (!refreshJob && deployedHash != undefined) {
+				params.set('dbt_script_hash', String(deployedHash))
+			}
+			const res = await fetch(`${OpenAPI.BASE ?? ''}${path}?${params}`, {
+				credentials: 'include'
+			})
+			if (!current()) return
+			if (!res.ok) {
+				failed = true
+				return
+			}
+			const body = (await res.json()) as AssetGraphResponse
+			if (!current()) return
+			raw = body
+			failed = false
+		} catch {
+			if (current()) failed = true
+		} finally {
+			if (current()) loading = false
+		}
+	}
+
+	$effect(() => {
+		void graphKey
+		loading = true
+		failed = false
+		raw = undefined
+		select(undefined)
+		void load()
+	})
+
+	/** Run a parse-only job over the buffer and pin the panel to its graph.
+	 *
+	 *  Its own submission rather than the editor's job loader: a refresh and a
+	 *  build are independent, and routing both through one would have each evict
+	 *  the other's job. */
+	export async function refresh() {
+		if (refreshing || !workspace) return
+		refreshError = undefined
+		refreshPending = undefined
+		let id: string | undefined
+		// Read once, and before the button is disabled: the editor keeps changing
+		// underneath, and everything the resulting graph is used for has to name the
+		// project it actually described.
+		const submitted: DbtPreviewBuffer = {
+			content: descriptor,
+			// The whole bundle, always: dbt resolves `ref()` project-wide and cannot
+			// parse one file of it.
+			modules: modules ? { ...modules } : undefined,
+			tag,
+			timeout,
+			// The form's `vars` come along, and only those: they steer `enabled`,
+			// schemas, aliases and materializations, so a parse without them reports
+			// a different project than the run would build. `select` and the rest
+			// belong to a command that builds. Deep-copied, because the form keeps
+			// being edited and this has to stay the parse's own inputs.
+			args: JSON.parse(
+				JSON.stringify({
+					...(args ?? {}),
+					command: { label: 'parse', vars: (args?.command as any)?.vars ?? {} }
+				})
+			)
+		}
+		refreshing = true
+		try {
+			id = await JobService.runScriptPreview({
+				workspace,
+				timeout: submitted.timeout,
+				requestBody: {
+					path: scriptPath,
+					content: submitted.content,
+					language: 'dbt',
+					tag: submitted.tag,
+					modules: submitted.modules,
+					args: submitted.args ?? {}
+				}
+			})
+			// Polled until the JOB ends, with no window of its own: a cold worker
+			// provisions an engine and runs `dbt deps` before dbt starts, which
+			// outlasts any bound worth hard-coding, and giving up early strands a
+			// parse that then succeeds where nothing can pin to it.
+			//
+			// A job's own timeout only starts once a worker takes it, so this does
+			// NOT terminate on its own for one nothing serves — `tag` is forwarded
+			// precisely so a project can name a worker pool, and a pool with no
+			// worker leaves it queued. Hence the notice below rather than a bound:
+			// waiting stays correct, and the job stays reachable while it waits.
+			//
+			// Backed off, because most of that wait is not the parse; and tolerant
+			// of a failed poll, because one lost request must not abandon a job
+			// that is still running — but only of a few in a row, since an expired
+			// session answers the same way forever.
+			let delay = 1000
+			let failures = 0
+			const slowAt = Date.now() + 60_000
+			while (!destroyed) {
+				await new Promise((r) => setTimeout(r, delay))
+				if (destroyed) return
+				let done: Awaited<ReturnType<typeof JobService.getCompletedJobResultMaybe>>
+				try {
+					done = await JobService.getCompletedJobResultMaybe({ workspace, id })
+					failures = 0
+				} catch (e) {
+					if (++failures >= 10) {
+						refreshError = {
+							message: `Lost track of the parse: ${e instanceof Error ? e.message : String(e)}`,
+							job: id
+						}
+						return
+					}
+					delay = Math.min(delay * 1.5, 5000)
+					continue
+				}
+				if (!done.completed) {
+					// Non-terminal, and the only thing that puts the job on screen
+					// while it runs: the header shows a disabled spinner and nothing
+					// else, so a parse that never starts would otherwise leave no link,
+					// no reason and nothing to do but reload — which discards the pin.
+					if (Date.now() > slowAt) refreshPending = id
+					delay = Math.min(delay * 1.5, 5000)
+					continue
+				}
+				if (!done.success) {
+					// A parse renders `profiles.yml` before it runs, so a project whose
+					// warehouse does not resolve fails here exactly as a run would. The
+					// job carries the reason; the panel says where to read it.
+					refreshError = { message: parseFailure(done.result), job: id }
+					return
+				}
+				refreshJob = id
+				parsedBuffer = submitted
+				return
+			}
+		} catch (e) {
+			refreshError = { message: e instanceof Error ? e.message : String(e), job: id }
+		} finally {
+			refreshing = false
+			refreshPending = undefined
+		}
+	}
+
+	/** dbt's own message out of the failed job's result, which is where the
+	 *  useful half is — "Could not find profile named 'x'" rather than "the job
+	 *  failed". */
+	function parseFailure(result: unknown): string {
+		const err = (result as { error?: { message?: string } } | undefined)?.error?.message
+		if (typeof err !== 'string' || !err.trim()) return 'The parse job failed.'
+		// dbt is verbose on failure and the panel is narrow; the head of it names
+		// the problem and the job page has the rest.
+		const trimmed = err.trim()
+		return trimmed.length > 400 ? `${trimmed.slice(0, 400)}…` : trimmed
+	}
+
+	// This project's models, and whatever else in the workspace reads them. The
+	// second half is why the editor draws from the shared asset graph rather than
+	// from a manifest of its own: a native script consuming one of these marts
+	// belongs on the same canvas as the model that writes it.
+	let graph = $derived.by(() => {
+		if (!raw) return undefined
+		// Pinned to this editor's own parse, every dbt node in the answer is this
+		// project's — that graph is nothing else. Unpinned the answer is
+		// FOLDER-wide, so the script's own usage rows are what say which relations
+		// are its; without that a new project draws a neighbouring one's models
+		// under a "never parsed" label.
+		const ids =
+			refreshJob && raw.dbt_snapshot_job === refreshJob
+				? new Set(raw.assets.filter((a) => a.dbt).map((a) => `${a.kind}:${a.path}`))
+				: new Set(
+						raw.edges
+							.filter((e) => e.runnable_path === scriptPath)
+							.map((e) => `${e.asset_kind}:${e.asset_path}`)
+					)
+		const assets = raw.assets.filter((a) => a.dbt && ids.has(`${a.kind}:${a.path}`))
+		if (assets.length === 0) return undefined
+		const edges = raw.edges.filter(
+			(e) => ids.has(`${e.asset_kind}:${e.asset_path}`) && e.runnable_path !== scriptPath
+		)
+		const readers = new Set(edges.map((e) => `${e.runnable_kind}:${e.runnable_path}`))
+		return {
+			...raw,
+			assets,
+			// The script's own node is dropped: the whole graph already IS this
+			// project, so a node for it only adds a hub every model hangs off.
+			runnables: raw.runnables.filter((r) => readers.has(`${r.usage_kind}:${r.path}`)),
+			edges,
+			triggers: [],
+			dbt_edges: (raw.dbt_edges ?? []).filter(
+				(e) => ids.has(`dbt:${e.from_asset_path}`) && ids.has(`dbt:${e.to_asset_path}`)
+			)
+		} as AssetGraphResponse
+	})
+
+	// The build the editor is running, drawn onto the same graph. One pane rather
+	// than a tab beside it: watching the models light up IS what you want while a
+	// build runs, and a tab makes that a choice between the two.
+	// Deliberately NOT `$state`: the effect below increments it, and `+= 1` reads
+	// it — a reactive read there would make the effect depend on its own write and
+	// loop. It exists only to invalidate responses issued for an older job.
+	let runGen = 0
+	const runStatus = useDbtRunStatus({
+		workspace: () => workspace,
+		jobId: () => testJobId,
+		running: () => testRunning,
+		result: () => testResult,
+		graph: () => graph,
+		generation: () => runGen,
+		destroyed: () => destroyed
+	})
+	// A new job's colours are not the previous one's, and a finished run settles
+	// itself from its own result.
+	$effect(() => {
+		void testJobId
+		runGen += 1
+		runStatus.reset()
+	})
+	$effect(() => {
+		if (!testRunning || !testJobId) return
+		void runStatus.load()
+		const t = setInterval(() => void runStatus.load(), 2000)
+		return () => clearInterval(t)
+	})
+	// Once, on the way out: the last events can land after the run ends, and a
+	// run that produced no result at all is coloured from these alone.
+	$effect(() => {
+		if (testRunning || !testJobId) return
+		void runStatus.load()
+	})
+
+	// Whether what is drawn is the buffer's graph. Not "a refresh has run": a pin
+	// that did not resolve falls back to the deployed graph, and everything keyed
+	// on this — the label, and which project a row preview runs — must follow the
+	// graph that actually came back.
+	let editorParsed = $derived(refreshJob != undefined && raw?.dbt_snapshot_job === refreshJob)
+
+	// `untrack`, because the effect that reloads the graph clears the selection
+	// through here: reading the graph to describe a selection would subscribe that
+	// effect to the very state its own fetch writes, and it would reload forever.
+	function select(sel: AssetGraphNodeData | undefined) {
+		untrack(() =>
+			onSelect?.(
+				sel,
+				sel?.kind === 'asset'
+					? graph?.assets.find((a) => a.kind === sel.asset_kind && a.path === sel.path)?.dbt
+					: undefined,
+				editorParsed ? parsedBuffer : undefined
+			)
+		)
+	}
+
+	let modelCount = $derived(
+		graph?.assets.filter((a) => a.dbt && a.dbt.resource_type !== 'source').length ?? 0
+	)
+
+	// Which graph is on screen, said plainly. The buffer's and the deploy's are
+	// drawn identically, so leaving it unlabelled would move the ambiguity the
+	// explicit refresh removes straight into the editor.
+	let provenance = $derived.by(() => {
+		if (editorParsed) {
+			// Time alone: a refresh is something you did minutes ago in this
+			// session, so the date is noise and the seconds are worse than noise.
+			const at = raw?.dbt_graph_ingested_at
+			return at
+				? `parsed from the editor at ${displayDate(at, false, false)}`
+				: 'parsed from the editor'
+		}
+		// Nothing has come back yet, so there is no provenance to state. Said
+		// plainly rather than left to the branches below, which would read the
+		// absent graph as a parse that failed to load.
+		if (loading) return 'loading…'
+		// A refresh landed but its graph is not what came back — the pin did not
+		// resolve to it. Saying which graph IS on screen beats guessing why.
+		if (refreshJob) return 'last parse could not be loaded — showing the deployed graph'
+		if (deployedHash != undefined) return 'as of last deploy'
+		return 'never parsed'
+	})
+
+</script>
+
+<div class="flex flex-col h-full min-h-0">
+	<div class="shrink-0 flex items-center gap-2 px-2 py-1 border-b bg-surface-secondary text-2xs">
+		<span class="text-secondary truncate" title="Where the models on screen came from">
+			{provenance}
+		</span>
+		{#if modelCount > 0}
+			<span class="text-tertiary shrink-0">· {modelCount} models</span>
+		{/if}
+		<div class="ml-auto shrink-0">
+			<Button
+				unifiedSize="2xs"
+				variant="subtle"
+				disabled={refreshing}
+				startIcon={{
+					icon: refreshing ? Loader2 : RefreshCw,
+					classes: refreshing ? 'animate-spin' : undefined
+				}}
+				on:click={refresh}
+				title="Run `dbt parse` over the project as it is here and redraw the graph"
+			>
+				{refreshing ? 'Parsing' : 'Refresh models'}
+			</Button>
+		</div>
+	</div>
+
+	{#if refreshPending}
+		<div class="shrink-0 px-2 py-1.5 border-b text-2xs text-secondary">
+			Still parsing. A cold worker provisions the dbt engine before it starts; a project
+			pinned to a worker tag nothing serves waits here indefinitely.
+			<a
+				class="text-blue-500 hover:underline"
+				href="{base}/run/{refreshPending}?workspace={workspace}"
+				target="_blank"
+				rel="noreferrer">Open the parse job</a
+			>
+		</div>
+	{/if}
+
+	{#if refreshError}
+		<div class="shrink-0 px-2 py-1.5 border-b text-2xs text-secondary">
+			<div class="font-semibold text-primary mb-0.5">The parse failed</div>
+			<pre class="whitespace-pre-wrap font-mono text-3xs">{refreshError.message}</pre>
+			{#if refreshError.job}
+				<a
+					class="text-blue-500 hover:underline"
+					href="{base}/run/{refreshError.job}?workspace={workspace}"
+					target="_blank"
+					rel="noreferrer">Open the parse job</a
+				>
+			{/if}
+		</div>
+	{/if}
+
+	{#if loading}
+		<div class="flex items-center gap-2 text-xs text-secondary p-3">
+			<Loader2 class="animate-spin" size={14} /> Loading the model graph
+		</div>
+	{:else if failed}
+		<div class="text-xs text-secondary p-3">Could not load the model graph.</div>
+	{:else if !graph}
+		<div class="text-xs text-secondary p-3 flex flex-col gap-2">
+			{#if refreshJob || deployedHash != undefined}
+				<span>
+					This project has no models in the asset graph. A project that brings its own
+					<span class="font-mono">profiles.yml</span> without naming a
+					<span class="font-mono">profile.warehouse</span> has no warehouse identity to key
+					<span class="font-mono">dbt://</span> assets on, so its relations cannot be drawn.
+				</span>
+			{:else}
+				<span>
+					Nothing has parsed this project yet. <span class="font-mono">Refresh models</span> runs
+					<span class="font-mono">dbt parse</span> over the files as they are here and draws what dbt
+					reports — deploying does the same.
+				</span>
+				<span class="text-tertiary">
+					It needs a warehouse it can reach: the profile is rendered before dbt runs, so a project
+					whose <span class="font-mono">profile.warehouse</span> is not configured under Settings → dbt
+					fails the parse the way it would fail a run.
+				</span>
+			{/if}
+		</div>
+	{:else}
+		<div class="flex-1 min-h-0">
+			<AssetGraphCanvas
+				{graph}
+				{selection}
+				assetRunStatus={runStatus.status}
+				onselect={select}
+				showMinimap={false}
+				scrollZoom={false}
+			/>
+		</div>
+	{/if}
+</div>
diff --git a/frontend/src/lib/components/dbt/DbtProjectPanel.svelte b/frontend/src/lib/components/dbt/DbtProjectPanel.svelte
new file mode 100644
index 0000000000..89b275aab3
--- /dev/null
+++ b/frontend/src/lib/components/dbt/DbtProjectPanel.svelte
@@ -0,0 +1,162 @@
+<script lang="ts">
+	// A dbt script's modules ARE its project, so they are browsed as the tree dbt
+	// expects rather than the flat tab strip helper files get. Selecting one opens
+	// it in the editor: the descriptor and the project's files are edited in the
+	// same place, because once the descriptor moved inside `__dbt/` there was no
+	// longer a boundary between them to draw.
+	import type { ScriptModule } from '$lib/gen'
+	import type { Snippet } from 'svelte'
+	import { ChevronDown, ChevronRight, FileText, Trash2 } from 'lucide-svelte'
+	import { dbtProjectFileKey } from './projectFiles'
+
+	let {
+		modules,
+		scriptPath,
+		descriptorName,
+		/** `null` is the descriptor, matching the editor's `activeModuleTab`. */
+		selected,
+		onSelect,
+		onDelete,
+		/** The add-file control. Owned by the editor, which holds the form. */
+		addFile
+	}: {
+		modules: Record<string, ScriptModule>
+		scriptPath: string
+		descriptorName: string
+		selected: string | null
+		onSelect: (path: string | null) => void
+		onDelete?: (path: string) => void
+		addFile?: Snippet
+	} = $props()
+
+	type Node = { name: string; path: string; children: Node[] }
+
+	function buildTree(paths: string[]): Node[] {
+		const root: Node = { name: '', path: '', children: [] }
+		for (const p of [...paths].sort()) {
+			let node = root
+			const parts = p.split('/')
+			parts.forEach((part, i) => {
+				const path = parts.slice(0, i + 1).join('/')
+				let next = node.children.find((c) => c.name === part)
+				if (!next) {
+					// Directories carry their full path too: it is what makes a node
+					// identity, and two of the same name at one depth under different
+					// parents — `models/staging` and `tests/staging` — would otherwise
+					// share a collapse key and fold together.
+					next = { name: part, path, children: [] }
+					node.children.push(next)
+				}
+				node = next
+			})
+		}
+		// Directories before files, each alphabetical: the same order `ls` gives,
+		// so the tree reads like the checkout on disk.
+		const sort = (n: Node) => {
+			n.children.sort((a, b) => {
+				const aDir = a.children.length > 0
+				const bDir = b.children.length > 0
+				if (aDir !== bDir) return aDir ? -1 : 1
+				return a.name.localeCompare(b.name)
+			})
+			n.children.forEach(sort)
+		}
+		sort(root)
+		return root.children
+	}
+
+	let tree = $derived(buildTree(Object.keys(modules)))
+	// The key the bundle actually holds it under, which a project imported with a
+	// redundant spelling states differently from the canonical name.
+	let projectFileKey = $derived(dbtProjectFileKey(modules))
+	let fileCount = $derived(Object.keys(modules).length)
+	let collapsed = $state<Record<string, boolean>>({})
+</script>
+
+{#snippet branch(nodes: Node[], depth: number)}
+	{#each nodes as node (node.name + node.path + depth)}
+		{@const key = `${depth}:${node.name}:${node.path}`}
+		{#if node.children.length > 0}
+			<button
+				class="w-full flex items-center gap-1 px-1 py-0.5 text-2xs hover:bg-surface-hover text-secondary"
+				style="padding-left: {depth * 10 + 4}px"
+				onclick={() => (collapsed[key] = !collapsed[key])}
+			>
+				{#if collapsed[key]}
+					<ChevronRight size={11} class="shrink-0" />
+				{:else}
+					<ChevronDown size={11} class="shrink-0" />
+				{/if}
+				<span class="truncate font-mono">{node.name}</span>
+			</button>
+			{#if !collapsed[key]}
+				{@render branch(node.children, depth + 1)}
+			{/if}
+		{:else}
+			<div
+				class="group w-full flex items-center hover:bg-surface-hover {selected === node.path
+					? 'bg-surface-selected'
+					: ''}"
+			>
+				<button
+					class="flex-1 min-w-0 flex items-center gap-1 px-1 py-0.5 text-2xs {selected === node.path
+						? 'font-semibold text-primary'
+						: 'text-secondary'}"
+					style="padding-left: {depth * 10 + 15}px"
+					onclick={() => onSelect(node.path)}
+				>
+					<FileText size={11} class="shrink-0 opacity-60" />
+					<span class="truncate font-mono">{node.name}</span>
+				</button>
+				<!-- `dbt_project.yml` is what makes the bundle a project: without it the
+				     worker refuses the version outright, so one click here would deploy a
+				     script that cannot run. -->
+				{#if onDelete && node.path !== projectFileKey}
+					<button
+						class="shrink-0 px-1 opacity-0 group-hover:opacity-100 text-secondary hover:text-red-500"
+						title="Delete {node.path}"
+						onclick={() => onDelete?.(node.path)}
+					>
+						<Trash2 size={11} />
+					</button>
+				{/if}
+			</div>
+		{/if}
+	{/each}
+{/snippet}
+
+<div class="w-56 shrink-0 border-r flex flex-col min-h-0 bg-surface">
+	<div
+		class="shrink-0 flex items-center gap-2 px-2 py-1 text-2xs border-b bg-surface-secondary text-secondary"
+	>
+		<span class="font-mono truncate">{scriptPath}__dbt/</span>
+		<div class="ml-auto shrink-0 flex items-center gap-1">
+			<span class="opacity-70">{fileCount + 1}</span>
+			{@render addFile?.()}
+		</div>
+	</div>
+	<div class="flex-1 min-h-0 overflow-auto py-1">
+		<!-- The descriptor sits at the project root, which is where it lives on disk. -->
+		<button
+			class="w-full flex items-center gap-1 px-1 py-0.5 text-2xs hover:bg-surface-hover {selected ===
+			null
+				? 'bg-surface-selected font-semibold text-primary'
+				: 'text-secondary'}"
+			style="padding-left: 15px"
+			onclick={() => onSelect(null)}
+		>
+			<FileText size={11} class="shrink-0 opacity-60" />
+			<span class="truncate font-mono">{descriptorName}</span>
+		</button>
+		{@render branch(tree, 0)}
+	</div>
+	{#if fileCount === 0}
+		<div class="shrink-0 p-2 text-2xs text-secondary border-t">
+			No project yet. Copy one in and push it:
+			<pre class="mt-1 p-1 rounded bg-surface-secondary overflow-x-auto"
+				>cp -r my-dbt-project/. {scriptPath}__dbt/
+wmill sync push</pre
+			>
+		</div>
+	{/if}
+</div>
diff --git a/frontend/src/lib/components/dbt/DbtRunGraph.svelte b/frontend/src/lib/components/dbt/DbtRunGraph.svelte
new file mode 100644
index 0000000000..cffb663b44
--- /dev/null
+++ b/frontend/src/lib/components/dbt/DbtRunGraph.svelte
@@ -0,0 +1,774 @@
+<script lang="ts">
+	// The models this run touches, as the graph, on the page you land on when you
+	// click a running job. The live per-model state the worker records is what
+	// makes it worth having here: nodes go amber then green as dbt walks the DAG,
+	// where the alternative is reading `N of M OK created` out of the log.
+	import { onDestroy, untrack } from 'svelte'
+	import { OpenAPI, JobService } from '$lib/gen'
+	import { nodeSelector, parseDbtRun, splitRelation, splitUniqueId } from './parseDbtRun'
+	import { Button } from '$lib/components/common'
+	import { ClipboardCopy, Code2, RefreshCw, TableProperties } from 'lucide-svelte'
+	import { copyToClipboard } from '$lib/utils'
+	import { isWindmillTooBigObject } from '$lib/components/job_args'
+	import { previewDbtRows } from './previewRows'
+	import { workspaceStore } from '$lib/stores'
+	import { appendViewToken } from '$lib/viewToken'
+	import AssetGraphCanvas from '$lib/components/assets/AssetGraph/AssetGraphCanvas.svelte'
+	import type { AssetGraphResponse } from '$lib/components/assets/AssetGraph/types'
+	import { useDbtRunStatus } from './runStatus.svelte'
+	import { Loader2 } from 'lucide-svelte'
+	import HighlightCode from '$lib/components/HighlightCode.svelte'
+	import type { AssetGraphNodeData } from '$lib/components/assets/AssetGraph/types'
+
+	let {
+		scriptPath,
+		jobId,
+		running = false,
+		result,
+		scriptHash,
+		runArgs,
+		canResume = false,
+		onResume,
+		fill = false
+	}: {
+		scriptPath: string
+		/** The run whose per-model progress to show. dbt records a state per
+		 *  relation as it walks the DAG; without this the graph can only show
+		 *  what a relation IS, not what this run is doing to it. */
+		jobId?: string
+		// While the job is in flight the graph is re-fetched, because the per-model
+		// materialization rows the worker writes are what move the nodes.
+		running?: boolean
+		/** The finished job's result. It carries a status per dbt node, which is
+		 *  what a completed run is coloured from. */
+		result?: unknown
+		/** The script version this job ran. The graph is stored per deployed
+		 *  version, so passing it renders the project as it was — the models, SQL
+		 *  and `ref()` lineage of that deploy, not of today's. */
+		scriptHash?: string | number
+		/** The arguments this run was invoked with. A preview is a `dbt show` of
+		 *  the same project, so it needs them: a descriptor with a required
+		 *  `{{ }}` var is refused without them, and an overridden one would
+		 *  otherwise query a different relation than the page is showing. */
+		runArgs?: Record<string, unknown>
+		/** Whether a `dbt retry` by this caller would resume THIS run. One failure
+		 *  is saved per script per principal, so a later run of the same script
+		 *  takes the state over and the worker refuses a resume aimed here. */
+		/** Fill the container instead of standing at a fixed height in a page's
+		 *  flow. A pane that IS the graph gives it the room; a page section that
+		 *  merely contains one does not. */
+		fill?: boolean
+		canResume?: boolean
+		/** Submits that retry. The caller owns it so the run's own arguments and
+		 *  resolved tag come along: worker tags, debounce and concurrency keys are
+		 *  interpolated from the submitted arguments at enqueue, long before the
+		 *  worker restores the ones being resumed. */
+		onResume?: () => Promise<unknown> | void
+	} = $props()
+
+	// The graph endpoint is folder-scoped; a script outside `f/` has no folder and
+	// falls back to the whole workspace, which the filter below narrows anyway.
+	let folder = $derived(scriptPath.startsWith('f/') ? scriptPath.split('/')[1] : undefined)
+	// Read inside `load` and listed here so a change of version refetches.
+	let graphKey = $derived(`${folder ?? ''}|${scriptHash ?? ''}|${jobId ?? ''}`)
+
+	let raw = $state<AssetGraphResponse | undefined>(undefined)
+	let loading = $state(true)
+	let failed = $state(false)
+
+	// Two loads of the SAME run overlap — the poll's parting one and the
+	// finished-run effect's — and nothing orders two requests to one endpoint. The
+	// older answers with the DEPLOYED graph, so landing second it replaces the run's
+	// own snapshot with nothing left to fetch again and correct it.
+	let graphSeq = 0
+	async function load() {
+		const ws = $workspaceStore
+		if (!ws) return
+		const gen = runGen
+		const seq = ++graphSeq
+		const current = () => gen === runGen && seq === graphSeq
+		try {
+			const params = new URLSearchParams({ asset_kinds: 'dbt' })
+			if (folder) params.set('folder', folder)
+			if (scriptHash != undefined) params.set('dbt_script_hash', String(scriptHash))
+			// Through the JOB when there is one: `/assets/graph` answers the
+			// workspace-wide question and cannot pin to a run.
+			const path = jobId != undefined ? `/w/${ws}/jobs/dbt_graph/${jobId}` : `/w/${ws}/assets/graph`
+			// `appendViewToken`, because this is a raw `fetch`: the interceptor that
+			// adds `X-View-Token` is installed on the generated client only, and a
+			// shared run page carries its access in that token.
+			const res = await fetch(appendViewToken(`${OpenAPI.BASE ?? ''}${path}?${params}`), {
+				credentials: 'include'
+			})
+			// The page may have moved to another run while this was in flight, and
+			// assigning that answer would leave the previous run's graph — or its
+			// loading state — on screen with nothing to correct it. A newer request
+			// for the SAME run supersedes this one just as completely.
+			if (!current()) return
+			if (!res.ok) {
+				failed = true
+				return
+			}
+			const body = (await res.json()) as AssetGraphResponse
+			if (!current()) return
+			raw = body
+			failed = false
+		} catch {
+			if (current()) failed = true
+		} finally {
+			if (current()) loading = false
+		}
+	}
+
+	// `asset:<kind>:<path>` -> what this run is doing to that relation: the id shape
+	// the canvas builds its nodes with, where a bare `kind:path` looks right and
+	// silently never matches. A retry rewrites the same rows, so a failed node
+	// returns to `running` and on to its new outcome by itself.
+	// Shared with the editor's graph, so "what colour is this model right now" has
+	// one answer. `generation` is this page's own: a response that outlives a
+	// navigation between runs would colour the next one's models.
+	const runStatus = useDbtRunStatus({
+		workspace: () => $workspaceStore,
+		jobId: () => jobId,
+		running: () => running,
+		result: () => result,
+		graph: () => graph,
+		generation: () => runGen,
+		destroyed: () => destroyed
+	})
+	const loadProgress = () => runStatus.load()
+
+	let timer: ReturnType<typeof setInterval> | undefined
+	// Bounded so a static descriptor, which never writes a snapshot, stops
+	// asking rather than polling for the length of the run.
+	let graphTries = 0
+	// Deliberately not `$state`: this guards an effect against its own writes, so
+	// reading it must not make the effect depend on it.
+	let finalLoadFor: string | undefined = undefined
+	// SvelteKit reuses this component across runs, so every response that outlives
+	// the navigation — graph, progress poll, preview — is checked against the
+	// generation it was requested under, or the previous run's answer stays on
+	// screen. Not `$state`: the effect below writes it and must not depend on it.
+	let runGen = 0
+	$effect(() => {
+		void scriptPath
+		void graphKey
+		// SvelteKit reuses this component when navigating between runs, and all
+		// three of these describe the PREVIOUS job: a spent retry count stops the
+		// next run's snapshot poll before it starts, and stale progress colours
+		// its models with another run's statuses.
+		graphTries = 0
+		finalLoadFor = undefined
+		runStatus.reset()
+		raw = undefined
+		// Both are written by `load` alone and describe the run it answered for,
+		// so they are as run-scoped as `raw`: left behind, the gap before the new
+		// run's answer falls past `{#if loading}` to the "no models in the asset
+		// graph" notice — a claim about the descriptor, on a project that is fine.
+		loading = true
+		failed = false
+		// Previews are keyed by `unique_id` alone, which is the same string for the
+		// same model in every run — so without this the next run opens showing the
+		// previous one's rows, and `runPreview` treats them as cached and refuses
+		// to fetch. The generation drops anything already in flight.
+		runGen += 1
+		selection = undefined
+		previews = {}
+		rowsFor = undefined
+		// Only while in flight; the effect below owns a FINISHED run, since a
+		// snapshot can land after the run ends. On mount both fire in the same tick,
+		// so loading here too fetches the whole graph twice. Untracked: depending on
+		// `running` would re-run this reset the moment the run finishes.
+		if (untrack(() => running)) void load()
+		void jobId
+		void loadProgress()
+	})
+	$effect(() => {
+		clearInterval(timer)
+		// Read synchronously so navigating between two RUNNING jobs re-arms this:
+		// everything below is read inside timer callbacks, so `running` alone would
+		// leave the second run polling on the first one's cycle — already spent.
+		void graphKey
+		// Only while in flight, and no faster than dbt finishes a model: this is a
+		// poll against the same rows the pipeline page reads, not a subscription.
+		if (running) {
+			// The GRAPH is refetched only until this run's own snapshot appears: a
+			// dynamic descriptor re-ingests once before the build, after a clone and
+			// a provision, so a fixed delay either fires too early to ever show the
+			// run's models or re-sends the whole graph for the length of the run.
+			timer = setInterval(() => void loadProgress(), 2000)
+			// Backed off, because for a whole class of runs neither stop below is
+			// reached and this walks to its cap: `dbt_snapshot_job` never matches a
+			// static descriptor, and the polled status stays empty on engines emitting no node
+			// events. Each try re-sends every model's SQL.
+			let graphDelay = 3000
+			let graphTimer: ReturnType<typeof setTimeout> | undefined
+			const pollGraph = () => {
+				// Two ways to be done, and the second is the common one. The
+				// ingest happens BEFORE the build, so once any model reports
+				// progress it has already run: a snapshot that is not here by
+				// then is a snapshot this run never writes.
+				if (raw?.dbt_snapshot_job === jobId || runStatus.status.size > 0 || graphTries >= 12) {
+					// One last load on the way out. Progress proves the ingest
+					// happened; it does not prove the previous tick SAW it, and
+					// dbt's compile window is usually wider than one tick.
+					if (raw?.dbt_snapshot_job !== jobId) void load()
+					return
+				}
+				graphTries += 1
+				void load()
+				graphDelay = Math.min(graphDelay * 1.6, 30000)
+				graphTimer = setTimeout(pollGraph, graphDelay)
+			}
+			graphTimer = setTimeout(pollGraph, graphDelay)
+			return () => {
+				clearTimeout(graphTimer)
+				clearInterval(timer)
+			}
+		}
+		// One unconditional load once the run has finished: the poll above gives up
+		// after a bounded number of tries, which provisioning plus `dbt deps` can
+		// outlast on a cold worker. Without this a snapshot written late is never
+		// displayed and the page keeps the deployed fallback for good.
+		else if (finalLoadFor !== (jobId ?? '')) {
+			// Once per finished job, not per response: `load()` assigns `raw`, which
+			// recomputes the settled status, which re-enters this effect and refetches the
+			// whole graph for as long as the page is open. A plain variable, so
+			// reading it adds no dependency.
+			finalLoadFor = jobId ?? ''
+			void load()
+			// The settled status colours a finished run with no request. The poll is the
+			// fallback for one that produced no `run_results.json` at all —
+			// cancelled or killed — whose relations the worker settles in the
+			// table instead.
+			if (!untrack(() => runStatus.isSettled)) void loadProgress()
+		}
+		return () => clearInterval(timer)
+	})
+	// A version pinned with no graph is usually a deploy that has not finished
+	// ingesting yet, so look again a few times before the empty state stands.
+	// Self-scheduling rather than effect-driven: a retry that finds the same empty
+	// answer changes no state an effect reads, so it would never re-arm. Bounded
+	// and backed off — a project with no warehouse identity never fills in, and
+	// must not poll for the life of the page.
+	$effect(() => {
+		void graphKey
+		if (running || scriptHash == undefined || jobId != undefined) return
+		let tries = 0
+		let timer: ReturnType<typeof setTimeout> | undefined
+		const again = () => {
+			if (destroyed || untrack(() => graph) != undefined || tries >= 5) return
+			tries += 1
+			void load().then(() => {
+				timer = setTimeout(again, 2000 * tries)
+			})
+		}
+		timer = setTimeout(again, 2000)
+		return () => clearTimeout(timer)
+	})
+
+	// Read by the preview poll, which outlives the component otherwise: its own
+	// loop is what has to stop, since there is no interval to clear.
+	let destroyed = false
+	onDestroy(() => {
+		destroyed = true
+		clearInterval(timer)
+	})
+
+	// Parsed once: five derivations below read it, and `result` is the whole
+	// `run_results.json` the job returned.
+	let run = $derived(parseDbtRun(result))
+
+	// A failed run's obvious next action is "Run again", which prefills the
+	// arguments it just ran — rebuilding the whole project. `dbt retry` redoes the
+	// failed and skipped nodes alone, and nothing on the page says so.
+	let resumable = $derived(
+		canResume && !running && ((run?.totals?.error ?? 0) > 0 || (run?.totals?.skipped ?? 0) > 0)
+	)
+	let resuming = $state(false)
+
+	async function resume() {
+		if (resuming) return
+		resuming = true
+		try {
+			await onResume?.()
+		} finally {
+			resuming = false
+		}
+	}
+
+	// A test is not a relation, so a run selecting tests alone has an empty graph
+	// and a healthy one — where the empty state otherwise blames the descriptor's
+	// warehouse identity. Both kinds: dbt spells a unit test `unit_test.<pkg>.…`.
+	let ranTestsOnly = $derived(
+		!!run?.nodes?.length &&
+			run.nodes.every((n) => ['test', 'unit_test'].includes(splitUniqueId(n.unique_id).kind))
+	)
+
+	// A run page is about one script, so the graph is the relations it reads and
+	// writes — a folder's other projects are noise here, and so is a node for the
+	// script itself: on the pipeline page that node distinguishes one project
+	// from another, but here the whole graph already IS that project.
+	let scoped = $derived.by(() => {
+		if (!raw) return undefined
+		// Asked for a specific version, the response IS that version's project.
+		// Scoping by usage edges would undo that: those rows are path-keyed and
+		// describe the current deploy, so a model this version had and a later one
+		// dropped has no edge to be found by.
+		const assetIds = scriptHash
+			? new Set(raw.assets.filter((a) => a.dbt).map((a) => `${a.kind}:${a.path}`))
+			: new Set(
+					raw.edges
+						.filter((e) => e.runnable_path === scriptPath)
+						.map((e) => `${e.asset_kind}:${e.asset_path}`)
+				)
+		if (assetIds.size === 0) return undefined
+		return {
+			...raw,
+			runnables: [],
+			assets: raw.assets.filter((a) => assetIds.has(`${a.kind}:${a.path}`)),
+			edges: [],
+			triggers: [],
+			// `ref()` lineage between two of this project's own models is the shape
+			// of the dbt DAG, so it is the one edge set worth keeping whole.
+			dbt_edges: (raw.dbt_edges ?? []).filter(
+				(e) => assetIds.has(`dbt:${e.from_asset_path}`) && assetIds.has(`dbt:${e.to_asset_path}`)
+			)
+		} as AssetGraphResponse
+	})
+
+	// A FINISHED run is narrowed to what it named: the response is the VERSION's
+	// graph, so a model this run never built would appear as though it had. Sources
+	// stay — dbt lists none in `run_results.json`, but the run read them. (No
+	// `resolveGraph`: it merges drafts and editor buffers a run page has neither of.)
+	let historical = $derived.by(() => {
+		if (running || !scoped) return undefined
+		if (!run?.nodes?.length) return undefined
+		const ran = new Set(run.nodes.map((n) => n.unique_id))
+		// dbt ids are `<resource_type>.<package>.<name>`, so the packages this run
+		// named are the projects it could speak for.
+		const pkg = (id: string) => id.split('.')[1]
+		const ranPackages = new Set(run.nodes.map((n) => pkg(n.unique_id)))
+		const keep = (a: (typeof scoped.assets)[number]) =>
+			a.dbt == undefined ||
+			a.dbt.resource_type === 'source' ||
+			ran.has(a.dbt.unique_id) ||
+			// Provenance keeps one winner per relation, so a relation two projects
+			// write may carry the OTHER project's model — and this run cannot be
+			// judged against an id that was never its own. Dropping it would make the
+			// run look like it built fewer models than it did.
+			!ranPackages.has(pkg(a.dbt.unique_id))
+		const assets = scoped.assets.filter(keep)
+		if (assets.length === scoped.assets.length) return undefined
+		const ids = new Set(assets.map((a) => `${a.kind}:${a.path}`))
+		return {
+			...scoped,
+			assets,
+			dbt_edges: (scoped.dbt_edges ?? []).filter(
+				(e) => ids.has(`dbt:${e.from_asset_path}`) && ids.has(`dbt:${e.to_asset_path}`)
+			)
+		} as AssetGraphResponse
+	})
+
+	let graph = $derived(historical ?? scoped)
+
+	// Models whose id survived but whose RELATION changed — an alias, schema or
+	// database edit. The graph on screen is the version's as it stands now, so a
+	// node can name a relation this run did not write, and saying so beats
+	// asserting the run materialized a table that did not exist then.
+	let relationDrift = $derived.by(() => {
+		if (running || !graph) return 0
+		if (!run?.nodes?.length) return 0
+		// Schema AND name: the move most likely being reported, a profile repointed
+		// at another schema, leaves every model's name where it was. An asset path is
+		// `<resource>/<schema>/<name>`, whose schema segment is `<database>.<schema>`
+		// only when the model overrode the target's database.
+		const byId = new Map(
+			graph.assets
+				.filter((a) => a.dbt?.unique_id)
+				.map((a) => [a.dbt!.unique_id, a.path.split('/').slice(-2)])
+		)
+		return run.nodes.filter((n) => {
+			if (!n.relation_name) return false
+			const now = byId.get(n.unique_id)
+			if (now == undefined || now.length < 2) return false
+			const [nowSchema, nowName] = now
+			const parts = splitRelation(n.relation_name)
+			const name = parts.at(-1) ?? ''
+			const schema = parts.at(-2) ?? ''
+			const qualified = parts.length > 2 ? `${parts.at(-3)}.${schema}` : schema
+			// Either spelling counts as unmoved: an unqualified segment names the
+			// target's own database, so demanding the qualified form reports a move on
+			// every node. Lower-cased because `relation_name` is the warehouse's own —
+			// Snowflake's is upper, and comparing raw looks like a rename.
+			const here = nowSchema.toLowerCase()
+			return (
+				nowName.toLowerCase() !== name.toLowerCase() ||
+				(here !== schema.toLowerCase() && here !== qualified.toLowerCase())
+			)
+		}).length
+	})
+
+	// Models this run built that the graph on screen no longer has under the same
+	// id — renamed or deleted since, or dropped from a version graph rewritten
+	// after this run. They cannot be drawn, so the count is stated rather than
+	// silently missing.
+	let goneSinceRun = $derived.by(() => {
+		if (running || !scoped) return 0
+		if (!run?.nodes?.length) return 0
+		const known = new Set(
+			scoped.assets.map((a) => a.dbt?.unique_id).filter((u): u is string => u != undefined)
+		)
+		// Only relations whose own project still lacks the id count as gone: an id
+		// missing because another project won the provenance is not a deletion.
+		const knownPackages = new Set(
+			[...known].map((u) => u.split('.')[1]).filter((p) => p != undefined)
+		)
+		return run.nodes.filter(
+			(n) =>
+				!known.has(n.unique_id) &&
+				knownPackages.has(n.unique_id.split('.')[1]) &&
+				/^(model|seed|snapshot)\./.test(n.unique_id)
+		).length
+	})
+
+	// A finished run's own output, joined on dbt's `unique_id` — what both sides
+	// carry, where the relation name would redo the worker's path derivation. The
+	// per-relation state table holds ONE row per relation, whichever job wrote it
+	// last, so reading THAT would show an old run a later one's models.
+	let assetRunStatus = $derived(runStatus.status)
+
+	// The transform behind the selected relation. dbt's own DAG node is the model
+	// — the SQL and the table it writes are one thing — so a graph of relations
+	// alone leaves out what a reader came to see.
+	let selection = $state<AssetGraphNodeData | undefined>(undefined)
+	let selectedDbt = $derived.by(() => {
+		const sel = selection
+		if (sel?.kind !== 'asset') return undefined
+		const dbt = graph?.assets.find((a) => a.kind === sel.asset_kind && a.path === sel.path)?.dbt
+		if (!dbt) return undefined
+		// Provenance keeps one winner per relation workspace-wide, so a relation two
+		// projects materialize carries one project's node, whose SQL is not this
+		// run's. Sources are exempt: a run executes none, so none appear in
+		// `run_results.json`.
+		if (
+			dbt.resource_type !== 'source' &&
+			run?.nodes?.length &&
+			!run.nodes.some((n) => n.unique_id === dbt.unique_id)
+		) {
+			return undefined
+		}
+		return dbt
+	})
+
+	// `dbt show` against the selected model, run as an ordinary job — same
+	// authorization, isolation and cancellation as any other. Explicit rather
+	// than on-select: each preview costs a worker slot and a few seconds of
+	// engine start-up, so it must be something the reader asked for.
+	type Preview =
+		| { rows: Record<string, unknown>[]; tookMs: number; node?: string }
+		| { error: string }
+		| { pending: true }
+	// Cached per model id, so flipping between two nodes does not re-run a job
+	// that costs a worker slot and an engine start-up. A preview also keeps
+	// running when the selection moves — the result lands in the cache and is
+	// there when the reader comes back.
+	let previews = $state<Record<string, Preview>>({})
+	// Read under the same key `runPreview` writes: the model AND the arguments it
+	// ran with, so an edited var shows its own rows rather than the last ones.
+	let preview = $derived(
+		selectedDbt ? previews[`${selectedDbt.unique_id}|${JSON.stringify(runArgs ?? {})}`] : undefined
+	)
+	let previewing = $derived(preview != undefined && 'pending' in preview)
+	// Which model's rows are on display. Keyed by id rather than a boolean so
+	// moving the selection goes back to SQL without anything having to reset it.
+	let rowsFor = $state<string | undefined>(undefined)
+	let showRows = $derived(
+		selectedDbt != undefined && rowsFor?.startsWith(`${selectedDbt.unique_id}|`) === true
+	)
+
+	// A column can hold an array or a JSON object, whose default stringification
+	// is `[object Object]` — which tells the reader nothing about the value.
+	function cellText(v: unknown): string {
+		if (v == undefined) return ''
+		return typeof v === 'object' ? JSON.stringify(v) : String(v)
+	}
+
+	async function runPreview() {
+		const ws = $workspaceStore
+		const dbt = selectedDbt
+		if (!ws || !dbt) return
+		// Keyed on the ARGUMENTS too, not the model alone: on the script page the
+		// form above feeds this, so a var edited between two clicks previews a
+		// different query — and a cache that ignored it would return the old rows
+		// as though nothing had changed.
+		const key = `${dbt.unique_id}|${JSON.stringify(runArgs ?? {})}`
+		// Displaying the rows and running the job are separate: coming back from
+		// the SQL to a result already in hand must not spend another worker slot.
+		rowsFor = key
+		// A cached FAILURE must not be cached: it would leave the button dead for
+		// that model until reload. Only a result or an in-flight run blocks a
+		// re-run.
+		const cached = previews[key]
+		if (cached != undefined && !('error' in cached)) return
+		const gen = runGen
+		previews = { ...previews, [key]: { pending: true } }
+		// The run's own arguments, so a required `{{ }}` var resolves and an
+		// overridden one points at the relation on screen. The result's copy wins:
+		// a `dbt retry` job's own arguments name the run it resumed, while what it
+		// ran with is the restored ones published here.
+		//
+		// Fetched when they were too big to inline: while the run is still going
+		// there is no result to fall back on, so the placeholder would submit a
+		// preview with none of the descriptor's required vars.
+		let submitted: Record<string, unknown> = runArgs ?? {}
+		if (jobId && isWindmillTooBigObject(submitted)) {
+			try {
+				submitted = ((await JobService.getJobArgs({ workspace: ws, id: jobId })) ?? {}) as Record<
+					string,
+					unknown
+				>
+			} catch {
+				// Leave the placeholder: the preview may still resolve, and its own
+				// failure says more than refusing to try.
+			}
+			if (gen !== runGen || destroyed) return
+		}
+		const ran = { ...submitted, ...(run?.invocation_args ?? {}) } as Record<string, any>
+		const { command: _cmd, ...placeholders } = ran
+		const next = await previewDbtRows({
+			workspace: ws,
+			scriptPath,
+			// By HASH whenever the graph is pinned, so the rows are that version's.
+			scriptHash,
+			// Scoped to the node's package, not the bare name: a package can ship a
+			// model whose name the project also uses. Derived from the node's id
+			// and NEVER from `key`, which carries the run arguments that make the
+			// cache entry distinct and would reach dbt as part of the selector.
+			model: nodeSelector(dbt.unique_id),
+			vars: ran.command?.vars ?? {},
+			args: placeholders,
+			stillWanted: () => gen === runGen && !destroyed
+		})
+		if (!next || gen !== runGen) return
+		previews = { ...previews, [key]: next }
+	}
+
+	// Selected a relation this run built, but its stored provenance belongs to
+	// another project that writes the same table. Saying so beats rendering
+	// nothing, which reads as a dead click.
+	let selectedIsForeign = $derived.by(() => {
+		const sel = selection
+		if (sel?.kind !== 'asset' || selectedDbt) return false
+		const dbt = graph?.assets.find((a) => a.kind === sel.asset_kind && a.path === sel.path)?.dbt
+		return dbt != undefined
+	})
+
+	// Fully qualified, as dbt reported it for THIS run, and verbatim — quoting
+	// included. There is no table browser to link to, so this is the name to paste
+	// into a SQL client, and stripping the quotes turns `"wh"."analytics.v2"."Order
+	// Items"` into four parts of a name that resolves to nothing.
+	let selectedRelation = $derived.by(() => {
+		const sel = selection
+		if (sel?.kind !== 'asset' || !selectedDbt) return undefined
+		return run?.nodes?.find((n) => n.unique_id === selectedDbt!.unique_id)?.relation_name
+	})
+</script>
+
+{#snippet sqlPane()}
+	{#if selectedIsForeign}
+		<div class="border-t px-2 py-1.5 text-2xs text-secondary">
+			Another dbt project in this workspace also materializes this relation, and the graph keeps one
+			project's model per relation — so the SQL shown here would not be this run's. Open that
+			project's own run to see it.
+		</div>
+	{:else if selectedDbt?.raw_code}
+		<div class="border-t flex flex-col min-h-0 max-h-72">
+			<div
+				class="shrink-0 flex items-center gap-2 px-2 py-1 text-2xs border-b bg-surface-secondary text-secondary"
+			>
+				<span class="font-mono truncate"
+					>{selectedDbt.original_file_path ?? selectedDbt.unique_id}</span
+				>
+				{#if selectedDbt.materialized}
+					<span class="shrink-0 opacity-70">{selectedDbt.materialized}</span>
+				{/if}
+				<!-- `dbt show` is a SELECT against the node's own relation, and the
+				     worker intersects the selector with `resource_type:model`, so
+				     offering it on a seed or a snapshot only ever produces a failed
+				     job. Their SQL still shows: a snapshot has a body worth reading. -->
+				{#if selectedDbt.resource_type === 'model'}
+					{#if showRows && preview && !('error' in preview)}
+						<Button
+							unifiedSize="2xs"
+							variant="subtle"
+							startIcon={{ icon: Code2 }}
+							on:click={() => (rowsFor = undefined)}
+							title="Show the model's SQL"
+						>
+							SQL
+						</Button>
+					{:else}
+						<Button
+							unifiedSize="2xs"
+							variant="subtle"
+							startIcon={{
+								icon: previewing ? Loader2 : TableProperties,
+								classes: previewing ? 'animate-spin' : undefined
+							}}
+							disabled={previewing}
+							on:click={runPreview}
+							title="Run `dbt show` against this model and display the rows"
+						>
+							{previewing ? 'Previewing…' : 'Preview rows'}
+						</Button>
+					{/if}
+				{/if}
+				{#if selectedRelation}
+					<Button
+						unifiedSize="2xs"
+						variant="subtle"
+						startIcon={{ icon: ClipboardCopy }}
+						on:click={() => copyToClipboard(selectedRelation)}
+						title="Copy the fully-qualified relation name"
+					>
+						<span class="font-mono truncate max-w-56">{selectedRelation}</span>
+					</Button>
+				{/if}
+				<!-- The copy taken at deploy, so editing it here would change nothing the
+				     next run reads. The file itself is a module of the script — editable
+				     in the script editor, or in the project and pushed. -->
+				<span class="ml-auto shrink-0 opacity-70" title={selectedDbt.original_file_path}>
+					read-only · edit in the script
+				</span>
+			</div>
+			<div class="flex-1 min-h-0 overflow-auto">
+				{#if showRows && preview}
+					{#if 'error' in preview}
+						<div class="p-2 text-2xs text-secondary">{preview.error}</div>
+						<HighlightCode language="sql" code={selectedDbt.raw_code} />
+					{:else if 'pending' in preview}
+						<div class="flex items-center gap-2 p-2 text-2xs text-secondary">
+							<Loader2 size={12} class="animate-spin" />
+							Running `dbt show` — this is a job, so it waits on a worker and the engine.
+						</div>
+					{:else}
+						{@const cols = Object.keys(preview.rows[0] ?? {})}
+						{#if cols.length === 0}
+							<div class="p-2 text-2xs text-secondary"> The model returned no rows. </div>
+						{:else}
+							<table class="w-full text-2xs font-mono">
+								<thead class="sticky top-0 bg-surface-secondary text-secondary">
+									<tr>
+										{#each cols as c (c)}
+											<th class="text-left font-semibold px-2 py-1 border-b">{c}</th>
+										{/each}
+									</tr>
+								</thead>
+								<tbody>
+									{#each preview.rows as row, i (i)}
+										<tr class="border-b border-surface-selected">
+											{#each cols as c (c)}
+												<td class="px-2 py-0.5 truncate max-w-56">{cellText(row[c])}</td>
+											{/each}
+										</tr>
+									{/each}
+								</tbody>
+							</table>
+							<div class="px-2 py-1 text-3xs text-tertiary">
+								{preview.rows.length} rows in {(preview.tookMs / 1000).toFixed(1)}s{preview.node
+									? ` · ${preview.node}`
+									: ''}
+							</div>
+						{/if}
+					{/if}
+				{:else}
+					<HighlightCode language="sql" code={selectedDbt.raw_code} />
+				{/if}
+			</div>
+		</div>
+	{/if}
+{/snippet}
+
+{#if resumable}
+	<div class="mb-2 px-2 py-1 text-2xs text-secondary border rounded bg-surface-secondary">
+		{(run?.totals?.error ?? 0) > 0 ? `${run?.totals?.error} failed` : ''}{(run?.totals?.error ??
+			0) > 0 && (run?.totals?.skipped ?? 0) > 0
+			? ', '
+			: ''}{(run?.totals?.skipped ?? 0) > 0 ? `${run?.totals?.skipped} skipped` : ''}. Rebuild only
+		those with <span class="font-mono">dbt retry</span>, instead of the whole project.
+		<span class="inline-block ml-1 align-middle">
+			<Button
+				unifiedSize="2xs"
+				variant="subtle"
+				disabled={resuming}
+				startIcon={{
+					icon: resuming ? Loader2 : RefreshCw,
+					classes: resuming ? 'animate-spin' : undefined
+				}}
+				on:click={resume}>{resuming ? 'Resuming' : 'Resume this run'}</Button
+			>
+		</span>
+	</div>
+{/if}
+
+{#if loading}
+	<div class="flex items-center gap-2 text-xs text-secondary p-3">
+		<Loader2 class="animate-spin" size={14} /> Loading the model graph
+	</div>
+{:else if failed}
+	<div class="text-xs text-secondary p-3">Could not load the model graph.</div>
+{:else if !graph}
+	<div class="text-xs text-secondary p-3">
+		{#if ranTestsOnly}
+			This run selected tests alone, so it built no models. A dbt test is an assertion rather than a
+			relation, so it has no node here — the models it asserts against belong to the runs that build
+			them. Its results are in the table below.
+		{:else}
+			<!-- States the fact and lists what can produce it, rather than asserting one
+			     cause. The common one is timing: a version's graph is written by its
+			     DEPLOY, so the seconds between deploying and that job finishing look
+			     exactly like a project with no warehouse identity. -->
+			No models stored for this version of the project.
+			{#if scriptHash}
+				A version's graph is written by its deploy, so this is what a deploy still in
+				flight looks like — it fills in when that job lands.
+			{/if}
+			A project that brings its own <span class="font-mono">profiles.yml</span> without naming
+			a <span class="font-mono">profile.warehouse</span> also has no warehouse identity to key
+			models on, and stores none.
+		{/if}
+	</div>
+{:else}
+	<div
+		class="overflow-hidden flex flex-col {fill ? 'h-full' : 'border rounded'}"
+	>
+		{#if relationDrift > 0}
+			<div class="shrink-0 px-2 py-1 text-2xs text-secondary border-b bg-surface-secondary">
+				{relationDrift}
+				{relationDrift === 1 ? 'model has' : 'models have'} been renamed or moved since this run —
+				{relationDrift === 1 ? 'its node shows' : 'their nodes show'} today's relation, not the one this
+				run wrote.
+			</div>
+		{/if}
+		{#if goneSinceRun > 0}
+			<div class="shrink-0 px-2 py-1 text-2xs text-secondary border-b bg-surface-secondary">
+				{goneSinceRun}
+				{goneSinceRun === 1 ? 'model' : 'models'} this run built {goneSinceRun === 1 ? 'is' : 'are'}
+				no longer in the project — renamed or removed since, so
+				{goneSinceRun === 1 ? 'it is' : 'they are'} not drawn.
+			</div>
+		{/if}
+		<div class={fill ? 'flex-1 min-h-0' : 'h-80'}>
+			<AssetGraphCanvas
+				{graph}
+				{selection}
+				{assetRunStatus}
+				onselect={(s) => (selection = s)}
+				showMinimap={false}
+				scrollZoom={false}
+			/>
+		</div>
+		{@render sqlPane()}
+	</div>
+{/if}
diff --git a/frontend/src/lib/components/dbt/DbtRunResult.svelte b/frontend/src/lib/components/dbt/DbtRunResult.svelte
new file mode 100644
index 0000000000..34d7886b30
--- /dev/null
+++ b/frontend/src/lib/components/dbt/DbtRunResult.svelte
@@ -0,0 +1,146 @@
+<script lang="ts">
+	// What a dbt invocation did, per node. The payload is already structured (the
+	// worker settles it from `run_results.json`); this renders it as the run
+	// summary a dbt user reads, instead of leaving them to scroll the JSON or
+	// count PASS/WARN lines in the log.
+	import { CheckCircle2, XCircle, AlertTriangle, MinusCircle, FlaskConical } from 'lucide-svelte'
+	import Tooltip from '$lib/components/Tooltip.svelte'
+	import {
+		splitUniqueId as split,
+		splitRelation,
+		statusRank as rank,
+		type DbtOutcome,
+		type DbtRun
+	} from '$lib/components/dbt/parseDbtRun'
+
+	let { run }: { run: DbtRun } = $props()
+
+	// Failures first, then warnings, then skips: the run's outcome is decided by
+	// a handful of nodes and a long green list buries them.
+	let nodes = $derived([...(run.nodes ?? [])].sort((a, b) => rank(a.status, a.outcome) - rank(b.status, b.outcome)))
+	let totals = $derived(run.totals ?? {})
+	let hasTests = $derived(nodes.some((n) => split(n.unique_id).kind === 'test'))
+
+	function statusClass(status: string, outcome?: DbtOutcome): string {
+		switch (rank(status, outcome)) {
+			case 0:
+				return 'text-red-600 dark:text-red-400'
+			case 1:
+				return 'text-yellow-600 dark:text-yellow-400'
+			case 2:
+				return 'text-secondary'
+			default:
+				return 'text-green-600 dark:text-green-400'
+		}
+	}
+
+	function fmtTime(s: number | undefined): string {
+		if (s === undefined) return ''
+		return s < 1 ? `${Math.round(s * 1000)}ms` : `${s.toFixed(2)}s`
+	}
+
+	// dbt qualifies every part. The database is dropped only when every row shares
+	// it, which is the common case and the noisiest to repeat — a model that
+	// overrode `database` would otherwise render identically to a same-named
+	// relation in another catalog.
+	let oneDatabase = $derived(
+		new Set(
+			nodes
+				.map((n) => n.relation_name)
+				.filter((r): r is string => !!r)
+				.map((r) => splitRelation(r).slice(0, -2).join('.'))
+		).size <= 1
+	)
+	function fmtRelation(relation: string | undefined): string | undefined {
+		if (!relation) return undefined
+		const parts = splitRelation(relation)
+		return (oneDatabase ? parts.slice(-2) : parts).join('.')
+	}
+</script>
+
+<div class="w-full flex flex-col gap-2 mb-2">
+	<div class="flex items-center flex-wrap gap-x-3 gap-y-1 text-xs">
+		{#each [{ k: 'success', label: 'passed', cls: 'text-green-600 dark:text-green-400' }, { k: 'warn', label: 'warned', cls: 'text-yellow-600 dark:text-yellow-400' }, { k: 'error', label: 'failed', cls: 'text-red-600 dark:text-red-400' }, { k: 'skipped', label: 'skipped', cls: 'text-secondary' }] as t (t.k)}
+			{@const n = (totals as Record<string, number | undefined>)[t.k] ?? 0}
+			{#if n > 0}
+				<span class={t.cls}><span class="font-semibold">{n}</span> {t.label}</span>
+			{/if}
+		{/each}
+		<span class="text-secondary">of {totals.total ?? nodes.length} nodes</span>
+		<span class="ml-auto text-secondary font-mono text-2xs">
+			{run.command ?? 'build'} · {run.engine ?? ''}
+			{run.engine_version ?? ''}
+		</span>
+	</div>
+
+	{#if nodes.length > 0}
+		<div class="border rounded overflow-hidden">
+			<table class="w-full text-xs">
+				<thead class="bg-surface-secondary text-secondary">
+					<tr>
+						<th class="text-left font-normal px-2 py-1">Node</th>
+						<th class="text-left font-normal px-2 py-1 w-24">Kind</th>
+						<th class="text-left font-normal px-2 py-1">Relation</th>
+						<th class="text-right font-normal px-2 py-1 w-20">Rows</th>
+						<th class="text-right font-normal px-2 py-1 w-20">Time</th>
+					</tr>
+				</thead>
+				<tbody>
+					{#each nodes as node (node.unique_id)}
+						{@const s = split(node.unique_id)}
+						{@const r = rank(node.status, node.outcome)}
+						<tr class="border-t {r < 2 ? 'bg-surface-secondary/40' : ''}">
+							<td class="px-2 py-1">
+								<div class="flex items-center gap-1.5 min-w-0">
+									<span class={statusClass(node.status, node.outcome)}>
+										{#if r === 0}
+											<XCircle size={13} />
+										{:else if r === 1}
+											<AlertTriangle size={13} />
+										{:else if r === 2}
+											<MinusCircle size={13} />
+										{:else}
+											<CheckCircle2 size={13} />
+										{/if}
+									</span>
+									<span class="font-mono truncate">{s.name}</span>
+									{#if node.message && r < 2}
+										<Tooltip>{node.message}</Tooltip>
+									{/if}
+								</div>
+								{#if node.message && r < 2}
+									<div class="pl-5 text-2xs {statusClass(node.status, node.outcome)} truncate">
+										{node.message}
+									</div>
+								{/if}
+							</td>
+							<td class="px-2 py-1 text-secondary">
+								<span class="inline-flex items-center gap-1">
+									{#if s.kind === 'test'}
+										<FlaskConical size={11} />
+									{/if}
+									{s.kind}
+								</span>
+							</td>
+							<td class="px-2 py-1 font-mono text-secondary truncate">
+								{fmtRelation(node.relation_name) ?? ''}
+							</td>
+							<td class="px-2 py-1 text-right tabular-nums text-secondary">
+								{node.rows_affected ?? ''}
+							</td>
+							<td class="px-2 py-1 text-right tabular-nums text-secondary">
+								{fmtTime(node.execution_time)}
+							</td>
+						</tr>
+					{/each}
+				</tbody>
+			</table>
+		</div>
+		{#if hasTests}
+			<div class="text-2xs text-secondary">
+				A test's severity decides the outcome: dbt's own <span class="font-mono">warn</span> surfaces
+				without failing the job.
+			</div>
+		{/if}
+	{/if}
+</div>
diff --git a/frontend/src/lib/components/dbt/parseDbtRun.test.ts b/frontend/src/lib/components/dbt/parseDbtRun.test.ts
new file mode 100644
index 0000000000..47d6073ef7
--- /dev/null
+++ b/frontend/src/lib/components/dbt/parseDbtRun.test.ts
@@ -0,0 +1,193 @@
+import { describe, it, expect } from 'vitest'
+import {
+	parseDbtRun,
+	relationOutcome,
+	splitRelation,
+	statusRank,
+	splitUniqueId,
+	nodeSelector
+} from './parseDbtRun'
+
+const run = {
+	engine: 'dbt-core-1x',
+	engine_version: '1.12.0',
+	command: 'build',
+	totals: { total: 1, success: 1, error: 0, warn: 0, skipped: 0 },
+	nodes: [{ unique_id: 'model.p.customers', status: 'success' }]
+}
+
+describe('parseDbtRun', () => {
+	it('takes a successful run as-is', () => {
+		expect(parseDbtRun(run)?.engine).toBe('dbt-core-1x')
+	})
+
+	// The worker puts the same JSON in the error message after the exit-status
+	// line, and this is the case worth rendering: the failing node is what the
+	// user came for.
+	it('recovers the run from a failed job’s error message', () => {
+		const failed = {
+			error: {
+				name: 'ExecutionErr',
+				message: `execution error:\nNon-zero exit status for dbt build: 1\n\n${JSON.stringify(run)}`
+			}
+		}
+		expect(parseDbtRun(failed)?.totals?.total).toBe(1)
+	})
+
+	// The failures worth reading are the ones whose message carries braces of its
+	// own — a Jinja template, the compiled SQL, an adapter's own JSON — and the
+	// payload is appended after all of it.
+	it('finds the run past braces in the error text', () => {
+		const failed = {
+			error: {
+				name: 'ExecutionErr',
+				message:
+					'execution error:\nCompilation Error in model x\n  {{ ref("missing") }} depends on {"a": 1}\n' +
+					`Non-zero exit status for dbt build: 1\n\n${JSON.stringify(run)}`
+			}
+		}
+		expect(parseDbtRun(failed)?.totals?.total).toBe(1)
+	})
+
+	// `{nodes, totals}` alone is a shape an ordinary script can return, and it
+	// would then be rendered as somebody's dbt run.
+	it('does not claim an ordinary result that happens to have nodes and totals', () => {
+		expect(parseDbtRun({ nodes: [], totals: {} })).toBeUndefined()
+		expect(parseDbtRun({ engine: 'v8', nodes: [], totals: {} })).toBeUndefined()
+	})
+
+	it('accepts every engine the worker stamps', () => {
+		for (const engine of ['dbt-core-1x', 'dbt-core-2x', 'fusion']) {
+			expect(parseDbtRun({ ...run, engine })?.engine).toBe(engine)
+		}
+	})
+
+	// The payload carries one object per node, so a scan bounded by brace COUNT
+	// gives up on an ordinary project — a few hundred nodes, tests included — and
+	// silently loses the per-model table on exactly the runs it exists for.
+	it('finds the run in a payload with hundreds of nodes', () => {
+		const big = {
+			...run,
+			totals: { total: 400, success: 399, error: 1, warn: 0, skipped: 0 },
+			nodes: Array.from({ length: 400 }, (_, i) => ({
+				unique_id: `model.p.m${i}`,
+				status: i === 0 ? 'error' : 'success'
+			}))
+		}
+		const failed = {
+			error: {
+				name: 'ExecutionErr',
+				message:
+					'execution error:\nCompilation Error {{ ref("x") }} {"a": 1}\n\n' +
+					JSON.stringify(big, null, 2)
+			}
+		}
+		expect(parseDbtRun(failed)?.nodes?.length).toBe(400)
+	})
+
+	it('is undefined for anything unparseable', () => {
+		expect(parseDbtRun(undefined)).toBeUndefined()
+		expect(parseDbtRun('a string')).toBeUndefined()
+		expect(parseDbtRun({ error: { message: 'failed with {not json' } })).toBeUndefined()
+	})
+})
+
+describe('statusRank', () => {
+	// dbt counts `partial success` in totals.error and a retry redoes it, so
+	// ranking it as a pass would contradict the job's own outcome.
+	it('ranks partial success with the failures', () => {
+		expect(statusRank('partial success')).toBe(statusRank('error'))
+		expect(statusRank('PARTIAL SUCCESS')).toBe(0)
+	})
+
+	// The worker publishes `unknown` for a status it does not recognise and counts
+	// it in `totals.error`; ranking it as a pass drew a green check on a node the
+	// same result called an error.
+	// The worker counts `no_op` in totals.skipped — dbt built nothing for that
+	// node — so a green check would claim a run that never happened.
+	it('ranks a no-op with the skips, not with the passes', () => {
+		expect(statusRank('no-op', 'no_op')).toBe(statusRank('skipped', 'skipped'))
+		expect(statusRank('success', 'no_op')).toBe(2)
+	})
+
+	it('ranks an unknown outcome with the failures, not with the passes', () => {
+		expect(statusRank('some-future-dbt-status', 'unknown')).toBe(0)
+		expect(statusRank('success', 'unknown')).toBe(0)
+	})
+
+	it('orders failed before warned before skipped before passed', () => {
+		expect(
+			['success', 'skipped', 'warn', 'error'].sort((a, b) => statusRank(a) - statusRank(b))
+		).toEqual(['error', 'warn', 'skipped', 'success'])
+	})
+})
+
+describe('splitUniqueId', () => {
+	it('splits kind from name and drops a generic test’s uniqueness hash', () => {
+		expect(splitUniqueId('model.jaffle.stg_orders')).toEqual({
+			kind: 'model',
+			name: 'stg_orders'
+		})
+		expect(splitUniqueId('test.jaffle.not_null_orders_id.4e687af8d0')).toEqual({
+			kind: 'test',
+			name: 'not_null_orders_id'
+		})
+		// A model whose name contains a dot keeps it: only tests carry the hash.
+		expect(splitUniqueId('model.jaffle.a.b').name).toBe('a.b')
+	})
+})
+
+describe('relationOutcome', () => {
+	it('agrees with the worker classifier on every status it names', () => {
+		expect(relationOutcome('started')).toBe('running')
+		for (const s of ['success', 'pass', 'PASS', ' Success ']) {
+			expect(relationOutcome(s)).toBe('materialized')
+		}
+		// `partial success` built the relation and then failed its tests; the
+		// worker records it failed, so the colour must agree.
+		for (const s of ['error', 'fail', 'runtime error', 'partial success', 'PARTIAL SUCCESS']) {
+			expect(relationOutcome(s)).toBe('failed')
+		}
+		// Nothing was built, so nothing is coloured.
+		for (const s of ['warn', 'skipped', 'no-op', 'something new']) {
+			expect(relationOutcome(s)).toBeUndefined()
+		}
+	})
+})
+
+describe('splitRelation', () => {
+	it('keeps a period that lives inside a quoted identifier', () => {
+		// The backend supports it, so rendering it as `v2.orders` names a
+		// relation that does not exist.
+		expect(splitRelation('"wh"."analytics.v2"."orders"')).toEqual(['wh', 'analytics.v2', 'orders'])
+		expect(splitRelation('"db"."schema"."name"')).toEqual(['db', 'schema', 'name'])
+		expect(splitRelation('db.schema.name')).toEqual(['db', 'schema', 'name'])
+		// BigQuery backticks and T-SQL brackets quote too.
+		expect(splitRelation('`proj`.`data.set`.`t`')).toEqual(['proj', 'data.set', 't'])
+		expect(splitRelation('[db].[my.schema].[t]')).toEqual(['db', 'my.schema', 't'])
+	})
+
+	// Every one of these dialects escapes its delimiter by doubling it. Dropping
+	// the pair renames the relation, and the manifest keeps the real spelling —
+	// so the run's status would be recorded against a key no graph node has.
+	it('keeps a delimiter the identifier escaped by doubling', () => {
+		expect(splitRelation('"wh"."schema"."a""b"')).toEqual(['wh', 'schema', 'a"b'])
+		expect(splitRelation('`proj`.`da``ta`.`t`')).toEqual(['proj', 'da`ta', 't'])
+		expect(splitRelation('[db].[my]]schema].[t]')).toEqual(['db', 'my]schema', 't'])
+	})
+})
+
+describe('nodeSelector', () => {
+	// Verified against dbt-core 1.12, dbt-core 2.0.0-alpha.5 and fusion
+	// 2.0.0-preview.202: the intersection resolves to the one node whatever the
+	// project's `model-paths` is, while a path-derived FQN resolves to nothing
+	// as soon as that root is more than one segment deep.
+	it('intersects the name with its package, wherever the model sits', () => {
+		expect(nodeSelector('model.jaffle_shop.fct_orders')).toBe('fct_orders,package:jaffle_shop')
+	})
+
+	// Ambiguous across packages, but a selector dbt resolves rather than rejects.
+	it('falls back to the bare name without a package', () => {
+		expect(nodeSelector('fct_orders')).toBe('fct_orders')
+	})
+})
diff --git a/frontend/src/lib/components/dbt/parseDbtRun.ts b/frontend/src/lib/components/dbt/parseDbtRun.ts
new file mode 100644
index 0000000000..aecd3dcf03
--- /dev/null
+++ b/frontend/src/lib/components/dbt/parseDbtRun.ts
@@ -0,0 +1,247 @@
+export type DbtNode = {
+	unique_id: string
+	status: string
+	/** Windmill's stable word for the same result, published beside dbt's own.
+	 *  Preferred wherever a decision is made: `status` is dbt's vocabulary and
+	 *  dbt may rename it. */
+	outcome?: DbtOutcome
+	execution_time?: number
+	rows_affected?: number
+	relation_name?: string
+	message?: string
+}
+
+export type DbtRun = {
+	engine?: string
+	engine_version?: string
+	command?: string
+	totals?: { total?: number; success?: number; error?: number; warn?: number; skipped?: number }
+	nodes?: DbtNode[]
+	/** The arguments the run actually used, as submitted. A `dbt retry` restores
+	 *  the failed run's arguments inside the worker, so the retry job's own args
+	 *  name only the run it resumed — this is the sole way to recover what it
+	 *  really ran with. */
+	invocation_args?: Record<string, unknown>
+}
+
+/** The engines the worker stamps on a result. This is the discriminator: a
+ *  `{nodes, totals}` shape alone is one an ordinary script can return, and it
+ *  would then be rendered as somebody's dbt run. */
+const ENGINES = ['dbt-core-1x', 'dbt-core-2x', 'fusion']
+
+function asDbtRun(v: unknown): DbtRun | undefined {
+	if (!v || typeof v !== 'object') return undefined
+	const o = v as Record<string, unknown>
+	return ENGINES.includes(o.engine as string) &&
+		Array.isArray(o.nodes) &&
+		o.totals != undefined &&
+		typeof o.totals === 'object'
+		? (o as DbtRun)
+		: undefined
+}
+
+/**
+ * The dbt invocation a job result describes, if it describes one.
+ *
+ * On success the result IS the run. On failure the worker puts the same JSON in
+ * the error message after the exit-status line, and that is the case worth
+ * rendering: the failing node is what the user came for.
+ */
+export function parseDbtRun(result: any): DbtRun | undefined {
+	const direct = asDbtRun(result)
+	if (direct) return direct
+	const msg = result?.error?.message
+	if (typeof msg !== 'string') return undefined
+	// The payload is appended pretty-printed, so its `{` is the only one at COLUMN
+	// ZERO — everything nested is indented, and dbt's own error text carries its
+	// braces mid-line. Counting braces instead needs a cap that a real project
+	// blows: forwards on an error full of them, backwards on one `{` per node.
+	for (const line of lineStarts(msg)) {
+		if (msg[line] !== '{') continue
+		try {
+			const run = asDbtRun(JSON.parse(msg.slice(line)))
+			if (run) return run
+		} catch {
+			// A `{` alone on a line inside the error text; the payload is later.
+		}
+	}
+	return undefined
+}
+
+/** Index of the first character of each line, the payload's own `{` among them. */
+function* lineStarts(s: string): Generator<number> {
+	let at = 0
+	while (at !== -1 && at < s.length) {
+		yield at
+		const next = s.indexOf('\n', at)
+		at = next === -1 ? -1 : next + 1
+	}
+}
+
+/** Ordering rank of a node's status: 0 failed, 1 warned, 2 skipped, 3 passed.
+ *
+ *  Both `unknown` and `no_op` rank where the RESULT counts them, not where the
+ *  default would put them: the worker counts `unknown` in `totals.error` and
+ *  `no_op` in `totals.skipped`, so falling through to 3 drew a green check on a
+ *  node the same result called an error, and on one it never built. */
+export function statusRank(status: string, outcome?: DbtOutcome): number {
+	switch (outcome ?? classifyStatus(status)) {
+		case 'failed':
+		case 'unknown':
+			return 0
+		case 'warned':
+			return 1
+		case 'skipped':
+		case 'no_op':
+			return 2
+		default:
+			return 3
+	}
+}
+
+/** The worker's stable vocabulary for a node result, published as `outcome`. */
+export type DbtOutcome =
+	| 'started'
+	| 'passed'
+	| 'failed'
+	| 'warned'
+	| 'skipped'
+	| 'no_op'
+	| 'unknown'
+
+/**
+ * dbt's node status, reduced to the outcomes the UI distinguishes.
+ *
+ * Only for results that predate `outcome`, or for the live event stream, which
+ * carries dbt's word alone. Anything holding a node from a job result should
+ * read `outcome` instead — that is the field the worker publishes precisely so
+ * this mapping is not the contract.
+ */
+function classifyStatus(
+	status: string
+): 'started' | 'passed' | 'failed' | 'warned' | 'skipped' | 'other' {
+	// `partial success` is dbt's word for a node that built but whose tests
+	// failed. The worker counts it in `totals.error` and a retry redoes it, so
+	// showing it green would contradict the job's own outcome.
+	switch (status.trim().toLowerCase()) {
+		case 'started':
+			return 'started'
+		case 'success':
+		case 'pass':
+			return 'passed'
+		case 'error':
+		case 'fail':
+		case 'runtime error':
+		case 'partial success':
+			return 'failed'
+		case 'warn':
+			return 'warned'
+		case 'skipped':
+			return 'skipped'
+		default:
+			return 'other'
+	}
+}
+
+/**
+ * The kind and name behind a dbt `unique_id`, which dbt builds as
+ * `<resource_type>.<package>.<name>`. A generic test's name carries a trailing
+ * hash dbt adds for uniqueness; it is noise in a run summary.
+ */
+export function splitUniqueId(uniqueId: string): { kind: string; name: string } {
+	const parts = uniqueId.split('.')
+	const kind = parts[0] ?? ''
+	let name = parts.slice(2).join('.')
+	if (kind === 'test') name = name.replace(/\.[0-9a-f]{6,}$/, '')
+	return { kind, name: name || uniqueId }
+}
+
+/**
+ * What a node's status says happened to the relation it builds, or `undefined`
+ * when it says nothing.
+ *
+ * Mirrors the worker's `classify_status`, and must keep mirroring it: the two
+ * decide the same thing about the same string, one for the record it writes and
+ * one for the colour drawn over it. `warn`, `skipped` and `no-op` leave the
+ * relation untouched, so they get no colour rather than a misleading one.
+ */
+export function relationOutcome(
+	status: string,
+	outcome?: DbtOutcome
+): 'running' | 'materialized' | 'failed' | undefined {
+	switch (outcome ?? classifyStatus(status)) {
+		case 'started':
+			return 'running'
+		case 'passed':
+			return 'materialized'
+		case 'failed':
+			return 'failed'
+		// `warn`, `skipped` and `no-op` say nothing about the relation: nothing
+		// was written, so its state is whatever the last run left.
+		default:
+			return undefined
+	}
+}
+
+/**
+ * dbt's `relation_name` split into its parts, honouring quoting.
+ *
+ * Mirrors the worker's `split_relation`: `"`, `` ` `` and `[` open a quoted
+ * identifier, and a `.` inside one is part of the name. Splitting on every `.`
+ * turns `"wh"."analytics.v2"."orders"` into a relation called `orders` in a
+ * schema called `v2` — a table that does not exist.
+ */
+export function splitRelation(relation: string): string[] {
+	const parts: string[] = []
+	let current = ''
+	let quote: string | undefined
+	for (let i = 0; i < relation.length; i++) {
+		const c = relation[i]
+		if (quote !== undefined) {
+			const close = quote === '[' ? ']' : quote
+			if (c === close) {
+				// Doubled, which is how each of these dialects escapes its own
+				// delimiter: one literal character, not the end of the identifier.
+				if (relation[i + 1] === close) {
+					current += close
+					i++
+				} else {
+					quote = undefined
+				}
+			} else current += c
+		} else if (c === '"' || c === '`' || c === '[') {
+			quote = c
+		} else if (c === '.') {
+			parts.push(current)
+			current = ''
+		} else {
+			current += c
+		}
+	}
+	parts.push(current)
+	return parts.map((p) => p.trim())
+}
+
+/**
+ * A selector naming exactly one node: `<name>,package:<package>`.
+ *
+ * The comma is dbt's intersection operator, so this reads "the node whose name
+ * is `<name>` and whose package is `<package>`" — one node, since dbt refuses
+ * two models of one name inside a package. A bare name would match the leaf of
+ * every package's FQN, and a package can ship a model whose name the project
+ * also uses.
+ *
+ * Not the FQN (`<package>.<subdirs...>.<name>`), which cannot be rebuilt from
+ * `original_file_path`: how many leading segments are the resource root is
+ * `model-paths`, and dropping exactly one turns `src/models/marts/orders.sql`
+ * into `pkg.models.marts.orders`, which dbt's matcher — equal lengths, from the
+ * front — resolves to nothing at all.
+ *
+ * Without a package, the bare name — ambiguous across packages, but a selector
+ * dbt resolves rather than one it rejects.
+ */
+export function nodeSelector(uniqueId: string): string {
+	const { name } = splitUniqueId(uniqueId)
+	const pkg = uniqueId.split('.')[1]
+	return pkg ? `${name},package:${pkg}` : name
+}
diff --git a/frontend/src/lib/components/dbt/previewRows.ts b/frontend/src/lib/components/dbt/previewRows.ts
new file mode 100644
index 0000000000..9364196d4a
--- /dev/null
+++ b/frontend/src/lib/components/dbt/previewRows.ts
@@ -0,0 +1,108 @@
+import { JobService, type ScriptModule } from '$lib/gen'
+
+/** An unsaved project, submitted as its own preview job. Held as it was sent,
+ *  never re-read from the editor: a graph describes the project it was parsed
+ *  from, and so must anything run against that graph's nodes. */
+export type DbtPreviewBuffer = {
+	content: string
+	modules: Record<string, ScriptModule> | undefined
+	tag?: string
+	timeout?: number
+	/** The arguments the project was parsed under, in run-form shape. Part of the
+	 *  snapshot because vars decide `enabled`, schemas and aliases: run a preview
+	 *  under later ones and it can address a relation this graph never had. */
+	args: Record<string, unknown> | undefined
+}
+
+/** A model's rows, as `dbt show` returns them. */
+export type DbtPreview =
+	| { pending: true }
+	| { rows: Record<string, unknown>[]; node?: string; tookMs: number }
+	| { error: string }
+
+/**
+ * Preview one model's rows by running its own project's `dbt show`.
+ *
+ * A job, not a query: the rows come from the warehouse through the project's
+ * profile, with its vars and its adapter, which is the only place that knows how
+ * to resolve `ref()` and where the relation actually lives. `show` is therefore
+ * not a run-form command — it is what a table's preview is made of, here and on
+ * the run page's graph.
+ *
+ * Which project runs is decided by the caller, and must match the graph the SQL
+ * on screen came from: a deployed version by hash, a buffer parse by shipping
+ * that same buffer.
+ *
+ * `stillWanted` is asked before each poll and before the result is used, so a
+ * preview outlives neither the page that asked for it nor a navigation.
+ */
+export async function previewDbtRows(opts: {
+	workspace: string
+	scriptPath: string
+	/** Pins the preview to a deployed version, for a graph showing that version. */
+	scriptHash?: string | number
+	/** The project the graph was parsed from, when that was a buffer. Required
+	 *  then, because there may be no deployed version at all — and when there
+	 *  is, it can lack the model or build it from other SQL. */
+	buffer?: DbtPreviewBuffer
+	/** One node: a model name, or `package.model` where two packages share one. */
+	model: string
+	/** The run's own vars, so a descriptor with a required `{{ }}` var resolves. */
+	vars?: Record<string, unknown>
+	limit?: number
+	/** Extra top-level arguments — a run's `{{ placeholder }}` values. */
+	args?: Record<string, unknown>
+	stillWanted?: () => boolean
+}): Promise<DbtPreview | undefined> {
+	const { workspace, scriptPath, scriptHash, buffer, model, vars, limit, args, stillWanted } = opts
+	const startedAt = Date.now()
+	const requestBody = {
+		...(args ?? {}),
+		command: { label: 'show', vars: vars ?? {}, model, limit: limit ?? 25 }
+	}
+	try {
+		// The BUFFER when the caller has one, because then the graph and the SQL
+		// above these rows are the buffer's: a model added since the deploy exists
+		// in no other project, and one whose SQL changed builds different rows
+		// there. It ships whole — dbt resolves `ref()` project-wide.
+		//
+		// Otherwise by HASH whenever the caller pins one: the SQL on screen is that
+		// version's, and running the deployed one would show today's rows under
+		// it — or fail outright for a model since removed.
+		const id = buffer
+			? await JobService.runScriptPreview({
+					workspace,
+					timeout: buffer.timeout,
+					requestBody: {
+						path: scriptPath,
+						content: buffer.content,
+						language: 'dbt',
+						tag: buffer.tag,
+						modules: buffer.modules,
+						args: requestBody
+					}
+				})
+			: scriptHash
+				? await JobService.runScriptByHash({
+						workspace,
+						hash: String(scriptHash),
+						requestBody
+					})
+				: await JobService.runScriptByPath({ workspace, path: scriptPath, requestBody })
+		// Polled rather than awaited: a preview is a job, and its engine may need
+		// provisioning on a cold worker.
+		for (let i = 0; i < 90; i++) {
+			await new Promise((r) => setTimeout(r, 1000))
+			if (stillWanted && !stillWanted()) return undefined
+			const done = await JobService.getCompletedJobResultMaybe({ workspace, id })
+			if (!done.completed) continue
+			const res = done.result as { node?: string; show?: Record<string, unknown>[] } | undefined
+			return done.success && res?.show
+				? { rows: res.show, node: res.node, tookMs: Date.now() - startedAt }
+				: { error: 'The preview job failed — open it from Runs for the detail.' }
+		}
+		return { error: 'The preview is still running; open it from Runs.' }
+	} catch (e) {
+		return { error: e instanceof Error ? e.message : String(e) }
+	}
+}
diff --git a/frontend/src/lib/components/dbt/projectFiles.test.ts b/frontend/src/lib/components/dbt/projectFiles.test.ts
new file mode 100644
index 0000000000..d9ed58b41a
--- /dev/null
+++ b/frontend/src/lib/components/dbt/projectFiles.test.ts
@@ -0,0 +1,72 @@
+import { describe, expect, it } from 'vitest'
+import type { ScriptModule } from '$lib/gen'
+import { dbtModelSelector, dbtModulePath, dbtProjectFileKey } from './projectFiles'
+
+const mod = (content: string): ScriptModule => ({ content, language: 'dbt' as any })
+
+const PROJECT = `name: jaffle
+model-paths: ["models"]
+`
+
+describe('dbtModulePath', () => {
+	// The worker resolves `.` and `//` away when it materialises the bundle, so a
+	// redundant spelling is a second key for one file on disk and walks straight
+	// past a check that compares the typed string.
+	it('canonicalises before the reserved-name and duplicate checks', () => {
+		expect(dbtModulePath('./models//x.sql', {})).toEqual({ path: 'models/x.sql' })
+		expect(dbtModulePath('./wm_dbt.yaml', {})).toEqual({
+			error: expect.stringContaining('is the descriptor')
+		})
+		const bundle = { './models/x.sql': mod('select 1') }
+		expect(dbtModulePath('models/x.sql', bundle)).toEqual({
+			error: expect.stringContaining('./models/x.sql already exists')
+		})
+	})
+
+	// A path outside the bundle has no canonical form inside it, and the worker
+	// drops it — which would read as a file that was added and never written.
+	it('refuses a path that escapes the bundle', () => {
+		expect(dbtModulePath('../secrets.sql', {})).toEqual({ error: expect.stringContaining('..') })
+		expect(dbtModulePath('/etc/x.sql', {})).toEqual({ error: expect.stringContaining('relative') })
+	})
+
+	it('refuses an extension dbt does not read', () => {
+		expect(dbtModulePath('models/x.txt', {})).toEqual({
+			error: expect.stringContaining('must end with')
+		})
+	})
+})
+
+// Every write path canonicalises, so a read that compares the constant exactly
+// would neither find a project imported under a redundant spelling nor protect
+// it from deletion.
+it('resolves the key a bundle actually holds the project file under', () => {
+	expect(dbtProjectFileKey({ './dbt_project.yml': mod(PROJECT) })).toBe('./dbt_project.yml')
+	expect(dbtProjectFileKey({})).toBeUndefined()
+})
+
+describe('dbtModelSelector', () => {
+	// Package-qualified, because a bare leaf name also matches a dependency
+	// package's model of the same name.
+	it('selects a model under the project’s own model-paths', () => {
+		const bundle = { 'dbt_project.yml': mod(PROJECT), 'models/orders.sql': mod('select 1') }
+		expect(dbtModelSelector(bundle, 'models/orders.sql')).toBe('orders,package:jaffle')
+	})
+
+	// A project may put its models anywhere; a macro or singular test is `.sql`
+	// too and is not selectable by name, so those fall back to the whole project.
+	it('honours a custom model-paths and skips what is not a model', () => {
+		const bundle = {
+			'dbt_project.yml': mod('name: jaffle\nmodel-paths: ["transform"]\n'),
+			'transform/orders.sql': mod('select 1'),
+			'macros/cents.sql': mod('{% macro cents() %}{% endmacro %}')
+		}
+		expect(dbtModelSelector(bundle, 'transform/orders.sql')).toBe('orders,package:jaffle')
+		expect(dbtModelSelector(bundle, 'macros/cents.sql')).toBeUndefined()
+	})
+
+	it('finds the project file under a redundant spelling', () => {
+		const bundle = { './dbt_project.yml': mod(PROJECT), 'models/orders.sql': mod('select 1') }
+		expect(dbtModelSelector(bundle, 'models/orders.sql')).toBe('orders,package:jaffle')
+	})
+})
diff --git a/frontend/src/lib/components/dbt/projectFiles.ts b/frontend/src/lib/components/dbt/projectFiles.ts
new file mode 100644
index 0000000000..36902ac74a
--- /dev/null
+++ b/frontend/src/lib/components/dbt/projectFiles.ts
@@ -0,0 +1,162 @@
+/**
+ * The rules for the files of a dbt project, which is what a dbt script's module
+ * bundle is.
+ *
+ * A `__mod` bundle is homogeneous — one language, one extension — and a dbt
+ * project is not: models are SQL or Python, schemas and the project file YAML,
+ * seeds CSV, doc blocks Markdown. Every module is stored with `language: dbt`
+ * because they are dbt's to read, so everything below is decided by the file
+ * name.
+ */
+import type { Preview, ScriptModule } from '$lib/gen'
+import { canonicalModulePath, findModulePathClash } from '../scriptModulePath'
+import YAML from 'yaml'
+
+/** The descriptor. It is the script's CONTENT, not a module: a module at the
+ *  same path would be a second, independent value for one file, since the export
+ *  writes the content there and the bundle would emit over it. */
+export const DBT_DESCRIPTOR = 'wm_dbt.yaml'
+
+/** What makes the bundle a project. The worker refuses a version without it, so
+ *  it is the one file the tree will not let you delete. */
+export const DBT_PROJECT_FILE = 'dbt_project.yml'
+
+/** The key a bundle actually holds `dbt_project.yml` under.
+ *
+ *  Not the constant: nothing on the push path rewrites existing keys, so a
+ *  project imported with `./dbt_project.yml` in it holds that spelling, and an
+ *  exact lookup would neither find the project nor protect it from deletion —
+ *  while every write path canonicalises. Resolved the same way the duplicate
+ *  check resolves a clash. */
+export function dbtProjectFileKey(
+	modules: Record<string, unknown> | null | undefined
+): string | undefined {
+	return findModulePathClash(modules, DBT_PROJECT_FILE)
+}
+
+/**
+ * Extensions a dbt project's own files take. `.py` because dbt Python models are
+ * first-class on Snowflake, BigQuery and Databricks.
+ */
+export const DBT_MODULE_EXTENSIONS = ['.sql', '.py', '.yml', '.yaml', '.csv', '.md']
+
+/**
+ * The editor language for one project file, by extension. `postgresql` and
+ * `ansible` are how Windmill spells "SQL" and "YAML" to the editor.
+ */
+export function dbtFileLang(path: string): Preview['language'] {
+	if (path.endsWith('.sql')) return 'postgresql'
+	if (path.endsWith('.yml') || path.endsWith('.yaml')) return 'ansible'
+	if (path.endsWith('.py')) return 'python3'
+	// `.md` (a doc block) and `.csv` (a seed) have no grammar of their own here;
+	// `bash` leaves prose alone, where the default would colour it as TypeScript.
+	return 'bash'
+}
+
+/** Whether this file may be added to the bundle at all. */
+export function dbtModuleLang(filePath: string): ScriptModule['language'] | undefined {
+	return DBT_MODULE_EXTENSIONS.some((e) => filePath.endsWith(e))
+		? ('dbt' as ScriptModule['language'])
+		: undefined
+}
+
+/** The canonical key a typed path becomes, or the reason it cannot be one.
+ *
+ *  Canonicalised before the reserved-name and duplicate checks, not after: the
+ *  worker resolves `.` and `//` away when it materialises the bundle, so
+ *  `./dbt_project.yml` and `dbt_project.yml` are two keys for one file on disk
+ *  and either check is trivially walked past by the redundant spelling. */
+export function dbtModulePath(
+	path: string,
+	modules: Record<string, ScriptModule> | undefined
+): { path: string } | { error: string } {
+	const canonical = canonicalModulePath(path)
+	if ('error' in canonical) return canonical
+	if (canonical.path === DBT_DESCRIPTOR) {
+		return {
+			error: `${DBT_DESCRIPTOR} is the descriptor, edited from the tree — it cannot also be a file`
+		}
+	}
+	if (!dbtModuleLang(canonical.path)) {
+		return { error: `File must end with one of: ${DBT_MODULE_EXTENSIONS.join(', ')}` }
+	}
+	const clash = findModulePathClash(modules, canonical.path)
+	if (clash) return { error: `${clash} already exists` }
+	return canonical
+}
+
+/** Why this path cannot be a file, or `undefined` when it can. */
+export function dbtPathError(
+	path: string,
+	modules: Record<string, ScriptModule> | undefined
+): string | undefined {
+	if (!path.trim()) return undefined
+	const resolved = dbtModulePath(path, modules)
+	return 'error' in resolved ? resolved.error : undefined
+}
+
+/** A new file's starting content. A model compiles on its own, so it is runnable
+ *  before it is edited; anything else starts empty rather than with a guess at
+ *  which dbt schema it is. */
+export function dbtDefaultContent(filePath: string): string {
+	return filePath.endsWith('.sql') ? 'select 1 as id\n' : ''
+}
+
+/**
+ * What `dbt build --select` should be given for an open file, or `undefined`
+ * when the file is not a model.
+ *
+ * Only files under the project's `model-paths` are models; a project also holds
+ * macros, analyses and singular tests, all `.sql`, none of them selectable by
+ * name. The selector is package-qualified because a bare leaf name also matches a
+ * dependency package's model of the same name.
+ */
+export function dbtModelSelector(
+	modules: Record<string, { content?: string }>,
+	filePath: string
+): string | undefined {
+	// `.py` as well as `.sql`: a dbt Python model is a model, and leaving it out
+	// would run the whole project to check one file — the larger warehouse bill
+	// this narrowing exists to avoid.
+	const ext = ['.sql', '.py'].find((e) => filePath.endsWith(e))
+	if (!ext) return undefined
+	const projectKey = dbtProjectFileKey(modules)
+	let project: any
+	try {
+		project = YAML.parse((projectKey ? modules[projectKey] : undefined)?.content ?? '')
+	} catch {
+		return undefined
+	}
+	if (!project?.name) return undefined
+	const modelPaths: string[] = Array.isArray(project['model-paths'])
+		? project['model-paths']
+		: ['models']
+	if (!modelPaths.some((d) => filePath === d || filePath.startsWith(d + '/'))) return undefined
+	const name = filePath.split('/').pop()!.slice(0, -ext.length)
+	return `${name},package:${project.name}`
+}
+
+/** The descriptor's `engine` and `profile.warehouse`, for the editor's header.
+ *  Best effort: a descriptor mid-edit is often not valid YAML, and a header that
+ *  blanked on every keystroke would be worse than one that lags. */
+export function dbtDescriptorSummary(content: string): {
+	engine: string
+	warehouse: string
+} {
+	try {
+		const d = YAML.parse(content ?? '')
+		return {
+			engine: typeof d?.engine === 'string' ? d.engine : 'dbt-core-1x',
+			// A descriptor naming its own `profiles_yml` and no warehouse has no
+			// warehouse identity at all, which is what leaves it with no graph.
+			warehouse:
+				typeof d?.profile?.warehouse === 'string'
+					? d.profile.warehouse
+					: d?.profile?.profiles_yml
+						? 'own profiles.yml'
+						: 'main'
+		}
+	} catch {
+		return { engine: 'dbt-core-1x', warehouse: 'main' }
+	}
+}
diff --git a/frontend/src/lib/components/dbt/runStatus.svelte.ts b/frontend/src/lib/components/dbt/runStatus.svelte.ts
new file mode 100644
index 0000000000..aaca172717
--- /dev/null
+++ b/frontend/src/lib/components/dbt/runStatus.svelte.ts
@@ -0,0 +1,100 @@
+/**
+ * What a dbt run is doing to each relation on a model graph, live and then
+ * settled.
+ *
+ * Two sources, in that order of authority:
+ *
+ * * the run's own `run_results.json`, once it has one — joined on dbt's
+ *   `unique_id`, which is what both sides carry. The per-relation state table
+ *   holds ONE row per relation stamped with its last writer, so reading that
+ *   for a finished run would show it a later run's outcomes.
+ * * `dbt_run_progress` while it is in flight, polled. Only `dbt-core-1x` emits
+ *   the node events behind it, and only a database-connected worker records
+ *   them, so on the other engines and on agent workers this stays empty and the
+ *   graph colours at the end instead.
+ *
+ * One definition, used by the run page and by the editor: a second one would be
+ * a second answer to "what colour is this model right now".
+ */
+import { JobService } from '$lib/gen'
+import type { AssetGraphResponse, AssetRunState } from '$lib/components/assets/AssetGraph/types'
+import { parseDbtRun, relationOutcome } from './parseDbtRun'
+
+export function useDbtRunStatus(opts: {
+	workspace: () => string | undefined
+	/** The run whose progress to show, or `undefined` for a graph with no run. */
+	jobId: () => string | undefined
+	running: () => boolean
+	/** The finished job's result, which carries a status per dbt node. */
+	result: () => unknown
+	/** The graph on screen, for the `unique_id` → relation mapping. */
+	graph: () => AssetGraphResponse | undefined
+	/** Guards every response against a navigation: a poll that outlives the run
+	 *  it was issued for would colour the next one's models. */
+	generation: () => number
+	destroyed: () => boolean
+}) {
+	let polled = $state<Map<string, AssetRunState>>(new Map())
+
+	async function load() {
+		const ws = opts.workspace()
+		const id = opts.jobId()
+		if (!ws || !id) return
+		const gen = opts.generation()
+		try {
+			const rows = await JobService.getRunProgress({ workspace: ws, id })
+			if (gen !== opts.generation() || opts.destroyed()) return
+			const next = new Map<string, AssetRunState>()
+			for (const r of rows) {
+				next.set(`asset:${r.asset_kind}:${r.asset_path}`, {
+					status: r.status,
+					rowCount: r.row_count
+				})
+			}
+			polled = next
+		} catch {
+			// A progress hiccup must not blank the graph.
+		}
+	}
+
+	let run = $derived(parseDbtRun(opts.result()))
+
+	let settled = $derived.by(() => {
+		if (opts.running()) return undefined
+		const g = opts.graph()
+		if (!run?.nodes?.length || !g) return undefined
+		const assetByNode = new Map<string, string>()
+		for (const a of g.assets) {
+			if (a.dbt?.unique_id) assetByNode.set(a.dbt.unique_id, `asset:${a.kind}:${a.path}`)
+		}
+		const out = new Map<string, AssetRunState>()
+		for (const n of run.nodes) {
+			const id = assetByNode.get(n.unique_id)
+			const outcome = id && relationOutcome(n.status, n.outcome)
+			// A test or an analysis matches no relation, and a skipped node says
+			// nothing about one; both are left uncoloured rather than guessed at.
+			if (id && outcome) out.set(id, { status: outcome, rowCount: n.rows_affected })
+		}
+		return out.size > 0 ? out : undefined
+	})
+
+	return {
+		/** Poll once. The caller owns the cadence — a run page ticks while its job
+		 *  runs, the editor while a build does. */
+		load,
+		/** Drop what a previous run left, so its colours do not survive into the
+		 *  next one. */
+		reset: () => (polled = new Map()),
+		get status() {
+			return settled ?? polled
+		},
+		/** Whether the run settled itself, which is what tells a caller it no
+		 *  longer needs to poll. */
+		get isSettled() {
+			return settled != undefined
+		},
+		get run() {
+			return run
+		}
+	}
+}
diff --git a/frontend/src/lib/components/debug/dapClient.ts b/frontend/src/lib/components/debug/dapClient.ts
index 71783b4ec0..d124637b9b 100644
--- a/frontend/src/lib/components/debug/dapClient.ts
+++ b/frontend/src/lib/components/debug/dapClient.ts
@@ -82,6 +82,14 @@ const initialState: DebugState = {
 
 export const debugState = writable<DebugState>({ ...initialState })
 
+const DEFAULT_REQUEST_TIMEOUT_MS = 10_000
+
+// `launch` waits on dependency installation in the debug server, which can take minutes on a
+// cold cache; anything shorter here reports a timeout while the install is still running.
+const REQUEST_TIMEOUT_MS_BY_COMMAND: Record<string, number> = {
+	launch: 180_000
+}
+
 export class DAPClient {
 	private ws: WebSocket | null = null
 	private seq = 1
@@ -120,7 +128,13 @@ export class DAPClient {
 						logs: s.logs,
 						output: s.output
 					}))
+					// Reject rather than drop: a dropped `launch` leaves its caller awaiting
+					// until the timeout below fires, which is minutes rather than seconds.
+					const aborted = Array.from(this.pendingRequests.values())
 					this.pendingRequests.clear()
+					for (const pending of aborted) {
+						pending.reject(new Error('DAP connection closed'))
+					}
 				}
 
 				this.ws.onerror = (error) => {
@@ -164,11 +178,13 @@ export class DAPClient {
 			arguments: args
 		}
 
+		const timeoutMs = REQUEST_TIMEOUT_MS_BY_COMMAND[command] ?? DEFAULT_REQUEST_TIMEOUT_MS
+
 		return new Promise((resolve, reject) => {
 			const timeout = setTimeout(() => {
 				this.pendingRequests.delete(seq)
-				reject(new Error(`Request timeout: ${command}`))
-			}, 10000)
+				reject(new Error(`Request timeout: ${command} (after ${timeoutMs}ms)`))
+			}, timeoutMs)
 
 			this.pendingRequests.set(seq, {
 				resolve: (value) => {
diff --git a/frontend/src/lib/components/details/OnBehalfOfBadge.svelte b/frontend/src/lib/components/details/OnBehalfOfBadge.svelte
new file mode 100644
index 0000000000..13bd94b122
--- /dev/null
+++ b/frontend/src/lib/components/details/OnBehalfOfBadge.svelte
@@ -0,0 +1,34 @@
+<script lang="ts">
+	import { UserCog } from 'lucide-svelte'
+	import Badge from '$lib/components/common/badge/Badge.svelte'
+	import Tooltip from '$lib/components/meltComponents/Tooltip.svelte'
+
+	interface Props {
+		/** Authorization identity the runnable runs as: `u/{username}`, `g/{group}`, or a bare email. */
+		onBehalfOf: string | undefined
+		/** Address of the account `onBehalfOf` names, derived from it on the read paths. */
+		onBehalfOfEmail: string | undefined
+		kind: 'script' | 'flow'
+	}
+
+	let { onBehalfOf, onBehalfOfEmail, kind }: Props = $props()
+
+	// The address is a display detail; it is only ever present alongside the identity, and
+	// it repeats it when the identity is itself an email.
+	let detailed = $derived(
+		onBehalfOfEmail != undefined && onBehalfOfEmail !== onBehalfOf
+			? `${onBehalfOf} (${onBehalfOfEmail})`
+			: onBehalfOf
+	)
+</script>
+
+{#if onBehalfOf}
+	<Tooltip>
+		{#snippet text()}
+			Every run of this {kind} is permissioned as {detailed}, whoever starts it.
+		{/snippet}
+		<Badge color="violet" icon={{ icon: UserCog, position: 'left' }}>
+			<span class="truncate max-w-40">On behalf of {onBehalfOf}</span>
+		</Badge>
+	</Tooltip>
+{/if}
diff --git a/frontend/src/lib/components/flows/DebounceLimit.svelte b/frontend/src/lib/components/flows/DebounceLimit.svelte
index 1889d964ba..3ab55caeed 100644
--- a/frontend/src/lib/components/flows/DebounceLimit.svelte
+++ b/frontend/src/lib/components/flows/DebounceLimit.svelte
@@ -5,6 +5,7 @@
 	import { enterpriseLicense } from '$lib/stores'
 	import Label from '../Label.svelte'
 	import type { Schema } from '$lib/common'
+	import { slideDynamic } from '$lib/transitions'
 
 	let {
 		debounce_delay_s = $bindable(),
@@ -16,7 +17,8 @@
 		placeholder,
 		size = 'xs',
 		color = undefined,
-		fontClass = 'font-normal'
+		fontClass = 'font-normal',
+		indentContent = false
 	}: {
 		debounce_delay_s: number | undefined
 		debounce_key: string | undefined
@@ -28,6 +30,8 @@
 		size: 'xs' | 'sm'
 		color?: 'nord' | undefined
 		fontClass?: string
+		/** Align the fields under the toggle's label, as the flow step settings do. */
+		indentContent?: boolean
 	} = $props()
 
 	// Check if an originalType like "string | string[]" is a top-level
@@ -85,6 +89,10 @@
 			max_total_debounces_amount = undefined
 		}
 	})
+
+	// Presence, not truthiness: a single backspace takes the seeded 1s to 0 while the
+	// user is still typing, and reading that as off would disable the field mid-edit.
+	let off = $derived(!$enterpriseLicense || debounce_delay_s === undefined)
 </script>
 
 <div>
@@ -94,9 +102,9 @@
 			{color}
 			{size}
 			disabled={!$enterpriseLicense}
-			checked={Boolean(debounce_delay_s)}
+			checked={debounce_delay_s !== undefined}
 			on:change={() => {
-				if (debounce_delay_s) {
+				if (debounce_delay_s !== undefined) {
 					debounce_delay_s = undefined
 					debounce_key = undefined
 				} else {
@@ -113,10 +121,10 @@
 		/>
 	</div>
 
-	{#if debounce_delay_s}
-		<div class="flex flex-col gap-4 mt-2">
+	{#if !off}
+		<div class="flex flex-col gap-4 mt-2 {indentContent ? 'pl-9' : ''}" transition:slideDynamic>
 			<Label label="Delay in seconds">
-				<SecondsInput disabled={!$enterpriseLicense} bind:seconds={debounce_delay_s} />
+				<SecondsInput disabled={off} bind:seconds={debounce_delay_s} />
 			</Label>
 			<Label label="Custom debounce key (optional)">
 				{#snippet header()}
@@ -125,14 +133,7 @@
 						`$workspace`. You can also use an argument's value using `$args[name_of_arg]`</Tooltip
 					>
 				{/snippet}
-				<!-- svelte-ignore a11y_autofocus -->
-				<input
-					type="text"
-					autofocus
-					disabled={!$enterpriseLicense}
-					bind:value={debounce_key}
-					{placeholder}
-				/>
+				<input type="text" disabled={off} bind:value={debounce_key} {placeholder} />
 			</Label>
 			<Label label="Argument to accumulate (optional)">
 				{#snippet header()}
@@ -141,7 +142,7 @@
 						debounced execution will be appended together.</Tooltip
 					>
 				{/snippet}
-				<select disabled={!$enterpriseLicense} bind:value={selectedArg}>
+				<select disabled={off} bind:value={selectedArg}>
 					<option value="">None</option>
 					{#each arrayArgs as arg}
 						<option value={arg}>{arg}</option>
@@ -161,7 +162,7 @@
 						this time is reached, the job will run regardless of ongoing debouncing.</Tooltip
 					>
 				{/snippet}
-				<SecondsInput disabled={!$enterpriseLicense} bind:seconds={max_total_debouncing_time} />
+				<SecondsInput disabled={off} bind:seconds={max_total_debouncing_time} />
 			</Label>
 			<Label label="Max total debounces amount (optional)">
 				{#snippet header()}
@@ -170,12 +171,7 @@
 						is reached, the job will run regardless of ongoing debouncing.</Tooltip
 					>
 				{/snippet}
-				<input
-					type="number"
-					disabled={!$enterpriseLicense}
-					bind:value={max_total_debounces_amount}
-					min="0"
-				/>
+				<input type="number" disabled={off} bind:value={max_total_debounces_amount} min="0" />
 			</Label>
 		</div>
 	{/if}
diff --git a/frontend/src/lib/components/flows/FlowEditor.svelte b/frontend/src/lib/components/flows/FlowEditor.svelte
index a484675f83..a8c18f70ba 100644
--- a/frontend/src/lib/components/flows/FlowEditor.svelte
+++ b/frontend/src/lib/components/flows/FlowEditor.svelte
@@ -1,12 +1,18 @@
 <script lang="ts">
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
+	import Disposable from '$lib/components/common/drawer/Disposable.svelte'
 	import FlowEditorPanel from './content/FlowEditorPanel.svelte'
 	import FlowModuleSchemaMap from './map/FlowModuleSchemaMap.svelte'
 	import type { OpenInSessionSource } from '$lib/components/sessions/OpenInSessionButton.svelte'
 	import WindmillIcon from '../icons/WindmillIcon.svelte'
 	import { Skeleton } from '../common'
-	import { getContext, onDestroy, onMount, setContext } from 'svelte'
-	import type { FlowEditorContext } from './types'
+	import { getContext, onDestroy, onMount, setContext, untrack } from 'svelte'
+	import type { FlowEditorContext, FlowPanelDetachContext } from './types'
+	import { getOverlayHost } from '$lib/components/common/overlayHost.svelte'
+	import Portal from '$lib/components/Portal.svelte'
+	import { isFlowLevelPanelTarget } from '$lib/components/graph/selectionUtils.svelte'
+	import { useFlowPanelMode } from './flowPanelMode.svelte'
+	import { useFlowPanelPlacementTelemetry } from './flowEditorTelemetry'
 
 	import { writable } from 'svelte/store'
 	import type { PropPickerContext, FlowPropPickerConfig } from '$lib/components/prop_picker'
@@ -26,7 +32,10 @@
 	import type { FlowOptions } from '../copilot/chat/ContextManager.svelte'
 	import { extractAllModules } from '../copilot/chat/shared'
 	import type { Snippet } from 'svelte'
-	const { flowStore } = getContext<FlowEditorContext>('FlowEditorContext')
+	import { Button } from '../common'
+	import { MousePointerClick, X } from 'lucide-svelte'
+	import FlowPanelPlacementPicker from './common/FlowPanelPlacementPicker.svelte'
+	const { flowStore, selectionManager } = getContext<FlowEditorContext>('FlowEditorContext')
 	const sessionScopedManager = getContext<AIChatManager>('aiChatManager')
 	const aiChatManager = sessionScopedManager ?? singletonAiChatManager
 
@@ -69,6 +78,9 @@
 		flowHasChanged?: boolean
 		previewOpen: boolean
 		graphOverlay?: Snippet
+		/** Allow the step-details pane to open as a modal. Whitelabel embeds turn this off
+		 *  to keep the classic always-docked pane. */
+		modalPanel?: boolean
 	}
 
 	let {
@@ -105,11 +117,91 @@
 		onDelete,
 		flowHasChanged,
 		previewOpen,
-		graphOverlay
+		graphOverlay,
+		modalPanel = true
 	}: Props = $props()
 
 	let flowModuleSchemaMap: FlowModuleSchemaMap | undefined = $state()
 
+	// 'docked' = normal split pane; 'modal' = graph full-width, panel in a modal opened by
+	// double-clicking a node. The controller resolves it from the user's Auto/Attached/
+	// Detached preference and the width measured below.
+	const panelController = useFlowPanelMode({ enabled: () => modalPanel })
+	const panelMode = $derived(panelController.mode)
+	let panelModalOpen = $state(false)
+
+	// Owned by FlowBuilder: this component is inside a `{#key}` that rebuilds it on a reload,
+	// and the crossing count belongs to the editing session rather than to one mount.
+	const placementTelemetry = useFlowPanelPlacementTelemetry()
+	$effect(() => {
+		placementTelemetry.observe(panelController.preference, panelMode, panelController.measured)
+	})
+
+	// Auto can move the panel back into the pane under a modal that is open — leaving it
+	// open would keep an overlay registered for a modal nothing renders, swallowing Escape.
+	$effect(() => {
+		if (panelMode === 'docked' && untrack(() => panelModalOpen)) {
+			panelModalOpen = false
+		}
+	})
+
+	let panelDisposable: Disposable | undefined = $state(undefined)
+	// Disposable joins the stack through its methods, not by watching `open` — same sync
+	// as Drawer and Modal, so setting `panelModalOpen` anywhere still registers the overlay.
+	$effect(() => {
+		panelModalOpen
+		untrack(() => {
+			panelModalOpen ? panelDisposable?.openDrawer() : panelDisposable?.closeDrawer()
+		})
+	})
+
+	const overlayHost = getOverlayHost()
+	const modalHost = $derived(overlayHost?.el())
+
+	// Only nodes that can take the selection, or the modal would open on whatever was
+	// selected before — asset and note nodes are deliberately unselectable.
+	//
+	// The In/Out bar sits inside the node but is a picker of its own: it toggles open and
+	// shut on click, so opening then closing it is a double-click the graph must not read
+	// as "show me this step".
+	function selectableNodeAt(e: MouseEvent): HTMLElement | null {
+		const target = e.target as HTMLElement | null
+		if (target?.closest('[data-prop-picker]')) return null
+		return target?.closest('.svelte-flow__node.selectable') ?? null
+	}
+
+	function openPanelModalFromGraph(e: MouseEvent) {
+		if (selectableNodeAt(e)) {
+			panelModalOpen = true
+		}
+	}
+
+	// A click on the step that is already selected is the second half of "select it, then
+	// show it". Read in the capture phase: by the time the click bubbles here the graph has
+	// applied its own selection, so a first click would look indistinguishable from this.
+	let clickStartedOnSelected = false
+	function noteSelectionBeforeClick(e: MouseEvent) {
+		const node = selectableNodeAt(e)
+		clickStartedOnSelected =
+			Boolean(node?.classList.contains('selected')) && selectionManager.selectedIds.length === 1
+	}
+
+	function openPanelModalIfReselected(e: MouseEvent) {
+		if (clickStartedOnSelected && selectableNodeAt(e)) {
+			panelModalOpen = true
+		}
+	}
+
+	// In modal mode a step's editor is a click or two away but invisible until then —
+	// keep a standing hint whenever the graph is showing (modal closed).
+	const showStepHint = $derived.by(() => panelMode === 'modal' && !panelModalOpen)
+	const stepHintText = $derived.by(() => {
+		const ids = selectionManager.selectedIds
+		return ids.length === 1 && !isFlowLevelPanelTarget(ids[0])
+			? 'Click the selected step to explore its content'
+			: 'Double click a step to explore its content'
+	})
+
 	// When the graph pane is narrow, fall back to a top-centered overlay so the
 	// preview buttons don't overlap the rightmost node ports (matches the dev
 	// page layout).
@@ -124,9 +216,50 @@
 		flowModuleSchemaMap?.enableNotes?.()
 	}
 
+	const flowPropPickerConfig = writable<FlowPropPickerConfig | undefined>(undefined)
+	// Closing the modal unmounts the panel that started a graph connect, but the config
+	// outlives it — a later pick would run a closure over a step nobody is editing.
+	$effect(() => {
+		if (!panelModalOpen) {
+			flowPropPickerConfig.set(undefined)
+		}
+	})
+
 	setContext<PropPickerContext>('PropPickerContext', {
-		flowPropPickerConfig: writable<FlowPropPickerConfig | undefined>(undefined),
-		pickablePropertiesFiltered: writable<PickableProperties | undefined>(undefined)
+		flowPropPickerConfig,
+		pickablePropertiesFiltered: writable<PickableProperties | undefined>(undefined),
+		inModalPanel: () => panelMode === 'modal'
+	})
+
+	// Read by graph step items (VirtualItem) to show a per-step "explore" hint on hover,
+	// since in modal mode a step's editor is hidden until a double-click, or a click on the
+	// step that is already selected.
+	setContext<() => boolean>('flowGraphStepExploreHint', () => panelMode === 'modal')
+
+	// The panel's chrome lives inline in its card header (no dedicated row); panels without
+	// a card header get FlowEditor's fallback strip instead, driven by the claim count.
+	let detachClaims = $state(0)
+	setContext<FlowPanelDetachContext>('flowPanelDetach', {
+		claim: () => {
+			detachClaims++
+			return () => detachClaims--
+		},
+		modalOpen: () => modalPanel && panelMode === 'modal' && panelModalOpen,
+		close: () => (panelModalOpen = false),
+		enabled: () => modalPanel,
+		preference: () => panelController.preference,
+		setPreference: (preference) => {
+			// Picking the row that is already active is not a move, and counting it would
+			// report a placement being forced that the panel was already in.
+			if (preference === panelController.preference) return
+			// Moving the panel must not lose what it was showing: docked, it is always on
+			// screen, so the modal it becomes has to open on arrival. The reverse is handled
+			// by the effect above, which closes a modal that is no longer rendered.
+			const wasVisible = panelMode === 'docked' || panelModalOpen
+			placementTelemetry.forced(preference, panelMode)
+			panelController.preference = preference
+			panelModalOpen = panelController.mode === 'modal' && wasVisible
+		}
 	})
 
 	$effect(() => {
@@ -141,6 +274,14 @@
 	})
 
 	onMount(() => {
+		if (modalPanel) {
+			selectionManager.setOnSelectIntent((id, opts) => {
+				if (opts?.openPanel === false) return
+				if (panelMode === 'modal' && (opts?.openPanel || isFlowLevelPanelTarget(id))) {
+					panelModalOpen = true
+				}
+			})
+		}
 		if (!sessionScopedManager) {
 			aiChatManager.saveAndClear()
 			aiChatManager.changeMode(AIMode.FLOW)
@@ -149,6 +290,9 @@
 
 	onDestroy(() => {
 		aiChatManager.flowOptions = undefined
+		if (modalPanel) {
+			selectionManager.setOnSelectIntent(undefined)
+		}
 		if (!sessionScopedManager) {
 			aiChatManager.saveAndClear()
 			aiChatManager.changeMode(AIMode.NAVIGATOR)
@@ -156,18 +300,44 @@
 	})
 </script>
 
+{#snippet panelBody()}
+	<FlowEditorPanel
+		{disabledFlowInputs}
+		{newFlow}
+		{savedFlow}
+		enableAi={!disableAi}
+		on:applyArgs
+		on:testWithArgs
+		{onDeployTrigger}
+		{forceTestTab}
+		{highlightArg}
+		{onTestFlow}
+		{job}
+		{isOwner}
+		{suspendStatus}
+		onOpenDetails={onOpenPreview}
+		{previewOpen}
+		{flowModuleSchemaMap}
+	/>
+{/snippet}
+
 <div
+	bind:clientWidth={null, (w) => panelController.measure(w)}
 	id="flow-editor"
-	class={'h-full overflow-hidden transition-colors duration-[400ms] ease-linear border-t'}
+	class={'relative h-full overflow-hidden transition-colors duration-[400ms] ease-linear border-t'}
 	use:triggerableByAI={{
 		id: 'flow-editor',
 		description: 'Component to edit a flow'
 	}}
 >
 	<Splitpanes>
-		<Pane size={50} minSize={15} class="h-full relative z-0">
+		<Pane size={panelMode === 'docked' ? 50 : 100} minSize={15} class="h-full relative z-0">
+			<!-- svelte-ignore a11y_no_static_element_interactions -->
 			<div
 				bind:clientWidth={graphPaneWidth}
+				ondblclick={panelMode === 'modal' ? openPanelModalFromGraph : undefined}
+				onpointerdowncapture={panelMode === 'modal' ? noteSelectionBeforeClick : undefined}
+				onclick={panelMode === 'modal' ? openPanelModalIfReselected : undefined}
 				class="grow overflow-hidden bg-gray h-full bg-surface-secondary relative"
 			>
 				{#if graphOverlay}
@@ -226,36 +396,96 @@
 				{/if}
 			</div>
 		</Pane>
-		<Pane class="relative z-10" size={50} minSize={20}>
-			{#if loading}
-				<div class="w-full h-full">
-					<div class="block m-auto pt-40 w-10">
-						<WindmillIcon height="40px" width="40px" spin="fast" />
+		{#if panelMode === 'docked'}
+			<!-- Panels manage their own scrolling, so the pane must not scroll as well or a second
+			     scrollbar appears beside theirs. `!` because splitpanes' own `overflow: auto` rule
+			     has equal specificity and wins on cascade order. -->
+			<Pane class="relative z-10 !overflow-hidden" size={50} minSize={20}>
+				{#if loading}
+					<div class="w-full h-full">
+						<div class="block m-auto pt-40 w-10">
+							<WindmillIcon height="40px" width="40px" spin="fast" />
+						</div>
 					</div>
-				</div>
-			{:else}
-				<FlowEditorPanel
-					{disabledFlowInputs}
-					{newFlow}
-					{savedFlow}
-					enableAi={!disableAi}
-					on:applyArgs
-					on:testWithArgs
-					{onDeployTrigger}
-					{forceTestTab}
-					{highlightArg}
-					{onTestFlow}
-					{job}
-					{isOwner}
-					{suspendStatus}
-					onOpenDetails={onOpenPreview}
-					{previewOpen}
-					{flowModuleSchemaMap}
-				/>
-			{/if}
-		</Pane>
+				{:else if modalPanel}
+					<div class="flex h-full flex-col">
+						<!-- Fallback for panels without a card header hosting the placement
+						     picker: a slim strip so moving the panel stays reachable. Toggled
+						     around a stable panelBody — re-parenting it would re-mount
+						     the claiming header and loop. -->
+						{#if detachClaims === 0}
+							<div class="flex items-center justify-end border-b px-1">
+								<FlowPanelPlacementPicker variant="header" />
+							</div>
+						{/if}
+						<div class="min-h-0 flex-1">
+							{@render panelBody()}
+						</div>
+					</div>
+				{:else}
+					{@render panelBody()}
+				{/if}
+			</Pane>
+		{/if}
 		{#if !disableAi}
 			<FlowAIChat {flowModuleSchemaMap} {onTestFlow} />
 		{/if}
 	</Splitpanes>
+
+	{#if showStepHint}
+		<div
+			class="pointer-events-none absolute bottom-2 left-3 z-30 flex items-center gap-1.5 text-xs text-hint"
+		>
+			<MousePointerClick size={13} />
+			{stepHintText}
+		</div>
+	{/if}
 </div>
+
+<!-- Portalled out of `#flow-editor` so the modal covers the chrome around the editor
+     (sidebar, top bar) rather than only the editor's own box. A host that embeds the
+     editor in its own box provides an anchor element instead, keeping the modal inside
+     it — one flow editor's modal must never cover a sibling's tab. -->
+<!-- Disposable owns the overlay stack: it takes a place while open, arbitrates Escape against
+     whatever else is open in this pane, and stays quiet while the pane is hidden. -->
+<Disposable bind:open={panelModalOpen} bind:this={panelDisposable}>
+	{#snippet children({ zIndex })}
+		{#if panelMode === 'modal' && panelModalOpen}
+			<Portal target={modalHost ?? 'body'} class="contents">
+				<!-- svelte-ignore a11y_click_events_have_key_events -->
+				<!-- svelte-ignore a11y_no_static_element_interactions -->
+				<div
+					class="{modalHost ? 'absolute' : 'fixed'} inset-0 flex justify-center px-2 py-6"
+					style="z-index: {zIndex}"
+					role="dialog"
+				>
+					<div class="absolute inset-0 bg-black/20" onclick={() => (panelModalOpen = false)}></div>
+					<div
+						class="relative flex w-full max-w-4xl flex-col overflow-hidden rounded-md border bg-surface shadow-xl"
+					>
+						<!-- Same fallback as the docked strip: a panel whose body has a card header
+						     hosts the id, placement and close inline, so this bar would double it. -->
+						{#if detachClaims === 0}
+							<div class="flex items-center justify-end gap-2 border-b px-2 py-1">
+								<div class="flex items-center gap-0.5">
+									<FlowPanelPlacementPicker variant="header" />
+									<Button
+										size="xs2"
+										variant="subtle"
+										iconOnly
+										startIcon={{ icon: X }}
+										title="Close"
+										on:click={() => (panelModalOpen = false)}
+									/>
+								</div>
+							</div>
+						{/if}
+						<div class="min-h-0 flex-1 overflow-auto">
+							{@render panelBody()}
+						</div>
+					</div>
+				</div>
+			</Portal>
+		{/if}
+	{/snippet}
+</Disposable>
diff --git a/frontend/src/lib/components/flows/branchOps.test.ts b/frontend/src/lib/components/flows/branchOps.test.ts
new file mode 100644
index 0000000000..844477c968
--- /dev/null
+++ b/frontend/src/lib/components/flows/branchOps.test.ts
@@ -0,0 +1,55 @@
+import { describe, it, expect } from 'vitest'
+import { writable, get } from 'svelte/store'
+import type { FlowModule } from '$lib/gen'
+import type { StateStore } from '$lib/utils'
+import type { ExtendedOpenFlow } from './types'
+import { reorderBranches } from './branchOps'
+
+function branch(expr: string) {
+	return { summary: expr, expr, modules: [] as FlowModule[] }
+}
+
+function ctx(branches: ReturnType<typeof branch>[]) {
+	const flow = {
+		summary: '',
+		value: {
+			modules: [{ id: 'a', value: { type: 'branchone', branches, default: [] } } as FlowModule]
+		}
+	} as ExtendedOpenFlow
+	const flowStore: StateStore<ExtendedOpenFlow> = { val: flow }
+	const history = writable({ history: [] as ExtendedOpenFlow[], index: -1 })
+	const read = () =>
+		(flowStore.val.value.modules[0].value as { branches: ReturnType<typeof branch>[] }).branches
+	return { flowStore, history, read }
+}
+
+describe('reorderBranches', () => {
+	it('commits the new order', () => {
+		const [x, y, z] = [branch('x'), branch('y'), branch('z')]
+		const { flowStore, history, read } = ctx([x, y, z])
+
+		reorderBranches('a', [z, x, y], { flowStore, history })
+
+		expect(read().map((b) => b.expr)).toEqual(['z', 'x', 'y'])
+	})
+
+	it('records an undo entry, so a drag can be undone like an add or a delete', () => {
+		const [x, y] = [branch('x'), branch('y')]
+		const { flowStore, history } = ctx([x, y])
+
+		reorderBranches('a', [y, x], { flowStore, history })
+
+		expect(get(history).history).toHaveLength(1)
+	})
+
+	it('spends nothing when the drag lands where it started', () => {
+		// `finalize` fires on every drop, so a no-op drag must not consume an undo step.
+		const [x, y] = [branch('x'), branch('y')]
+		const { flowStore, history, read } = ctx([x, y])
+
+		reorderBranches('a', [x, y], { flowStore, history })
+
+		expect(get(history).history).toHaveLength(0)
+		expect(read().map((b) => b.expr)).toEqual(['x', 'y'])
+	})
+})
diff --git a/frontend/src/lib/components/flows/branchOps.ts b/frontend/src/lib/components/flows/branchOps.ts
new file mode 100644
index 0000000000..f42026bccb
--- /dev/null
+++ b/frontend/src/lib/components/flows/branchOps.ts
@@ -0,0 +1,82 @@
+import type { FlowModule } from '$lib/gen'
+import type { ExtendedOpenFlow } from './types'
+import type { FlowState } from './flowState'
+import type { StateStore } from '$lib/utils'
+import type { History } from '$lib/history.svelte'
+import { push } from '$lib/history.svelte'
+import { dfs } from './dfs'
+import { findModuleInFlow } from './flowTree'
+
+type BranchList = Array<{ summary?: string; expr?: string; modules: FlowModule[] }>
+
+type Ctx = {
+	flowStore: StateStore<ExtendedOpenFlow>
+	flowStateStore: StateStore<FlowState>
+	history: History<ExtendedOpenFlow>
+}
+
+/** Append an empty branch to a branchone/branchall step. */
+export function addBranch(moduleId: string, { flowStore, history }: Omit<Ctx, 'flowStateStore'>) {
+	push(history, flowStore.val)
+	const module = findModuleInFlow(flowStore.val.value, moduleId)
+	if (!module) throw new Error(`Node ${moduleId} not found`)
+
+	if (module.value.type === 'branchone' || module.value.type === 'branchall') {
+		module.value.branches.push({ summary: '', expr: 'false', modules: [] })
+	}
+}
+
+/**
+ * Drop a branch and the flow state of every step inside it.
+ *
+ * `index` counts the way the graph lays the branches out, where a branchone's default
+ * occupies slot 0 — one ahead of the same branch's position in `value.branches`. Callers
+ * working from the array (the settings panel) must add that offset back.
+ */
+export function removeBranch(
+	moduleId: string,
+	index: number,
+	{ flowStore, flowStateStore, history }: Ctx
+) {
+	push(history, flowStore.val)
+	const module = findModuleInFlow(flowStore.val.value, moduleId)
+	if (!module) throw new Error(`Node ${moduleId} not found`)
+
+	if (module.value.type === 'branchone' || module.value.type === 'branchall') {
+		const offset = module.value.type === 'branchone' ? 1 : 0
+		const at = index - offset
+
+		if (module.value.branches[at]?.modules) {
+			const leaves = dfs(module.value.branches[at].modules, (mod) => mod.id)
+			leaves.forEach((leafId: string) => delete flowStateStore.val[leafId])
+		}
+
+		module.value.branches.splice(at, 1)
+	}
+}
+
+/**
+ * Commit a reordered branch list. Undoable like add/remove — a drag is a structural edit,
+ * and for a branchone it changes which predicate is evaluated first.
+ */
+export function reorderBranches(
+	moduleId: string,
+	ordered: BranchList,
+	{ flowStore, history }: Omit<Ctx, 'flowStateStore'>
+) {
+	const module = findModuleInFlow(flowStore.val.value, moduleId)
+	if (!module) throw new Error(`Node ${moduleId} not found`)
+	if (module.value.type !== 'branchone' && module.value.type !== 'branchall') return
+
+	const current = module.value.branches
+	// A drag that lands where it started must not spend an undo entry.
+	if (ordered.length === current.length && ordered.every((b, i) => b === current[i])) return
+
+	push(history, flowStore.val)
+	module.value.branches = ordered as typeof current
+}
+
+/** Slot a branch occupies in the graph's numbering, from its index in `value.branches`. */
+export function graphBranchIndex(type: 'branchone' | 'branchall', arrayIndex: number): number {
+	return type === 'branchone' ? arrayIndex + 1 : arrayIndex
+}
diff --git a/frontend/src/lib/components/flows/common/FlowCard.svelte b/frontend/src/lib/components/flows/common/FlowCard.svelte
index aadb9d459d..091d3a9feb 100644
--- a/frontend/src/lib/components/flows/common/FlowCard.svelte
+++ b/frontend/src/lib/components/flows/common/FlowCard.svelte
@@ -6,6 +6,8 @@
 		title?: string | undefined
 		summary?: string | undefined
 		description?: string | undefined
+		subtitle?: string | undefined
+		subtitleDocLink?: string | undefined
 		noEditor: boolean
 		noHeader?: boolean
 		flowModuleValue?: FlowModuleValue | undefined
@@ -20,6 +22,8 @@
 		title = undefined,
 		summary = $bindable(undefined),
 		description = $bindable(undefined),
+		subtitle = undefined,
+		subtitleDocLink = undefined,
 		noEditor,
 		noHeader = false,
 		flowModuleValue = undefined,
@@ -37,9 +41,12 @@
 			<FlowCardHeader
 				on:setHash
 				on:reload
+				on:fork
 				{title}
 				bind:summary
 				bind:description
+				{subtitle}
+				{subtitleDocLink}
 				{flowModuleValue}
 				{action}
 				{isAgentTool}
diff --git a/frontend/src/lib/components/flows/common/FlowCardHeader.svelte b/frontend/src/lib/components/flows/common/FlowCardHeader.svelte
index 1a96ad6861..8c9e57fa10 100644
--- a/frontend/src/lib/components/flows/common/FlowCardHeader.svelte
+++ b/frontend/src/lib/components/flows/common/FlowCardHeader.svelte
@@ -1,26 +1,30 @@
-<script lang="ts" module>
-	let cachedValues: Record<
-		string,
-		{
-			latestHash: string | undefined
-		}
-	> = {}
-</script>
-
 <script lang="ts">
 	import Badge from '$lib/components/common/badge/Badge.svelte'
-	import Button from '$lib/components/common/button/Button.svelte'
 	import LanguageIcon from '$lib/components/common/languageIcons/LanguageIcon.svelte'
 	import MetadataGen from '$lib/components/copilot/MetadataGen.svelte'
 	import IconedPath from '$lib/components/IconedPath.svelte'
-	import { ScriptService, type FlowModuleValue, type PathScript } from '$lib/gen'
-	import { hubBaseUrlStore, workspaceStore } from '$lib/stores'
-	import { Flag, Lock, RefreshCw, Unlock } from 'lucide-svelte'
+	import { ScriptService, type FlowModuleValue } from '$lib/gen'
+	import {
+		ArrowUpCircle,
+		Flag,
+		GitFork,
+		Lock,
+		Pen,
+		RefreshCw,
+		Settings,
+		Unlock
+	} from 'lucide-svelte'
 	import { createEventDispatcher, getContext, untrack } from 'svelte'
 	import type { FlowEditorContext } from '../types'
+	import FlowPanelChrome from './FlowPanelChrome.svelte'
+	import type { FlowBuilderWhitelabelCustomUi } from '$lib/components/custom_ui'
+	import DropdownV2 from '$lib/components/DropdownV2.svelte'
+	import { hubBaseUrlStore, workspaceStore } from '$lib/stores'
+	import { DEFAULT_HUB_BASE_URL, PRIVATE_HUB_MIN_VERSION } from '$lib/hub'
+	import { getLatestHashForScript } from '$lib/scripts'
+	import { sendUserToast, type Item } from '$lib/utils'
 	import { twMerge } from 'tailwind-merge'
 	import { getToolNameError } from '$lib/components/graph/renderers/nodes/AIToolNode.svelte'
-	import { DEFAULT_HUB_BASE_URL, PRIVATE_HUB_MIN_VERSION } from '$lib/hub'
 	import autosize from '$lib/autosize'
 
 	interface Props {
@@ -28,6 +32,10 @@
 		title?: string | undefined
 		summary?: string | undefined
 		description?: string | undefined
+		/** Static one-line explanation of what this kind of step does. Not the editable
+		 *  `description`, which is the AI-tool prompt the user writes. */
+		subtitle?: string | undefined
+		subtitleDocLink?: string | undefined
 		children?: import('svelte').Snippet
 		action?: import('svelte').Snippet
 		isAgentTool?: boolean
@@ -39,6 +47,8 @@
 		title = undefined,
 		summary = $bindable(undefined),
 		description = $bindable(undefined),
+		subtitle = undefined,
+		subtitleDocLink = undefined,
 		children,
 		action,
 		isAgentTool = false,
@@ -49,50 +59,125 @@
 		isAgentTool ? getToolNameError(summary ?? '', undefined, siblingToolNames) : undefined
 	)
 
-	let latestHash: string | undefined = $state(undefined)
-
-	const flowEditorContext = getContext<FlowEditorContext>('FlowEditorContext')
-	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $workspaceStore)
-
-	// Extract version_id from hub path (format: hub/{version_id}/{app}/{summary})
-	let hubVersionId = $derived(
-		flowModuleValue?.type === 'script' && flowModuleValue.path?.startsWith('hub/')
-			? flowModuleValue.path.split('/')[1]
-			: undefined
-	)
-
-	function getCachedKey(path: string) {
-		return `${opWs}-${path}`
-	}
-	function getCachedValues(path: string) {
-		const key = getCachedKey(path)
-		latestHash = cachedValues[key]?.latestHash
-	}
-	const untrackedFlowModuleValue = untrack(() => flowModuleValue)
-	if (untrackedFlowModuleValue?.type === 'script' && untrackedFlowModuleValue.path) {
-		getCachedValues(untrackedFlowModuleValue.path)
-	}
-
-	async function loadLatestHash(value: PathScript) {
-		let script = await ScriptService.getScriptByPath({
-			workspace: opWs!,
-			path: value.path
-		})
-		const key = getCachedKey(value.path)
-		cachedValues[key] = {
-			latestHash: script.hash
-		}
-		latestHash = script.hash
-	}
-
 	const dispatch = createEventDispatcher()
+	const customUi: FlowBuilderWhitelabelCustomUi | undefined = getContext('customUi')
+	const flowEditorContext = getContext<FlowEditorContext>('FlowEditorContext')
+	const { scriptEditorDrawer, workspaceScriptSettingsDrawer } = flowEditorContext
 
-	$effect.pre(() => {
-		$workspaceStore &&
-			flowModuleValue?.type === 'script' &&
-			flowModuleValue.path &&
-			!flowModuleValue.path.startsWith('hub/') &&
-			untrack(() => loadLatestHash(flowModuleValue))
+	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $workspaceStore)
+	const scriptPath = $derived(flowModuleValue?.type === 'script' ? flowModuleValue.path : undefined)
+	const pinnedHash = $derived(flowModuleValue?.type === 'script' ? flowModuleValue.hash : undefined)
+	const isHub = $derived(scriptPath?.startsWith('hub/') ?? false)
+	// Version id out of a hub path: hub/{version_id}/{app}/{summary}
+	const hubVersionId = $derived(isHub ? scriptPath?.split('/')[1] : undefined)
+
+	let latestHash: string | undefined = $state(undefined)
+	$effect(() => {
+		const path = scriptPath
+		if (!opWs || !path || isHub) return
+		untrack(async () => {
+			latestHash = (await ScriptService.getScriptByPath({ workspace: opWs, path })).hash
+		})
+	})
+
+	function reportIssue() {
+		const targetHubBaseUrl =
+			Number(hubVersionId) < PRIVATE_HUB_MIN_VERSION ? DEFAULT_HUB_BASE_URL : $hubBaseUrlStore
+		window.open(
+			`${targetHubBaseUrl}/from_version/${hubVersionId}?report_issue=${hubVersionId}`,
+			'_blank'
+		)
+	}
+
+	// Every one of these acts on the referenced script rather than the step, so they share
+	// a single menu instead of a row of icon buttons.
+	const scriptItems: Item[] = $derived.by(() => {
+		if (flowModuleValue?.type !== 'script') return []
+		const items: Item[] = []
+		if (!isHub && customUi?.scriptEdit != false) {
+			items.push({
+				displayName: "Edit the script's code",
+				icon: Pen,
+				disabled: pinnedHash != undefined,
+				tooltip: pinnedHash != undefined ? 'Unlock the hash to edit' : undefined,
+				action: async () => {
+					if (flowModuleValue?.type !== 'script') return
+					const hash =
+						flowModuleValue.hash ?? (await getLatestHashForScript(flowModuleValue.path, opWs))
+					$scriptEditorDrawer?.openDrawer(hash, () => {
+						dispatch('reload')
+						sendUserToast('Script has been updated')
+					})
+				}
+			})
+			// Only when the settings drawer is actually mounted (not in the local-dev
+			// editors, which provide the context store but never render it).
+			if ($workspaceScriptSettingsDrawer) {
+				items.push({
+					displayName: 'Runtime settings',
+					icon: Settings,
+					disabled: pinnedHash != undefined,
+					tooltip: 'Concurrency, cache, timeout, …',
+					action: () => {
+						if (flowModuleValue?.type !== 'script') return
+						$workspaceScriptSettingsDrawer?.openDrawer(
+							flowModuleValue.path,
+							flowModuleValue.hash,
+							() => dispatch('reload')
+						)
+					}
+				})
+			}
+		}
+		if (customUi?.scriptFork != false) {
+			items.push({
+				displayName: 'Fork into an inline script',
+				icon: GitFork,
+				action: () => dispatch('fork')
+			})
+		}
+		if (pinnedHash) {
+			if (latestHash && latestHash !== pinnedHash) {
+				items.push({
+					displayName: 'Update to latest hash',
+					icon: ArrowUpCircle,
+					separatorTop: items.length > 0,
+					action: () => {
+						dispatch('setHash', latestHash)
+						dispatch('reload')
+					}
+				})
+			}
+			items.push({
+				displayName: 'Unlock hash',
+				icon: Unlock,
+				tooltip: 'Always use the latest deployed version at that path',
+				separatorTop: items.length > 0 && !items.at(-1)?.separatorTop,
+				action: () => dispatch('setHash', undefined)
+			})
+		} else if (latestHash) {
+			items.push({
+				displayName: 'Lock hash',
+				icon: Lock,
+				tooltip: 'Always use this specific version',
+				separatorTop: items.length > 0,
+				action: () => dispatch('setHash', latestHash)
+			})
+			items.push({
+				displayName: 'Reload latest hash',
+				icon: RefreshCw,
+				action: () => dispatch('reload')
+			})
+		}
+		if (hubVersionId) {
+			items.push({
+				displayName: 'Report issue',
+				icon: Flag,
+				separatorTop: items.length > 0,
+				action: reportIssue
+			})
+		}
+		return items
 	})
 </script>
 
@@ -101,8 +186,8 @@
 		class="overflow-x-auto scrollbar-hidden flex items-center justify-between flex-nowrap w-full"
 	>
 		{#if flowModuleValue}
-			<span class="text-sm w-full mr-4">
-				<div class="flex items-center space-x-2">
+			<span class="mr-4 min-w-0 flex-1 text-sm">
+				<div class="flex min-w-0 items-center space-x-2">
 					{#if flowModuleValue.type === 'identity'}
 						<span class="font-bold text-xs">Identity (input copied to output)</span>
 					{:else if flowModuleValue.type === 'rawscript'}
@@ -121,75 +206,16 @@
 							{siblingToolNames}
 						/>
 					{:else if flowModuleValue.type === 'script' && 'path' in flowModuleValue && flowModuleValue.path}
-						<IconedPath path={flowModuleValue.path} hash={flowModuleValue.hash} class="grow" />
-
-						{#if hubVersionId}
-							<Button
-								title="Report an issue with this hub script"
-								unifiedSize="sm"
-								variant="subtle"
-								on:click={() => {
-									const targetHubBaseUrl =
-										Number(hubVersionId) < PRIVATE_HUB_MIN_VERSION
-											? DEFAULT_HUB_BASE_URL
-											: $hubBaseUrlStore
-									window.open(
-										`${targetHubBaseUrl}/from_version/${hubVersionId}?report_issue=${hubVersionId}`,
-										'_blank'
-									)
-								}}
-							>
-								<Flag size={12} />Report issue
-							</Button>
+						<IconedPath
+							path={flowModuleValue.path}
+							hash={flowModuleValue.hash}
+							class="!w-auto shrink min-w-0"
+						/>
+						{#if scriptItems.length > 0}
+							<DropdownV2 size="sm" placement="bottom-end" items={scriptItems} />
 						{/if}
 
-						{#if flowModuleValue.hash}
-							{#if latestHash != flowModuleValue.hash}
-								<Button
-									size="xs"
-									variant="default"
-									on:click={() => {
-										if (flowModuleValue.type == 'script') {
-											dispatch('setHash', latestHash)
-										}
-										dispatch('reload')
-									}}>Update to latest hash</Button
-								>
-							{/if}
-							<Button
-								title="Unlock hash to always use latest deployed version at that path"
-								size="xs"
-								btnClasses="text-primary inline-flex gap-1 items-center"
-								color="light"
-								on:click={() => {
-									if (flowModuleValue.type == 'script') {
-										dispatch('setHash', undefined)
-									}
-								}}><Unlock size={12} />hash</Button
-							>
-						{:else if latestHash}
-							<div class="flex gap-2">
-								<Button
-									title="Lock hash to always use this specific version"
-									unifiedSize="sm"
-									variant="default"
-									on:click={() => {
-										if (flowModuleValue.type == 'script') {
-											dispatch('setHash', latestHash)
-										}
-									}}><Lock size={12} />hash</Button
-								>
-								<Button
-									title="Reload latest hash"
-									unifiedSize="sm"
-									variant="default"
-									on:click={() => dispatch('reload')}
-									startIcon={{ icon: RefreshCw }}
-									iconOnly
-								/>
-							</div>
-						{/if}
-						<div class="flex flex-col w-full grow">
+						<div class="flex min-w-[8rem] flex-1 flex-col">
 							<input
 								bind:value={summary}
 								placeholder={isAgentTool ? 'Tool name' : 'Summary'}
@@ -210,11 +236,27 @@
 			</span>
 		{/if}
 		{#if title}
-			<div class="text-sm font-bold text-primary pr-2">{title}</div>
+			<!-- Absorbs the free space so the actions stay together on the right: with
+			     justify-between alone, adding the detach button centres them. -->
+			<div class="mr-auto truncate pr-2 text-sm font-semibold text-emphasis">{title}</div>
 		{/if}
 		{@render children?.()}
 		{@render action?.()}
+		<FlowPanelChrome />
 	</div>
+	{#if subtitle}
+		<p class="text-xs leading-snug text-tertiary">
+			{subtitle}
+			{#if subtitleDocLink}
+				<a
+					href={subtitleDocLink}
+					target="_blank"
+					rel="noreferrer"
+					class="text-blue-500 hover:underline">Docs</a
+				>
+			{/if}
+		</p>
+	{/if}
 	{#if isAgentTool}
 		{#if toolNameError}
 			<p class="text-3xs text-red-400 leading-tight w-full">{toolNameError}</p>
diff --git a/frontend/src/lib/components/flows/common/FlowPanelChrome.svelte b/frontend/src/lib/components/flows/common/FlowPanelChrome.svelte
new file mode 100644
index 0000000000..0a3d822fd1
--- /dev/null
+++ b/frontend/src/lib/components/flows/common/FlowPanelChrome.svelte
@@ -0,0 +1,29 @@
+<script lang="ts">
+	import Button from '$lib/components/common/button/Button.svelte'
+	import { X } from 'lucide-svelte'
+	import { getContext, onMount } from 'svelte'
+	import type { FlowPanelDetachContext } from '../types'
+	import FlowPanelPlacementPicker from './FlowPanelPlacementPicker.svelte'
+
+	const panelDetach = getContext<FlowPanelDetachContext | undefined>('flowPanelDetach')
+
+	// The detached modal draws no header of its own, so the header this sits in carries its
+	// chrome too. onMount, not $effect: claim() increments (reads+writes) the claim count,
+	// and a tracking effect would re-run on its own write.
+	onMount(() => panelDetach?.claim())
+</script>
+
+<div class="ml-2 flex shrink-0 items-center">
+	<FlowPanelPlacementPicker variant="header" />
+</div>
+{#if panelDetach?.modalOpen()}
+	<Button
+		unifiedSize="sm"
+		variant="subtle"
+		iconOnly
+		wrapperClasses="shrink-0"
+		startIcon={{ icon: X }}
+		title="Close"
+		onClick={() => panelDetach.close()}
+	/>
+{/if}
diff --git a/frontend/src/lib/components/flows/common/FlowPanelPlacementPicker.svelte b/frontend/src/lib/components/flows/common/FlowPanelPlacementPicker.svelte
new file mode 100644
index 0000000000..765fa48b2c
--- /dev/null
+++ b/frontend/src/lib/components/flows/common/FlowPanelPlacementPicker.svelte
@@ -0,0 +1,70 @@
+<script lang="ts">
+	import DropdownV2 from '$lib/components/DropdownV2.svelte'
+	import Button from '$lib/components/common/button/Button.svelte'
+	import { PanelRight } from 'lucide-svelte'
+	import { getContext } from 'svelte'
+	import type { Placement } from '@floating-ui/core'
+	import type { FlowPanelDetachContext } from '../types'
+
+	interface Props {
+		/** 'control' borrows the graph control bar's cell styling; 'header' matches the icon
+		 *  buttons beside it in the panel's card header. */
+		variant: 'control' | 'header'
+		placement?: Placement
+	}
+
+	let { variant, placement = 'bottom-end' }: Props = $props()
+
+	const panelDetach = getContext<FlowPanelDetachContext | undefined>('flowPanelDetach')
+
+	// Named options with a check, no per-row icons: whether the panel is attached is plain
+	// from the layout, so the only thing worth spelling out is which of the three is active —
+	// and Auto is the one name that doesn't say what it follows.
+	const PANEL_PREFERENCES = [
+		{
+			value: 'auto' as const,
+			displayName: 'Auto',
+			tooltip: 'Follows the editor width: attached when there is room, detached when not'
+		},
+		{ value: 'docked' as const, displayName: 'Attached' },
+		{ value: 'modal' as const, displayName: 'Detached' }
+	]
+
+	const items = $derived(
+		PANEL_PREFERENCES.map((p) => ({
+			displayName: p.displayName,
+			tooltip: p.tooltip,
+			selected: panelDetach?.preference() === p.value,
+			action: () => panelDetach?.setPreference(p.value)
+		}))
+	)
+</script>
+
+{#if panelDetach?.enabled()}
+	<DropdownV2
+		{items}
+		{placement}
+		customWidth={220}
+		class={variant === 'control' ? 'svelte-flow__controls-button !justify-center' : 'shrink-0'}
+	>
+		{#snippet buttonReplacement()}
+			{#if variant === 'control'}
+				<!-- The trigger itself carries the control-bar cell class. Wrapping a ControlButton
+				     instead would nest a sized 32x30 box inside the trigger's own box, growing the
+				     bar, and would take `:last-child` off the real last cell so its divider stayed. -->
+				<span class="flex" title="Where the step panel opens">
+					<PanelRight size="14" />
+				</span>
+			{:else}
+				<Button
+					nonCaptureEvent
+					unifiedSize="sm"
+					variant="subtle"
+					iconOnly
+					startIcon={{ icon: PanelRight }}
+					title="Where the step panel opens"
+				/>
+			{/if}
+		{/snippet}
+	</DropdownV2>
+{/if}
diff --git a/frontend/src/lib/components/flows/content/AgentToolWrapper.svelte b/frontend/src/lib/components/flows/content/AgentToolWrapper.svelte
index df545ab367..194d19c6dc 100644
--- a/frontend/src/lib/components/flows/content/AgentToolWrapper.svelte
+++ b/frontend/src/lib/components/flows/content/AgentToolWrapper.svelte
@@ -50,7 +50,7 @@
 	/>
 {:else if isMcpTool(tool)}
 	<!-- MCP tool - use McpToolEditor -->
-	<McpToolEditor bind:tool />
+	<McpToolEditor bind:tool {noEditor} />
 {:else if isWebsearchTool(tool)}
-	<WebsearchToolDisplay />
+	<WebsearchToolDisplay {noEditor} />
 {/if}
diff --git a/frontend/src/lib/components/flows/content/BranchPredicateEditor.svelte b/frontend/src/lib/components/flows/content/BranchPredicateEditor.svelte
index 854ecc363a..949862632a 100644
--- a/frontend/src/lib/components/flows/content/BranchPredicateEditor.svelte
+++ b/frontend/src/lib/components/flows/content/BranchPredicateEditor.svelte
@@ -1,14 +1,13 @@
 <script lang="ts">
 	import type { FlowModule } from '$lib/gen'
 	import { getContext } from 'svelte'
-	import PropPickerWrapper from '../propPicker/PropPickerWrapper.svelte'
-	import SimpleEditor from '$lib/components/SimpleEditor.svelte'
-
 	import { getStepPropPicker } from '../previousResults'
 	import type { FlowEditorContext } from '../types'
-	import Button from '$lib/components/common/button/Button.svelte'
-	import { Pen } from 'lucide-svelte'
+	import InputTransformForm from '$lib/components/InputTransformForm.svelte'
 	import PredicateGen from '$lib/components/copilot/PredicateGen.svelte'
+	import PropPickerWrapper from '../propPicker/PropPickerWrapper.svelte'
+	import type SimpleEditor from '$lib/components/SimpleEditor.svelte'
+	import { emptySchema } from '$lib/utils'
 
 	interface Props {
 		branch: {
@@ -21,13 +20,18 @@
 		enableAi?: boolean
 	}
 
-	let { branch = $bindable(), parentModule, previousModule, enableAi = false }: Props = $props()
+	let { branch, parentModule, previousModule, enableAi = false }: Props = $props()
+
+	let editor: SimpleEditor | undefined = $state(undefined)
+
+	// The predicate is a bare string on `branch`, so the form is told its kind through
+	// `argType` rather than inferring one from the value.
+	let predicateSchema = $state(emptySchema())
+	predicateSchema.properties['expr'] = { type: 'boolean' }
 
 	const { previewArgs, flowStateStore, flowStore } =
 		getContext<FlowEditorContext>('FlowEditorContext')
 
-	let editor: SimpleEditor | undefined = $state(undefined)
-	let open = $state(false)
 	let stepPropPicker = $derived(
 		getStepPropPicker(
 			flowStateStore.val,
@@ -41,49 +45,50 @@
 	)
 </script>
 
-{#if open}
-	<PropPickerWrapper
-		notSelectable
+<PropPickerWrapper
+	sidePane
+	flow_input={stepPropPicker.pickableProperties.flow_input}
+	notSelectable
+	pickableProperties={stepPropPicker.pickableProperties}
+	on:select={({ detail }) => {
+		editor?.insertAtCursor(detail)
+		editor?.focus()
+	}}
+>
+	<!-- `branch` itself is the arg: the form reads and writes `arg.expr` in place, which
+	     is exactly where the predicate lives. Its other keys are inert here. -->
+	<InputTransformForm
+		bind:arg={branch}
+		argName="expr"
+		argType="javascript"
+		label="Run this branch if"
+		headerTooltip="The first branch whose expression evaluates to true is the one that runs."
+		noDynamicToggle
+		schema={predicateSchema}
+		previousModuleId={previousModule?.id}
 		pickableProperties={stepPropPicker.pickableProperties}
-		on:select={({ detail }) => {
-			editor?.insertAtCursor(detail)
-			editor?.focus()
-		}}
-		paneClass="max-h-[320px] overflow-auto"
+		extraLib={stepPropPicker.extraLib}
+		bind:editor
 	>
-		<div class="border border-gray-400">
-			<SimpleEditor
-				bind:this={editor}
-				lang="javascript"
-				bind:code={branch.expr}
-				class="small-editor border "
-				shouldBindKey={false}
-				extraLib={stepPropPicker.extraLib}
-			/>
-		</div>
-	</PropPickerWrapper>
-{:else}
-	<div class="flex justify-between gap-4 p-2">
-		<div class="truncate"><pre class="text-sm truncate">{branch.expr}</pre></div>
-		<div class="flex flex-row gap-2 items-center">
+		{#snippet aiGen()}
 			{#if enableAi}
 				<PredicateGen
 					on:setExpr={(e) => {
 						branch.expr = e.detail
+						// Monaco owns its buffer once mounted: writing the value alone leaves
+						// the visible code stale until the editor is torn down and rebuilt.
+						editor?.setCode(e.detail)
+					}}
+					on:updateSummary={(e) => {
+						// The prompt names the branch better than "Branch 2" does, but only
+						// when the user hasn't already named it themselves.
+						if (!branch.summary) {
+							branch.summary = e.detail
+						}
 					}}
-					on:updateSummary
 					pickableProperties={stepPropPicker.pickableProperties}
 				/>
 			{/if}
-			<Button
-				size="xs"
-				startIcon={{ icon: Pen }}
-				variant="default"
-				on:click={() => (open = !open)}
-				id="flow-editor-edit-predicate"
-			>
-				Edit predicate
-			</Button>
-		</div>
-	</div>
-{/if}
+		{/snippet}
+	</InputTransformForm>
+</PropPickerWrapper>
diff --git a/frontend/src/lib/components/flows/content/DynamicInputHelpBox.svelte b/frontend/src/lib/components/flows/content/DynamicInputHelpBox.svelte
index 93bfd2d533..8ed18d73bf 100644
--- a/frontend/src/lib/components/flows/content/DynamicInputHelpBox.svelte
+++ b/frontend/src/lib/components/flows/content/DynamicInputHelpBox.svelte
@@ -3,11 +3,12 @@
 	import Button from '$lib/components/common/button/Button.svelte'
 	import { ChevronDown } from 'lucide-svelte'
 
-	let opened = $state(false);
-	
+	let opened = $state(false)
 </script>
 
-<div class="text-xs flex flex-row-reverse">
+<!-- Pulled up against the input above: it reads as a footnote on that field rather than
+     as the next thing in the form. -->
+<div class="text-2xs flex flex-row-reverse -mt-2">
 	<Button
 		on:click={() => {
 			opened = !opened
@@ -16,7 +17,7 @@
 		variant="divider"
 		size="xs2"
 		endIcon={{ icon: ChevronDown, classes: `rotate-0 duration-300 ${opened ? '!rotate-180' : ''}` }}
-		btnClasses="text-hint text-2xs font-normal pt-1"
+		btnClasses="text-hint !text-2xs font-normal py-0"
 	>
 		Help
 	</Button>
diff --git a/frontend/src/lib/components/flows/content/ExpandedSubflowStep.svelte b/frontend/src/lib/components/flows/content/ExpandedSubflowStep.svelte
new file mode 100644
index 0000000000..4aede5e3d1
--- /dev/null
+++ b/frontend/src/lib/components/flows/content/ExpandedSubflowStep.svelte
@@ -0,0 +1,149 @@
+<script lang="ts">
+	import { getContext, untrack } from 'svelte'
+	import { FlowService, type FlowModule } from '$lib/gen'
+	import { workspaceStore } from '$lib/stores'
+	import Badge from '$lib/components/common/badge/Badge.svelte'
+	import Button from '$lib/components/common/button/Button.svelte'
+	import Skeleton from '$lib/components/common/skeleton/Skeleton.svelte'
+	import FlowGraphViewerStep from '$lib/components/FlowGraphViewerStep.svelte'
+	import { ChevronRight, ExternalLink, Pen } from 'lucide-svelte'
+	import { sendUserToast } from '$lib/utils'
+	import type { FlowEditorContext } from '../types'
+	import {
+		resolveExpandedSubflowStep,
+		type ResolvedExpandedSubflowStep
+	} from '../expandedSubflowStep'
+	import { parseExpandedSubflowId } from '$lib/components/restartFromStepPath'
+	import { base } from '$app/paths'
+	import FlowPanelChrome from '../common/FlowPanelChrome.svelte'
+
+	interface Props {
+		/** Graph node id of the selected step, of the form `subflow:<step>[:<step>...]:<leaf>`. */
+		selectedId: string
+		/** Called once the subflow was deployed from the drawer, to refresh the inlined graph. */
+		onSubflowUpdated?: () => void
+	}
+
+	let { selectedId, onSubflowUpdated }: Props = $props()
+
+	const { flowStore, flowEditorDrawer, opWorkspace } =
+		getContext<FlowEditorContext>('FlowEditorContext')
+	let opWs = $derived(opWorkspace?.() ?? $workspaceStore)
+
+	let leafId = $derived(parseExpandedSubflowId(selectedId)?.leaf ?? selectedId)
+
+	// Modules of the subflows crossed so far: the panel stays mounted while the user clicks
+	// through the expansion, so without this every click refetches the whole chain. Deploying
+	// a subflow bumps the generation, which drops what the cache holds.
+	let modulesCache = new Map<string, FlowModule[]>()
+	let cachedGeneration = 0
+	let generation = $state(0)
+	// `undefined` while resolving. A resolution is only applied when it is still the one the
+	// current selection asked for, so a slower deep chain can't overwrite a newer selection.
+	let loaded = $state<{ step?: ResolvedExpandedSubflowStep; error?: Error } | undefined>(undefined)
+	let latestRequest = 0
+
+	$effect(() => {
+		const [id, ws, gen] = [selectedId, opWs, generation]
+		if (gen !== cachedGeneration) {
+			modulesCache.clear()
+			cachedGeneration = gen
+		}
+		const request = ++latestRequest
+		loaded = undefined
+		const rootModules = untrack(() => $state.snapshot(flowStore.val.value.modules) as FlowModule[])
+		resolveExpandedSubflowStep(id, rootModules, async (path) => {
+			const key = `${ws}:${path}`
+			let modules = modulesCache.get(key)
+			if (!modules) {
+				modules = (await FlowService.getFlowByPath({ workspace: ws!, path })).value.modules
+				// A response from before the last deploy must not repopulate the cache it cleared.
+				if (gen === cachedGeneration) {
+					modulesCache.set(key, modules)
+				}
+			}
+			return modules
+		})
+			.then((step) => {
+				if (request === latestRequest) loaded = { step }
+			})
+			.catch((error) => {
+				if (request === latestRequest) loaded = { error }
+			})
+	})
+
+	let resolved = $derived(loaded?.step)
+
+	function editSubflow(path: string, stepId: string | undefined) {
+		$flowEditorDrawer?.openDrawer(
+			path,
+			() => {
+				sendUserToast('Subflow has been updated')
+				generation++
+				onSubflowUpdated?.()
+			},
+			stepId
+		)
+	}
+</script>
+
+<div class="flex flex-col h-full bg-surface">
+	<div class="flex items-center justify-between gap-2 px-4 py-2 border-b shrink-0">
+		<div class="flex items-center gap-1 min-w-0 text-xs text-secondary">
+			<Badge color="indigo">{leafId}</Badge>
+			{#if resolved}
+				<span class="shrink-0">in</span>
+				{#each resolved.pathChain as path, i (i)}
+					{#if i > 0}
+						<ChevronRight size={12} class="shrink-0" />
+					{/if}
+					<span class="truncate text-primary font-medium" title={path}>{path}</span>
+				{/each}
+			{/if}
+		</div>
+		<div class="flex items-center gap-1 shrink-0">
+			{#if resolved}
+				{@const { containingFlowPath, module } = resolved}
+				{#if $flowEditorDrawer}
+					<Button
+						unifiedSize="sm"
+						variant="subtle"
+						startIcon={{ icon: Pen }}
+						on:click={() => editSubflow(containingFlowPath, module ? leafId : undefined)}
+					>
+						Edit
+					</Button>
+				{/if}
+				<Button
+					unifiedSize="sm"
+					variant="subtle"
+					title="Open the subflow in a new tab"
+					startIcon={{ icon: ExternalLink }}
+					iconOnly
+					href={`${base}/flows/edit/${containingFlowPath}?workspace=${encodeURIComponent(
+						opWs ?? ''
+					)}${module ? `&selected=${encodeURIComponent(leafId)}` : ''}`}
+					target="_blank"
+				/>
+			{/if}
+			<FlowPanelChrome />
+		</div>
+	</div>
+	<div class="min-h-0 grow overflow-auto">
+		{#if loaded == undefined}
+			<div class="p-4">
+				<Skeleton layout={[[2], 1, [8]]} />
+			</div>
+		{:else if loaded.error}
+			<div class="p-4 text-xs text-secondary">
+				Could not load the subflow this step belongs to: {loaded.error.message}
+			</div>
+		{:else if resolved?.module}
+			<FlowGraphViewerStep stepDetail={resolved.module} workspace={opWs} />
+		{:else}
+			<div class="p-4 text-xs text-secondary">
+				This step is part of an expanded subflow and is not editable from this flow.
+			</div>
+		{/if}
+	</div>
+</div>
diff --git a/frontend/src/lib/components/flows/content/FlowBranchAllWrapper.svelte b/frontend/src/lib/components/flows/content/FlowBranchAllWrapper.svelte
index 17f5767c46..da06034a8d 100644
--- a/frontend/src/lib/components/flows/content/FlowBranchAllWrapper.svelte
+++ b/frontend/src/lib/components/flows/content/FlowBranchAllWrapper.svelte
@@ -12,7 +12,7 @@
 		}
 	}
 
-	let { noEditor, branch = $bindable() }: Props = $props()
+	let { noEditor, branch }: Props = $props()
 </script>
 
 <div class="h-full flex flex-col">
@@ -23,13 +23,8 @@
 			</div>
 		{/snippet}
 		<div class="p-4">
-			<div class="mt-2 mb-2 text-sm font-bold">Skip failures</div>
-			<Toggle
-				bind:checked={branch.skip_failure}
-				options={{
-					right: 'Skip failures'
-				}}
-			/>
+			<div class="mb-2 text-xs font-semibold text-emphasis">Skip failures</div>
+			<Toggle bind:checked={branch.skip_failure} />
 		</div>
 	</FlowCard>
 </div>
diff --git a/frontend/src/lib/components/flows/content/FlowBranchOneWrapper.svelte b/frontend/src/lib/components/flows/content/FlowBranchOneWrapper.svelte
index fd7bbc82e8..f118e0859d 100644
--- a/frontend/src/lib/components/flows/content/FlowBranchOneWrapper.svelte
+++ b/frontend/src/lib/components/flows/content/FlowBranchOneWrapper.svelte
@@ -16,13 +16,7 @@
 		enableAi?: boolean
 	}
 
-	let {
-		branch = $bindable(),
-		parentModule,
-		previousModule,
-		noEditor,
-		enableAi = false
-	}: Props = $props()
+	let { branch, parentModule, previousModule, noEditor, enableAi = false }: Props = $props()
 </script>
 
 <div class="h-full flex flex-col">
@@ -32,19 +26,8 @@
 				<input bind:value={branch.summary} placeholder={'Summary'} />
 			</div>
 		{/snippet}
-		<div class="overflow-hidden flex-grow">
-			<h3 class="p-2">Predicate expression</h3>
-			<BranchPredicateEditor
-				{branch}
-				{parentModule}
-				{previousModule}
-				{enableAi}
-				on:updateSummary={(e) => {
-					if (!branch.summary) {
-						branch.summary = e.detail
-					}
-				}}
-			/>
+		<div class="flex h-full min-h-0 flex-col overflow-auto p-4" style="scrollbar-gutter: stable">
+			<BranchPredicateEditor {branch} {parentModule} {previousModule} {enableAi} />
 		</div>
 	</FlowCard>
 </div>
diff --git a/frontend/src/lib/components/flows/content/FlowBranchesAllWrapper.svelte b/frontend/src/lib/components/flows/content/FlowBranchesAllWrapper.svelte
index 8fa98b33d1..8374962083 100644
--- a/frontend/src/lib/components/flows/content/FlowBranchesAllWrapper.svelte
+++ b/frontend/src/lib/components/flows/content/FlowBranchesAllWrapper.svelte
@@ -1,20 +1,26 @@
 <script lang="ts">
-	import { Alert, Badge, Tab } from '$lib/components/common'
-	import TabContent from '$lib/components/common/tabs/TabContent.svelte'
+	import { Badge, Tab, Tabs } from '$lib/components/common'
+	import { GripVertical, Plus, Trash2 } from 'lucide-svelte'
+	import { getContext } from 'svelte'
+	import type { FlowEditorContext } from '../types'
+	import {
+		addBranch as addBranchOp,
+		removeBranch as removeBranchOp,
+		reorderBranches as reorderBranchesOp,
+		graphBranchIndex
+	} from '../branchOps'
+	import { refreshFlowStateStore } from '../flowStoreRefresh.svelte'
+	import Button from '$lib/components/common/button/Button.svelte'
+	import TextInput from '$lib/components/text_input/TextInput.svelte'
+	import { dragHandle, dragHandleZone } from '@windmill-labs/svelte-dnd-action'
+	import { randomUUID } from '$lib/utils/uuid'
 	import Toggle from '$lib/components/Toggle.svelte'
+	import StepSettingsBadges from './StepSettingsBadges.svelte'
+	import { tick, untrack } from 'svelte'
 
 	import type { BranchAll, FlowModule } from '$lib/gen'
-	import { Pane, Splitpanes } from 'svelte-splitpanes'
-	import SplitPanesWrapper from '../../splitPanes/SplitPanesWrapper.svelte'
 	import FlowCard from '../common/FlowCard.svelte'
-	import FlowModuleEarlyStop from './FlowModuleEarlyStop.svelte'
-	import FlowModuleSleep from './FlowModuleSleep.svelte'
-	import FlowModuleSuspend from './FlowModuleSuspend.svelte'
-	import FlowModuleMock from './FlowModuleMock.svelte'
-	import FlowModuleDeleteAfterUse from './FlowModuleDeleteAfterUse.svelte'
-	import { enterpriseLicense } from '$lib/stores'
-	import FlowModuleSkip from './FlowModuleSkip.svelte'
-	import TabsV2 from '$lib/components/common/tabs/TabsV2.svelte'
+	import FlowRunSettings from './FlowRunSettings.svelte'
 	import { useUiIntent } from '$lib/components/copilot/chat/flow/useUiIntent'
 
 	interface Props {
@@ -31,110 +37,193 @@
 		value = flowModule.value as BranchAll
 	})
 
-	let selected = $state('early-stop')
+	// dnd needs a stable id per item; branches have none and must not gain one (it would
+	// land in the saved flow), so ids are held beside them, keyed by object identity.
+	const branchIds = new WeakMap<object, string>()
+	function idFor(branch: object): string {
+		let id = branchIds.get(branch)
+		if (!id) {
+			id = randomUUID()
+			branchIds.set(branch, id)
+		}
+		return id
+	}
+
+	let items = $state(value.branches.map((b) => ({ id: idFor(b), branch: b })))
+	// dnd owns `items` for the length of a gesture: mid-drag it holds a shadow placeholder
+	// alongside the real entries, so rebuilding from `value.branches` there would splice a
+	// second copy of the dragged branch into the list (duplicate keys).
+	let dragging = false
+
+	$effect(() => {
+		const next = value.branches.map((b) => ({ id: idFor(b), branch: b }))
+		// untrack: this reads and writes `items`, which would otherwise re-invalidate itself.
+		untrack(() => {
+			if (dragging) return
+			const same = next.length === items.length && next.every((it, i) => it.id === items[i].id)
+			if (!same) items = next
+		})
+	})
+
+	function handleConsider(e: CustomEvent<{ items: typeof items }>) {
+		dragging = true
+		items = e.detail.items
+	}
+	function handleFinalize(e: CustomEvent<{ items: typeof items }>) {
+		items = e.detail.items
+		reorderBranchesOp(
+			flowModule.id,
+			items.map((it) => it.branch),
+			{ flowStore, history }
+		)
+		dragging = false
+	}
+
+	const { flowStore, flowStateStore, history } = getContext<FlowEditorContext>('FlowEditorContext')
+
+	function addBranch() {
+		addBranchOp(flowModule.id, { flowStore, history })
+		refreshFlowStateStore(flowStore)
+	}
+	function removeBranch(arrayIndex: number) {
+		// The shared op counts branches the way the graph does; see graphBranchIndex.
+		removeBranchOp(flowModule.id, graphBranchIndex(value.type, arrayIndex), {
+			flowStore,
+			flowStateStore,
+			history
+		})
+		refreshFlowStateStore(flowStore)
+	}
+
+	let runSettings: FlowRunSettings | undefined = $state(undefined)
+	let selectedTab = $state('branches')
 
 	useUiIntent(`branchall-${flowModule.id}`, {
-		openTab: (tab) => {
-			selected = tab
+		openTab: async (tab) => {
+			// Every setting the intent can name lives in the other tab, which only mounts
+			// `runSettings` once selected.
+			selectedTab = 'settings'
+			await tick()
+			runSettings?.openSetting(tab)
 		}
 	})
 </script>
 
 <div class="h-full flex flex-col w-full" id="flow-editor-branch-all-wrapper">
-	<FlowCard {noEditor} title={value.type == 'branchall' ? 'Run all branches' : 'Run one branch'}>
-		<SplitPanesWrapper>
-			<Splitpanes horizontal>
-				<Pane size={flowModule ? 60 : 100}>
-					{#if !noEditor}
-						<Alert
-							type="info"
-							title="All branches will be run"
-							tooltip="Branch all"
-							documentationLink="https://www.windmill.dev/docs/flows/flow_branches#branch-all"
-							class="m-4"
-						>
-							The result of this step is the list of the result of each branch.
-						</Alert>
-					{/if}
-					<div class="p-4 mt-4 w-full">
-						<h3 class="mb-4"
-							>{value.branches.length} branch{value.branches.length > 1 ? 'es' : ''}</h3
-						>
-						<div class="flex flex-col gap-y-4 py-2 w-full">
-							{#each value.branches as branch, i}
-								<div class="flex flex-row gap-x-4 w-full items-center">
-									<div class="grow flex gap-2">
-										<Badge large={true} color="blue">Branch {i + 1}</Badge>
-										<input type="text" bind:value={branch.summary} placeholder="Summary" />
-									</div>
-									<div class="w-min-sm">
-										<Toggle
-											bind:checked={branch.skip_failure}
-											options={{
-												right: 'Skip failure'
-											}}
+	<FlowCard
+		{noEditor}
+		title={value.type == 'branchall' ? 'Run all branches' : 'Run one branch'}
+		subtitle="Every branch runs. The result of this step is the list of each branch's result."
+		subtitleDocLink="https://www.windmill.dev/docs/flows/flow_branches#branch-all"
+	>
+		<div class="flex h-full min-h-0 flex-col">
+			<Tabs bind:selected={selectedTab} wrapperClass="shrink-0">
+				<Tab value="branches" label="Branches" />
+				<Tab value="settings" label="Run settings">
+					{#snippet extra()}
+						<StepSettingsBadges {flowModule} />
+					{/snippet}
+				</Tab>
+			</Tabs>
+
+			<div
+				class="flex min-h-0 flex-1 flex-col gap-6 overflow-auto p-4"
+				style="scrollbar-gutter: stable"
+			>
+				{#if selectedTab === 'branches'}
+					<section class="flex w-full flex-col gap-4">
+						<div>
+							<section
+								class="flex flex-col gap-3"
+								use:dragHandleZone={{ items, flipDurationMs: 150, dropTargetStyle: {} }}
+								onconsider={handleConsider}
+								onfinalize={handleFinalize}
+							>
+								{#each items as item, i (item.id)}
+									<!-- The handle and the delete button each own a column, so the row below
+									     lines up with the summary instead of running under them. -->
+									<div
+										class="grid grid-cols-[auto_minmax(0,1fr)_auto] items-center gap-x-2 gap-y-0 rounded-md bg-surface-tertiary p-3 shadow-sm"
+									>
+										<!-- svelte-ignore a11y_no_static_element_interactions -->
+										<div
+											class="cursor-move text-tertiary hover:text-primary"
+											use:dragHandle
+											aria-label="Reorder branch"
+										>
+											<GripVertical size={16} />
+										</div>
+										<div class="flex min-w-0 items-center gap-2">
+											<Badge color="blue" class="text-xs">Branch {i + 1}</Badge>
+											<TextInput
+												size="sm"
+												class="grow"
+												bind:value={
+													() => item.branch.summary ?? '', (v) => (item.branch.summary = String(v))
+												}
+												inputProps={{ placeholder: 'Summary' }}
+											/>
+										</div>
+										<Button
+											unifiedSize="sm"
+											variant="subtle"
+											destructive
+											iconOnly
+											startIcon={{ icon: Trash2 }}
+											title="Delete branch"
+											on:click={() => removeBranch(i)}
 										/>
+										<div class="col-start-2 py-2">
+											<Toggle
+												size="xs"
+												textClass="text-xs font-normal text-primary"
+												bind:checked={item.branch.skip_failure}
+												options={{
+													right: 'Skip failure'
+												}}
+											/>
+										</div>
 									</div>
-								</div>
-							{/each}
+								{/each}
+							</section>
+							<Button
+								unifiedSize="sm"
+								variant="default"
+								startIcon={{ icon: Plus }}
+								wrapperClasses="mt-4 self-start"
+								on:click={addBranch}
+							>
+								Add branch
+							</Button>
 						</div>
-						<p class="text-sm">Add branches and steps directly on the graph.</p>
-						<div class="mt-6 mb-2 text-sm font-bold">Run in parallel</div>
-						<Toggle
-							bind:checked={value.parallel}
-							options={{
-								right: 'All branches run in parallel'
-							}}
-						/>
-					</div>
-				</Pane>
-				{#if flowModule}
-					<Pane size={40}>
-						<TabsV2 bind:selected>
-							<Tab value="early-stop" label="Early Stop/Break" />
-							<Tab value="skip" label="Skip" />
-							<Tab value="suspend" label="Suspend/Approval/Prompt" />
-							<Tab value="sleep" label="Sleep" />
-							<Tab value="mock" label="Mock" />
-							<Tab value="lifetime" label="Lifetime" />
-							{#snippet content()}
-								<div class="overflow-hidden bg-surface">
-									<TabContent value="early-stop" class="flex flex-col flex-1 h-full">
-										<div class="p-4 overflow-y-auto">
-											<FlowModuleEarlyStop bind:flowModule />
-										</div>
-									</TabContent>
-									<TabContent value="skip" class="flex flex-col flex-1 h-full">
-										<div class="p-4 overflow-y-auto">
-											<FlowModuleSkip bind:flowModule {parentModule} {previousModule} />
-										</div>
-									</TabContent>
-									<TabContent value="suspend" class="flex flex-col flex-1 h-full">
-										<div class="p-4 overflow-y-auto">
-											<FlowModuleSuspend previousModuleId={previousModule?.id} bind:flowModule />
-										</div>
-									</TabContent>
-									<TabContent value="sleep" class="flex flex-col flex-1 h-full">
-										<div class="p-4 overflow-y-auto">
-											<FlowModuleSleep previousModuleId={previousModule?.id} bind:flowModule />
-										</div>
-									</TabContent>
-									<TabContent value="mock" class="flex flex-col flex-1 h-full">
-										<div class="p-4 overflow-y-auto">
-											<FlowModuleMock bind:flowModule />
-										</div>
-									</TabContent>
-									<TabContent value="lifetime" class="flex flex-col flex-1 h-full">
-										<div class="p-4 overflow-y-auto">
-											<FlowModuleDeleteAfterUse bind:flowModule disabled={!$enterpriseLicense} />
-										</div>
-									</TabContent>
-								</div>
-							{/snippet}
-						</TabsV2>
-					</Pane>
+						<div>
+							<label
+								for="branchall-parallel-{flowModule.id}"
+								class="mb-2 block w-fit cursor-pointer text-xs font-semibold text-emphasis"
+							>
+								Run in parallel
+							</label>
+							<Toggle
+								id="branchall-parallel-{flowModule.id}"
+								bind:checked={value.parallel}
+								options={{
+									right: 'All branches run in parallel'
+								}}
+							/>
+						</div>
+					</section>
+				{:else}
+					<FlowRunSettings
+						embedded
+						loopSubset
+						bind:this={runSettings}
+						bind:flowModule
+						{parentModule}
+						{previousModule}
+						selectedId={flowModule.id}
+					/>
 				{/if}
-			</Splitpanes>
-		</SplitPanesWrapper>
+			</div>
+		</div>
 	</FlowCard>
 </div>
diff --git a/frontend/src/lib/components/flows/content/FlowBranchesOneWrapper.svelte b/frontend/src/lib/components/flows/content/FlowBranchesOneWrapper.svelte
index aa6d1af97c..25b843268a 100644
--- a/frontend/src/lib/components/flows/content/FlowBranchesOneWrapper.svelte
+++ b/frontend/src/lib/components/flows/content/FlowBranchesOneWrapper.svelte
@@ -1,24 +1,29 @@
 <script lang="ts">
-	import { Alert, Badge, Tab } from '$lib/components/common'
-	import TabContent from '$lib/components/common/tabs/TabContent.svelte'
-	import TabsV2 from '$lib/components/common/tabs/TabsV2.svelte'
+	import { Badge, Tab, Tabs } from '$lib/components/common'
+	import { GripVertical, Plus, Trash2 } from 'lucide-svelte'
+	import { getContext } from 'svelte'
+	import type { FlowEditorContext } from '../types'
+	import {
+		addBranch as addBranchOp,
+		removeBranch as removeBranchOp,
+		reorderBranches as reorderBranchesOp,
+		graphBranchIndex
+	} from '../branchOps'
+	import { refreshFlowStateStore } from '../flowStoreRefresh.svelte'
+	import Button from '$lib/components/common/button/Button.svelte'
+	import TextInput from '$lib/components/text_input/TextInput.svelte'
+	import { dragHandle, dragHandleZone } from '@windmill-labs/svelte-dnd-action'
+	import { randomUUID } from '$lib/utils/uuid'
+	import StepSettingsBadges from './StepSettingsBadges.svelte'
+	import { tick, untrack } from 'svelte'
 
 	import type { BranchOne, FlowModule } from '$lib/gen'
-	import { Pane, Splitpanes } from 'svelte-splitpanes'
 	import FlowCard from '../common/FlowCard.svelte'
 	import BranchPredicateEditor from './BranchPredicateEditor.svelte'
-	import FlowModuleEarlyStop from './FlowModuleEarlyStop.svelte'
-	import FlowModuleDeleteAfterUse from './FlowModuleDeleteAfterUse.svelte'
-	import FlowModuleSleep from './FlowModuleSleep.svelte'
-	import FlowModuleSuspend from './FlowModuleSuspend.svelte'
-	import SplitPanesWrapper from '../../splitPanes/SplitPanesWrapper.svelte'
-	import FlowModuleMock from './FlowModuleMock.svelte'
-	import { enterpriseLicense } from '$lib/stores'
-	import FlowModuleSkip from './FlowModuleSkip.svelte'
+	import FlowRunSettings from './FlowRunSettings.svelte'
 	import { useUiIntent } from '$lib/components/copilot/chat/flow/useUiIntent'
 
 	interface Props {
-		// import FlowRetries from './FlowRetries.svelte'
 		flowModule: FlowModule
 		previousModule: FlowModule | undefined
 		parentModule: FlowModule | undefined
@@ -39,120 +44,180 @@
 		value = flowModule.value as BranchOne
 	})
 
-	let selected = $state('early-stop')
+	// dnd needs a stable id per item; branches have none and must not gain one (it would
+	// land in the saved flow), so ids are held beside them, keyed by object identity.
+	const branchIds = new WeakMap<object, string>()
+	function idFor(branch: object): string {
+		let id = branchIds.get(branch)
+		if (!id) {
+			id = randomUUID()
+			branchIds.set(branch, id)
+		}
+		return id
+	}
+
+	let items = $state(value.branches.map((b) => ({ id: idFor(b), branch: b })))
+	// dnd owns `items` for the length of a gesture: mid-drag it holds a shadow placeholder
+	// alongside the real entries, so rebuilding from `value.branches` there would splice a
+	// second copy of the dragged branch into the list (duplicate keys).
+	let dragging = false
+
+	$effect(() => {
+		const next = value.branches.map((b) => ({ id: idFor(b), branch: b }))
+		// untrack: this reads and writes `items`, which would otherwise re-invalidate itself.
+		untrack(() => {
+			if (dragging) return
+			const same = next.length === items.length && next.every((it, i) => it.id === items[i].id)
+			if (!same) items = next
+		})
+	})
+
+	function handleConsider(e: CustomEvent<{ items: typeof items }>) {
+		dragging = true
+		items = e.detail.items
+	}
+	function handleFinalize(e: CustomEvent<{ items: typeof items }>) {
+		items = e.detail.items
+		reorderBranchesOp(
+			flowModule.id,
+			items.map((it) => it.branch),
+			{ flowStore, history }
+		)
+		dragging = false
+	}
+
+	const { flowStore, flowStateStore, history } = getContext<FlowEditorContext>('FlowEditorContext')
+
+	function addBranch() {
+		addBranchOp(flowModule.id, { flowStore, history })
+		refreshFlowStateStore(flowStore)
+	}
+	function removeBranch(arrayIndex: number) {
+		// The shared op counts branches the way the graph does; see graphBranchIndex.
+		removeBranchOp(flowModule.id, graphBranchIndex(value.type, arrayIndex), {
+			flowStore,
+			flowStateStore,
+			history
+		})
+		refreshFlowStateStore(flowStore)
+	}
+
+	let runSettings: FlowRunSettings | undefined = $state(undefined)
+	let selectedTab = $state('branches')
 
 	useUiIntent(`branchone-${flowModule.id}`, {
-		openTab: (tab) => {
-			selected = tab
+		openTab: async (tab) => {
+			// Every setting the intent can name lives in the other tab, which only mounts
+			// `runSettings` once selected.
+			selectedTab = 'settings'
+			await tick()
+			runSettings?.openSetting(tab)
 		}
 	})
 </script>
 
 <div class="h-full" id="flow-editor-branch-one-wrapper">
-	<FlowCard {noEditor} title="Run one branch">
-		<SplitPanesWrapper>
-			<Splitpanes horizontal>
-				<Pane size={flowModule ? 60 : 100}>
-					{#if !noEditor}
-						<Alert
-							type="info"
-							title="Only first branch whose condition is true will be run"
-							tooltip="Branch one"
-							documentationLink="https://www.windmill.dev/docs/flows/flow_branches#branch-one"
-							class="m-4"
-						>
-							The result of this step is the result of the branch.
-						</Alert>
-					{/if}
-					<div class="p-4">
-						<h3 class="my-4">
-							{value.branches.length + 1} branch{value.branches.length + 1 > 1 ? 'es' : ''}
-						</h3>
-						<div class="py-2">
-							<div class="flex flex-row gap-2 text-sm p-2">
-								<Badge large={true} color="blue">Default branch</Badge>
-								<p class="italic text-primary"
-									>If none of the predicates' expressions evaluated in-order match, this branch is
-									chosen</p
-								>
-							</div>
-							{#each value.branches as branch, i}
-								<div class="flex flex-col gap-x-2 items-center">
-									<div class="w-full flex gap-2 px-2 pt-4 pb-2">
-										<Badge large={true} color="blue">Branch {i + 1}</Badge>
-										<input
-											class="w-full"
-											type="text"
-											bind:value={branch.summary}
-											placeholder="Summary"
-										/>
-									</div>
-									<div class="w-full border">
-										<BranchPredicateEditor
-											{branch}
-											on:updateSummary={(e) => {
-												if (!branch.summary) {
-													branch.summary = e.detail
+	<FlowCard
+		{noEditor}
+		title="Run one branch"
+		subtitle="The first branch whose predicate is true runs. The result of this step is that branch's result."
+		subtitleDocLink="https://www.windmill.dev/docs/flows/flow_branches#branch-one"
+	>
+		<div class="flex h-full min-h-0 flex-col">
+			<Tabs bind:selected={selectedTab} wrapperClass="shrink-0">
+				<Tab value="branches" label="Branches" />
+				<Tab value="settings" label="Run settings">
+					{#snippet extra()}
+						<StepSettingsBadges {flowModule} />
+					{/snippet}
+				</Tab>
+			</Tabs>
+
+			<div
+				class="flex min-h-0 flex-1 flex-col gap-6 overflow-auto p-4"
+				style="scrollbar-gutter: stable"
+			>
+				{#if selectedTab === 'branches'}
+					<section>
+						<div class="flex flex-col gap-3">
+							<section
+								class="flex flex-col gap-3"
+								use:dragHandleZone={{ items, flipDurationMs: 150, dropTargetStyle: {} }}
+								onconsider={handleConsider}
+								onfinalize={handleFinalize}
+							>
+								{#each items as item, i (item.id)}
+									<!-- The handle and the delete button each own a column, so the predicate
+									     below lines up with the summary instead of running under them. -->
+									<div
+										class="grid grid-cols-[auto_minmax(0,1fr)_auto] items-center gap-x-2 gap-y-0 rounded-md bg-surface-tertiary p-3 shadow-sm"
+									>
+										<!-- svelte-ignore a11y_no_static_element_interactions -->
+										<div
+											class="cursor-move text-tertiary hover:text-primary"
+											use:dragHandle
+											aria-label="Reorder branch"
+										>
+											<GripVertical size={16} />
+										</div>
+										<div class="flex min-w-0 items-center gap-2">
+											<Badge color="blue" class="text-xs">Branch {i + 1}</Badge>
+											<TextInput
+												size="sm"
+												class="grow"
+												bind:value={
+													() => item.branch.summary ?? '', (v) => (item.branch.summary = String(v))
 												}
-											}}
-											parentModule={flowModule}
-											{previousModule}
-											{enableAi}
+												inputProps={{ placeholder: 'Summary' }}
+											/>
+										</div>
+										<Button
+											unifiedSize="sm"
+											variant="subtle"
+											destructive
+											iconOnly
+											startIcon={{ icon: Trash2 }}
+											title="Delete branch"
+											on:click={() => removeBranch(i)}
 										/>
+										<div class="col-start-2 py-2">
+											<BranchPredicateEditor
+												branch={item.branch}
+												parentModule={flowModule}
+												{previousModule}
+												{enableAi}
+											/>
+										</div>
 									</div>
-								</div>
-							{/each}
+								{/each}
+							</section>
+							<div class="flex items-center gap-2 rounded-md bg-surface-tertiary p-3 shadow-sm">
+								<Badge color="blue" class="text-xs">Default</Badge>
+								<p class="text-xs italic text-tertiary">Runs if none of the above match</p>
+							</div>
 						</div>
-						<p class="text-sm">Add branches and steps directly on the graph.</p>
-					</div>
-				</Pane>
-				{#if flowModule}
-					<Pane size={40}>
-						<TabsV2 bind:selected>
-							<Tab value="early-stop" label="Early Stop/Break" />
-							<Tab value="skip" label="Skip" />
-							<Tab value="suspend" label="Suspend/Approval/Prompt" />
-							<Tab value="sleep" label="Sleep" />
-							<Tab value="mock" label="Mock" />
-							<Tab value="lifetime" label="Lifetime" />
-							{#snippet content()}
-								<div class="overflow-hidden bg-surface">
-									<TabContent value="early-stop" class="flex flex-col flex-1 h-full">
-										<div class="p-4 overflow-y-auto">
-											<FlowModuleEarlyStop bind:flowModule />
-										</div>
-									</TabContent>
-									<TabContent value="skip" class="flex flex-col flex-1 h-full">
-										<div class="p-4 overflow-y-auto">
-											<FlowModuleSkip bind:flowModule {parentModule} {previousModule} />
-										</div>
-									</TabContent>
-									<TabContent value="suspend" class="flex flex-col flex-1 h-full">
-										<div class="p-4 overflow-y-auto">
-											<FlowModuleSuspend previousModuleId={previousModule?.id} bind:flowModule />
-										</div>
-									</TabContent>
-									<TabContent value="sleep" class="flex flex-col flex-1 h-full">
-										<div class="p-4 overflow-y-auto">
-											<FlowModuleSleep previousModuleId={previousModule?.id} bind:flowModule />
-										</div>
-									</TabContent>
-									<TabContent value="mock" class="flex flex-col flex-1 h-full">
-										<div class="p-4 overflow-y-auto">
-											<FlowModuleMock bind:flowModule />
-										</div>
-									</TabContent>
-									<TabContent value="lifetime" class="flex flex-col flex-1 h-full">
-										<div class="p-4 overflow-y-auto">
-											<FlowModuleDeleteAfterUse bind:flowModule disabled={!$enterpriseLicense} />
-										</div>
-									</TabContent>
-								</div>
-							{/snippet}
-						</TabsV2>
-					</Pane>
+						<Button
+							unifiedSize="sm"
+							variant="default"
+							startIcon={{ icon: Plus }}
+							wrapperClasses="mt-4 self-start"
+							on:click={addBranch}
+						>
+							Add branch
+						</Button>
+					</section>
+				{:else}
+					<FlowRunSettings
+						embedded
+						loopSubset
+						bind:this={runSettings}
+						bind:flowModule
+						{parentModule}
+						{previousModule}
+						selectedId={flowModule.id}
+					/>
 				{/if}
-			</Splitpanes>
-		</SplitPanesWrapper>
+			</div>
+		</div>
 	</FlowCard>
 </div>
diff --git a/frontend/src/lib/components/flows/content/FlowEditorDrawer.svelte b/frontend/src/lib/components/flows/content/FlowEditorDrawer.svelte
index 00643588ae..3103f310b4 100644
--- a/frontend/src/lib/components/flows/content/FlowEditorDrawer.svelte
+++ b/frontend/src/lib/components/flows/content/FlowEditorDrawer.svelte
@@ -12,6 +12,7 @@
 	import { initFlow } from '$lib/components/flows/flowStore.svelte'
 	import type { FlowState } from '$lib/components/flows/flowState'
 	import type { FlowEditorContext } from '../types'
+	import { base } from '$app/paths'
 
 	let flowEditorDrawer: Drawer | undefined = $state()
 
@@ -20,11 +21,12 @@
 	const flowEditorContext = getContext<FlowEditorContext>('FlowEditorContext')
 	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $workspaceStore)
 
-	export async function openDrawer(path: string, cb: () => void): Promise<void> {
+	export async function openDrawer(path: string, cb: () => void, stepId?: string): Promise<void> {
 		flowPath = path
 		flow = undefined
 		loading = true
 		callback = cb
+		selectedStepId = stepId
 		flowEditorDrawer?.openDrawer?.()
 
 		try {
@@ -47,6 +49,7 @@
 
 	let callback: (() => void) | undefined = undefined
 	let flowPath: string = $state('')
+	let selectedStepId: string | undefined = $state(undefined)
 	let flow: Flow | undefined = $state(undefined)
 	let savedFlow: Flow | undefined = $state(undefined)
 	let loading = $state(true)
@@ -66,6 +69,7 @@
 	const flowStateStore: StateStore<FlowState> = $state({ val: {} })
 
 	let diffDrawer: DiffDrawer | undefined = $state()
+	let flowBuilder: FlowBuilder | undefined = $state(undefined)
 </script>
 
 <Drawer bind:this={flowEditorDrawer} size="100%">
@@ -87,12 +91,13 @@
 			</div>
 		{:else if flow}
 			<FlowBuilder
+				bind:this={flowBuilder}
 				{flowStore}
 				{flowStateStore}
 				initialPath={flowPath}
 				autosaveWorkspace={opWs}
 				newFlow={false}
-				selectedId="settings-metadata"
+				selectedId={selectedStepId ?? 'settings-metadata'}
 				loading={false}
 				bind:savedFlow
 				{diffDrawer}
@@ -117,7 +122,10 @@
 			<Button
 				variant="default"
 				on:click={() => {
-					window.open(`/flows/edit/${flowPath}`, '_blank', 'noopener,noreferrer')
+					// Follow the drawer's own selection, which the user may have moved since it opened.
+					const stepId = flowBuilder?.getSelectedId() ?? selectedStepId
+					const selected = stepId ? `?selected=${encodeURIComponent(stepId)}` : ''
+					window.open(`${base}/flows/edit/${flowPath}${selected}`, '_blank', 'noopener,noreferrer')
 					flowEditorDrawer?.closeDrawer()
 				}}
 				startIcon={{ icon: ExternalLink }}
diff --git a/frontend/src/lib/components/flows/content/FlowEditorPanel.svelte b/frontend/src/lib/components/flows/content/FlowEditorPanel.svelte
index 471790d539..81600e2dcc 100644
--- a/frontend/src/lib/components/flows/content/FlowEditorPanel.svelte
+++ b/frontend/src/lib/components/flows/content/FlowEditorPanel.svelte
@@ -2,6 +2,7 @@
 	import { getContext } from 'svelte'
 	import type { FlowEditorContext } from '../types'
 	import FlowModuleWrapper from './FlowModuleWrapper.svelte'
+	import { moduleSlot, savedModuleById } from '../moduleSlot'
 	import FlowSettings from './FlowSettings.svelte'
 	import FlowInput from './FlowInput.svelte'
 	import FlowFailureModule from './FlowFailureModule.svelte'
@@ -14,6 +15,7 @@
 	import { handleSelectTriggerFromKind, type Trigger } from '$lib/components/triggers/utils'
 	import { computeMissingInputWarnings } from '../missingInputWarnings'
 	import FlowResult from './FlowResult.svelte'
+	import ExpandedSubflowStep from './ExpandedSubflowStep.svelte'
 	import type { StateStore } from '$lib/utils'
 	import FlowSelectionPanel from './FlowSelectionPanel.svelte'
 	import {
@@ -123,7 +125,7 @@
 		{noEditor}
 		disabled={disabledFlowInputs}
 		on:openTriggers={(ev) => {
-			selectionManager.selectId('Trigger')
+			selectionManager.selectId('Trigger', { openPanel: true })
 			handleSelectTriggerFromKind(triggersState, triggersCount, savedFlow?.path, ev.detail.kind)
 			showCaptureHint.set(true)
 		}}
@@ -176,9 +178,10 @@
 		{onDeployTrigger}
 	/>
 {:else if selectedId?.startsWith('subflow:')}
-	<div class="p-4"
-		>Selected step is witin an expanded subflow and is not directly editable in the flow editor</div
-	>
+	<ExpandedSubflowStep
+		{selectedId}
+		onSubflowUpdated={() => flowModuleSchemaMap?.reloadExpandedSubflows()}
+	/>
 {:else}
 	{@const dup = checkDup(flowStore.val.value.modules)}
 	{#if dup}
@@ -186,12 +189,13 @@
 	{:else}
 		{#key selectedId}
 			{#each flowStore.val.value.modules as flowModule, index (flowModule.id ?? index)}
+				{@const slot = moduleSlot(() => flowStore.val.value.modules, flowModule.id, flowModule)}
 				<FlowModuleWrapper
 					{noEditor}
-					bind:flowModule={flowStore.val.value.modules[index]}
+					bind:flowModule={slot.get, slot.set}
 					previousModule={flowStore.val.value.modules[index - 1]}
 					{enableAi}
-					savedModule={savedFlow?.value.modules[index]}
+					savedModule={savedModuleById(savedFlow?.value.modules, flowModule.id)}
 					{forceTestTab}
 					{highlightArg}
 				/>
diff --git a/frontend/src/lib/components/flows/content/FlowEnvironmentVariables.svelte b/frontend/src/lib/components/flows/content/FlowEnvironmentVariables.svelte
index e0f9a7d319..4af530a08a 100644
--- a/frontend/src/lib/components/flows/content/FlowEnvironmentVariables.svelte
+++ b/frontend/src/lib/components/flows/content/FlowEnvironmentVariables.svelte
@@ -234,6 +234,10 @@
 		connectProp: () => {},
 		propPickerConfig: writable(undefined),
 		clearConnect: () => {},
+		openPicker: () => {},
+		pickerMode: () => 'pane' as const,
+		setPickTarget: () => {},
+		onPick: () => {},
 		exprBeingEdited: writable([])
 	})
 </script>
diff --git a/frontend/src/lib/components/flows/content/FlowInputs.svelte b/frontend/src/lib/components/flows/content/FlowInputs.svelte
index 335a37b0c7..e275df3976 100644
--- a/frontend/src/lib/components/flows/content/FlowInputs.svelte
+++ b/frontend/src/lib/components/flows/content/FlowInputs.svelte
@@ -12,7 +12,7 @@
 	import { Check, Code, Zap } from 'lucide-svelte'
 	import SuspendDrawer from './SuspendDrawer.svelte'
 	import { defaultScripts } from '$lib/stores'
-	import { defaultScriptLanguages, processLangs } from '$lib/scripts'
+	import { defaultScriptLanguages, processInlineLangs } from '$lib/scripts'
 	import type { SupportedLanguage } from '$lib/common'
 	import DefaultScripts from '$lib/components/DefaultScripts.svelte'
 	import type { FlowBuilderWhitelabelCustomUi } from '$lib/components/custom_ui'
@@ -48,7 +48,7 @@
 	let filter = $state('')
 
 	let langs = $derived(
-		processLangs(undefined, $defaultScripts?.order ?? Object.keys(defaultScriptLanguages))
+		processInlineLangs(undefined, $defaultScripts?.order ?? Object.keys(defaultScriptLanguages))
 			.map((l) => [defaultScriptLanguages[l], l])
 			.filter(
 				(x) => $defaultScripts?.hidden == undefined || !$defaultScripts.hidden.includes(x[1])
diff --git a/frontend/src/lib/components/flows/content/FlowInputsQuick.svelte b/frontend/src/lib/components/flows/content/FlowInputsQuick.svelte
index dc2cba93d4..d7503b67a8 100644
--- a/frontend/src/lib/components/flows/content/FlowInputsQuick.svelte
+++ b/frontend/src/lib/components/flows/content/FlowInputsQuick.svelte
@@ -6,7 +6,7 @@
 <script lang="ts">
 	import { sendUserToast } from '$lib/toast'
 	import FlowScriptPickerQuick from '../pickers/FlowScriptPickerQuick.svelte'
-	import { defaultScriptLanguages, processLangs } from '$lib/scripts'
+	import { defaultScriptLanguages, processInlineLangs } from '$lib/scripts'
 	import {
 		defaultScripts,
 		enterpriseLicense,
@@ -200,12 +200,7 @@
 
 	let scrollable: HTMLElement | undefined = $state()
 	function onKeyDown(e: KeyboardEvent) {
-		let length =
-			topLevelNodes?.length +
-			inlineScripts.length +
-			aiLength +
-			filteredWorkspaceItems.length +
-			hubCompletions.length
+		let length = hubOffset + (hubCompletions?.length ?? 0)
 		if (e.key === 'ArrowDown') {
 			selectedByKeyboard = (selectedByKeyboard + 1) % length
 			scrollable?.scrollTo({ top: selectedByKeyboard * 32, behavior: 'smooth' })
@@ -217,6 +212,13 @@
 		}
 	}
 
+	// Mouse and keyboard share this one index, so rows report hover on mousemove rather than
+	// mouseenter: arrow keys scroll the list, which slides a row under a stationary cursor and
+	// fires mouseenter, which would otherwise hijack the selection mid-navigation.
+	function hover(index: number) {
+		selectedByKeyboard = index
+	}
+
 	onMount(() => {
 		$insertButtonOpen = true
 	})
@@ -225,7 +227,7 @@
 		$insertButtonOpen = false
 	})
 	let langs = $derived(
-		processLangs(undefined, $defaultScripts?.order ?? Object.keys(defaultScriptLanguages))
+		processInlineLangs(undefined, $defaultScripts?.order ?? Object.keys(defaultScriptLanguages))
 			.map((l) => [defaultScriptLanguages[l], l])
 			.filter(
 				(x) => $defaultScripts?.hidden == undefined || !$defaultScripts.hidden.includes(x[1])
@@ -247,9 +249,48 @@
 		preFilter
 		untrack(() => onPrefilterChange(preFilter))
 	})
-	let aiLength = $derived(
-		funcDesc?.length > 0 && !disableAi && selectedKind != 'flow' && preFilter == 'all' ? 2 : 0
+	// Gates the two AI rows and their slots in the index space; both must agree or arrow keys land
+	// on indices that render nothing.
+	let showAiRows = $derived(
+		!disableAi &&
+			funcDesc?.length > 0 &&
+			kind != 'failure' &&
+			kind != 'preprocessor' &&
+			(selectedKind == 'script' || selectedKind == 'trigger') &&
+			preFilter == 'all'
 	)
+	let aiLength = $derived(showAiRows ? 2 : 0)
+
+	// Must match the heading and label rendered for the AI Sandbox section
+	const aiSandboxHeading = 'AI Sandbox'
+	const aiSandboxLabel = 'Claude Code'
+	let matchesAiSandbox = $derived.by(() => {
+		const query = funcDesc?.trim().toLowerCase() ?? ''
+		if (query.length == 0) {
+			return true
+		}
+		return [aiSandboxHeading, aiSandboxLabel].some((term) => {
+			const lowered = term.toLowerCase()
+			return lowered.startsWith(query) || lowered.split(' ').some((w) => w.startsWith(query))
+		})
+	})
+	// Gates the AI Sandbox row and its slot in the index space; both must agree or arrow keys land
+	// on an index that renders nothing.
+	let showAiSandbox = $derived(
+		selectedKind === 'script' &&
+			preFilter === 'all' &&
+			!selected &&
+			customUi?.aiSandbox != false &&
+			matchesAiSandbox
+	)
+
+	// Every result row lives in one keyboard index space, and hovering a row moves that index, so
+	// mouse and keyboard can never highlight two different rows. Offsets follow the render order.
+	let inlineOffset = $derived(topLevelNodes.length)
+	let aiOffset = $derived(inlineOffset + (inlineScripts?.length ?? 0))
+	let workspaceOffset = $derived(aiOffset + aiLength)
+	let aiSandboxOffset = $derived(workspaceOffset + (filteredWorkspaceItems?.length ?? 0))
+	let hubOffset = $derived(aiSandboxOffset + (showAiSandbox ? 1 : 0))
 </script>
 
 <svelte:window onkeydown={onKeyDown} />
@@ -281,8 +322,9 @@
 										icon: owner.startsWith('f/') ? Folder : User,
 										props: { width: 14, height: 14 }
 									}}
+									title={owner.slice(2)}
 								>
-									{owner.slice(2)}
+									<span class="truncate">{owner.slice(2)}</span>
 								</Button>
 							</div>
 						{/each}
@@ -355,6 +397,7 @@
 					}}
 					{label}
 					selected={selectedByKeyboard === i}
+					onHover={() => hover(i)}
 				/>
 			{/each}
 		{/if}
@@ -395,7 +438,8 @@
 			{#each inlineScripts as [label, lang], i (lang)}
 				<FlowScriptPickerQuick
 					eeRestricted={!$enterpriseLicense && enterpriseLangs.includes(lang)}
-					selected={selectedByKeyboard === i + topLevelNodes.length}
+					selected={selectedByKeyboard === i + inlineOffset}
+					onHover={() => hover(i + inlineOffset)}
 					{enterpriseLangs}
 					{label}
 					lang={lang == 'docker' ? 'bash' : lang}
@@ -419,13 +463,14 @@
 			{/each}
 		{/if}
 
-		{#if !disableAi && funcDesc?.length > 0 && kind != 'failure' && kind != 'preprocessor' && (selectedKind == 'script' || selectedKind == 'trigger') && preFilter == 'all'}
+		{#if showAiRows}
 			<ul class="transition-all">
 				<li
 					><GenAiQuick
 						{funcDesc}
 						lang="TypeScript"
-						selected={selectedByKeyboard === inlineScripts?.length + topLevelNodes.length}
+						selected={selectedByKeyboard === aiOffset}
+						onHover={() => hover(aiOffset)}
 						on:click={() => {
 							lang = 'bun'
 							onGenerate()
@@ -436,7 +481,8 @@
 					<GenAiQuick
 						{funcDesc}
 						lang="Python"
-						selected={selectedByKeyboard === inlineScripts?.length + topLevelNodes.length + 1}
+						selected={selectedByKeyboard === aiOffset + 1}
+						onHover={() => hover(aiOffset + 1)}
 						on:click={() => {
 							lang = 'python3'
 							onGenerate()
@@ -463,22 +509,24 @@
 					bind:filteredWithOwner={filteredWorkspaceItems}
 					{filter}
 					kind={selectedKind}
-					selected={selectedByKeyboard - inlineScripts?.length - aiLength - topLevelNodes.length}
+					selected={selectedByKeyboard - workspaceOffset}
 					on:pickScript
 					on:pickFlow
 					{displayPath}
 					{refreshCount}
+					onHover={(i) => hover(workspaceOffset + i)}
 				/>
 			{/await}
 			<div class="pb-1"></div>
 		{/if}
-		{#if selectedKind === 'script' && preFilter === 'all' && !selected && customUi?.aiSandbox != false}
-			<div class="pb-0 text-2xs font-normal text-secondary ml-2">AI Sandbox</div>
+		{#if showAiSandbox}
+			<div class="pb-0 text-2xs font-normal text-secondary ml-2">{aiSandboxHeading}</div>
 			<FlowScriptPickerQuick
 				eeRestricted={false}
-				selected={false}
+				selected={selectedByKeyboard === aiSandboxOffset}
+				onHover={() => hover(aiSandboxOffset)}
 				enterpriseLangs={[]}
-				label="Claude Code"
+				label={aiSandboxLabel}
 				lang="claudesandbox"
 				on:click={() => {
 					dispatch('new', {
@@ -511,15 +559,12 @@
 						}
 						appFilter={selected?.name}
 						kind={selectedKind}
-						selected={selectedByKeyboard -
-							inlineScripts?.length -
-							aiLength -
-							filteredWorkspaceItems?.length -
-							topLevelNodes.length}
+						selected={selectedByKeyboard - hubOffset}
 						on:pickScript
 						bind:loading
 						{displayPath}
 						{refreshCount}
+						onHover={(i) => hover(hubOffset + i)}
 					/>
 				{/await}
 			{/if}
diff --git a/frontend/src/lib/components/flows/content/FlowLoop.svelte b/frontend/src/lib/components/flows/content/FlowLoop.svelte
index a7bbe35251..bfb80addd6 100644
--- a/frontend/src/lib/components/flows/content/FlowLoop.svelte
+++ b/frontend/src/lib/components/flows/content/FlowLoop.svelte
@@ -1,37 +1,28 @@
 <script lang="ts">
-	import { getContext } from 'svelte'
+	import { getContext, tick } from 'svelte'
 	import FlowCard from '../common/FlowCard.svelte'
 	import type { FlowEditorContext } from '../types'
 	import Toggle from '$lib/components/Toggle.svelte'
 	import SimpleEditor from '$lib/components/SimpleEditor.svelte'
 	import Tooltip from '$lib/components/Tooltip.svelte'
 
-	import FlowModuleEarlyStop from './FlowModuleEarlyStop.svelte'
-	import FlowModuleSuspend from './FlowModuleSuspend.svelte'
-	// import FlowRetries from './FlowRetries.svelte'
-	import { Button, Drawer, Tab, TabContent } from '$lib/components/common'
-	import { Pane, Splitpanes } from 'svelte-splitpanes'
+	import { Button, Drawer, Tab, Tabs } from '$lib/components/common'
 	import { getStepPropPicker } from '../previousResults'
-	import { enterpriseLicense } from '$lib/stores'
 
-	import FlowModuleSleep from './FlowModuleSleep.svelte'
-	import FlowModuleMock from './FlowModuleMock.svelte'
-	import { Play, FunctionSquare } from 'lucide-svelte'
+	import { Play } from 'lucide-svelte'
 	import type { FlowModule, ForloopFlow, Job } from '$lib/gen'
 	import FlowLoopIterationPreview from '$lib/components/FlowLoopIterationPreview.svelte'
-	import FlowModuleDeleteAfterUse from './FlowModuleDeleteAfterUse.svelte'
 	import IteratorGen from '$lib/components/copilot/IteratorGen.svelte'
-	import FlowModuleSkip from './FlowModuleSkip.svelte'
-	import FlowPlugConnect from '$lib/components/FlowPlugConnect.svelte'
+	import FlowRunSettings from './FlowRunSettings.svelte'
+	import StepSettingsBadges from './StepSettingsBadges.svelte'
+	import FlowModuleEarlyStop from './FlowModuleEarlyStop.svelte'
 
+	import InputTransformForm from '$lib/components/InputTransformForm.svelte'
 	import PropPickerWrapper from '../propPicker/PropPickerWrapper.svelte'
 	import type { PropPickerContext } from '$lib/components/prop_picker'
-	import TabsV2 from '$lib/components/common/tabs/TabsV2.svelte'
 	import { useUiIntent } from '$lib/components/copilot/chat/flow/useUiIntent'
-	import { emptySchema } from '$lib/utils'
-	import { slide } from 'svelte/transition'
-	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
-	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
+	import { emptySchema, emptyString } from '$lib/utils'
+	import { slideDynamic } from '$lib/transitions'
 
 	const { previewArgs, flowStateStore, flowStore, currentEditor } =
 		getContext<FlowEditorContext>('FlowEditorContext')
@@ -54,20 +45,21 @@
 
 	let editor: SimpleEditor | undefined = $state(undefined)
 	let parallelismEditor: SimpleEditor | undefined = $state(undefined)
-	let selected: string = $state('early-stop')
-	let parallelismType: 'static' | 'javascript' | undefined = $state(
-		mod.value.type === 'forloopflow'
-			? mod.value.parallelism?.type === 'javascript'
-				? 'javascript'
-				: 'static'
-			: undefined
-	)
+	let runSettings: FlowRunSettings | undefined = $state(undefined)
 
 	let parallelismSchema = $state(emptySchema())
 	parallelismSchema.properties['parallelism'] = {
-		type: 'number'
+		type: 'integer'
 	}
 
+	// `array` keeps the field on the expression editor: an iterator is never a literal
+	// the static input could hold, which is also why the type switch is hidden.
+	let iteratorSchema = $state(emptySchema())
+	iteratorSchema.properties['iterator'] = {
+		type: 'array'
+	}
+	iteratorSchema.required = ['iterator']
+
 	if (mod.value.type === 'forloopflow') {
 		const forloopValue = mod.value as ForloopFlow
 		if (typeof forloopValue.parallelism === 'number') {
@@ -78,14 +70,20 @@
 		}
 	}
 
-	// UI Intent handling for AI tool control
+	let selectedTab = $state('loop')
+
 	useUiIntent(`forloopflow-${mod.id}`, {
-		openTab: (tab) => {
-			selected = tab
+		openTab: async (tab) => {
+			// Every setting the intent can name lives in the other tab, which only mounts
+			// `runSettings` once selected.
+			selectedTab = 'settings'
+			await tick()
+			runSettings?.openSetting(tab)
 		}
 	})
 
-	const { flowPropPickerConfig } = getContext<PropPickerContext>('PropPickerContext')
+	const propPickerContext = getContext<PropPickerContext>('PropPickerContext')
+	const { flowPropPickerConfig } = propPickerContext
 	flowPropPickerConfig.set(undefined)
 
 	let stepPropPicker = $derived(
@@ -125,8 +123,53 @@
 	})
 
 	let suggestion: string | undefined = $state(undefined)
+
+	// A loop with nothing to iterate over fails at runtime, and the step's own inputs
+	// aren't schema-checked like a script's — so the field says it here.
+	const iterator = $derived(
+		mod.value.type === 'forloopflow' ? (mod.value as ForloopFlow).iterator : undefined
+	)
+	const iteratorMissing = $derived.by(() => {
+		if (iterator == undefined) return true
+		if (iterator.type === 'javascript') return emptyString(iterator.expr)
+		if (iterator.type === 'static') return iterator.value == undefined
+		return false
+	})
+
+	const ITERATOR_LABEL = 'Iterator expression'
+	const ITERATOR_MISSING = 'An iterator expression is required for the loop to run.'
+	const ITERATOR_TOOLTIP =
+		'The JavaScript expression that will be evaluated to get the list of items to iterate over. Example: ["banana", "apple", flow_input.my_fruit].'
+	const DEFAULT_PARALLELISM = 4
+	const PARALLELISM_LABEL = 'Limit concurrent iterations'
+	const SQUASH_PARALLEL_CONFLICT =
+		'Squash and Run in parallel are mutually exclusive: squashing runs every iteration in sequence on a single worker. Turn the other one off to use this.'
+	const PARALLELISM_TOOLTIP =
+		'Cap how many iterations run at once, so a huge loop does not flood the workers. Without a cap every iteration starts at once.'
+
+	const parallelismCapped = $derived(
+		mod.value.type === 'forloopflow' && mod.value.parallelism != undefined
+	)
 </script>
 
+{#snippet parallelismToggle()}
+	<Toggle
+		size="xs"
+		textClass="text-xs font-normal text-primary"
+		checked={parallelismCapped}
+		on:change={({ detail }) => {
+			;(mod.value as ForloopFlow).parallelism = detail
+				? { type: 'static', value: DEFAULT_PARALLELISM }
+				: undefined
+		}}
+		options={{
+			right: PARALLELISM_LABEL,
+			rightTooltip: PARALLELISM_TOOLTIP,
+			rightDocumentationLink: 'https://www.windmill.dev/docs/flows/flow_loops'
+		}}
+	/>
+{/snippet}
+
 <Drawer bind:open={previewOpen} alwaysOpen size="75%">
 	<FlowLoopIterationPreview
 		modules={mod.value.type == 'forloopflow' ? mod.value.modules : []}
@@ -143,7 +186,7 @@
 <FlowCard {noEditor} title="For loop">
 	{#snippet header()}
 		<div class="grow">
-			<div class="my-2 flex flex-row gap-2 items-center">
+			<div class="flex flex-row gap-2 items-center">
 				<div>
 					<Tooltip documentationLink="https://www.windmill.dev/docs/flows/flow_loops">
 						Add steps inside the loop and specify an iterator expression that defines the sequence
@@ -157,7 +200,7 @@
 					<Button
 						on:click={() => (previewOpen = true)}
 						startIcon={{ icon: Play }}
-						variant="accent"
+						variant="default"
 						size="sm">Test an iteration</Button
 					>
 				</div>
@@ -165,332 +208,169 @@
 		</div>
 	{/snippet}
 
-	<Splitpanes horizontal class="h-full">
-		<Pane size={50} minSize={20} class="p-4">
-			{#if mod.value.type === 'forloopflow'}
-				<div class="flex flex-row gap-6 mt-2 mb-6">
-					<div class="flex-shrink-0">
-						<div class="mb-2 text-sm font-bold"
-							>Skip failures <Tooltip
-								documentationLink="https://www.windmill.dev/docs/flows/flow_loops"
-								>If disabled, the flow will fail as soon as one of the iteration fail. Otherwise,
-								the error will be collected as the result of the iteration. Regardless of this
-								setting, if a flow level error handler is defined, it will process the error.
-								(Workspace error handlers will NOT be used to process errors if enabled.)</Tooltip
-							></div
+	<div class="flex h-full min-h-0 flex-col">
+		{#if mod.value.type === 'forloopflow'}
+			<Tabs bind:selected={selectedTab} wrapperClass="shrink-0">
+				<Tab value="loop" label="Loop" />
+				<Tab value="settings" label="Run settings">
+					{#snippet extra()}
+						<StepSettingsBadges flowModule={mod} />
+					{/snippet}
+				</Tab>
+			</Tabs>
+
+			<div
+				class="flex min-h-0 flex-1 flex-col gap-8 overflow-auto p-4"
+				style="scrollbar-gutter: stable"
+			>
+				{#if selectedTab === 'loop'}
+					<section>
+						<PropPickerWrapper
+							sidePane
+							flow_input={stepPropPicker.pickableProperties.flow_input}
+							notSelectable
+							pickableProperties={stepPropPicker.pickableProperties}
+							on:select={({ detail }) => {
+								editor?.insertAtCursor(detail)
+								editor?.focus()
+							}}
 						>
+							<InputTransformForm
+								bind:arg={
+									() => (mod.value as ForloopFlow).iterator,
+									(v) => {
+										;(mod.value as ForloopFlow).iterator = v
+									}
+								}
+								argName="iterator"
+								label={ITERATOR_LABEL}
+								headerTooltip={ITERATOR_TOOLTIP}
+								error={iteratorMissing ? ITERATOR_MISSING : undefined}
+								schema={iteratorSchema}
+								noDynamicToggle
+								extraLib={stepPropPicker.extraLib}
+								pickableProperties={stepPropPicker.pickableProperties}
+								previousModuleId={previousModule?.id}
+								bind:suggestion
+								bind:focused={iteratorFieldFocused}
+								aiOnKeyUp={iteratorGen?.onKeyUp}
+								bind:editor
+							>
+								{#snippet aiGen()}
+									{#if enableAi}
+										<IteratorGen
+											bind:this={iteratorGen}
+											focused={iteratorFieldFocused}
+											arg={(mod.value as ForloopFlow).iterator}
+											on:showExpr={(e) => (suggestion = e.detail || undefined)}
+											on:setExpr={(e) => setExpr(e.detail)}
+											pickableProperties={stepPropPicker.pickableProperties}
+										/>
+									{/if}
+								{/snippet}
+							</InputTransformForm>
+						</PropPickerWrapper>
+					</section>
+					<section class="flex flex-col gap-6">
 						<Toggle
+							size="xs"
+							textClass="text-xs font-normal text-primary"
 							bind:checked={mod.value.skip_failures}
 							options={{
-								right: 'Skip failures'
+								right: 'Skip failures',
+								rightTooltip:
+									'If disabled, the flow will fail as soon as one of the iteration fail. Otherwise, the error will be collected as the result of the iteration. Regardless of this setting, if a flow level error handler is defined, it will process the error. (Workspace error handlers will NOT be used to process errors if enabled.)',
+								rightDocumentationLink: 'https://www.windmill.dev/docs/flows/flow_loops'
 							}}
-							class="whitespace-nowrap"
 						/>
-					</div>
-					<div class="flex-shrink-0">
-						<div class="mb-2 text-sm font-bold"
-							>Squash
-							<Tooltip documentationLink="https://www.windmill.dev/docs/flows/flow_loops">
-								Squashing a for loop runs all iterations on the same worker, using a single runner
-								per step for the entire loop. This eliminates cold starts between iterations for
-								supported languages (Bun, Deno, and Python).
-							</Tooltip>
-						</div>
 						<Toggle
+							size="xs"
+							textClass="text-xs font-normal text-primary"
 							bind:checked={mod.value.squash}
 							on:change={({ detail }) => {
 								;(mod.value as ForloopFlow).squash = detail
 							}}
-							options={{
-								right: 'Squash'
-							}}
-							class="whitespace-nowrap"
 							disabled={mod.value.parallel}
-						/>
-					</div>
-					<div class="flex-shrink-0">
-						<div class="mb-2 text-sm font-bold">Run in parallel</div>
-						<Toggle
-							bind:checked={mod.value.parallel}
-							on:change={({ detail }) => {
-								if (detail === false) {
-									;(mod.value as ForloopFlow).parallelism = undefined
-								}
-							}}
 							options={{
-								right: 'All iterations run in parallel'
+								title: mod.value.parallel ? SQUASH_PARALLEL_CONFLICT : undefined,
+								right: 'Squash',
+								rightTooltip:
+									'Squashing a for loop runs all iterations on the same worker, using a single runner per step for the entire loop. This eliminates cold starts between iterations for supported languages (Bun, Deno, and Python).',
+								rightDocumentationLink: 'https://www.windmill.dev/docs/flows/flow_loops'
 							}}
-							class="whitespace-nowrap"
-							disabled={mod.value.squash}
 						/>
-					</div>
-					<div class="flex-shrink-0">
-						<div class="mb-2 text-sm font-bold"
-							>Parallelism <Tooltip
-								>Assign a maximum number of branches run in parallel to control huge for-loops.</Tooltip
-							>
-						</div>
-						<div class="flex gap-2 items-center">
-							<input
-								type="number"
-								min="1"
-								class="w-20 px-2 py-1 text-sm border border-gray-200 dark:border-gray-700 rounded bg-surface"
-								disabled={!mod.value.parallel || parallelismType === 'javascript'}
-								placeholder={parallelismType === 'javascript' ? 'Expression' : ''}
-								bind:value={
-									() => {
-										const parallelismExpr = (mod.value as ForloopFlow).parallelism
-
-										return parallelismExpr && parallelismExpr.type === 'static'
-											? parallelismExpr.value
-											: ''
-									},
-									(value) => {
-										if (value === '' || value === null || value === undefined) {
-											;(mod.value as ForloopFlow).parallelism = undefined
-										} else {
-											;(mod.value as ForloopFlow).parallelism = {
-												type: 'static',
-												value
-											}
-										}
-									}
-								}
-							/>
-							<ToggleButtonGroup
-								disabled={!mod.value.parallel}
-								bind:selected={parallelismType}
-								on:selected={(e) => {
-									const forLoopFlow = mod.value as ForloopFlow
-									if (e.detail == parallelismType) return
-									if (e.detail === 'javascript') {
-										if (!forLoopFlow.parallelism || forLoopFlow.parallelism.type !== 'javascript') {
-											;(mod.value as ForloopFlow).parallelism = {
-												type: 'javascript',
-												expr: ''
-											}
-										}
-									} else {
-										if (!forLoopFlow.parallelism || forLoopFlow.parallelism.type !== 'static') {
-											;(mod.value as ForloopFlow).parallelism = {
-												type: 'static',
-												value: 0
-											}
-										}
-									}
+						<!-- Its own group: the setting's input belongs to the toggle above it, not
+						     24px away like the next setting. -->
+						<div class="flex flex-col gap-2">
+							<Toggle
+								size="xs"
+								textClass="text-xs font-normal text-primary"
+								bind:checked={mod.value.parallel}
+								on:change={({ detail }) => {
+									// An absent `parallelism` means "no cap" to the worker, so switching
+									// parallelism on must not seed one — the cap below is opted into.
+									if (!detail) (mod.value as ForloopFlow).parallelism = undefined
+								}}
+								disabled={mod.value.squash}
+								options={{
+									title: mod.value.squash ? SQUASH_PARALLEL_CONFLICT : undefined,
+									right: 'Run in parallel',
+									rightTooltip: 'Run the iterations concurrently instead of one after the other.',
+									rightDocumentationLink: 'https://www.windmill.dev/docs/flows/flow_loops'
 								}}
-							>
-								{#snippet children({ item })}
-									<ToggleButton small label="static" value="static" {item} />
-
-									<ToggleButton
-										small
-										tooltip="JavaScript expression ('flow_input' or 'results')."
-										value="javascript"
-										icon={FunctionSquare}
-										{item}
-									/>
-								{/snippet}
-							</ToggleButtonGroup>
-						</div>
-					</div>
-				</div>
-
-				{#if mod.value.type === 'forloopflow' && mod.value.parallel && mod.value.parallelism?.type == 'javascript'}
-					<div class="my-2 flex flex-row gap-2 items-center">
-						<div class="text-sm font-bold whitespace-nowrap">
-							Parallelism expression
-							<Tooltip>
-								JavaScript expression that defines the maximum number of parallel executions.
-								Example: flow_input.max_parallel || 3
-							</Tooltip>
-						</div>
-					</div>
-					<!-- svelte-ignore a11y_no_static_element_interactions -->
-					<div
-						class="border rounded-md overflow-auto w-full mb-2 h-full max-h-[250px]"
-						id="flow-editor-parallel-expression"
-						transition:slide={{ duration: 300 }}
-					>
-						<PropPickerWrapper
-							notSelectable
-							noPadding
-							flow_input={stepPropPicker.pickableProperties.flow_input}
-							pickableProperties={stepPropPicker.pickableProperties}
-							on:select={({ detail }) => {
-								parallelismEditor?.insertAtCursor(detail)
-								parallelismEditor?.focus()
-							}}
-						>
-							<SimpleEditor
-								bind:this={parallelismEditor}
-								autofocus
-								lang="javascript"
-								bind:code={
-									() => {
-										const parallelismExpr = (mod.value as ForloopFlow).parallelism
-
-										return parallelismExpr && parallelismExpr.type === 'javascript'
-											? parallelismExpr.expr
-											: ''
-									},
-									(expr) => {
-										;(mod.value as ForloopFlow).parallelism = {
-											type: 'javascript',
-											expr
-										}
-									}
-								}
-								class="h-full"
-								shouldBindKey={false}
-								extraLib={stepPropPicker.extraLib}
 							/>
-						</PropPickerWrapper>
-					</div>
-				{/if}
-				<div class="my-2 flex flex-row gap-2 items-center">
-					<div class="text-sm font-bold whitespace-nowrap">
-						Iterator expression
-						<Tooltip documentationLink="https://www.windmill.dev/docs/flows/flow_loops">
-							The JavaScript expression that will be evaluated to get the list of items to iterate
-							over. Example : ["banana", "apple", flow_input.my_fruit].
-						</Tooltip>
-					</div>
-					<FlowPlugConnect
-						connecting={$flowPropPickerConfig != undefined}
-						on:click={() => {
-							const config = {
-								onSelect: (code) => {
-									setExpr(code)
-									return true
-								},
-								clearFocus: () => {
-									flowPropPickerConfig.set(undefined)
-								}
-							}
-							flowPropPickerConfig.set({
-								...config,
-								clearFocus: () => {
-									flowPropPickerConfig.set(undefined)
-								}
-							})
-						}}
-					/>
-					{#if enableAi}
-						<IteratorGen
-							bind:this={iteratorGen}
-							focused={iteratorFieldFocused}
-							arg={mod.value.iterator}
-							on:showExpr={(e) => (suggestion = e.detail || undefined)}
-							on:setExpr={(e) => {
-								setExpr(e.detail)
-							}}
-							pickableProperties={stepPropPicker.pickableProperties}
-						/>
-					{/if}
-				</div>
+							{#if mod.value.parallel}
+								<div class="pl-9" transition:slideDynamic>
+									<PropPickerWrapper
+										sidePane
+										flow_input={stepPropPicker.pickableProperties.flow_input}
+										notSelectable
+										pickableProperties={stepPropPicker.pickableProperties}
+										on:select={({ detail }) => {
+											parallelismEditor?.insertAtCursor(detail)
+											parallelismEditor?.focus()
+										}}
+									>
+										<!-- Keyed on the toggle: the form seeds its static/expression mode once, so re-enabling
+										     the cap would hand a fresh static value to a form still in expression mode. -->
+										{#key parallelismCapped}
+											<InputTransformForm
+												bind:arg={
+													() => (mod.value as ForloopFlow).parallelism,
+													(v) => {
+														;(mod.value as ForloopFlow).parallelism = v
+													}
+												}
+												argName="parallelism"
+												collapsed={!parallelismCapped}
+												header={parallelismToggle}
+												schema={parallelismSchema}
+												argExtra={{ min: 1, step: 1 }}
+												animateAppear
+												previousModuleId={previousModule?.id}
+												bind:editor={parallelismEditor}
+											/>
+										{/key}
+									</PropPickerWrapper>
+								</div>
+							{/if}
+						</div>
 
-				{#if mod.value.iterator.type == 'javascript'}
-					<!-- svelte-ignore a11y_no_static_element_interactions -->
-					<div
-						class="border rounded-md overflow-auto w-full"
-						id="flow-editor-iterator-expression"
-						onkeyup={iteratorGen?.onKeyUp}
-					>
-						<PropPickerWrapper
-							notSelectable
-							pickableProperties={stepPropPicker.pickableProperties}
-							on:select={({ detail }) => {
-								if ($flowPropPickerConfig) {
-									setExpr(detail)
-									flowPropPickerConfig.set(undefined)
-									return
-								}
-								editor?.insertAtCursor(detail)
-								editor?.focus()
-							}}
-							noPadding
-						>
-							<div class="relative w-full h-full overflow-clip">
-								<SimpleEditor
-									small
-									bind:this={editor}
-									on:focus={() => {
-										iteratorFieldFocused = true
-									}}
-									on:blur={() => {
-										iteratorFieldFocused = false
-									}}
-									lang="javascript"
-									bind:code={mod.value.iterator.expr}
-									class="h-full"
-									shouldBindKey={false}
-									extraLib={stepPropPicker.extraLib}
-									{suggestion}
-								/>
-							</div>
-						</PropPickerWrapper>
-					</div>
+						<FlowModuleEarlyStop blocks="stop-after" bind:flowModule={mod} />
+					</section>
 				{:else}
-					<Button
-						on:click={() => {
-							if (mod.value.type === 'forloopflow') mod.value.iterator.type = 'javascript'
-						}}
+					<FlowRunSettings
+						embedded
+						loopSubset
+						earlyStopBlocks="all-iters"
+						bind:this={runSettings}
+						bind:flowModule={mod}
+						{parentModule}
+						{previousModule}
+						selectedId={mod.id}
 					/>
 				{/if}
-			{/if}
-		</Pane>
-		<Pane size={40} minSize={20} class="flex flex-col flex-1">
-			<TabsV2 bind:selected>
-				<!-- <Tab value="retries">Retries</Tab> -->
-				<Tab value="early-stop" label="Early Stop/Break" />
-				<Tab value="skip" label="Skip" />
-				<Tab value="suspend" label="Suspend/Approval/Prompt" />
-				<Tab value="sleep" label="Sleep" />
-				<Tab value="mock" label="Mock" />
-				<Tab value="lifetime" label="Lifetime" />
-
-				{#snippet content()}
-					<div class="overflow-hidden bg-surface" style="height:calc(100% - 32px);">
-						<!-- <TabContent value="retries" class="flex flex-col flex-1 h-full">
-									<div class="p-4 overflow-y-auto">
-										<FlowRetries bind:flowModule={mod} />
-									</div>
-								</TabContent> -->
-
-						<TabContent value="early-stop" class="flex flex-col flex-1 h-full">
-							<div class="p-4 overflow-y-auto">
-								<FlowModuleEarlyStop bind:flowModule={mod} />
-							</div>
-						</TabContent>
-						<TabContent value="skip" class="flex flex-col flex-1 h-full">
-							<div class="p-4 overflow-y-auto">
-								<FlowModuleSkip bind:flowModule={mod} {parentModule} {previousModule} />
-							</div>
-						</TabContent>
-						<TabContent value="suspend" class="flex flex-col flex-1 h-full">
-							<div class="p-4 overflow-y-auto">
-								<FlowModuleSuspend previousModuleId={previousModule?.id} bind:flowModule={mod} />
-							</div>
-						</TabContent>
-						<TabContent value="sleep" class="flex flex-col flex-1 h-full">
-							<div class="p-4 overflow-y-auto">
-								<FlowModuleSleep previousModuleId={previousModule?.id} bind:flowModule={mod} />
-							</div>
-						</TabContent>
-						<TabContent value="mock" class="flex flex-col flex-1 h-full">
-							<div class="p-4 overflow-y-auto">
-								<FlowModuleMock bind:flowModule={mod} />
-							</div>
-						</TabContent>
-						<TabContent value="lifetime" class="flex flex-col flex-1 h-full">
-							<div class="p-4 overflow-y-auto">
-								<FlowModuleDeleteAfterUse bind:flowModule={mod} disabled={!$enterpriseLicense} />
-							</div>
-						</TabContent>
-					</div>
-				{/snippet}
-			</TabsV2>
-		</Pane>
-	</Splitpanes>
+			</div>
+		{/if}
+	</div>
 </FlowCard>
diff --git a/frontend/src/lib/components/flows/content/FlowModuleCache.svelte b/frontend/src/lib/components/flows/content/FlowModuleCache.svelte
index 99fc4c7b3a..981e8a5aa9 100644
--- a/frontend/src/lib/components/flows/content/FlowModuleCache.svelte
+++ b/frontend/src/lib/components/flows/content/FlowModuleCache.svelte
@@ -1,12 +1,12 @@
 <script lang="ts">
 	import Label from '$lib/components/Label.svelte'
-	import Section from '$lib/components/Section.svelte'
 	import Toggle from '$lib/components/Toggle.svelte'
-	import Tooltip from '$lib/components/Tooltip.svelte'
 
 	import type { FlowModule } from '$lib/gen'
+	import { stepSettingDefaults } from '../flowStepSettings'
 	import { SecondsInput } from '../../common'
 	import WorkspaceScriptSettingInfo from './WorkspaceScriptSettingInfo.svelte'
+	import { slideDynamic } from '$lib/transitions'
 
 	interface Props {
 		flowModule: FlowModule
@@ -30,18 +30,12 @@
 		onEditWorkspaceScript
 	}: Props = $props()
 
-	let isCacheEnabled = $derived(Boolean(flowModule.cache_ttl))
+	// Presence, not truthiness: SecondsInput passes through 0 while a segment is being
+	// retyped, and reading that as off would disable the field mid-edit.
+	let isCacheEnabled = $derived(flowModule.cache_ttl !== undefined)
 </script>
 
-<Section label="Cache" class="flex flex-col gap-4">
-	{#snippet header()}
-		<Tooltip documentationLink="https://www.windmill.dev/docs/flows/cache">
-			If defined, the result of the step will be cached for the number of seconds defined such that
-			if this step were to be re-triggered with the same input it would retrieve and return its
-			cached value instead of recomputing it.
-		</Tooltip>
-	{/snippet}
-
+<div class="flex flex-col gap-2">
 	{#if flowModule.value.type == 'script'}
 		<WorkspaceScriptSettingInfo
 			label="Cache"
@@ -61,34 +55,41 @@
 		</p>
 	{:else}
 		<Toggle
+			size="xs"
+			textClass="text-xs font-normal text-primary"
 			checked={isCacheEnabled}
 			on:change={() => {
-				if (isCacheEnabled && flowModule.cache_ttl != undefined) {
+				if (isCacheEnabled) {
 					flowModule.cache_ttl = undefined
 				} else {
-					flowModule.cache_ttl = 600
+					flowModule.cache_ttl = stepSettingDefaults('cache')
 				}
 			}}
 			options={{
-				right: 'Cache the results for each possible inputs'
+				right: 'Cache results',
+				rightTooltip:
+					'The result of the step is cached for the configured number of seconds; a re-trigger with the same input returns the cached value instead of recomputing it.',
+				rightDocumentationLink: 'https://www.windmill.dev/docs/flows/cache'
 			}}
 		/>
-		{#if flowModule.cache_ttl}
-			<Label label="How long to keep cache valid">
-				<SecondsInput bind:seconds={flowModule.cache_ttl} />
-			</Label>
-			<Toggle
-				size="2xs"
-				bind:checked={
-					() => flowModule.cache_ignore_s3_path,
-					(v) => (flowModule.cache_ignore_s3_path = v || undefined)
-				}
-				options={{
-					right: 'Ignore S3 Object paths for caching purposes',
-					rightTooltip:
-						'If two S3 objects passed as input have the same content, they will hit the same cache entry, regardless of their path.'
-				}}
-			/>
+		{#if isCacheEnabled}
+			<div class="flex flex-col gap-2 pl-9" transition:slideDynamic>
+				<Label label="How long to keep cache valid">
+					<SecondsInput bind:seconds={flowModule.cache_ttl} />
+				</Label>
+				<Toggle
+					size="2xs"
+					bind:checked={
+						() => flowModule.cache_ignore_s3_path,
+						(v) => (flowModule.cache_ignore_s3_path = v || undefined)
+					}
+					options={{
+						right: 'Ignore S3 object paths',
+						rightTooltip:
+							'If two S3 objects passed as input have the same content, they will hit the same cache entry, regardless of their path.'
+					}}
+				/>
+			</div>
 		{/if}
 	{/if}
-</Section>
+</div>
diff --git a/frontend/src/lib/components/flows/content/FlowModuleComponent.svelte b/frontend/src/lib/components/flows/content/FlowModuleComponent.svelte
index 75c0d03d65..d1fdf8f412 100644
--- a/frontend/src/lib/components/flows/content/FlowModuleComponent.svelte
+++ b/frontend/src/lib/components/flows/content/FlowModuleComponent.svelte
@@ -1,10 +1,8 @@
 <script lang="ts">
-	import { createBubbler } from 'svelte/legacy'
-
-	const bubble = createBubbler()
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
 	import Tab from '$lib/components/common/tabs/Tab.svelte'
 	import Tabs from '$lib/components/common/tabs/Tabs.svelte'
+	import StepSettingsBadges from './StepSettingsBadges.svelte'
 	import Editor from '$lib/components/Editor.svelte'
 	import EditorBar, {
 		EDITOR_BAR_WIDTH_THRESHOLD,
@@ -22,47 +20,27 @@
 	import { getContext, onDestroy, tick, untrack } from 'svelte'
 	import type { FlowEditorContext, FlowGraphAssetContext } from '../types'
 	import FlowModuleScript from './FlowModuleScript.svelte'
-	import FlowModuleEarlyStop from './FlowModuleEarlyStop.svelte'
-	import FlowModuleSuspend from './FlowModuleSuspend.svelte'
-	import FlowModuleCache from './FlowModuleCache.svelte'
-	import FlowModuleDeleteAfterUse from './FlowModuleDeleteAfterUse.svelte'
-	import FlowRetries from './FlowRetries.svelte'
+	import FlowRunSettings from './FlowRunSettings.svelte'
 	import { getFailureStepPropPicker, getStepPropPicker } from '../previousResults'
 	import { deepEqual } from 'fast-equals'
 	import Section from '$lib/components/Section.svelte'
 
 	import Button from '$lib/components/common/button/Button.svelte'
-	import Alert from '$lib/components/common/alert/Alert.svelte'
-	import FlowModuleSleep from './FlowModuleSleep.svelte'
 	import FlowPathViewer from './FlowPathViewer.svelte'
 	import InputTransformSchemaForm from '$lib/components/InputTransformSchemaForm.svelte'
 	import AgentResourceBar from './AgentResourceBar.svelte'
 	import AgentToolBindings from './AgentToolBindings.svelte'
 	import { getLinkedAgentTools, linkedToolsScope } from '../linkedAgentToolsStore.svelte'
 	import { flowLocalAgentSchema } from '../agentResourceUtils'
-	import FlowModuleMockTransitionMessage from './FlowModuleMockTransitionMessage.svelte'
-	import Tooltip from '$lib/components/Tooltip.svelte'
-	import { SecondsInput } from '$lib/components/common'
 	import DiffEditor from '$lib/components/DiffEditor.svelte'
 	import type { ButtonProp } from '$lib/components/diffEditorTypes'
-	import FlowModuleTimeout from './FlowModuleTimeout.svelte'
-	import HighlightCode from '$lib/components/HighlightCode.svelte'
-	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
-	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
-	import s3Scripts from './s3Scripts/lib'
-	import Label from '$lib/components/Label.svelte'
-	import { enterpriseLicense } from '$lib/stores'
-	import { isCloudHosted } from '$lib/cloud'
 	import { loadSchemaFromModule } from '../flowInfers'
-	import FlowModuleSkip from './FlowModuleSkip.svelte'
-	import FlowModuleDebounce from './FlowModuleDebounce.svelte'
 	import { type Job } from '$lib/gen'
 	import { workspaceStore } from '$lib/stores'
 	import { checkIfParentLoop } from '../utils.svelte'
 	import { useWorkspaceScriptSettings } from '../useWorkspaceScriptSettings.svelte'
 	import ScriptSettingsBadges from '$lib/components/ScriptSettingsBadges.svelte'
 	import { getActiveScriptSettingsBadges } from '$lib/components/scriptSettings'
-	import WorkspaceScriptSettingInfo from './WorkspaceScriptSettingInfo.svelte'
 	import ModulePreviewResultViewer from '$lib/components/ModulePreviewResultViewer.svelte'
 	import LogViewer from '$lib/components/LogViewer.svelte'
 	import DisplayResult from '$lib/components/DisplayResult.svelte'
@@ -200,10 +178,8 @@
 			flowModule.value.type === 'aiagent'
 	)
 	let visibleSelected = $derived(selected === 'chat' && !canShowChatTab ? 'inputs' : selected)
+	let runSettings: FlowRunSettings | undefined = $state()
 	let agentLinked = $derived(flowModule.value.type === 'aiagent' && Boolean(flowModule.value.agent))
-	let advancedSelected = $state('retries')
-	let advancedRuntimeSelected = $state('concurrency')
-	let s3Kind = $state('s3_client')
 	let validCode = $state(true)
 	let width = $state(1200)
 	let testJob: Job | undefined = $state(undefined)
@@ -334,7 +310,7 @@
 
 	function selectAdvanced(subtab: string) {
 		selected = 'advanced'
-		advancedSelected = subtab
+		tick().then(() => runSettings?.openSetting(subtab))
 	}
 
 	function setOmitOutputFromConversation(omit: boolean) {
@@ -351,7 +327,7 @@
 
 	let forceReload = $state(0)
 	let editorPanelSize = $state(
-		untrack(() => noEditor) ? 0 : flowModule.value.type == 'script' ? 30 : 50
+		untrack(() => noEditor) ? 0 : flowModule.value.type == 'script' ? 30 : 40
 	)
 	let editorSettingsPanelSize = $state(100 - untrack(() => editorPanelSize))
 	let stepHistoryLoader = getStepHistoryLoaderContext()
@@ -362,6 +338,25 @@
 		}
 	}
 
+	// Reached from both headers: the card header owns the script-path actions, the module
+	// header the subflow ones.
+	async function reloadModule() {
+		if (flowModule.value.type == 'script') {
+			if (flowModule.value.hash != undefined) {
+				flowModule.value.hash = await getLatestHashForScript(flowModule.value.path, opWs)
+			}
+			forceReload++
+			// Keep the surfaced concurrency/cache values and badges in sync after a
+			// settings/code save from the header (path/hash may be unchanged).
+			await referencedScriptSettings.reload()
+			await reload(flowModule)
+		}
+		if (flowModule.value.type == 'flow') {
+			forceReload++
+			await reload(flowModule)
+		}
+	}
+
 	let leftPanelSize = $state(0)
 
 	function showDiffMode() {
@@ -810,16 +805,18 @@
 	<div class="h-full bg-surface" bind:clientWidth={width}>
 		<FlowCard
 			flowModuleValue={flowModule?.value}
-			on:reload={() => {
-				forceReload++
-				reload(flowModule)
-			}}
 			{noEditor}
 			on:setHash={(e) => {
 				if (flowModule.value.type == 'script') {
 					flowModule.value.hash = e.detail
 				}
 			}}
+			on:fork={async () => {
+				const [module, state] = await fork(flowModule, opWs)
+				flowModule = module
+				flowStateStore.val[module.id] = state
+			}}
+			on:reload={reloadModule}
 			bind:summary={flowModule.summary}
 			bind:description={toolDescription}
 			{isAgentTool}
@@ -837,35 +834,7 @@
 							flowModule.value.tag = e.detail
 						}
 					}}
-					on:toggleSuspend={() => selectAdvanced('suspend')}
-					on:toggleSleep={() => selectAdvanced('sleep')}
-					on:toggleMock={() => selectAdvanced('mock')}
-					on:toggleRetry={() => selectAdvanced('retries')}
-					on:togglePin={() => (selected = 'test')}
-					on:toggleConcurrency={() => selectAdvanced('runtime')}
-					on:toggleCache={() => selectAdvanced('cache')}
-					on:toggleStopAfterIf={() => selectAdvanced('early-stop')}
-					on:fork={async () => {
-						const [module, state] = await fork(flowModule, opWs)
-						flowModule = module
-						flowStateStore.val[module.id] = state
-					}}
-					on:reload={async () => {
-						if (flowModule.value.type == 'script') {
-							if (flowModule.value.hash != undefined) {
-								flowModule.value.hash = await getLatestHashForScript(flowModule.value.path, opWs)
-							}
-							forceReload++
-							// Keep the surfaced concurrency/cache values and badges in sync after
-							// a settings/code save from the header (path/hash may be unchanged).
-							await referencedScriptSettings.reload()
-							await reload(flowModule)
-						}
-						if (flowModule.value.type == 'flow') {
-							forceReload++
-							await reload(flowModule)
-						}
-					}}
+					on:reload={reloadModule}
 					on:createScriptFromInlineScript={async () => {
 						const [module, state] = await createScriptFromInlineScript(
 							flowModule,
@@ -1131,7 +1100,11 @@
 											/>
 										{/if}
 										{#if !preprocessorModule && !isAgentTool}
-											<Tab value="advanced" label="Advanced" />
+											<Tab value="advanced" label="Run settings">
+												{#snippet extra()}
+													<StepSettingsBadges {flowModule} />
+												{/snippet}
+											</Tab>
 										{/if}
 									</Tabs>
 									{#if visibleSelected === 'inputs' && (flowModule.value.type == 'rawscript' || flowModule.value.type == 'script' || flowModule.value.type == 'flow' || flowModule.value.type == 'aiagent')}
@@ -1312,316 +1285,24 @@
 											</Section>
 										</div>
 									{:else if visibleSelected === 'advanced'}
-										<Tabs bind:selected={advancedSelected} wrapperClass="shrink-0">
-											<Tab
-												value="retries"
-												active={flowModule.retry !== undefined || flowModule.continue_on_error}
-												label="Error handling"
-											/>
-											{#if !selectedId.includes('failure')}
-												<Tab value="runtime" label="Runtime" />
-												<Tab value="cache" active={Boolean(flowModule.cache_ttl)} label="Cache" />
-												<Tab
-													value="early-stop"
-													active={Boolean(
-														flowModule.stop_after_if || flowModule.stop_after_all_iters_if
-													)}
-													label="Early Stop"
-												/>
-												<Tab value="skip" active={Boolean(flowModule.skip_if)} label="Skip" />
-												<Tab value="suspend" active={Boolean(flowModule.suspend)} label="Suspend" />
-												<Tab value="sleep" active={Boolean(flowModule.sleep)} label="Sleep" />
-												<Tab
-													value="debounce"
-													active={Boolean(flowModule.debouncing?.debounce_delay_s)}
-													label="Debounce"
-												/>
-												<Tab value="mock" active={Boolean(flowModule.mock?.enabled)} label="Mock" />
-												<Tab value="same_worker" label="Shared Directory" />
-												{#if flowModule.value['language'] === 'python3' || flowModule.value['language'] === 'deno'}
-													<Tab value="s3" label="S3" />
-												{/if}
-											{/if}
-										</Tabs>
-										{#if advancedSelected === 'runtime'}
-											<Tabs bind:selected={advancedRuntimeSelected} wrapperClass="shrink-0">
-												<Tab value="concurrency" label="Concurrency" />
-												<Tab value="timeout" label="Timeout" />
-												<Tab value="priority" label="Priority" />
-												<Tab value="lifetime" label="Lifetime" />
-											</Tabs>
-										{/if}
-										<div class="flex-1 overflow-auto p-4">
-											{#if advancedSelected === 'retries'}
-												<Section label="Continue on error">
-													{#snippet header()}
-														<Tooltip>
-															When enabled, the flow will continue to the next step even if this
-															step fails (after exhausting all retries, if any). This enables to
-															process the error in a branch one for instance.
-														</Tooltip>
-													{/snippet}
-													<Toggle
-														size="xs"
-														bind:checked={flowModule.continue_on_error}
-														options={{
-															left: 'Stop on error and propagate error up',
-															right: "Continue on error with error as step's return"
-														}}
-													/>
-												</Section>
-												<div class="mt-4"></div>
-												<Section label="Retries">
-													{#snippet header()}
-														<Tooltip
-															documentationLink="https://www.windmill.dev/docs/flows/retries"
-														>
-															If defined, upon error this step will be retried with a delay and a
-															maximum number of attempts as defined below.
-														</Tooltip>
-													{/snippet}
-													<FlowRetries
-														bind:flowModuleRetry={flowModule.retry}
-														bind:flowModule
-														{isAgentTool}
-													/>
-												</Section>
-											{:else if advancedSelected === 'runtime' && advancedRuntimeSelected === 'concurrency'}
-												<Section label="Concurrency limits" class="flex flex-col gap-4" eeOnly>
-													{#snippet header()}
-														<Tooltip>Allowed concurrency within a given timeframe</Tooltip>
-													{/snippet}
-													{#if flowModule.value.type == 'rawscript'}
-														<Label label="Max number of executions within the time window">
-															<div class="flex flex-row gap-2 max-w-sm whitespace-nowrap">
-																<input
-																	disabled={!$enterpriseLicense}
-																	bind:value={flowModule.value.concurrent_limit}
-																	type="number"
-																/>
-																<Button
-																	size="xs"
-																	variant="default"
-																	on:click={() => {
-																		if (flowModule.value.type == 'rawscript') {
-																			flowModule.value.concurrent_limit = undefined
-																		}
-																	}}
-																>
-																	<div class="flex flex-row gap-2"> Remove Limits </div>
-																</Button>
-															</div>
-														</Label>
-														<Label label="Time window in seconds">
-															<SecondsInput
-																disabled={!$enterpriseLicense}
-																bind:seconds={flowModule.value.concurrency_time_window_s}
-																clearable
-															/>
-														</Label>
-														<Label label="Custom concurrency key (optional)">
-															{#snippet header()}
-																<Tooltip>
-																	Concurrency keys are global, you can have them be workspace
-																	specific using the variable `$workspace`. You can also use an
-																	argument's value using `$args[name_of_arg]`</Tooltip
-																>
-															{/snippet}
-															<!-- svelte-ignore a11y_autofocus -->
-															<input
-																type="text"
-																autofocus
-																disabled={!$enterpriseLicense}
-																bind:value={flowModule.value.custom_concurrency_key}
-																placeholder={`$workspace/script/${$pathStore}-$args[foo]`}
-															/>
-														</Label>
-													{:else if flowModule.value.type == 'script'}
-														<WorkspaceScriptSettingInfo
-															label="Concurrency limit"
-															active={referencedConcurrentLimit != undefined}
-															valueText={referencedConcurrentLimit != undefined
-																? `Max ${referencedConcurrentLimit} execution${
-																		referencedConcurrentLimit === 1 ? '' : 's'
-																	}${
-																		referencedScriptSettings.settings?.concurrency_time_window_s !=
-																		undefined
-																			? ` within ${referencedScriptSettings.settings.concurrency_time_window_s}s`
-																			: ''
-																	}`
-																: undefined}
-															loading={referencedScriptSettings.loading}
-															error={referencedScriptSettings.error}
-															canEdit={canEditWorkspaceScriptSettings}
-															noEditReason={workspaceScriptNoEditReason}
-															onEdit={openWorkspaceScriptSettings}
-														/>
-													{:else}
-														<Alert type="warning" title="Limitation" size="xs">
-															The concurrency limit of a referenced flow is only settable in the
-															flow settings directly.
-														</Alert>
-													{/if}
-												</Section>
-											{:else if advancedSelected === 'runtime' && advancedRuntimeSelected === 'timeout'}
-												<div>
-													<FlowModuleTimeout
-														previousModuleId={previousModule?.id}
-														bind:flowModule
-													/>
-												</div>
-											{:else if advancedSelected === 'runtime' && advancedRuntimeSelected === 'priority'}
-												<Section label="Priority" class="flex flex-col gap-4">
-													<!-- TODO: Add EE-only badge when we have it -->
-													<Toggle
-														disabled={!$enterpriseLicense || isCloudHosted()}
-														checked={flowModule.priority !== undefined && flowModule.priority > 0}
-														on:change={() => {
-															if (flowModule.priority) {
-																flowModule.priority = undefined
-															} else {
-																flowModule.priority = 100
-															}
-														}}
-														options={{
-															right: 'Enabled high priority flow step',
-															rightTooltip: `Jobs scheduled from this step when the flow is executed are labeled as high priority and take precedence over the other jobs in the jobs queue. ${
-																!$enterpriseLicense
-																	? 'This is a feature only available on enterprise edition.'
-																	: ''
-															}`
-														}}
-													/>
-													<Label label="Priority number">
-														{#snippet header()}
-															<Tooltip>The higher the number, the higher the priority.</Tooltip>
-														{/snippet}
-														<input
-															type="number"
-															class="!w-24"
-															disabled={flowModule.priority === undefined}
-															bind:value={flowModule.priority}
-															onfocus={bubble('focus')}
-															onchange={() => {
-																if (flowModule.priority && flowModule.priority > 100) {
-																	flowModule.priority = 100
-																} else if (flowModule.priority && flowModule.priority < 0) {
-																	flowModule.priority = 0
-																}
-															}}
-														/>
-													</Label>
-
-													<Alert type="warning" title="Limitation" size="xs">
-														Setting priority is only available for enterprise edition and not
-														available on the cloud.
-													</Alert>
-												</Section>
-											{:else if advancedSelected === 'runtime' && advancedRuntimeSelected === 'lifetime'}
-												<div>
-													<FlowModuleDeleteAfterUse
-														bind:flowModule
-														disabled={!$enterpriseLicense}
-													/>
-												</div>
-											{:else if advancedSelected === 'cache'}
-												<div>
-													<FlowModuleCache
-														bind:flowModule
-														workspaceScriptCacheTtl={referencedCacheTtl}
-														loadingWorkspaceScript={referencedScriptSettings.loading}
-														workspaceScriptError={referencedScriptSettings.error}
-														canEditWorkspaceScript={canEditWorkspaceScriptSettings}
-														{workspaceScriptNoEditReason}
-														onEditWorkspaceScript={openWorkspaceScriptSettings}
-													/>
-												</div>
-											{:else if advancedSelected === 'early-stop'}
-												<FlowModuleEarlyStop bind:flowModule />
-											{:else if advancedSelected === 'skip'}
-												<FlowModuleSkip bind:flowModule {parentModule} {previousModule} />
-											{:else if advancedSelected === 'suspend'}
-												<div>
-													<FlowModuleSuspend
-														previousModuleId={previousModule?.id}
-														bind:flowModule
-													/>
-												</div>
-											{:else if advancedSelected === 'sleep'}
-												<div>
-													<FlowModuleSleep
-														previousModuleId={previousModule?.id}
-														bind:flowModule
-														{isAgentTool}
-													/>
-												</div>
-											{:else if advancedSelected === 'debounce'}
-												<div>
-													<FlowModuleDebounce bind:flowModule {selectedId} />
-												</div>
-											{:else if advancedSelected === 'mock'}
-												<div>
-													<FlowModuleMockTransitionMessage />
-												</div>
-											{:else if advancedSelected === 'same_worker'}
-												<div>
-													<Alert type="info" title="Share a directory between steps">
-														If shared directory is set, will share a folder that will be mounted on
-														`./shared` for each of them to pass data between each other.
-													</Alert>
-													<Button
-														btnClasses="mt-4"
-														on:click={() => {
-															selectionManager.selectId('settings-same-worker')
-														}}
-													>
-														Set shared directory in the flow settings
-													</Button>
-												</div>
-											{:else if advancedSelected === 's3'}
-												<div>
-													<h2 class="pb-4">
-														S3 snippets
-														<Tooltip>
-															Read/Write object from/to S3 and leverage Polars and DuckDB to run
-															efficient ETL processes.
-														</Tooltip>
-													</h2>
-												</div>
-												<div class="flex gap-2 justify-between mb-4 items-center">
-													<div class="flex gap-2">
-														<ToggleButtonGroup bind:selected={s3Kind} class="w-auto">
-															{#snippet children({ item })}
-																{#if flowModule.value['language'] === 'deno'}
-																	<ToggleButton
-																		value="s3_client"
-																		small
-																		label="S3 lite client"
-																		{item}
-																	/>
-																{:else}
-																	<ToggleButton value="s3_client" small label="Boto3" {item} />
-																	<ToggleButton value="polars" small label="Polars" {item} />
-																	<ToggleButton value="duckdb" small label="DuckDB" {item} />
-																{/if}
-															{/snippet}
-														</ToggleButtonGroup>
-													</div>
-
-													<Button
-														size="xs"
-														on:click={() =>
-															editor?.setCode(s3Scripts[flowModule.value['language']][s3Kind])}
-													>
-														Apply snippet
-													</Button>
-												</div>
-												<HighlightCode
-													language={flowModule.value['language']}
-													code={s3Scripts[flowModule.value['language']][s3Kind]}
-												/>
-											{/if}
-										</div>
+										<FlowRunSettings
+											bind:this={runSettings}
+											onApplyS3Snippet={(code) => editor?.setCode(code)}
+											bind:flowModule
+											{isAgentTool}
+											{parentModule}
+											{previousModule}
+											{selectedId}
+											{referencedConcurrentLimit}
+											referencedConcurrencyTimeWindowS={referencedScriptSettings.settings
+												?.concurrency_time_window_s}
+											workspaceScriptCacheTtl={referencedCacheTtl}
+											loadingWorkspaceScript={referencedScriptSettings.loading}
+											workspaceScriptError={referencedScriptSettings.error}
+											canEditWorkspaceScript={canEditWorkspaceScriptSettings}
+											{workspaceScriptNoEditReason}
+											onEditWorkspaceScript={openWorkspaceScriptSettings}
+										/>
 									{/if}
 								</div>
 							</Pane>
@@ -1710,7 +1391,10 @@
 											{scriptProgress}
 											mod={flowModule}
 											linkedAgentTools={agentLinked
-												? getLinkedAgentTools(linkedToolsScope(opWs, $pathStore), linkedToolsModuleId)
+												? getLinkedAgentTools(
+														linkedToolsScope(opWs, $pathStore),
+														linkedToolsModuleId
+													)
 												: undefined}
 											{testIsLoading}
 											disableMock={preprocessorModule || failureModule}
diff --git a/frontend/src/lib/components/flows/content/FlowModuleDebounce.svelte b/frontend/src/lib/components/flows/content/FlowModuleDebounce.svelte
index 5ce33b4852..17e2cf2d00 100644
--- a/frontend/src/lib/components/flows/content/FlowModuleDebounce.svelte
+++ b/frontend/src/lib/components/flows/content/FlowModuleDebounce.svelte
@@ -56,4 +56,6 @@
 	schema={flowStateStore.val[selectedId]?.schema}
 	placeholder={`$workspace/flow/<flow_path>-${flowModule.id}`}
 	size="xs"
+	fontClass="text-xs font-normal text-primary"
+	indentContent
 />
diff --git a/frontend/src/lib/components/flows/content/FlowModuleDeleteAfterUse.svelte b/frontend/src/lib/components/flows/content/FlowModuleDeleteAfterUse.svelte
index 6bcb790b83..d39de7a1ed 100644
--- a/frontend/src/lib/components/flows/content/FlowModuleDeleteAfterUse.svelte
+++ b/frontend/src/lib/components/flows/content/FlowModuleDeleteAfterUse.svelte
@@ -1,10 +1,9 @@
 <script lang="ts">
 	import Toggle from '$lib/components/Toggle.svelte'
-	import Tooltip from '$lib/components/Tooltip.svelte'
 	import type { FlowModule } from '$lib/gen'
+	import { stepSettingDefaults } from '../flowStepSettings'
 	import { SecondsInput } from '$lib/components/common'
-
-	import Section from '$lib/components/Section.svelte'
+	import { slideDynamic } from '$lib/transitions'
 
 	interface Props {
 		flowModule: FlowModule
@@ -14,45 +13,33 @@
 	let { flowModule = $bindable(), disabled = false }: Props = $props()
 
 	let enabled = $derived(flowModule.delete_after_secs != null)
+
+	const tip =
+		'The logs, arguments and results of this flow step are permanently deleted after the configured delay once the flow completes (they may be briefly visible in the UI while running). This also applies to a failed step: the error will not be accessible. The deletion is irreversible. Set to 0 for immediate deletion.'
 </script>
 
-<Section label="Delete after completion">
-	{#snippet header()}
-		<Tooltip>
-			The logs, arguments and results of this flow step will be completely deleted from Windmill
-			after the specified delay once the flow is complete. They might be temporarily visible in UI
-			while the flow is running.
-			<br />
-			This also applies to a flow step that has failed: the error will not be accessible.
-			<br />
-			<br />
-			The deletion is irreversible. Set to 0 for immediate deletion.
-			{#if disabled}
-				<br />
-				<br />
-				This option is only available on Windmill Enterprise Edition.
-			{/if}
-		</Tooltip>
-	{/snippet}
-
+<div class="flex flex-col gap-2">
 	<Toggle
 		{disabled}
-		size="sm"
+		eeOnly
+		size="xs"
+		textClass="text-xs font-normal text-primary"
 		checked={enabled}
 		on:change={() => {
 			if (enabled) {
 				flowModule.delete_after_secs = undefined
 			} else {
-				flowModule.delete_after_secs = 0
+				flowModule.delete_after_secs = stepSettingDefaults('lifetime')
 			}
 		}}
 		options={{
-			right: 'Delete logs, arguments and results after the flow is complete'
+			right: 'Delete after use',
+			rightTooltip: tip
 		}}
 	/>
 	{#if enabled}
-		<div class="mt-2">
+		<div class="pl-9" transition:slideDynamic>
 			<SecondsInput bind:seconds={flowModule.delete_after_secs} {disabled} size="sm" />
 		</div>
 	{/if}
-</Section>
+</div>
diff --git a/frontend/src/lib/components/flows/content/FlowModuleEarlyStop.svelte b/frontend/src/lib/components/flows/content/FlowModuleEarlyStop.svelte
index fbe747cff3..e9a824c294 100644
--- a/frontend/src/lib/components/flows/content/FlowModuleEarlyStop.svelte
+++ b/frontend/src/lib/components/flows/content/FlowModuleEarlyStop.svelte
@@ -1,26 +1,43 @@
 <script lang="ts">
-	import SimpleEditor from '$lib/components/SimpleEditor.svelte'
 	import Toggle from '$lib/components/Toggle.svelte'
-	import PropPickerWrapper from '$lib/components/flows/propPicker/PropPickerWrapper.svelte'
-	import type { Flow, FlowModule } from '$lib/gen'
-	import Tooltip from '$lib/components/Tooltip.svelte'
+	import { stepSettingDefaults } from '../flowStepSettings'
+	import InputTransformForm from '$lib/components/InputTransformForm.svelte'
+	import PropPickerWrapper from '../propPicker/PropPickerWrapper.svelte'
+	import type SimpleEditor from '$lib/components/SimpleEditor.svelte'
+	import type { Flow, FlowModule, StopAfterIf } from '$lib/gen'
+	import Label from '$lib/components/Label.svelte'
+	import TextInput from '$lib/components/text_input/TextInput.svelte'
+	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
+	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
 	import type { ExtendedOpenFlow, FlowEditorContext } from '../types'
 	import { getContext } from 'svelte'
+	import { emptySchema } from '$lib/utils'
 	import { NEVER_TESTED_THIS_FAR } from '../models'
-	import Section from '$lib/components/Section.svelte'
 	import { getStepPropPicker } from '../previousResults'
 	import { dfs } from '../previousResults'
+	import { slideDynamic } from '$lib/transitions'
 
 	const { flowStateStore, flowStore, previewArgs } =
 		getContext<FlowEditorContext>('FlowEditorContext')
 
 	interface Props {
 		flowModule: FlowModule
+		/** A loop shows both predicates, and puts the per-iteration one (`stop_after_if`)
+		 *  next to its own settings rather than in the run-settings list. */
+		blocks?: 'both' | 'stop-after' | 'all-iters'
 	}
 
-	let { flowModule = $bindable() }: Props = $props()
+	let { flowModule = $bindable(), blocks = 'both' }: Props = $props()
+
+	let stopAfterEditor: SimpleEditor | undefined = $state(undefined)
+	let stopAfterAllItersEditor: SimpleEditor | undefined = $state(undefined)
+
+	// Both predicates are stored as a bare `{ expr }`, so the form is told their kind
+	// through `argType` rather than inferring one from the value.
+	let predicateSchema = $state(emptySchema())
+	predicateSchema.properties['stop_after_if'] = { type: 'boolean' }
+	predicateSchema.properties['stop_after_all_iters_if'] = { type: 'boolean' }
 
-	let editor: SimpleEditor | undefined = $state(undefined)
 	let stepPropPicker = $derived(
 		getStepPropPicker(
 			flowStateStore.val,
@@ -50,12 +67,20 @@
 		}
 		return null
 	}
-	let raise_error_message_stop_after_all_if = $state(
-		flowModule.stop_after_all_iters_if?.error_message != undefined
-	)
-	let raise_error_message_stop_after_if = $state(
-		flowModule.stop_after_if?.error_message != undefined
-	)
+	// `skip_if_stopped` and `error_message` are mutually exclusive in the worker, and
+	// setting neither is a third outcome — so the three are one choice, not two flags.
+	type StopStatus = 'success' | 'skipped' | 'error'
+	function stopStatus(stop: StopAfterIf): StopStatus {
+		if (stop.skip_if_stopped) return 'skipped'
+		if (stop.error_message != undefined) return 'error'
+		return 'success'
+	}
+	function setStopStatus(stop: StopAfterIf, status: StopStatus) {
+		stop.skip_if_stopped = status === 'skipped'
+		stop.error_message = status === 'error' ? (stop.error_message ?? '') : undefined
+		if (status !== 'error') stop.error_include_result = false
+	}
+
 	let { isLoop, isParallelLoop } = $derived(
 		flowModule.value.type === 'forloopflow' || flowModule.value.type === 'whileloopflow'
 			? { isLoop: true, isParallelLoop: flowModule.value.parallel ?? false }
@@ -66,327 +91,246 @@
 	let isStopAfterAllIterationsEnabled = $derived(Boolean(flowModule.stop_after_all_iters_if))
 	let result = $derived(flowStateStore.val[flowModule.id]?.previewResult ?? NEVER_TESTED_THIS_FAR)
 	let breakableParent = $derived(checkIfBreakableParent(flowStore.val))
-</script>
-
-<div class="flex flex-col items-start space-y-2">
-	{#if !isBranchAll && !isParallelLoop}
-		<Section
-			label={(isLoop
-				? 'Break loop'
+	// One `stop_after_if` field, but what stopping early *does* depends on where the step
+	// sits — so the name and the explanation are picked together rather than sharing one
+	// tooltip that has to enumerate every case.
+	let stopAfterCopy = $derived(
+		isParallelLoop
+			? {
+					label: 'Break loop if',
+					tooltip:
+						'Unavailable on a parallel loop: iterations don\'t run in sequence, so there is nothing to break out of and the worker skips this predicate. Use "Stop flow if" to decide once every iteration has completed.'
+				}
+			: isLoop
+				? {
+						label: 'Break loop if',
+						tooltip:
+							'Evaluated after each iteration. When it returns true the loop stops iterating and the flow carries on with the iterations collected so far.'
+					}
 				: breakableParent
 					? breakableParent.isParallel
 						? breakableParent.type === 'loop'
-							? 'Skip rest of steps in iteration'
-							: 'Skip rest of steps in branch'
-						: 'Break parent loop module ' + breakableParent.stepId
-					: 'Stop flow early') + (isLoop ? ' (evaluated after each iteration)' : '')}
-			class="w-full"
-		>
-			{#snippet header()}
-				<Tooltip documentationLink="https://www.windmill.dev/docs/flows/early_stop">
-					If defined, at the end of the step, the predicate expression will be evaluated to decide
-					if the flow should stop early, skip rest of steps in iteration/branch if inside a parallel
-					for loop or branch all, or break if inside a for/while loop or branch all.
-				</Tooltip>
-			{/snippet}
+							? {
+									label: 'Skip rest of iteration if',
+									tooltip:
+										'Evaluated after this step. When it returns true the remaining steps of this iteration are skipped; the other iterations are unaffected.'
+								}
+							: {
+									label: 'Skip rest of branch if',
+									tooltip:
+										'Evaluated after this step. When it returns true the remaining steps of this branch are skipped; the other branches are unaffected.'
+								}
+						: {
+								label: 'Break parent loop if',
+								tooltip: `Evaluated after this step. When it returns true the enclosing loop ${breakableParent.stepId} stops iterating and the flow carries on.`
+							}
+					: {
+							label: 'Stop flow if',
+							tooltip:
+								"Evaluated after this step. When it returns true the flow stops here and returns this step's result."
+						}
+	)
 
-			<Toggle
-				checked={isStopAfterIfEnabled}
-				on:change={() => {
-					if (isStopAfterIfEnabled && flowModule.stop_after_if) {
-						flowModule.stop_after_if = undefined
-					} else {
-						flowModule.stop_after_if = {
-							expr: 'result == undefined',
-							skip_if_stopped: false,
-							error_message: undefined,
-							error_include_result: false
+	// The all-iterations predicate runs once the loop or branch-all is done, over what
+	// every iteration returned, so it can decide on the whole rather than on one result.
+	let allItersPrefix = $derived(
+		`Evaluated once ${isBranchAll ? 'every branch' : 'every iteration'} has completed, over their collected results.`
+	)
+	let stopAfterAllItersCopy = $derived(
+		breakableParent
+			? breakableParent.isParallel
+				? breakableParent.type === 'loop'
+					? {
+							label: 'Skip rest of iteration if',
+							tooltip: `${allItersPrefix} When it returns true the remaining steps of the enclosing iteration are skipped.`
+						}
+					: {
+							label: 'Skip rest of branch if',
+							tooltip: `${allItersPrefix} When it returns true the remaining steps of the enclosing branch are skipped.`
+						}
+				: {
+						label: `Break parent loop ${breakableParent.stepId} if`,
+						tooltip: `${allItersPrefix} When it returns true the enclosing loop stops iterating and the flow carries on.`
+					}
+			: {
+					label: 'Stop flow if',
+					tooltip: `${allItersPrefix} When it returns true the flow stops here and returns them.`
+				}
+	)
+
+	let earlyStopResult = $derived(
+		isLoop
+			? Array.isArray(result) && result.length > 0
+				? result[result.length - 1]
+				: result === NEVER_TESTED_THIS_FAR
+					? result
+					: undefined
+			: result
+	)
+</script>
+
+{#snippet stopStatusPicker(stop: StopAfterIf)}
+	<div class="flex flex-col gap-2 pl-9" transition:slideDynamic>
+		<Label
+			label="Flow status"
+			tooltip="How the flow is reported once this condition stops it. Success returns this step's result, Skipped marks the flow as skipped, and Error fails it."
+		>
+			<ToggleButtonGroup
+				noWFull
+				selected={stopStatus(stop)}
+				onSelected={(v) => setStopStatus(stop, v)}
+			>
+				{#snippet children({ item })}
+					<ToggleButton value="success" label="Success" {item} small />
+					<ToggleButton value="skipped" label="Skipped" {item} small />
+					<ToggleButton value="error" label="Error" {item} small />
+				{/snippet}
+			</ToggleButtonGroup>
+		</Label>
+		{#if stop.error_message != undefined}
+			<div class="flex flex-col gap-2" transition:slideDynamic>
+				<TextInput
+					size="sm"
+					bind:value={() => stop.error_message ?? '', (v) => (stop.error_message = String(v))}
+					inputProps={{ placeholder: 'Enter custom error message (optional)' }}
+				/>
+				<Toggle
+					size="xs"
+					bind:checked={
+						() => stop.error_include_result ?? false, (v) => (stop.error_include_result = v)
+					}
+					options={{
+						right: 'Include result in error',
+						rightTooltip:
+							"When enabled, this step's output is embedded inside the raised error object (as error.result) instead of being discarded. The flow result stays { error }."
+					}}
+				/>
+			</div>
+		{/if}
+	</div>
+{/snippet}
+
+{#snippet stopAfterToggle()}
+	<Toggle
+		size="xs"
+		textClass="text-xs font-normal text-primary"
+		disabled={isParallelLoop}
+		checked={isStopAfterIfEnabled}
+		on:change={() => {
+			if (isStopAfterIfEnabled && flowModule.stop_after_if) {
+				flowModule.stop_after_if = undefined
+			} else {
+				flowModule.stop_after_if = stepSettingDefaults('early-stop')
+			}
+		}}
+		options={{
+			title: isParallelLoop ? stopAfterCopy.tooltip : undefined,
+			right: stopAfterCopy.label,
+			rightTooltip: stopAfterCopy.tooltip,
+			rightDocumentationLink: 'https://www.windmill.dev/docs/flows/early_stop'
+		}}
+	/>
+{/snippet}
+
+{#snippet stopAfterAllItersToggle()}
+	<Toggle
+		size="xs"
+		textClass="text-xs font-normal text-primary"
+		checked={isStopAfterAllIterationsEnabled}
+		on:change={() => {
+			if (isStopAfterAllIterationsEnabled && flowModule.stop_after_all_iters_if) {
+				flowModule.stop_after_all_iters_if = undefined
+			} else {
+				flowModule.stop_after_all_iters_if = stepSettingDefaults('early-stop')
+			}
+		}}
+		options={{
+			right: stopAfterAllItersCopy.label,
+			rightTooltip: stopAfterAllItersCopy.tooltip,
+			rightDocumentationLink: 'https://www.windmill.dev/docs/flows/early_stop'
+		}}
+	/>
+{/snippet}
+
+<div class="flex flex-col items-start gap-6">
+	{#if blocks !== 'all-iters' && !isBranchAll}
+		<div class="w-full flex flex-col gap-2">
+			<PropPickerWrapper
+				sidePane
+				flow_input={stepPropPicker.pickableProperties.flow_input}
+				notSelectable
+				result={earlyStopResult}
+				extraResults={isLoop ? { all_iters: result } : undefined}
+				pickableProperties={stepPropPicker.pickableProperties}
+				on:select={({ detail }) => {
+					stopAfterEditor?.insertAtCursor(detail)
+					stopAfterEditor?.focus()
+				}}
+			>
+				<InputTransformForm
+					bind:arg={
+						() => flowModule.stop_after_if,
+						(v) => {
+							flowModule.stop_after_if = v
 						}
 					}
-				}}
-				options={{
-					right: isLoop
-						? 'Break loop'
-						: breakableParent
-							? breakableParent.isParallel
-								? breakableParent.type === 'loop'
-									? 'Skip rest of steps in iteration'
-									: 'Skip rest of steps in branch'
-								: 'Break parent loop module'
-							: 'Stop flow if condition met'
-				}}
-			/>
-
-			<div
-				class="w-full mt-2 border rounded-md p-2 flex flex-col gap-2 {flowModule.stop_after_if
-					? ''
-					: 'bg-surface-secondary'}"
-			>
-				{#if flowModule.stop_after_if}
-					{@const earlyStopResult = isLoop
-						? Array.isArray(result) && result.length > 0
-							? result[result.length - 1]
-							: result === NEVER_TESTED_THIS_FAR
-								? result
-								: undefined
-						: result}
-					{#if !breakableParent && !isLoop}
-						<div class="flex flex-col gap-2">
-							<Toggle
-								size="xs"
-								bind:checked={flowModule.stop_after_if.skip_if_stopped}
-								on:change={(event) => {
-									if (flowModule.stop_after_if && event.detail) {
-										flowModule.stop_after_if.error_message = undefined
-										flowModule.stop_after_if.error_include_result = false
-										raise_error_message_stop_after_if = false
-									}
-								}}
-								options={{
-									right: 'Label flow as "skipped" if stopped'
-								}}
-							/>
-							<Toggle
-								size="xs"
-								bind:checked={raise_error_message_stop_after_if}
-								on:change={(event) => {
-									if (flowModule.stop_after_if) {
-										if (event.detail) {
-											flowModule.stop_after_if.error_message = ''
-											flowModule.stop_after_if.skip_if_stopped = false
-										} else {
-											flowModule.stop_after_if.error_message = undefined
-											flowModule.stop_after_if.error_include_result = false
-										}
-									}
-								}}
-								options={{
-									right: 'Raise an error message if stopped',
-									rightTooltip:
-										'If enabled and the stop condition is met, an error message will be raised. A custom message can be provided; otherwise, a default message will be used. Mutually exclusive with "Label flow as skipped".'
-								}}
-							/>
-						</div>
-					{/if}
-					{#if raise_error_message_stop_after_if}
-						<input
-							type="text"
-							bind:value={flowModule.stop_after_if.error_message}
-							placeholder="Enter custom error message (optional)"
-						/>
-						<Toggle
-							size="xs"
-							bind:checked={flowModule.stop_after_if.error_include_result}
-							options={{
-								right: "Include the stopping step's result in the error",
-								rightTooltip:
-									"When enabled, this step's output is embedded inside the raised error object (as error.result) instead of being discarded. The flow result stays { error }."
-							}}
-						/>
-					{/if}
-					<span class="mt-2 text-xs font-bold">Stop condition expression</span>
-					<div class="border rounded-md w-full overflow-auto">
-						<PropPickerWrapper
-							noPadding
-							notSelectable
-							pickableProperties={stepPropPicker.pickableProperties}
-							result={earlyStopResult}
-							extraResults={isLoop ? { all_iters: result } : undefined}
-							on:select={({ detail }) => {
-								editor?.insertAtCursor(detail)
-								editor?.focus()
-							}}
-						>
-							<SimpleEditor
-								bind:this={editor}
-								lang="javascript"
-								bind:code={flowModule.stop_after_if.expr}
-								class="h-full"
-								extraLib={`declare const result = ${JSON.stringify(earlyStopResult)};\n` +
-									stepPropPicker.extraLib +
-									(isLoop ? `\ndeclare const all_iters = ${JSON.stringify(result)};` : '')}
-							/>
-						</PropPickerWrapper>
-					</div>
-				{:else}
-					{#if !breakableParent && !isLoop}
-						<div class="flex flex-col gap-2">
-							<Toggle
-								disabled
-								size="xs"
-								options={{
-									right: 'Label flow as "skipped" if stopped'
-								}}
-							/>
-							<Toggle
-								disabled
-								size="xs"
-								options={{
-									right: 'Raise an error message if stopped'
-								}}
-							/>
-						</div>
-					{/if}
-					<span class="mt-2 text-xs font-bold">Stop condition expression</span>
-					<textarea disabled rows="3" class="min-h-[80px]"></textarea>
-				{/if}
-			</div>
-		</Section>
+					argName="stop_after_if"
+					argType="javascript"
+					collapsed={!isStopAfterIfEnabled || isParallelLoop}
+					animateAppear
+					header={stopAfterToggle}
+					noDynamicToggle
+					schema={predicateSchema}
+					previousModuleId={undefined}
+					pickableProperties={stepPropPicker.pickableProperties}
+					extraLib={`declare const result = ${JSON.stringify(earlyStopResult)};\n` +
+						stepPropPicker.extraLib +
+						(isLoop ? `\ndeclare const all_iters = ${JSON.stringify(result)};` : '')}
+					bind:editor={stopAfterEditor}
+				/>
+			</PropPickerWrapper>
+			{#if isStopAfterIfEnabled && !breakableParent && !isLoop && flowModule.stop_after_if}
+				{@render stopStatusPicker(flowModule.stop_after_if)}
+			{/if}
+		</div>
 	{/if}
 
-	{#if isLoop || isBranchAll}
-		<Section
-			label={(breakableParent
-				? breakableParent.isParallel
-					? breakableParent.type === 'loop'
-						? 'Skip rest of steps in iteration'
-						: 'Skip rest of steps in branch'
-					: 'Break parent loop module ' + breakableParent.stepId
-				: 'Stop flow early') +
-				(isBranchAll
-					? ' (evaluated after all branches have been run)'
-					: ' (evaluated after all iterations)')}
-			class="w-full"
-		>
-			{#snippet header()}
-				<Tooltip documentationLink="https://www.windmill.dev/docs/flows/early_stop">
-					If defined, at the end of the step, the predicate expression will be evaluated to decide
-					if the flow should stop early, skip rest of steps in iteration/branch if inside a parallel
-					for loop or branch all, or break if inside a for/while loop or branch all.
-				</Tooltip>
-			{/snippet}
-
-			<Toggle
-				checked={isStopAfterAllIterationsEnabled}
-				on:change={() => {
-					if (isStopAfterAllIterationsEnabled && flowModule.stop_after_all_iters_if) {
-						flowModule.stop_after_all_iters_if = undefined
-					} else {
-						flowModule.stop_after_all_iters_if = {
-							expr: 'result == undefined',
-							skip_if_stopped: false,
-							error_message: undefined,
-							error_include_result: false
+	{#if blocks !== 'stop-after' && (isLoop || isBranchAll)}
+		<div class="w-full flex flex-col gap-2">
+			<PropPickerWrapper
+				sidePane
+				flow_input={stepPropPicker.pickableProperties.flow_input}
+				notSelectable
+				{result}
+				pickableProperties={stepPropPicker.pickableProperties}
+				on:select={({ detail }) => {
+					stopAfterAllItersEditor?.insertAtCursor(detail)
+					stopAfterAllItersEditor?.focus()
+				}}
+			>
+				<InputTransformForm
+					bind:arg={
+						() => flowModule.stop_after_all_iters_if,
+						(v) => {
+							flowModule.stop_after_all_iters_if = v
 						}
 					}
-				}}
-				options={{
-					right:
-						(breakableParent
-							? breakableParent.isParallel
-								? breakableParent.type === 'loop'
-									? 'Skip rest of steps in iteration'
-									: 'Skip rest of steps in branch'
-								: 'Break parent loop module ' + breakableParent.stepId
-							: 'Stop flow') + ' if condition met'
-				}}
-			/>
-
-			<div
-				class="w-full border rounded-md mt-2 p-2 flex flex-col gap-2 {flowModule.stop_after_all_iters_if
-					? ''
-					: 'bg-surface-secondary'}"
-			>
-				{#if flowModule.stop_after_all_iters_if}
-					{#if !breakableParent}
-						<div class="flex flex-col gap-2">
-							<Toggle
-								size="xs"
-								bind:checked={flowModule.stop_after_all_iters_if.skip_if_stopped}
-								on:change={(event) => {
-									if (flowModule.stop_after_all_iters_if && event.detail) {
-										flowModule.stop_after_all_iters_if.error_message = undefined
-										flowModule.stop_after_all_iters_if.error_include_result = false
-										raise_error_message_stop_after_all_if = false
-									}
-								}}
-								options={{
-									right: 'Label flow as "skipped" if stopped'
-								}}
-							/>
-							<Toggle
-								size="xs"
-								bind:checked={raise_error_message_stop_after_all_if}
-								on:change={(event) => {
-									if (flowModule.stop_after_all_iters_if) {
-										if (event.detail) {
-											flowModule.stop_after_all_iters_if.error_message = ''
-											flowModule.stop_after_all_iters_if.skip_if_stopped = false
-										} else {
-											flowModule.stop_after_all_iters_if.error_message = undefined
-											flowModule.stop_after_all_iters_if.error_include_result = false
-										}
-									}
-								}}
-								options={{
-									right: 'Raise an error message if stopped',
-									rightTooltip:
-										'If enabled and the stop condition is met, an error message will be raised. A custom message can be provided; otherwise, a default message will be used. Mutually exclusive with "Label flow as skipped".'
-								}}
-							/>
-						</div>
-					{/if}
-					{#if raise_error_message_stop_after_all_if}
-						<input
-							type="text"
-							bind:value={flowModule.stop_after_all_iters_if.error_message}
-							placeholder="Enter custom error message (optional)"
-						/>
-						<Toggle
-							size="xs"
-							bind:checked={flowModule.stop_after_all_iters_if.error_include_result}
-							options={{
-								right: "Include the stopping step's result in the error",
-								rightTooltip:
-									"When enabled, this step's output is embedded inside the raised error object (as error.result) instead of being discarded. The flow result stays { error }."
-							}}
-						/>
-					{/if}
-					<span class="mt-2 text-xs font-bold">Stop condition expression</span>
-					<div class="border rounded-md w-full overflow-auto">
-						<PropPickerWrapper
-							notSelectable
-							noPadding
-							pickableProperties={stepPropPicker.pickableProperties}
-							{result}
-							on:select={({ detail }) => {
-								editor?.insertAtCursor(detail)
-								editor?.focus()
-							}}
-						>
-							<SimpleEditor
-								bind:this={editor}
-								lang="javascript"
-								bind:code={flowModule.stop_after_all_iters_if.expr}
-								class="h-full"
-								extraLib={`declare const result = ${JSON.stringify(result)};\n` +
-									stepPropPicker.extraLib}
-							/>
-						</PropPickerWrapper>
-					</div>
-				{:else}
-					{#if !breakableParent}
-						<div class="flex flex-col gap-2">
-							<Toggle
-								disabled
-								size="xs"
-								options={{
-									right: 'Label flow as "skipped" if stopped'
-								}}
-							/>
-							<Toggle
-								disabled
-								size="xs"
-								options={{
-									right: 'Raise an error message if stopped'
-								}}
-							/>
-						</div>
-					{/if}
-					<span class="mt-2 text-xs font-bold">Stop condition expression</span>
-					<textarea disabled rows="3" class="min-h-[80px]"></textarea>
-				{/if}
-			</div>
-		</Section>
+					argName="stop_after_all_iters_if"
+					argType="javascript"
+					collapsed={!isStopAfterAllIterationsEnabled}
+					animateAppear
+					header={stopAfterAllItersToggle}
+					noDynamicToggle
+					schema={predicateSchema}
+					previousModuleId={undefined}
+					pickableProperties={stepPropPicker.pickableProperties}
+					extraLib={`declare const result = ${JSON.stringify(result)};\n` + stepPropPicker.extraLib}
+					bind:editor={stopAfterAllItersEditor}
+				/>
+			</PropPickerWrapper>
+			{#if isStopAfterAllIterationsEnabled && !breakableParent && flowModule.stop_after_all_iters_if}
+				{@render stopStatusPicker(flowModule.stop_after_all_iters_if)}
+			{/if}
+		</div>
 	{/if}
 </div>
diff --git a/frontend/src/lib/components/flows/content/FlowModuleHeader.svelte b/frontend/src/lib/components/flows/content/FlowModuleHeader.svelte
index b34a78e1db..63d053fe14 100644
--- a/frontend/src/lib/components/flows/content/FlowModuleHeader.svelte
+++ b/frontend/src/lib/components/flows/content/FlowModuleHeader.svelte
@@ -2,24 +2,10 @@
 	import Button from '$lib/components/common/button/Button.svelte'
 	import { type FlowModule } from '$lib/gen'
 	import { createEventDispatcher, getContext } from 'svelte'
-	import {
-		Bed,
-		Database,
-		Gauge,
-		GitFork,
-		Pen,
-		PhoneIncoming,
-		RefreshCcw,
-		Repeat,
-		Square,
-		Pin,
-		Save,
-		Settings
-	} from 'lucide-svelte'
-	import Popover from '../../Popover.svelte'
+	import { Pen, RefreshCcw, Save } from 'lucide-svelte'
+	import DropdownV2 from '../../DropdownV2.svelte'
 	import type { FlowEditorContext } from '../types'
 	import { sendUserToast } from '$lib/utils'
-	import { getLatestHashForScript } from '$lib/scripts'
 	import type { FlowBuilderWhitelabelCustomUi } from '$lib/components/custom_ui'
 	import FlowModuleWorkerTagSelect from './FlowModuleWorkerTagSelect.svelte'
 
@@ -29,134 +15,14 @@
 	}
 
 	let { module, tag }: Props = $props()
-	const { scriptEditorDrawer, workspaceScriptSettingsDrawer, flowEditorDrawer, opWorkspace } =
-		getContext<FlowEditorContext>('FlowEditorContext')
+	const { flowEditorDrawer } = getContext<FlowEditorContext>('FlowEditorContext')
 
 	const dispatch = createEventDispatcher()
 	let customUi: undefined | FlowBuilderWhitelabelCustomUi = getContext('customUi')
-
-	let popoverClasses =
-		'center-center rounded p-2 bg-blue-100 text-blue-800 border border-blue-300 hover:bg-blue-200 dark:bg-frost-700 dark:text-frost-100 dark:border-frost-600'
 </script>
 
-<div class="flex flex-row gap-2 whitespace-nowrap">
-	{#if module.value.type === 'script' || module.value.type === 'rawscript' || module.value.type == 'flow'}
-		{#if module.retry?.constant || module.retry?.exponential}
-			<Popover placement="bottom" class={popoverClasses} onClick={() => dispatch('toggleRetry')}>
-				<Repeat size={14} />
-				{#snippet text()}
-					Retries
-				{/snippet}
-			</Popover>
-		{/if}
-		{#if module?.value?.['concurrent_limit'] != undefined}
-			<Popover
-				placement="bottom"
-				class={popoverClasses}
-				onClick={() => dispatch('toggleConcurrency')}
-			>
-				<Gauge size={14} />
-				{#snippet text()}
-					Concurrency Limits
-				{/snippet}
-			</Popover>
-		{/if}
-		{#if module.cache_ttl != undefined}
-			<Popover placement="bottom" class={popoverClasses} onClick={() => dispatch('toggleCache')}>
-				<Database size={14} />
-				{#snippet text()}
-					Cache
-				{/snippet}
-			</Popover>
-		{/if}
-		{#if module.stop_after_if || module.stop_after_all_iters_if}
-			<Popover
-				placement="bottom"
-				class={popoverClasses}
-				onClick={() => dispatch('toggleStopAfterIf')}
-			>
-				<Square size={14} />
-				{#snippet text()}
-					Early stop/break
-				{/snippet}
-			</Popover>
-		{/if}
-		{#if module.suspend}
-			<Popover placement="bottom" class={popoverClasses} onClick={() => dispatch('toggleSuspend')}>
-				<PhoneIncoming size={14} />
-				{#snippet text()}
-					Suspend
-				{/snippet}
-			</Popover>
-		{/if}
-		{#if module.sleep}
-			<Popover placement="bottom" class={popoverClasses} onClick={() => dispatch('toggleSleep')}>
-				<Bed size={14} />
-				{#snippet text()}
-					Sleep
-				{/snippet}
-			</Popover>
-		{/if}
-		{#if module.mock?.enabled}
-			<Popover placement="bottom" class={popoverClasses} onClick={() => dispatch('togglePin')}>
-				<Pin size={14} />
-				{#snippet text()}
-					This step is pinned
-				{/snippet}
-			</Popover>
-		{/if}
-	{/if}
+<div class="flex shrink-0 flex-row gap-2 whitespace-nowrap">
 	{#if module.value.type === 'script'}
-		{#if !module.value.path.startsWith('hub/') && customUi?.scriptEdit != false}
-			<Popover notClickable placement="bottom">
-				<Button
-					unifiedSize="sm"
-					variant="subtle"
-					onClick={async () => {
-						if (module.value.type == 'script') {
-							const hash =
-								module.value.hash ??
-								(await getLatestHashForScript(module.value.path, opWorkspace?.()))
-							$scriptEditorDrawer?.openDrawer(hash, () => {
-								dispatch('reload')
-								sendUserToast('Script has been updated')
-							})
-						}
-					}}
-					startIcon={{ icon: Pen }}
-					iconOnly
-					aria-label="Edit the script's code"
-					disabled={module.value.hash != undefined}
-				/>
-				{#snippet text()}Edit the script's code{/snippet}
-			</Popover>
-			<!-- Only when the settings drawer is actually mounted (not in the local-dev
-				editors, which provide the context store but never render it). -->
-			{#if $workspaceScriptSettingsDrawer}
-				<Popover notClickable placement="bottom">
-					<Button
-						unifiedSize="sm"
-						variant="subtle"
-						onClick={() => {
-							if (module.value.type == 'script') {
-								$workspaceScriptSettingsDrawer?.openDrawer(
-									module.value.path,
-									module.value.hash,
-									() => {
-										dispatch('reload')
-									}
-								)
-							}
-						}}
-						startIcon={{ icon: Settings }}
-						iconOnly
-						aria-label="Edit the script's runtime settings"
-						disabled={module.value.hash != undefined}
-					/>
-					{#snippet text()}Edit the script's runtime settings (concurrency, cache, timeout, ...){/snippet}
-				</Popover>
-			{/if}
-		{/if}
 		{#if customUi?.tagEdit != false}
 			<FlowModuleWorkerTagSelect
 				isPreprocessor={module.id == 'preprocessor'}
@@ -167,19 +33,6 @@
 				on:change={(e) => dispatch('tagChange', e.detail)}
 			/>
 		{/if}
-		{#if customUi?.scriptFork != false}
-			<Popover notClickable placement="bottom">
-				<Button
-					unifiedSize="sm"
-					variant="subtle"
-					on:click={() => dispatch('fork')}
-					startIcon={{ icon: GitFork }}
-					iconOnly
-					aria-label="Fork into an inline script"
-				/>
-				{#snippet text()}Fork into an inline script{/snippet}
-			</Popover>
-		{/if}
 	{:else if module.value.type === 'flow'}
 		<Button
 			unifiedSize="sm"
@@ -230,14 +83,16 @@
 			tag={module.value.tag}
 			on:change={(e) => dispatch('tagChange', e.detail)}
 		/>
-		<Button
-			unifiedSize="sm"
-			variant="subtle"
-			startIcon={{ icon: Save }}
-			on:click={() => dispatch('createScriptFromInlineScript')}
-			iconOnly={false}
-		>
-			Save to workspace
-		</Button>
+		<DropdownV2
+			size="sm"
+			placement="bottom-end"
+			items={[
+				{
+					displayName: 'Save to workspace',
+					icon: Save,
+					action: () => dispatch('createScriptFromInlineScript')
+				}
+			]}
+		/>
 	{/if}
 </div>
diff --git a/frontend/src/lib/components/flows/content/FlowModuleMock.svelte b/frontend/src/lib/components/flows/content/FlowModuleMock.svelte
index e3d4cb3bea..e56fee962c 100644
--- a/frontend/src/lib/components/flows/content/FlowModuleMock.svelte
+++ b/frontend/src/lib/components/flows/content/FlowModuleMock.svelte
@@ -2,11 +2,11 @@
 	import { run } from 'svelte/legacy'
 
 	import Toggle from '$lib/components/Toggle.svelte'
-	import Tooltip from '$lib/components/Tooltip.svelte'
 	import type { FlowModule } from '$lib/gen'
-	import { Section } from '$lib/components/common'
+	import Label from '$lib/components/Label.svelte'
 	import JsonEditor from '$lib/components/JsonEditor.svelte'
 	import { untrack } from 'svelte'
+	import { slideDynamic } from '$lib/transitions'
 
 	interface Props {
 		flowModule: FlowModule
@@ -56,47 +56,38 @@
 	}
 </script>
 
-<Section label="Mock">
-	{#snippet header()}
-		<div class="flex flex-row items-center gap-2">
-			<Tooltip>
-				If defined and enabled, the step will immediately return the mock value instead of being
-				executed.
-			</Tooltip>
-			<Toggle
-				checked={isMockEnabled}
-				on:change={() => {
-					if (isMockEnabled) {
-						flowModule.mock = {
-							enabled: false,
-							return_value: flowModule.mock?.return_value
-						}
-					} else {
-						flowModule.mock = {
-							enabled: true,
-							return_value: flowModule.mock?.return_value ?? { example: 'value' }
-						}
-						code = JSON.stringify(flowModule.mock?.return_value, null, 2)
-					}
-				}}
-				size="xs"
-			/>
+<div class="flex flex-col gap-2">
+	<Toggle
+		size="xs"
+		textClass="text-xs font-normal text-primary"
+		checked={isMockEnabled}
+		on:change={() => {
+			if (isMockEnabled) {
+				flowModule.mock = {
+					enabled: false,
+					return_value: flowModule.mock?.return_value
+				}
+			} else {
+				flowModule.mock = {
+					enabled: true,
+					return_value: flowModule.mock?.return_value ?? { example: 'value' }
+				}
+				code = JSON.stringify(flowModule.mock?.return_value, null, 2)
+			}
+		}}
+		options={{
+			right: 'Pin output',
+			rightTooltip:
+				'While pinned, the step returns this value immediately instead of executing. The same control lives on the step in the graph.'
+		}}
+	/>
+	{#if isMockEnabled}
+		<div class="pl-9" transition:slideDynamic>
+			<Label label="Pinned value">
+				{#key renderCount}
+					<JsonEditor {code} on:changeValue={updateMockValue} />
+				{/key}
+			</Label>
 		</div>
-	{/snippet}
-
-	<div>
-		<span class="text-xs py-1">Mocked Return value</span>
-
-		{#if isMockEnabled}
-			{#key renderCount}
-				<JsonEditor {code} on:changeValue={updateMockValue} />
-			{/key}
-		{:else}
-			<pre class="text-xs border rounded p-2 bg-surface-disabled"
-				>{flowModule.mock?.return_value
-					? JSON.stringify(flowModule.mock?.return_value, null, 2)
-					: ''}</pre
-			>
-		{/if}
-	</div>
-</Section>
+	{/if}
+</div>
diff --git a/frontend/src/lib/components/flows/content/FlowModuleMockTransitionMessage.svelte b/frontend/src/lib/components/flows/content/FlowModuleMockTransitionMessage.svelte
deleted file mode 100644
index 34384cc506..0000000000
--- a/frontend/src/lib/components/flows/content/FlowModuleMockTransitionMessage.svelte
+++ /dev/null
@@ -1,145 +0,0 @@
-<script lang="ts">
-	import { Pin } from 'lucide-svelte'
-	import { base } from '$lib/base'
-	import DarkModeObserver from '$lib/components/DarkModeObserver.svelte'
-	import { Info } from 'lucide-svelte'
-
-	let darkMode = $state(true)
-
-	function openFullscreen(event: MouseEvent) {
-		const img = event.target as HTMLImageElement
-		if (img.requestFullscreen) {
-			img.requestFullscreen({
-				navigationUI: 'auto'
-			})
-		}
-	}
-</script>
-
-<DarkModeObserver bind:darkMode />
-
-<div class="p-1.5">
-	<!-- Header Banner -->
-	<div
-		class="bg-gradient-to-r from-blue-50 to-indigo-50 dark:from-blue-900/20 dark:to-indigo-900/20
-                text-blue-700 dark:text-blue-300 rounded-md px-3 py-2 flex items-center justify-between mb-3"
-	>
-		<div class="flex items-center gap-2">
-			<div
-				class="bg-blue-600 dark:bg-blue-400 px-1.5 py-0.5 text-white text-xs font-bold tracking-wide rounded shadow-sm"
-				>NEW</div
-			>
-			<span class="font-normal text-sm">Mock has evolved into</span>
-			<span class="font-semibold flex items-center gap-0.5 text-sm">
-				<Pin size="14" strokeWidth="2.5" />
-				PIN
-			</span>
-		</div>
-		<div class="text-xs bg-white/60 dark:bg-slate-800/60 py-0.5 px-2 rounded">
-			<span class="font-medium">Find it in:</span>
-			<span class="font-semibold">"Test this step"</span> tab
-		</div>
-	</div>
-
-	<!-- Main Content -->
-	<div class="text-xs">
-		<!-- Steps Header -->
-		<span class="flex items-center mb-2 text-slate-500"> How to use the PIN feature: </span>
-
-		<!-- Steps Container -->
-		<div class="grid grid-cols-2 gap-3">
-			<!-- Step 1 -->
-			<div class="flex items-start gap-2 group">
-				<div
-					class="bg-surface-secondary text-secondary rounded-full w-5 h-5 flex items-center justify-center text-xs font-medium flex-shrink-0 -mt-0.5"
-					>1</div
-				>
-				<div class="w-full">
-					<div class="font-medium mb-1.5">Pick a result from history</div>
-					<div
-						class="border rounded-md p-1 bg-white dark:bg-slate-800 h-56 overflow-hidden shadow-sm group-hover:shadow transition-shadow"
-					>
-						<!--svelte-ignore a11y_click_events_have_key_events-->
-						<!-- svelte-ignore a11y_no_noninteractive_element_interactions -->
-						<img
-							class="w-full h-full object-contain opacity-70 hover:opacity-100 cursor-pointer"
-							src={darkMode ? `${base}/pin-history-dark.png` : `${base}/pin-history.png`}
-							alt="History picker"
-							onclick={openFullscreen}
-						/>
-					</div>
-				</div>
-			</div>
-
-			<!-- Step 2 -->
-			<div class="flex items-start gap-2 group">
-				<div
-					class="bg-surface-secondary text-secondary rounded-full w-5 h-5 flex items-center justify-center text-xs font-medium flex-shrink-0 -mt-0.5"
-					>2</div
-				>
-				<div class="w-full">
-					<div class="font-medium mb-1.5">Pin it as a fixed output</div>
-					<div
-						class="border rounded-md p-1 bg-white dark:bg-slate-800 h-56 overflow-hidden shadow-sm group-hover:shadow transition-shadow"
-					>
-						<!--svelte-ignore a11y_click_events_have_key_events-->
-						<!-- svelte-ignore a11y_no_noninteractive_element_interactions -->
-						<img
-							class="w-full h-full object-contain opacity-70 hover:opacity-100 cursor-pointer"
-							src={darkMode ? `${base}/pin-pin-dark.png` : `${base}/pin-pin.png`}
-							alt="Pin action"
-							onclick={openFullscreen}
-						/>
-					</div>
-				</div>
-			</div>
-
-			<!-- Step 3 -->
-			<div class="flex items-start gap-2 group">
-				<div
-					class="bg-surface-secondary text-secondary rounded-full w-5 h-5 flex items-center justify-center text-xs font-medium flex-shrink-0 -mt-0.5"
-					><Info size="14" /></div
-				>
-				<div class="w-full">
-					<div class="font-medium mb-1.5">The last pin can be recovered from history</div>
-					<div
-						class="border rounded-md p-1 bg-white dark:bg-slate-800 h-56 overflow-hidden shadow-sm group-hover:shadow transition-shadow"
-					>
-						<!--svelte-ignore a11y_click_events_have_key_events-->
-						<!-- svelte-ignore a11y_no_noninteractive_element_interactions -->
-						<img
-							class="w-full h-full object-contain opacity-70 hover:opacity-100 cursor-pointer"
-							src={darkMode ? `${base}/pin-restore-dark.png` : `${base}/pin-restore.png`}
-							alt="Recover pins"
-							onclick={openFullscreen}
-						/>
-					</div>
-				</div>
-			</div>
-
-			<!-- Step 4 -->
-			<div class="flex items-start gap-2 group">
-				<div
-					class="bg-surface-secondary text-secondary rounded-full w-5 h-5 flex items-center justify-center text-xs font-medium flex-shrink-0 -mt-0.5"
-				>
-					<Info size="14" />
-				</div>
-				<div class="w-full">
-					<div class="font-medium mb-1.5">All of this can be done from the flow view</div>
-					<div
-						class="border rounded-md p-1 bg-white dark:bg-slate-800 h-56 overflow-hidden shadow-sm group-hover:shadow transition-shadow"
-					>
-						<!--svelte-ignore a11y_click_events_have_key_events-->
-						<!-- svelte-ignore a11y_no_noninteractive_element_interactions -->
-						<img
-							class="w-full h-full object-contain opacity-70 hover:opacity-100 cursor-pointer"
-							src={darkMode ? `${base}/pin-flow-view-dark.png` : `${base}/pin-flow-view.png`}
-							alt="Flow view pinning"
-							onclick={openFullscreen}
-						/>
-					</div>
-				</div>
-			</div>
-		</div>
-	</div>
-</div>
diff --git a/frontend/src/lib/components/flows/content/FlowModuleSkip.svelte b/frontend/src/lib/components/flows/content/FlowModuleSkip.svelte
index ffb0a8d502..40fb32b064 100644
--- a/frontend/src/lib/components/flows/content/FlowModuleSkip.svelte
+++ b/frontend/src/lib/components/flows/content/FlowModuleSkip.svelte
@@ -1,12 +1,13 @@
 <script lang="ts">
-	import SimpleEditor from '$lib/components/SimpleEditor.svelte'
 	import Toggle from '$lib/components/Toggle.svelte'
-	import PropPickerWrapper from '$lib/components/flows/propPicker/PropPickerWrapper.svelte'
+	import InputTransformForm from '$lib/components/InputTransformForm.svelte'
+	import PropPickerWrapper from '../propPicker/PropPickerWrapper.svelte'
+	import type SimpleEditor from '$lib/components/SimpleEditor.svelte'
 	import type { FlowModule } from '$lib/gen'
-	import Tooltip from '$lib/components/Tooltip.svelte'
+	import { stepSettingDefaults } from '../flowStepSettings'
 	import type { FlowEditorContext } from '../types'
 	import { getContext } from 'svelte'
-	import Section from '$lib/components/Section.svelte'
+	import { emptySchema } from '$lib/utils'
 	import { getStepPropPicker } from '../previousResults'
 
 	const { flowStateStore, flowStore, previewArgs } =
@@ -21,6 +22,12 @@
 	let { flowModule = $bindable(), parentModule, previousModule }: Props = $props()
 
 	let editor: SimpleEditor | undefined = $state(undefined)
+
+	// A predicate is stored as a bare `{ expr }`, so the form is told its kind through
+	// `argType` rather than inferring one from the value.
+	let schema = $state(emptySchema())
+	schema.properties['skip_if'] = { type: 'boolean' }
+
 	let stepPropPicker = $derived(
 		getStepPropPicker(
 			flowStateStore.val,
@@ -33,64 +40,65 @@
 		)
 	)
 
+	// The worker evaluates skip_if before this step runs, passing the last job result,
+	// so `result` here is the previous step's output — not this step's.
+	let result = $derived(
+		previousModule ? flowStateStore.val[previousModule.id]?.previewResult : undefined
+	)
+
 	let isSkipEnabled = $derived(Boolean(flowModule.skip_if))
 </script>
 
-<div class="flex flex-col items-start space-y-2">
-	<Section label="Skip" class="w-full">
-		{#snippet header()}
-			<Tooltip>
-				If the condition is met, the step will behave as an identity step, passing the previous
-				step's result through unchanged.
-			</Tooltip>
-		{/snippet}
+{#snippet skipToggle()}
+	<Toggle
+		size="xs"
+		textClass="text-xs font-normal text-primary"
+		checked={isSkipEnabled}
+		on:change={() => {
+			if (isSkipEnabled && flowModule.skip_if) {
+				flowModule.skip_if = undefined
+			} else {
+				flowModule.skip_if = stepSettingDefaults('skip')
+			}
+		}}
+		options={{
+			right: 'Skip step if',
+			rightTooltip:
+				"If the condition is met, the step behaves as an identity step, passing the previous step's result through unchanged."
+		}}
+	/>
+{/snippet}
 
-		<Toggle
-			checked={isSkipEnabled}
-			on:change={() => {
-				if (isSkipEnabled && flowModule.skip_if) {
-					flowModule.skip_if = undefined
-				} else {
-					flowModule.skip_if = {
-						expr: 'false'
-					}
+<div class="w-full">
+	<PropPickerWrapper
+		sidePane
+		flow_input={stepPropPicker.pickableProperties.flow_input}
+		notSelectable
+		{result}
+		pickableProperties={stepPropPicker.pickableProperties}
+		on:select={({ detail }) => {
+			editor?.insertAtCursor(detail)
+			editor?.focus()
+		}}
+	>
+		<InputTransformForm
+			bind:arg={
+				() => flowModule.skip_if,
+				(v) => {
+					flowModule.skip_if = v
 				}
-			}}
-			options={{
-				right: 'Skip step if condition is met'
-			}}
+			}
+			argName="skip_if"
+			argType="javascript"
+			collapsed={!isSkipEnabled}
+			animateAppear
+			header={skipToggle}
+			noDynamicToggle
+			{schema}
+			previousModuleId={previousModule?.id}
+			pickableProperties={stepPropPicker.pickableProperties}
+			extraLib={`declare const result = ${JSON.stringify(result)};\n` + stepPropPicker.extraLib}
+			bind:editor
 		/>
-
-		<div
-			class="w-full border rounded-md p-2 mt-2 flex flex-col gap-1 {flowModule.skip_if
-				? ''
-				: 'bg-surface-secondary'}"
-		>
-			{#if flowModule.skip_if}
-				<span class="mt-2 text-xs font-bold">Skip condition expression</span>
-				<div class="border rounded-md w-full overflow-auto">
-					<PropPickerWrapper
-						noPadding
-						notSelectable
-						pickableProperties={stepPropPicker.pickableProperties}
-						on:select={({ detail }) => {
-							editor?.insertAtCursor(detail)
-							editor?.focus()
-						}}
-					>
-						<SimpleEditor
-							bind:this={editor}
-							lang="javascript"
-							bind:code={flowModule.skip_if.expr}
-							class="h-full"
-							extraLib={stepPropPicker.extraLib}
-						/>
-					</PropPickerWrapper>
-				</div>
-			{:else}
-				<span class="mt-2 text-xs font-bold">Skip condition expression</span>
-				<textarea disabled rows="3" class="min-h-[80px]"></textarea>
-			{/if}
-		</div>
-	</Section>
+	</PropPickerWrapper>
 </div>
diff --git a/frontend/src/lib/components/flows/content/FlowModuleSleep.svelte b/frontend/src/lib/components/flows/content/FlowModuleSleep.svelte
index 92086ccd37..f0645c4854 100644
--- a/frontend/src/lib/components/flows/content/FlowModuleSleep.svelte
+++ b/frontend/src/lib/components/flows/content/FlowModuleSleep.svelte
@@ -2,16 +2,14 @@
 	import InputTransformForm from '$lib/components/InputTransformForm.svelte'
 	import type SimpleEditor from '$lib/components/SimpleEditor.svelte'
 	import Toggle from '$lib/components/Toggle.svelte'
-	import Tooltip from '$lib/components/Tooltip.svelte'
 	import type { FlowModule } from '$lib/gen'
+	import { stepSettingDefaults } from '../flowStepSettings'
 	import { emptySchema } from '$lib/utils'
 	import { getContext } from 'svelte'
 	import PropPickerWrapper from '../propPicker/PropPickerWrapper.svelte'
 	import type { FlowEditorContext } from '../types'
-	import { SecondsInput } from '../../common'
-	import Section from '$lib/components/Section.svelte'
-	import Label from '$lib/components/Label.svelte'
 	import { getStepPropPicker } from '../previousResults'
+	import { slideDynamic } from '$lib/transitions'
 	import { SAME_WORKER_INCOMPATIBLE_MSG } from '../utils.svelte'
 	import { Alert } from '$lib/components/common'
 
@@ -51,66 +49,53 @@
 	let sameWorker = $derived(Boolean(!isAgentTool && flowStore.val.value.same_worker))
 </script>
 
-<Section label="Sleep" class="w-full">
-	{#snippet header()}
-		<Tooltip documentationLink="https://www.windmill.dev/docs/flows/sleep">
-			If defined, at the end of the step, the flow will sleep for a number of seconds before
-			scheduling the next job (if any, no effect if the step is the last one).
-		</Tooltip>
-	{/snippet}
-
+<div class="flex flex-col gap-2">
 	{#if sameWorker}
-		<Alert type="warning" size="xs" title="Disabled by the shared directory" class="mb-4">
+		<Alert type="warning" size="xs" title="Disabled by the shared directory">
 			{SAME_WORKER_INCOMPATIBLE_MSG} Disable `Same Worker` in the flow settings to use a sleep.
 		</Alert>
 	{/if}
-
 	<Toggle
+		size="xs"
+		textClass="text-xs font-normal text-primary"
 		checked={isSleepEnabled}
 		disabled={sameWorker}
-		class="mb-6"
 		on:change={() => {
 			if (isSleepEnabled && flowModule.sleep != undefined) {
 				flowModule.sleep = undefined
 			} else {
-				flowModule.sleep = {
-					type: 'static',
-					value: 0
-				}
+				flowModule.sleep = stepSettingDefaults('sleep')
 			}
 		}}
 		options={{
-			right: 'Sleep after module successful execution'
+			right: 'Sleep after step',
+			rightTooltip:
+				'At the end of the step, the flow sleeps for a number of seconds before scheduling the next job (no effect if the step is the last one).',
+			rightDocumentationLink: 'https://www.windmill.dev/docs/flows/sleep'
 		}}
 	/>
-	<Label label="Sleep for duration">
-		{#if flowModule.sleep && schema.properties['sleep'] && !sameWorker}
-			<div class="border rounded-md overflow-auto">
-				<PropPickerWrapper
-					noFlowPlugConnect={true}
-					flow_input={stepPropPicker.pickableProperties.flow_input}
-					notSelectable
-					{result}
-					displayContext={false}
-					pickableProperties={undefined}
-					on:select={({ detail }) => {
-						editor?.insertAtCursor(detail)
-						editor?.focus()
-					}}
-				>
-					<InputTransformForm
-						bind:arg={flowModule.sleep}
-						argName="sleep"
-						{schema}
-						{previousModuleId}
-						argExtra={{ seconds: true, clearable: false }}
-						bind:editor
-					/>
-				</PropPickerWrapper>
-			</div>
-		{:else}
-			<SecondsInput disabled />
-			<div class="text-secondary text-xs">OR use a dynamic expression</div>
-		{/if}
-	</Label>
-</Section>
+	{#if flowModule.sleep && schema.properties['sleep'] && !sameWorker}
+		<div class="pl-9" transition:slideDynamic>
+			<PropPickerWrapper
+				sidePane
+				flow_input={stepPropPicker.pickableProperties.flow_input}
+				notSelectable
+				{result}
+				pickableProperties={stepPropPicker.pickableProperties}
+				on:select={({ detail }) => {
+					editor?.insertAtCursor(detail)
+					editor?.focus()
+				}}
+			>
+				<InputTransformForm
+					bind:arg={flowModule.sleep}
+					argName="sleep"
+					{schema}
+					{previousModuleId}
+					argExtra={{ seconds: true, clearable: false }}
+					bind:editor
+				/>
+			</PropPickerWrapper>
+		</div>
+	{/if}
+</div>
diff --git a/frontend/src/lib/components/flows/content/FlowModuleSuspend.svelte b/frontend/src/lib/components/flows/content/FlowModuleSuspend.svelte
index 3a9e791d2d..43c65bc482 100644
--- a/frontend/src/lib/components/flows/content/FlowModuleSuspend.svelte
+++ b/frontend/src/lib/components/flows/content/FlowModuleSuspend.svelte
@@ -1,22 +1,23 @@
 <script lang="ts">
 	import Toggle from '$lib/components/Toggle.svelte'
-	import Tooltip from '$lib/components/Tooltip.svelte'
+	import { stepSettingDefaults } from '../flowStepSettings'
 	import InputTransformForm from '$lib/components/InputTransformForm.svelte'
 	import type SimpleEditor from '$lib/components/SimpleEditor.svelte'
 	import { getContext, tick, untrack } from 'svelte'
 
-	import { Alert, Tab, Tabs } from '$lib/components/common'
+	import { Alert, Button, Tab, Tabs } from '$lib/components/common'
 	import { GroupService, type FlowModule } from '$lib/gen'
 	import { emptySchema, emptyString } from '$lib/utils'
 	import { enterpriseLicense, workspaceStore } from '$lib/stores.js'
 	import { SecondsInput } from '../../common'
 	import PropPickerWrapper from '../propPicker/PropPickerWrapper.svelte'
 	import type { FlowEditorContext } from '../types'
-	import Section from '$lib/components/Section.svelte'
 	import Label from '$lib/components/Label.svelte'
 	import SuspendDrawer from './SuspendDrawer.svelte'
 	import EditableSchemaDrawer from '$lib/components/schema/EditableSchemaDrawer.svelte'
-	import AddProperty from '$lib/components/schema/AddProperty.svelte'
+	import SchemaForm from '$lib/components/SchemaForm.svelte'
+	import { Pen, Plus } from 'lucide-svelte'
+	import { slideDynamic } from '$lib/transitions'
 
 	const { selectionManager, flowStateStore, opWorkspace } =
 		getContext<FlowEditorContext>('FlowEditorContext')
@@ -69,153 +70,158 @@
 		}
 	})
 
-	let jsonView: boolean = $state(false)
+	let formEditor: EditableSchemaDrawer | undefined = $state(undefined)
+	// Stands in for the form's schema until the step has one, so the editor can be mounted
+	// (and thus openable) before the first field exists.
+	let draftFormSchema = $state(emptySchema())
+
+	function openFormEditor() {
+		if (flowModule.suspend && !flowModule.suspend.resume_form) {
+			flowModule.suspend.resume_form = { schema: draftFormSchema }
+		}
+		formEditor?.openDrawer()
+	}
 </script>
 
-<Section label="Suspend/Approval/Prompt" class="w-full">
-	{#snippet action()}
-		<SuspendDrawer text="Approval/Prompt helpers" />
-	{/snippet}
-	{#snippet header()}
-		<div class="flex flex-row items-center gap-2">
-			<Tooltip documentationLink="https://www.windmill.dev/docs/flows/flow_approval">
-				If defined, at the end of the step, the flow will be suspended until it receives external
-				requests to be resumed or canceled. This is most useful to implement approval steps but can
-				be used flexibly for other purposes.
-			</Tooltip>
-			<Toggle
-				size="xs"
-				checked={isSuspendEnabled}
-				on:change={() => {
-					if (isSuspendEnabled && flowModule.suspend != undefined) {
-						flowModule.suspend = undefined
-					} else {
-						flowModule.suspend = {
-							required_events: 1,
-							timeout: 1800
-						}
-					}
-				}}
-				options={{
-					right: 'Suspend flow execution until events/approvals received'
-				}}
-			/>
-		</div>
-	{/snippet}
+<div class="flex w-full flex-col gap-2">
+	<Toggle
+		size="xs"
+		textClass="text-xs font-normal text-primary"
+		checked={isSuspendEnabled}
+		on:change={() => {
+			if (isSuspendEnabled && flowModule.suspend != undefined) {
+				flowModule.suspend = undefined
+			} else {
+				flowModule.suspend = stepSettingDefaults('suspend')
+			}
+		}}
+		options={{
+			right: 'Suspend until approval/resume',
+			rightTooltip:
+				'At the end of the step, the flow is suspended until it receives external requests to resume or cancel it. Most useful for approval steps, but can be used flexibly for other purposes.',
+			rightDocumentationLink: 'https://www.windmill.dev/docs/flows/flow_approval'
+		}}
+	/>
 
-	<div class="overflow-x-auto scrollbar-hidden">
-		<Tabs bind:selected={suspendTabSelected}>
-			<Tab value="core" disabled={!isSuspendEnabled} label="Core" />
-			<Tab value="form" disabled={!isSuspendEnabled} label="Form" />
-			<Tab value="permissions" disabled={!isSuspendEnabled} label="Permissions" />
-		</Tabs>
-	</div>
+	{#if isSuspendEnabled}
+		<div class="flex flex-col gap-3 pl-9" transition:slideDynamic>
+			<div class="overflow-x-auto scrollbar-hidden">
+				<Tabs bind:selected={suspendTabSelected}>
+					<Tab value="core" label="Core" />
+					<Tab value="form" label="Form" />
+					<Tab value="permissions" label="Permissions" />
+				</Tabs>
+			</div>
 
-	{#if suspendTabSelected === 'core'}
-		<div class="flex flex-col mt-4 gap-4">
-			<Label label="Number of approvals/events required for resuming flow">
-				{#if flowModule.suspend}
-					<input
-						bind:value={flowModule.suspend.required_events}
-						type="number"
-						min="1"
-						placeholder="1"
-					/>
-				{:else}
-					<input type="number" disabled />
-				{/if}
-			</Label>
-			<Label label="Timeout">
-				{#if flowModule.suspend}
-					<SecondsInput bind:seconds={flowModule.suspend.timeout} />
-				{:else}
-					<SecondsInput disabled />
-				{/if}
-			</Label>
+			{#if suspendTabSelected === 'core'}
+				<div class="flex flex-col gap-3">
+					<Label label="Number of approvals/events required for resuming flow">
+						{#if flowModule.suspend}
+							<input
+								bind:value={flowModule.suspend.required_events}
+								type="number"
+								min="1"
+								placeholder="1"
+							/>
+						{:else}
+							<input type="number" disabled />
+						{/if}
+					</Label>
+					<Label label="Timeout">
+						{#if flowModule.suspend}
+							<SecondsInput bind:seconds={flowModule.suspend.timeout} />
+						{:else}
+							<SecondsInput disabled />
+						{/if}
+					</Label>
 
-			<Toggle
-				options={{
-					right: 'Continue on disapproval/timeout',
-					rightTooltip: `Instead of failing the flow and bubbling up the error, continue to the next step which would allow to put a branchone right after to handle both cases separately. 
+					<Toggle
+						size="xs"
+						textClass="text-xs font-normal text-primary"
+						options={{
+							right: 'Continue on disapproval/timeout',
+							rightTooltip: `Instead of failing the flow and bubbling up the error, continue to the next step which would allow to put a branchone right after to handle both cases separately. 
 						If any disapproval/timeout event is received, the resume payload will be similar to every error result in Windmill, an object containing an "error" field which you can use 
 						to distinguish between approvals and disapproval/timeouts. 
 						
 						We recommend using the expr "resume?.error" to handle null payload values. 
 						To filter timeout, use "resume?.error?.name === "SuspendedTimedOut" 
 						To filter disapproval, use "resume?.error?.name === "SuspendedDisapproved"`
-				}}
-				checked={Boolean(flowModule.suspend?.continue_on_disapprove_timeout)}
-				disabled={!Boolean(flowModule.suspend)}
-				on:change={(e) => {
-					if (flowModule.suspend) {
-						flowModule.suspend.continue_on_disapprove_timeout = e.detail
-					}
-				}}
-			/>
-			{#if Boolean(flowModule.suspend?.continue_on_disapprove_timeout)}
-				<Alert type="info" title="Continue on disapproval/timeout">
-					We recommend using the expr <code>resume?.error</code> to handle null payload values.
-					<br />
-					To filter timeout, use <code>resume?.error?.name === "SuspendedTimedOut"</code>. <br />
-					To filter disapproval, use <code>resume?.error?.name === "SuspendedDisapproved"</code>
-				</Alert>
-			{/if}
-		</div>
-	{:else if suspendTabSelected === 'permissions'}
-		<div class="flex flex-col mt-4 gap-4">
-			{#if emptyString($enterpriseLicense)}
-				<Alert type="warning" title="Editing permissions is only available in enterprise version" />
-			{/if}
-			{#if flowModule.suspend}
-				<div class="flex flex-col gap-2">
-					<Toggle
-						disabled={emptyString($enterpriseLicense)}
-						checked={Boolean(flowModule.suspend.user_auth_required)}
-						options={{
-							right: 'Require approvers to be logged in'
 						}}
+						checked={Boolean(flowModule.suspend?.continue_on_disapprove_timeout)}
+						disabled={!Boolean(flowModule.suspend)}
 						on:change={(e) => {
 							if (flowModule.suspend) {
-								flowModule.suspend.user_auth_required = e.detail
-								if (e.detail && flowModule.suspend?.user_groups_required === undefined) {
-									flowModule.suspend.user_groups_required = {
-										type: 'static',
-										value: []
+								flowModule.suspend.continue_on_disapprove_timeout = e.detail
+							}
+						}}
+					/>
+					{#if Boolean(flowModule.suspend?.continue_on_disapprove_timeout)}
+						<Alert type="info" title="Continue on disapproval/timeout">
+							We recommend using the expr <code>resume?.error</code> to handle null payload values.
+							<br />
+							To filter timeout, use <code>resume?.error?.name === "SuspendedTimedOut"</code>.
+							<br />
+							To filter disapproval, use <code>resume?.error?.name === "SuspendedDisapproved"</code>
+						</Alert>
+					{/if}
+				</div>
+			{:else if suspendTabSelected === 'permissions'}
+				<div class="flex flex-col gap-3">
+					<div class="flex flex-col gap-2">
+						<Toggle
+							size="xs"
+							textClass="text-xs font-normal text-primary"
+							eeOnly
+							disabled={!flowModule.suspend || emptyString($enterpriseLicense)}
+							checked={Boolean(flowModule.suspend?.user_auth_required)}
+							options={{
+								right: 'Require approvers to be logged in'
+							}}
+							on:change={(e) => {
+								if (flowModule.suspend) {
+									flowModule.suspend.user_auth_required = e.detail
+									if (e.detail && flowModule.suspend?.user_groups_required === undefined) {
+										flowModule.suspend.user_groups_required = {
+											type: 'static',
+											value: []
+										}
+									} else if (!e.detail) {
+										flowModule.suspend.user_groups_required = undefined
+										flowModule.suspend.self_approval_disabled = false
 									}
-								} else if (!e.detail) {
-									flowModule.suspend.user_groups_required = undefined
-									flowModule.suspend.self_approval_disabled = false
 								}
-							}
-						}}
-					/>
+							}}
+						/>
 
-					<Toggle
-						options={{
-							right: 'Disable self-approval',
-							rightTooltip: 'The user who triggered the flow will not be allowed to approve it'
-						}}
-						checked={Boolean(flowModule.suspend.self_approval_disabled)}
-						disabled={!Boolean(flowModule.suspend.user_auth_required)}
-						on:change={(e) => {
-							if (flowModule.suspend) {
-								flowModule.suspend.self_approval_disabled = e.detail
-							}
-						}}
-					/>
+						<Toggle
+							size="xs"
+							textClass="text-xs font-normal text-primary"
+							eeOnly
+							options={{
+								right: 'Disable self-approval',
+								rightTooltip: 'The user who triggered the flow will not be allowed to approve it'
+							}}
+							checked={Boolean(flowModule.suspend?.self_approval_disabled)}
+							disabled={!flowModule.suspend || !Boolean(flowModule.suspend?.user_auth_required)}
+							on:change={(e) => {
+								if (flowModule.suspend) {
+									flowModule.suspend.self_approval_disabled = e.detail
+								}
+							}}
+						/>
 
-					<div class="mb-4"></div>
+						<div class="mb-4"></div>
 
-					{#if Boolean(flowModule.suspend.user_auth_required) && allUserGroups.length !== 0 && flowModule.suspend && schema.properties['groups']}
-						<span class="text-xs font-bold"
-							>Require approvers to be members of one of the following user groups (leave empty for
-							any)
-						</span>
-						<div class="border">
+						{#if Boolean(flowModule.suspend?.user_auth_required) && allUserGroups.length !== 0 && flowModule.suspend && schema.properties['groups']}
+							<span class="text-xs font-bold"
+								>Require approvers to be members of one of the following user groups (leave empty
+								for any)
+							</span>
 							<PropPickerWrapper
+								sidePane
+								notSelectable
 								{result}
-								noFlowPlugConnect
-								displayContext={false}
 								pickableProperties={undefined}
 								on:select={({ detail }) => {
 									editor?.insertAtCursor(detail)
@@ -231,75 +237,79 @@
 									bind:editor
 								/>
 							</PropPickerWrapper>
+						{/if}
+					</div>
+				</div>
+			{:else}
+				<div class="flex flex-col gap-4">
+					{#if flowModule?.suspend?.resume_form}
+						<div class="flex justify-end">
+							<Button
+								unifiedSize="xs"
+								variant="default"
+								startIcon={{ icon: Pen }}
+								on:click={openFormEditor}
+							>
+								Edit form
+							</Button>
 						</div>
+						<!-- The approval page renders the form with the same component; here it only
+						     shows what approvers will see, and editing happens in the drawer. -->
+						<div class="rounded-md border p-2">
+							<SchemaForm
+								schema={flowModule.suspend.resume_form.schema}
+								disabled
+								noVariablePicker
+							/>
+						</div>
+					{:else if emptyString($enterpriseLicense)}
+						<Alert type="warning" title="Adding a form to the approval page is an EE feature" />
+					{:else}
+						<Button
+							unifiedSize="md"
+							variant="default"
+							btnClasses="w-full border-dashed"
+							startIcon={{ icon: Plus }}
+							on:click={openFormEditor}
+						>
+							Add a form
+						</Button>
+					{/if}
+
+					<EditableSchemaDrawer
+						bind:this={formEditor}
+						bind:schema={
+							() => flowModule.suspend?.resume_form?.schema ?? draftFormSchema,
+							(v) => {
+								if (flowModule.suspend) {
+									flowModule.suspend.resume_form = { schema: v }
+								}
+							}
+						}
+						drawerOnly
+					/>
+
+					{#if flowModule.suspend?.resume_form}
+						<Toggle
+							textClass="text-xs font-normal text-primary"
+							size="xs"
+							checked={Boolean(flowModule.suspend.hide_cancel)}
+							on:change={(e) => {
+								if (flowModule.suspend) {
+									flowModule.suspend.hide_cancel = e.detail
+								}
+							}}
+							options={{
+								right: 'Hide cancel button on approval page'
+							}}
+						/>
 					{/if}
 				</div>
 			{/if}
-		</div>
-	{:else}
-		<div class="grid grid-cols-4 mt-4 gap-8">
-			<div class="col-span-2">
-				{#if flowModule?.suspend?.resume_form}
-					<EditableSchemaDrawer bind:schema={flowModule.suspend.resume_form.schema} {jsonView} />
-				{:else if emptyString($enterpriseLicense)}
-					<Alert type="warning" title="Adding a form to the approval page is an EE feature" />
-				{:else}
-					<div class="flex flex-col items-end mb-2 w-full">
-						<Toggle
-							checked={false}
-							size="xs"
-							options={{
-								right: 'JSON editor',
-								rightTooltip:
-									'Arguments can be edited either using the wizard, or by editing their JSON Schema.'
-							}}
-							lightMode
-							on:change={() => {
-								if (flowModule.suspend) {
-									flowModule.suspend.resume_form = {
-										schema: emptySchema()
-									}
-								}
-								jsonView = true
-							}}
-						/>
-					</div>
-					<AddProperty
-						on:change={(e) => {
-							jsonView = false
-							if (flowModule.suspend) {
-								flowModule.suspend.resume_form = {
-									schema: e.detail
-								}
-							}
-						}}
-						schema={{}}
-					/>
-				{/if}
-			</div>
-			<div class="col-span-2 flex flex-col gap-4">
-				{#if flowModule.suspend}
-					{#if emptyString($enterpriseLicense)}
-						<Alert type="warning" title="Adding a form to the approval page is an EE feature" />
-					{/if}
 
-					<div class="flex flex-col gap-2">
-						<div class="flex">
-							<SuspendDrawer text="Default args & Dynamic enums help" />
-						</div>
-					</div>
-				{/if}
-				{#if flowModule.suspend}
-					<Toggle
-						bind:checked={flowModule.suspend.hide_cancel}
-						size="xs"
-						options={{
-							right: 'Hide cancel button on approval page'
-						}}
-						disabled={!Boolean(flowModule?.suspend?.resume_form)}
-					/>
-				{/if}
+			<div class="flex justify-end">
+				<SuspendDrawer text="Approval/Prompt helpers" />
 			</div>
 		</div>
 	{/if}
-</Section>
+</div>
diff --git a/frontend/src/lib/components/flows/content/FlowModuleTimeout.svelte b/frontend/src/lib/components/flows/content/FlowModuleTimeout.svelte
index 62a3432995..ae4c614ee2 100644
--- a/frontend/src/lib/components/flows/content/FlowModuleTimeout.svelte
+++ b/frontend/src/lib/components/flows/content/FlowModuleTimeout.svelte
@@ -1,19 +1,17 @@
 <script lang="ts">
 	import InputTransformForm from '$lib/components/InputTransformForm.svelte'
 	import type SimpleEditor from '$lib/components/SimpleEditor.svelte'
-	import Section from '$lib/components/Section.svelte'
 	import Toggle from '$lib/components/Toggle.svelte'
-	import Tooltip from '$lib/components/Tooltip.svelte'
-	import Label from '$lib/components/Label.svelte'
 
 	import type { FlowModule } from '$lib/gen'
-	import { Alert, SecondsInput } from '../../common'
+	import { Alert } from '../../common'
 	import { emptySchema } from '$lib/utils'
 	import { getContext } from 'svelte'
 	import PropPickerWrapper from '$lib/components/flows/propPicker/PropPickerWrapper.svelte'
 	import type { FlowEditorContext } from '../types'
 	import { getStepPropPicker } from '../previousResults'
 	import type { FlowBuilderWhitelabelCustomUi } from '$lib/components/custom_ui'
+	import { slideDynamic } from '$lib/transitions'
 
 	interface Props {
 		flowModule: FlowModule
@@ -56,15 +54,10 @@
 	let istimeoutEnabled = $derived(Boolean(flowModule.timeout))
 </script>
 
-<Section label="Timeout">
-	{#snippet header()}
-		<Tooltip>
-			If defined, the custom timeout will be used instead of the instance timeout for the step. The
-			step's timeout cannot be greater than the instance timeout.
-		</Tooltip>
-	{/snippet}
-
+<div class="flex flex-col gap-2">
 	<Toggle
+		size="xs"
+		textClass="text-xs font-normal text-primary"
 		checked={istimeoutEnabled}
 		on:change={() => {
 			if (istimeoutEnabled && flowModule.timeout != undefined) {
@@ -77,39 +70,37 @@
 			}
 		}}
 		options={{
-			right: 'Add a custom timeout for this step'
+			right: 'Custom timeout',
+			rightTooltip:
+				"The custom timeout is used instead of the instance timeout for the step. The step's timeout cannot be greater than the instance timeout."
 		}}
 	/>
-	<Label label="Timeout duration" class="mt-2">
-		{#if flowModule.timeout && schema.properties['timeout']}
-			<div class="border">
-				<PropPickerWrapper
-					flow_input={stepPropPicker.pickableProperties.flow_input}
-					notSelectable
-					pickableProperties={stepPropPicker.pickableProperties}
-					on:select={({ detail }) => {
-						editor?.insertAtCursor(detail)
-						editor?.focus()
-					}}
-				>
-					<InputTransformForm
-						bind:arg={flowModule.timeout}
-						argName="timeout"
-						{schema}
-						{previousModuleId}
-						argExtra={{ seconds: true }}
-						bind:editor
-					/>
-				</PropPickerWrapper>
-			</div>
-		{:else}
-			<SecondsInput disabled />
-			<div class="text-secondary text-sm">OR use a dynamic expression</div>
-		{/if}
-	</Label>
+	{#if flowModule.timeout && schema.properties['timeout']}
+		<div class="pl-9" transition:slideDynamic>
+			<PropPickerWrapper
+				sidePane
+				flow_input={stepPropPicker.pickableProperties.flow_input}
+				notSelectable
+				pickableProperties={stepPropPicker.pickableProperties}
+				on:select={({ detail }) => {
+					editor?.insertAtCursor(detail)
+					editor?.focus()
+				}}
+			>
+				<InputTransformForm
+					bind:arg={flowModule.timeout}
+					argName="timeout"
+					{schema}
+					{previousModuleId}
+					argExtra={{ seconds: true }}
+					bind:editor
+				/>
+			</PropPickerWrapper>
+		</div>
+	{/if}
 
 	{#if flowModule.timeout && flowModule.timeout.type !== 'static'}
-		<div class="mt-4">
+		<div class="mt-4 pl-9" transition:slideDynamic>
 			<Alert title="Dynamic timeout only used when testing the full flow" type="info">
 				<p class="text-xs">
 					A dynamic timeout expression is evaluated when running the full flow. It is ignored when
@@ -118,4 +109,4 @@
 			</Alert>
 		</div>
 	{/if}
-</Section>
+</div>
diff --git a/frontend/src/lib/components/flows/content/FlowModuleWrapper.svelte b/frontend/src/lib/components/flows/content/FlowModuleWrapper.svelte
index 0cae21b630..6f832902d0 100644
--- a/frontend/src/lib/components/flows/content/FlowModuleWrapper.svelte
+++ b/frontend/src/lib/components/flows/content/FlowModuleWrapper.svelte
@@ -1,8 +1,11 @@
 <script lang="ts">
+	import { moduleSlot, savedModuleById } from '../moduleSlot'
 	import FlowModuleWrapper from './FlowModuleWrapper.svelte'
 	import { type FlowModule } from '$lib/gen'
 	import { getContext } from 'svelte'
 
+	import { stepSettingDefaults } from '$lib/components/flows/flowStepSettings'
+	import { emptyString } from '$lib/utils'
 	import type { FlowEditorContext } from '../types'
 	import FlowLoop from './FlowLoop.svelte'
 	import FlowModuleComponent from './FlowModuleComponent.svelte'
@@ -19,6 +22,7 @@
 	import FlowBranchesAllWrapper from './FlowBranchesAllWrapper.svelte'
 	import FlowBranchesOneWrapper from './FlowBranchesOneWrapper.svelte'
 	import FlowWhileLoop from './FlowWhileLoop.svelte'
+	import FlowCard from '../common/FlowCard.svelte'
 	import type { TriggerContext } from '$lib/components/triggers'
 	import { formatCron } from '$lib/utils'
 	import AgentToolWrapper from './AgentToolWrapper.svelte'
@@ -88,10 +92,7 @@
 			}
 		}
 
-		module.stop_after_if = {
-			expr: 'result == undefined || Array.isArray(result) && result.length == 0',
-			skip_if_stopped: true
-		}
+		module.stop_after_if = stepSettingDefaults('early-stop', 'trigger')
 	}
 	async function createModuleFromScript(
 		path: string,
@@ -109,7 +110,7 @@
 		)
 
 		if (kind == 'approval') {
-			module.suspend = { required_events: 1, timeout: 1800 }
+			module.suspend = stepSettingDefaults('suspend')
 		}
 
 		if (kind == 'trigger') {
@@ -127,7 +128,7 @@
 	{:else if flowModule.value.type === 'whileloopflow'}
 		<FlowWhileLoop {noEditor} bind:mod={flowModule} {previousModule} {parentModule} />
 	{:else if flowModule.value.type === 'branchone'}
-		<FlowBranchesOneWrapper {noEditor} {previousModule} {parentModule} bind:flowModule {enableAi} />
+		<FlowBranchesOneWrapper {noEditor} {previousModule} {parentModule} {enableAi} bind:flowModule />
 	{:else if flowModule.value.type === 'branchall'}
 		<FlowBranchesAllWrapper {noEditor} {previousModule} {parentModule} bind:flowModule />
 	{:else if flowModule.value.type === 'identity'}
@@ -169,7 +170,14 @@
 					selectedId == 'preprocessor'}
 				on:pick={async ({ detail }) => {
 					const { path, summary, kind, hash } = detail
-					createModuleFromScript(path, summary, kind, hash)
+					// The picked script's summary is a default: anything already typed on the step
+					// was the user's choice and outranks it.
+					createModuleFromScript(
+						path,
+						emptyString(flowModule.summary) ? summary : flowModule.summary,
+						kind,
+						hash
+					)
 				}}
 				on:new={async ({ detail }) => {
 					const { language, kind, subkind, summary } = detail
@@ -189,7 +197,7 @@
 					}
 
 					if (kind == 'approval') {
-						module.suspend = { required_events: 1, timeout: 1800 }
+						module.suspend = stepSettingDefaults('suspend')
 					}
 
 					flowModule = module
@@ -217,16 +225,18 @@
 		/>
 	{/if}
 {:else if flowModule.value.type === 'forloopflow' || flowModule.value.type == 'whileloopflow'}
-	{#each flowModule.value.modules as _, index (index)}
+	{#each flowModule.value.modules as child, index (child.id ?? index)}
+		{@const slot = moduleSlot(
+			() => (flowModule.value as { modules: FlowModule[] }).modules,
+			child.id,
+			child
+		)}
 		<FlowModuleWrapper
 			{noEditor}
-			bind:flowModule={flowModule.value.modules[index]}
+			bind:flowModule={slot.get, slot.set}
 			bind:parentModule={flowModule}
 			previousModule={flowModule.value.modules[index - 1]}
-			savedModule={savedModule?.value.type === 'forloopflow' ||
-			savedModule?.value.type === 'whileloopflow'
-				? savedModule.value.modules[index]
-				: undefined}
+			savedModule={savedModuleById(savedModule, child.id)}
 			{enableAi}
 			{forceTestTab}
 			{highlightArg}
@@ -234,45 +244,52 @@
 	{/each}
 {:else if flowModule.value.type === 'branchone'}
 	{#if selectedId === `${flowModule?.id}-branch-default`}
-		<div class="p-2">
-			<h3 class="mb-4">Default branch</h3>
-			Nothing to configure, this is the default branch if none of the predicates are met.
+		<div class="h-full flex flex-col">
+			<FlowCard {noEditor} title="Default branch">
+				<div class="p-4">
+					<p class="text-xs text-tertiary">
+						Nothing to configure — this branch runs when none of the predicates match.
+					</p>
+				</div>
+			</FlowCard>
 		</div>
 	{:else}
-		{#each flowModule.value.default as _, index}
+		{#each flowModule.value.default as child, index (child.id ?? index)}
+			{@const slot = moduleSlot(
+				() => (flowModule.value as { default: FlowModule[] }).default,
+				child.id,
+				child
+			)}
 			<FlowModuleWrapper
 				{noEditor}
-				bind:flowModule={flowModule.value.default[index]}
+				bind:flowModule={slot.get, slot.set}
 				bind:parentModule={flowModule}
 				previousModule={flowModule.value.default[index - 1]}
-				savedModule={savedModule?.value.type === 'branchone'
-					? savedModule.value.default[index]
-					: undefined}
+				savedModule={savedModuleById(savedModule, child.id)}
 				{enableAi}
 				{forceTestTab}
 				{highlightArg}
 			/>
 		{/each}
 	{/if}
-	{#each flowModule.value.branches as branch, branchIndex (branchIndex)}
+	{#each flowModule.value.branches as branch, branchIndex (branch)}
 		{#if selectedId === `${flowModule?.id}-branch-${branchIndex}`}
 			<FlowBranchOneWrapper
 				{noEditor}
-				bind:branch={flowModule.value.branches[branchIndex]}
+				{branch}
 				parentModule={flowModule}
 				{previousModule}
 				{enableAi}
 			/>
 		{:else}
-			{#each branch.modules as _, index}
+			{#each branch.modules as child, index (child.id ?? index)}
+				{@const slot = moduleSlot(() => branch.modules, child.id, child)}
 				<FlowModuleWrapper
 					{noEditor}
-					bind:flowModule={flowModule.value.branches[branchIndex].modules[index]}
+					bind:flowModule={slot.get, slot.set}
 					bind:parentModule={flowModule}
 					previousModule={flowModule.value.branches[branchIndex].modules[index - 1]}
-					savedModule={savedModule?.value.type === 'branchone'
-						? savedModule.value.branches[branchIndex]?.modules[index]
-						: undefined}
+					savedModule={savedModuleById(savedModule, child.id)}
 					{enableAi}
 					{forceTestTab}
 					{highlightArg}
@@ -281,20 +298,19 @@
 		{/if}
 	{/each}
 {:else if flowModule.value.type === 'branchall'}
-	{#each flowModule.value.branches as branch, branchIndex (branchIndex)}
+	{#each flowModule.value.branches as branch, branchIndex (branch)}
 		{#if selectedId === `${flowModule?.id}-branch-${branchIndex}`}
-			<FlowBranchAllWrapper {noEditor} bind:branch={flowModule.value.branches[branchIndex]} />
+			<FlowBranchAllWrapper {noEditor} {branch} />
 		{:else}
-			{#each branch.modules as _, index}
+			{#each branch.modules as child, index (child.id ?? index)}
+				{@const slot = moduleSlot(() => branch.modules, child.id, child)}
 				<FlowModuleWrapper
 					{noEditor}
-					bind:flowModule={flowModule.value.branches[branchIndex].modules[index]}
+					bind:flowModule={slot.get, slot.set}
 					bind:parentModule={flowModule}
 					previousModule={flowModule.value.branches[branchIndex].modules[index - 1]}
 					{enableAi}
-					savedModule={savedModule?.value.type === 'branchall'
-						? savedModule.value.branches[branchIndex]?.modules[index]
-						: undefined}
+					savedModule={savedModuleById(savedModule, child.id)}
 					{forceTestTab}
 					{highlightArg}
 				/>
diff --git a/frontend/src/lib/components/flows/content/FlowResult.svelte b/frontend/src/lib/components/flows/content/FlowResult.svelte
index 70d783895d..d9b140f09b 100644
--- a/frontend/src/lib/components/flows/content/FlowResult.svelte
+++ b/frontend/src/lib/components/flows/content/FlowResult.svelte
@@ -1,9 +1,6 @@
 <script lang="ts">
 	import FlowExecutionStatus from '$lib/components/runs/FlowExecutionStatus.svelte'
 	import type { Job } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
-	import { getContext } from 'svelte'
-	import type { FlowEditorContext } from '../types'
 	import FlowCard from '../common/FlowCard.svelte'
 	import Button from '$lib/components/common/button/Button.svelte'
 	import type { StateStore } from '$lib/utils'
@@ -20,9 +17,6 @@
 	}
 
 	let { job, isOwner, suspendStatus, noEditor, onOpenDetails }: Props = $props()
-
-	const flowEditorContext = getContext<FlowEditorContext>('FlowEditorContext')
-	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $workspaceStore)
 </script>
 
 <FlowCard {noEditor} title="Flow result">
@@ -44,7 +38,6 @@
 			{#if isOwner !== undefined && suspendStatus}
 				<FlowExecutionStatus
 					{job}
-					workspaceId={opWs}
 					{isOwner}
 					innerModules={job?.flow_status?.modules}
 					{suspendStatus}
diff --git a/frontend/src/lib/components/flows/content/FlowRetries.svelte b/frontend/src/lib/components/flows/content/FlowRetries.svelte
index 7560b49e3f..b23eec2d5c 100644
--- a/frontend/src/lib/components/flows/content/FlowRetries.svelte
+++ b/frontend/src/lib/components/flows/content/FlowRetries.svelte
@@ -7,14 +7,15 @@
 	import { untrack, getContext } from 'svelte'
 	import Toggle from '$lib/components/Toggle.svelte'
 	import SimpleEditor from '$lib/components/SimpleEditor.svelte'
-	import PropPickerWrapper from '$lib/components/flows/propPicker/PropPickerWrapper.svelte'
-	import Tooltip from '$lib/components/Tooltip.svelte'
-	import Section from '$lib/components/Section.svelte'
+	import InputTransformForm from '$lib/components/InputTransformForm.svelte'
+	import PropPickerWrapper from '../propPicker/PropPickerWrapper.svelte'
+	import { emptySchema } from '$lib/utils'
 	import type { FlowEditorContext } from '../types'
 	import { getStepPropPicker } from '../previousResults'
 	import { NEVER_TESTED_THIS_FAR } from '../models'
 	import { validateRetryConfig } from '$lib/utils'
 	import EEOnly from '$lib/components/EEOnly.svelte'
+	import { slideDynamic } from '$lib/transitions'
 	import Alert from '$lib/components/common/alert/Alert.svelte'
 	import { SAME_WORKER_INCOMPATIBLE_MSG } from '../utils.svelte'
 
@@ -40,9 +41,14 @@
 	}
 
 	let delayType = $state() as 'disabled' | 'constant' | 'exponential' | undefined
+	let retryIfEditor: SimpleEditor | undefined = $state(undefined)
+
+	// `retry_if` is stored as a bare `{ expr }`, so the form is told its kind through
+	// `argType` rather than inferring one from the value.
+	let predicateSchema = $state(emptySchema())
+	predicateSchema.properties['retry_if'] = { type: 'boolean' }
 	let loaded = $state(false)
 
-	let editor: SimpleEditor | undefined = $state(undefined)
 	let stepPropPicker = $derived(
 		flowModule && flowStateStore?.val && flowStore?.val && previewArgs?.val
 			? getStepPropPicker(
@@ -66,6 +72,58 @@
 	let isDisabled = $derived(disabled || sameWorker)
 
 	let isRetryConditionEnabled = $derived(Boolean(flowModuleRetry?.retry_if))
+	// When retries are toggled off the config is still shown (read-only) so the row
+	// isn't empty: fall back to sensible defaults and force the "constant" tab.
+	let retriesOff = $derived(!(delayType === 'constant' || delayType === 'exponential'))
+	let displayDelayType = $derived(delayType === 'exponential' ? 'exponential' : 'constant')
+	// The shown branch's config must actually exist, or its inputs would bind to the
+	// display fallback below and silently discard every keystroke.
+	let shownBranchMissing = $derived(
+		displayDelayType === 'constant' ? !flowModuleRetry?.constant : !flowModuleRetry?.exponential
+	)
+	let cfgDisabled = $derived(disabled || retriesOff || shownBranchMissing)
+	// The kind selector never takes `shownBranchMissing`: switching kind is how the user
+	// reseeds a branch, so disabling it there would strand them with no way back.
+	let kindDisabled = $derived(disabled || retriesOff)
+
+	// An external rewrite (AI chat, a session edit) can swap the retry kind under a mounted
+	// row. Follow it, or the row would disable itself over a config that is perfectly valid.
+	$effect(() => {
+		const r = flowModuleRetry
+		if (!r) return
+		untrack(() => {
+			if (delayType === 'constant' && !r.constant && r.exponential) {
+				delayType = 'exponential'
+			} else if (delayType === 'exponential' && !r.exponential && r.constant) {
+				delayType = 'constant'
+			} else if (delayType === 'disabled' && (r.constant || r.exponential)) {
+				// Retries added from outside: without this the row keeps reading "off" while
+				// rendering the incoming values greyed out, and toggling on would overwrite them.
+				delayType = r.constant ? 'constant' : 'exponential'
+			}
+		})
+	})
+	let displayRetry = $derived(
+		flowModuleRetry ?? {
+			constant: { attempts: 1, seconds: 5 },
+			exponential: { attempts: 1, multiplier: 1, seconds: 5, random_factor: 0 }
+		}
+	)
+	// Always-defined sub-configs so the read-only off-state can bind without
+	// undefined checks; when the real config exists these are the same refs.
+	let displayConstant = $derived(displayRetry.constant ?? { attempts: 1, seconds: 5 })
+	let displayExponential = $derived(
+		displayRetry.exponential ?? { attempts: 1, multiplier: 1, seconds: 5, random_factor: 0 }
+	)
+	// Only feed the preview the branch that's actually shown, so the off-state
+	// defaults don't render a bogus combined schedule.
+	let previewRetry = $derived(
+		retriesOff
+			? displayDelayType === 'constant'
+				? { constant: displayRetry.constant }
+				: { exponential: displayRetry.exponential }
+			: flowModuleRetry
+	)
 	let result = $derived(
 		flowModule && flowStateStore?.val
 			? (flowStateStore.val[flowModule.id]?.previewResult ?? NEVER_TESTED_THIS_FAR)
@@ -99,10 +157,12 @@
 	}
 
 	function initialLoad() {
+		// Presence, not attempts > 0: a retry block with zero attempts is still
+		// configured, and flowStepSettings describes it that way.
 		delayType =
-			(flowModuleRetry?.constant?.attempts ?? 0) > 0
+			flowModuleRetry?.constant != undefined
 				? 'constant'
-				: (flowModuleRetry?.exponential?.attempts ?? 0) > 0
+				: flowModuleRetry?.exponential != undefined
 					? 'exponential'
 					: 'disabled'
 		loaded = true
@@ -122,258 +182,288 @@
 	const u32Max = 4294967295
 </script>
 
-<div class="flex flex-col gap-4">
+<div class="flex flex-col gap-2">
 	{#if sameWorker}
 		<Alert type="warning" size="xs" title="Disabled by the shared directory">
 			{SAME_WORKER_INCOMPATIBLE_MSG} Disable `Same Worker` in the flow settings to use retries.
 		</Alert>
 	{/if}
-
-	<ToggleButtonGroup
-		bind:selected={delayType}
+	<Toggle
+		size="xs"
+		textClass="text-xs font-normal text-primary"
 		disabled={isDisabled}
-		on:selected={(e) => {
-			flowModuleRetry = undefined
-			if (e.detail === 'constant') {
+		checked={delayType === 'constant' || delayType === 'exponential'}
+		on:change={() => {
+			if (delayType === 'constant' || delayType === 'exponential') {
 				flowModuleRetry = undefined
+				delayType = 'disabled'
+			} else {
 				setConstantRetries()
-			} else if (e.detail === 'exponential') {
-				flowModuleRetry = undefined
-				setExponentialRetries()
+				delayType = 'constant'
 			}
 		}}
-	>
-		{#snippet children({ item })}
-			<ToggleButton value="disabled" label="Disabled" {item} />
-			<ToggleButton value="constant" label="Constant" {item} />
-			<ToggleButton value="exponential" label="Exponential" {item} />
-		{/snippet}
-	</ToggleButtonGroup>
+		options={{
+			right: 'Retry on failure',
+			rightTooltip:
+				'Upon error this step is retried with a delay and a maximum number of attempts as defined below.',
+			rightDocumentationLink: 'https://www.windmill.dev/docs/flows/retries'
+		}}
+	/>
 
-	{#if (delayType === 'constant' || delayType === 'exponential') && !sameWorker}
-		<Section label="Retry Condition" class="w-full">
-			{#snippet header()}
-				<Tooltip>
-					Optional condition to determine when to retry. If not specified, will retry on any failure
-					within the configured attempt limits.
-				</Tooltip>
-			{/snippet}
-
-			<Toggle
-				checked={isRetryConditionEnabled}
-				on:change={() => {
-					if (!flowModuleRetry) {
-						return
+	{#if !retriesOff && !sameWorker}
+		<div class="flex flex-col gap-6 pl-9" transition:slideDynamic>
+			<ToggleButtonGroup
+				selected={retriesOff ? displayDelayType : delayType}
+				disabled={kindDisabled}
+				class={`${kindDisabled ? 'disabled' : ''}`}
+				on:selected={(e) => {
+					flowModuleRetry = undefined
+					if (e.detail === 'constant') {
+						setConstantRetries()
+						delayType = 'constant'
+					} else if (e.detail === 'exponential') {
+						setExponentialRetries()
+						delayType = 'exponential'
 					}
-					if (isRetryConditionEnabled && flowModuleRetry.retry_if) {
-						const { retry_if, ...rest } = flowModuleRetry
-						flowModuleRetry = rest
-					} else {
-						flowModuleRetry = {
-							...flowModuleRetry,
-							retry_if: {
-								expr: 'error && error.name !== "PERMANENT_FAILURE"'
+				}}
+			>
+				{#snippet children({ item })}
+					<ToggleButton value="constant" label="Constant" {item} />
+					<ToggleButton value="exponential" label="Exponential" {item} />
+				{/snippet}
+			</ToggleButtonGroup>
+
+			{#snippet retryConditionToggle()}
+				<Toggle
+					size="xs"
+					textClass="text-xs font-normal text-primary"
+					disabled={cfgDisabled}
+					checked={isRetryConditionEnabled}
+					on:change={() => {
+						if (!flowModuleRetry) {
+							return
+						}
+						if (isRetryConditionEnabled && flowModuleRetry.retry_if) {
+							const { retry_if, ...rest } = flowModuleRetry
+							flowModuleRetry = rest
+						} else {
+							flowModuleRetry = {
+								...flowModuleRetry,
+								retry_if: {
+									expr: 'error && error.name !== "PERMANENT_FAILURE"'
+								}
 							}
 						}
-					}
-				}}
-				options={{
-					right: 'Only retry if condition is met'
-				}}
-			/>
+					}}
+					options={{
+						right: 'Conditional retry',
+						rightTooltip:
+							'Optional condition to determine when to retry. Expression should return true to retry, false to skip retry. If not specified, retries on any failure within the configured attempt limits.'
+					}}
+				/>
+			{/snippet}
 
-			<div
-				class="w-full border rounded-md p-2 mt-2 flex flex-col {flowModuleRetry?.retry_if
-					? ''
-					: 'bg-surface-secondary'}"
-			>
-				{#if flowModuleRetry?.retry_if}
-					<span class="mt-2 text-xs font-bold">Retry condition expression</span>
-					<span class="text-xs text-primary mb-2"
-						>Expression should return true to retry, false to skip retry</span
-					>
-					<div class="border rounded-md overflow-auto w-full">
-						{#if stepPropPicker}
-							<PropPickerWrapper
-								noPadding
-								notSelectable
-								pickableProperties={stepPropPicker.pickableProperties}
-								{result}
-								on:select={({ detail }) => {
-									editor?.insertAtCursor(detail)
-									editor?.focus()
-								}}
-							>
-								<SimpleEditor
-									bind:this={editor}
-									lang="javascript"
-									bind:code={flowModuleRetry.retry_if.expr}
-									class="h-full"
-									extraLib={`declare const result = ${JSON.stringify(result)};` +
-										`\ndeclare const flow_input = ${JSON.stringify(stepPropPicker.pickableProperties.flow_input || {})};`}
-								/>
-							</PropPickerWrapper>
-						{:else}
+			{#if stepPropPicker}
+				<PropPickerWrapper
+					sidePane
+					flow_input={stepPropPicker.pickableProperties.flow_input}
+					notSelectable
+					{result}
+					pickableProperties={stepPropPicker.pickableProperties}
+					on:select={({ detail }) => {
+						retryIfEditor?.insertAtCursor(detail)
+						retryIfEditor?.focus()
+					}}
+				>
+					<InputTransformForm
+						bind:arg={
+							() => flowModuleRetry?.retry_if,
+							(v) => {
+								if (flowModuleRetry) flowModuleRetry.retry_if = v
+							}
+						}
+						argName="retry_if"
+						argType="javascript"
+						collapsed={!isRetryConditionEnabled}
+						animateAppear
+						header={retryConditionToggle}
+						noDynamicToggle
+						schema={predicateSchema}
+						previousModuleId={undefined}
+						pickableProperties={stepPropPicker.pickableProperties}
+						extraLib={`declare const result = ${JSON.stringify(result)};` +
+							`\ndeclare const flow_input = ${JSON.stringify(stepPropPicker.pickableProperties.flow_input || {})};`}
+						bind:editor={retryIfEditor}
+					/>
+				</PropPickerWrapper>
+			{:else}
+				<div class="flex flex-col gap-2">
+					{@render retryConditionToggle()}
+					{#if flowModuleRetry?.retry_if}
+						<div class="border rounded-md overflow-auto w-full">
 							<SimpleEditor
-								bind:this={editor}
 								lang="javascript"
 								bind:code={flowModuleRetry.retry_if.expr}
 								class="few-lines-editor"
 								extraLib={`declare const result = ${JSON.stringify(result)};`}
 							/>
-						{/if}
-					</div>
-				{:else}
-					<span class="mt-2 text-xs font-bold">Retry condition expression</span>
-					<span class="text-xs text-primary mb-2"
-						>Expression should return true to retry, false to skip retry</span
-					>
-					<textarea disabled rows="3" class="min-h-[80px]"></textarea>
-				{/if}
-			</div>
-		</Section>
-	{/if}
+						</div>
+					{/if}
+				</div>
+			{/if}
 
-	{#if (delayType === 'constant' || delayType === 'exponential') && !sameWorker}
-	<div class="flex h-[calc(100%-22px)]">
-		<div class="w-1/2 h-full overflow-auto pr-2">
-			{#if delayType === 'constant'}
-				{#if flowModuleRetry?.constant}
-					<div class="text-xs font-bold !mt-2">Attempts</div>
-					<div class="flex gap-1">
+			<div class="flex h-[calc(100%-22px)]">
+				<div class="w-1/2 h-full overflow-auto pr-2">
+					{#if displayDelayType === 'constant'}
+						<div class="text-xs font-bold !mt-2">Attempts</div>
+						<div class="flex gap-1">
+							<input
+								max={u32Max.toString()}
+								disabled={cfgDisabled}
+								bind:value={displayConstant.attempts}
+								type="number"
+							/>
+							<button
+								class="text-xs"
+								disabled={cfgDisabled}
+								onclick={() =>
+									flowModuleRetry?.constant && (flowModuleRetry.constant.attempts = u32Max)}
+								>max</button
+							>
+						</div>
+						<div class="text-xs font-bold !mt-4">Delay</div>
+						<SecondsInput disabled={cfgDisabled} bind:seconds={displayConstant.seconds} />
+					{:else if displayDelayType === 'exponential'}
+						<div class="text-xs font-bold !mt-2">Attempts</div>
+						<div class="flex gap-1">
+							<input
+								max="100"
+								disabled={cfgDisabled}
+								bind:value={displayExponential.attempts}
+								type="number"
+							/>
+							<button
+								class="text-xs"
+								disabled={cfgDisabled}
+								onclick={() =>
+									flowModuleRetry?.exponential && (flowModuleRetry.exponential.attempts = 100)}
+								>max</button
+							>
+						</div>
+						<div class="text-xs font-bold !mt-2">Multiplier</div>
+						<span class="text-xs text-primary">delay = multiplier * base ^ (number of attempt)</span
+						>
 						<input
-							max={u32Max.toString()}
-							bind:value={flowModuleRetry.constant.attempts}
+							disabled={cfgDisabled}
+							bind:value={displayExponential.multiplier}
 							type="number"
 						/>
-						<button
-							class="text-xs"
-							onclick={() =>
-								flowModuleRetry?.constant && (flowModuleRetry.constant.attempts = u32Max)}
-							>max</button
-						>
-					</div>
-					<div class="text-xs font-bold !mt-4">Delay</div>
-					<SecondsInput bind:seconds={flowModuleRetry.constant.seconds} />
-				{/if}
-			{:else if delayType === 'exponential'}
-				{#if flowModuleRetry?.exponential}
-					<div class="text-xs font-bold !mt-2">Attempts</div>
-					<div class="flex gap-1">
-						<input max="100" bind:value={flowModuleRetry.exponential.attempts} type="number" />
-						<button
-							class="text-xs"
-							onclick={() =>
-								flowModuleRetry?.exponential && (flowModuleRetry.exponential.attempts = 100)}
-							>max</button
-						>
-					</div>
-					<div class="text-xs font-bold !mt-2">Multiplier</div>
-					<span class="text-xs text-primary">delay = multiplier * base ^ (number of attempt)</span>
-					<input bind:value={flowModuleRetry.exponential.multiplier} type="number" />
-					<div class="text-xs font-bold !mt-2">Base (in seconds)</div>
-					<input
-						bind:value={flowModuleRetry.exponential.seconds}
-						type="number"
-						step="1"
-						min="0"
-						class={validationError ? 'border-red-500' : ''}
-					/>
-					{#if validationError}
-						<span class="text-xs text-red-500">{validationError}</span>
-					{:else}
-						<span class="text-xs text-tertiary"
-							>Must be ≥ 1. A base of 0 would cause immediate retries.</span
-						>
-					{/if}
-					<div class="text-xs font-bold !mt-2">Randomization factor (percentage)</div>
-					<div class="flex w-full gap-4">
-						{#if !$enterpriseLicense}
-							<EEOnly />
-						{/if}
+						<div class="text-xs font-bold !mt-2">Base (in seconds)</div>
 						<input
-							disabled={!$enterpriseLicense}
-							type="range"
-							min={0}
-							max={100}
-							step={5}
-							bind:value={flowModuleRetry.exponential.random_factor}
+							disabled={cfgDisabled}
+							bind:value={displayExponential.seconds}
+							type="number"
+							step="1"
+							min="0"
+							class={validationError ? 'border-red-500' : ''}
 						/>
-						<div class="w-20">
+						{#if validationError}
+							<span class="text-xs text-red-500">{validationError}</span>
+						{:else}
+							<span class="text-xs text-tertiary"
+								>Must be ≥ 1. A base of 0 would cause immediate retries.</span
+							>
+						{/if}
+						<div class="text-xs font-bold !mt-2">Randomization factor (percentage)</div>
+						<div class="flex w-full gap-4">
+							{#if !$enterpriseLicense}
+								<EEOnly />
+							{/if}
 							<input
-								disabled={true}
-								bind:value={flowModuleRetry.exponential.random_factor}
-								type="number"
-								step={5}
+								disabled={cfgDisabled || !$enterpriseLicense}
+								type="range"
 								min={0}
 								max={100}
+								step={5}
+								bind:value={displayExponential.random_factor}
 							/>
+							<div class="w-20">
+								<input
+									disabled={true}
+									bind:value={displayExponential.random_factor}
+									type="number"
+									step={5}
+									min={0}
+									max={100}
+								/>
+							</div>
 						</div>
-					</div>
-				{/if}
-			{/if}
-		</div>
-		<div class="w-1/2 h-full overflow-auto pl-2">
-			{#if true}
-			{@const { attempts: cAttempts, seconds: cSeconds } = flowModuleRetry?.constant || {}}
-			{@const {
-				attempts: eAttempts,
-				seconds: eSeconds,
-				multiplier,
-				random_factor
-			} = flowModuleRetry?.exponential || {}}
-			{@const cArray = Array.from({ length: Math.min(cAttempts || 0, 100) }, () => cSeconds)}
-			{@const eArray = Array.from(
-				{ length: Math.min(eAttempts || 0, 100) },
-				(_, i) => (multiplier || 0) * (eSeconds || 0) ** (i + cArray.length + 1)
-			)}
-			{@const array = [...cArray, ...eArray]}
-			<div class="bg-surface-secondary border rounded px-4 py-2">
-				<div class="text-xs font-medium mb-2">Retry attempts</div>
-				{#if array.length > 0}
-					<table class="text-xs">
-						<thead>
-							<tr>
-								<td class="font-semibold pr-1 pb-1">1:</td>
-								<td class="pb-1"
-									>After {array[0]} second{array[0] === 1 ? '' : 's'}
-									{#if (random_factor ?? 0) > 0}(+/- {((array[0] ?? 0) * (random_factor ?? 0)) /
-											100}
-										seconds){/if}</td
-								>
-							</tr>
-						</thead>
-						<tbody>
-							{#each array.slice(1, 100) as delay, i}
-								{@const index = i + 2}
-								<tr>
-									<td class="font-semibold pr-1 align-top">{index}:</td>
-									<td class="pb-1 whitespace-nowrap">
-										{delay} second{delay === 1 ? '' : 's'}
-										{#if (random_factor ?? 0) > 0}(+/- {((delay ?? 0) * (random_factor ?? 0)) /
-												100}
-											seconds){/if}
-										after attempt #{index - 1}
-										{#if i > cArray.length - 2}
-											<span class="text-gray-400 pl-2">
-												({multiplier} * {eSeconds}<sup>{index}</sup>)
-											</span>
+					{/if}
+				</div>
+				<div class="w-1/2 h-full overflow-auto pl-2">
+					{#if true}
+						{@const { attempts: cAttempts, seconds: cSeconds } = previewRetry?.constant || {}}
+						{@const {
+							attempts: eAttempts,
+							seconds: eSeconds,
+							multiplier,
+							random_factor
+						} = previewRetry?.exponential || {}}
+						{@const cArray = Array.from({ length: Math.min(cAttempts || 0, 100) }, () => cSeconds)}
+						{@const eArray = Array.from(
+							{ length: Math.min(eAttempts || 0, 100) },
+							(_, i) => (multiplier || 0) * (eSeconds || 0) ** (i + cArray.length + 1)
+						)}
+						{@const array = [...cArray, ...eArray]}
+						<div class="bg-surface-secondary border rounded px-4 py-2">
+							<div class="text-xs font-medium mb-2">Retry attempts</div>
+							{#if array.length > 0}
+								<table class="text-xs">
+									<thead>
+										<tr>
+											<td class="font-semibold pr-1 pb-1">1:</td>
+											<td class="pb-1"
+												>After {array[0]} second{array[0] === 1 ? '' : 's'}
+												{#if (random_factor ?? 0) > 0}(+/- {((array[0] ?? 0) *
+														(random_factor ?? 0)) /
+														100}
+													seconds){/if}</td
+											>
+										</tr>
+									</thead>
+									<tbody>
+										{#each array.slice(1, 100) as delay, i}
+											{@const index = i + 2}
+											<tr>
+												<td class="font-semibold pr-1 align-top">{index}:</td>
+												<td class="pb-1 whitespace-nowrap">
+													{delay} second{delay === 1 ? '' : 's'}
+													{#if (random_factor ?? 0) > 0}(+/- {((delay ?? 0) *
+															(random_factor ?? 0)) /
+															100}
+														seconds){/if}
+													after attempt #{index - 1}
+													{#if i > cArray.length - 2}
+														<span class="text-gray-400 pl-2">
+															({multiplier} * {eSeconds}<sup>{index}</sup>)
+														</span>
+													{/if}
+												</td>
+											</tr>
+										{/each}
+										{#if (cAttempts ?? 0) > 100 || (eAttempts ?? 0) > 100}
+											<tr>
+												<td class="font-semibold pr-1 align-top">...</td>
+												<td class="pb-1">...</td>
+											</tr>
 										{/if}
-									</td>
-								</tr>
-							{/each}
-							{#if (cAttempts ?? 0) > 100 || (eAttempts ?? 0) > 100}
-								<tr>
-									<td class="font-semibold pr-1 align-top">...</td>
-									<td class="pb-1">...</td>
-								</tr>
+									</tbody>
+								</table>
 							{/if}
-						</tbody>
-					</table>
-				{/if}
+						</div>
+					{/if}
+				</div>
 			</div>
-			{/if}
 		</div>
-	</div>
 	{/if}
 </div>
diff --git a/frontend/src/lib/components/flows/content/FlowRunSettings.svelte b/frontend/src/lib/components/flows/content/FlowRunSettings.svelte
new file mode 100644
index 0000000000..a1dae0f3a4
--- /dev/null
+++ b/frontend/src/lib/components/flows/content/FlowRunSettings.svelte
@@ -0,0 +1,385 @@
+<script lang="ts">
+	import { getContext } from 'svelte'
+	import { enterpriseLicense } from '$lib/stores'
+	import { isCloudHosted } from '$lib/cloud'
+	import type { FlowModule } from '$lib/gen'
+	import type { FlowEditorContext } from '../types'
+
+	import Toggle from '$lib/components/Toggle.svelte'
+	import Label from '$lib/components/Label.svelte'
+	import Tooltip from '$lib/components/Tooltip.svelte'
+	import Alert from '$lib/components/common/alert/Alert.svelte'
+	import { SecondsInput } from '$lib/components/common'
+	import Button from '$lib/components/common/button/Button.svelte'
+	import HighlightCode from '$lib/components/HighlightCode.svelte'
+	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
+	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
+	import s3Scripts from './s3Scripts/lib'
+
+	import FlowRetries from './FlowRetries.svelte'
+	import FlowModuleEarlyStop from './FlowModuleEarlyStop.svelte'
+	import FlowModuleSkip from './FlowModuleSkip.svelte'
+	import FlowModuleSuspend from './FlowModuleSuspend.svelte'
+	import FlowModuleSleep from './FlowModuleSleep.svelte'
+	import FlowModuleTimeout from './FlowModuleTimeout.svelte'
+	import FlowModuleDeleteAfterUse from './FlowModuleDeleteAfterUse.svelte'
+	import FlowModuleCache from './FlowModuleCache.svelte'
+	import { hasInlineConcurrency, stepSettingDefaults } from '../flowStepSettings'
+
+	import FlowModuleDebounce from './FlowModuleDebounce.svelte'
+	import FlowModuleMock from './FlowModuleMock.svelte'
+	import WorkspaceScriptSettingInfo from './WorkspaceScriptSettingInfo.svelte'
+	import { slideDynamic } from '$lib/transitions'
+
+	const { pathStore } = getContext<FlowEditorContext>('FlowEditorContext')
+
+	interface Props {
+		flowModule: FlowModule
+		parentModule?: FlowModule | undefined
+		previousModule?: FlowModule | undefined
+		selectedId: string
+		/** Lay out for embedding inside another scroll container (no own scroll/padding). */
+		embedded?: boolean
+		/** Container steps (loops and branches): keep only the subset of settings they support
+		 *  (Flow control rows + Lifetime), hiding the rest of Execution policy. */
+		loopSubset?: boolean
+		/** Loops render the per-iteration break next to their own settings, so they ask
+		 *  for the all-iterations predicate only. */
+		earlyStopBlocks?: 'both' | 'all-iters'
+		// For workspace-script steps: the concurrency/cache settings currently set on
+		// the referenced script, and a shortcut to edit them. Undefined for
+		// inline/subflow steps.
+		referencedConcurrentLimit?: number | undefined
+		referencedConcurrencyTimeWindowS?: number | undefined
+		workspaceScriptCacheTtl?: number | undefined
+		loadingWorkspaceScript?: boolean
+		workspaceScriptError?: string | undefined
+		canEditWorkspaceScript?: boolean
+		workspaceScriptNoEditReason?: string | undefined
+		onEditWorkspaceScript?: () => void
+		/** Replace the inline script's code — provided by the step editor. */
+		onApplyS3Snippet?: (code: string) => void
+		/** Agent tools never go through the flow scheduler, so the settings `same_worker`
+		 *  rules out for a flow step still apply to them. */
+		isAgentTool?: boolean
+	}
+
+	let {
+		flowModule = $bindable(),
+		parentModule = undefined,
+		previousModule = undefined,
+		selectedId,
+		embedded = false,
+		loopSubset = false,
+		earlyStopBlocks = 'both',
+		referencedConcurrentLimit = undefined,
+		referencedConcurrencyTimeWindowS = undefined,
+		workspaceScriptCacheTtl = undefined,
+		loadingWorkspaceScript = false,
+		workspaceScriptError = undefined,
+		canEditWorkspaceScript = false,
+		workspaceScriptNoEditReason = undefined,
+		onEditWorkspaceScript,
+		onApplyS3Snippet,
+		isAgentTool = false
+	}: Props = $props()
+
+	let rootEl: HTMLDivElement | undefined = $state()
+
+	/** Scroll one setting into view. `key` is a StepSettingKey, so the AI tool's openTab
+	 *  intent must name settings with those keys. */
+	export function openSetting(key: string) {
+		rootEl?.querySelector(`[data-setting="${key}"]`)?.scrollIntoView({ block: 'nearest' })
+	}
+
+	// Exact id: only the flow's error handler is 'failure'; a step the user named
+	// something like handle_failure is an ordinary step and keeps every row.
+	const isFailure = $derived(selectedId === 'failure')
+	const isRawScript = $derived(flowModule.value.type === 'rawscript')
+	const isWorkspaceScript = $derived(flowModule.value.type === 'script')
+	const s3Language = $derived(
+		flowModule.value.type === 'rawscript' &&
+			(flowModule.value.language === 'python3' || flowModule.value.language === 'deno')
+			? flowModule.value.language
+			: undefined
+	)
+	let s3Kind = $state<'s3_client' | 'polars' | 'duckdb'>('s3_client')
+	const s3Snippet = $derived(s3Language ? s3Scripts[s3Language][s3Kind] : undefined)
+	const concurrencyOn = $derived(hasInlineConcurrency(flowModule))
+	const concurrencyOff = $derived(!$enterpriseLicense || !concurrencyOn)
+	// A resolved approval is recorded against the step the gate holds back, not this one, so
+	// `continue_on_error` never sees it — the suspend option is the only way to continue past it.
+	const suspendNeedsItsOwnContinueToggle = $derived(
+		Boolean(flowModule.continue_on_error) &&
+			Boolean(flowModule.suspend) &&
+			!flowModule.suspend?.continue_on_disapprove_timeout
+	)
+</script>
+
+{#snippet sectionHeader(title: string)}
+	<div class="text-[11px] font-medium uppercase tracking-[0.04em] text-hint">
+		{title}
+	</div>
+{/snippet}
+
+<div
+	bind:this={rootEl}
+	class="flex flex-col gap-8 {embedded ? '' : 'flex-1 min-h-0 overflow-auto p-4 pb-8'}"
+	style={embedded ? undefined : 'scrollbar-gutter: stable'}
+>
+	{#if !isFailure}
+		<section class="flex flex-col gap-3">
+			{@render sectionHeader('Flow control')}
+
+			<div class="flex flex-col gap-6">
+				<div data-setting="skip">
+					<FlowModuleSkip bind:flowModule {parentModule} {previousModule} />
+				</div>
+
+				<div data-setting="early-stop">
+					<FlowModuleEarlyStop bind:flowModule blocks={earlyStopBlocks} />
+				</div>
+
+				<div data-setting="suspend">
+					<FlowModuleSuspend previousModuleId={previousModule?.id} bind:flowModule />
+				</div>
+
+				<div data-setting="sleep">
+					<FlowModuleSleep previousModuleId={previousModule?.id} bind:flowModule {isAgentTool} />
+				</div>
+			</div></section
+		>
+	{/if}
+
+	<section class="flex flex-col gap-3">
+		{@render sectionHeader('Execution policy')}
+
+		<div class="flex flex-col gap-6">
+			{#if !loopSubset}
+				<div data-setting="retries">
+					<FlowRetries bind:flowModuleRetry={flowModule.retry} bind:flowModule {isAgentTool} />
+				</div>
+
+				<div data-setting="error-handling" class="flex flex-col gap-2">
+					<Toggle
+						size="xs"
+						textClass="text-xs font-normal text-primary"
+						bind:checked={flowModule.continue_on_error}
+						options={{
+							right: 'Continue on error',
+							rightTooltip:
+								"The flow continues to the next step even if this step fails (after exhausting retries, if any). The step's error becomes its return, so a following branch can handle it."
+						}}
+					/>
+					{#if suspendNeedsItsOwnContinueToggle}
+						<Alert type="info" title="Does not cover the approval" size="xs">
+							This only applies when the step's own code fails. A disapproval or an approval timeout
+							is not a failure of this step, so it still stops the flow. To continue past those,
+							turn on "Continue on disapproval/timeout" in the approval settings.
+						</Alert>
+					{/if}
+				</div>
+
+				<!-- The error handler runs outside the flow's control graph; only its own
+			     failure handling applies. -->
+				{#if !isFailure}
+					<div data-setting="timeout">
+						<FlowModuleTimeout previousModuleId={previousModule?.id} bind:flowModule />
+					</div>
+
+					{#if isRawScript || isWorkspaceScript}
+						<div data-setting="concurrency">
+							{#if flowModule.value.type === 'script'}
+								<WorkspaceScriptSettingInfo
+									label="Concurrency limit"
+									active={referencedConcurrentLimit != undefined}
+									valueText={referencedConcurrentLimit != undefined
+										? `Max ${referencedConcurrentLimit} execution${
+												referencedConcurrentLimit === 1 ? '' : 's'
+											}${
+												referencedConcurrencyTimeWindowS != undefined
+													? ` within ${referencedConcurrencyTimeWindowS}s`
+													: ''
+											}`
+										: undefined}
+									loading={loadingWorkspaceScript}
+									error={workspaceScriptError}
+									canEdit={canEditWorkspaceScript}
+									noEditReason={workspaceScriptNoEditReason}
+									onEdit={onEditWorkspaceScript}
+								/>
+							{:else if flowModule.value.type === 'rawscript'}
+								<div class="flex flex-col gap-2">
+									<Toggle
+										size="xs"
+										textClass="text-xs font-normal text-primary"
+										eeOnly
+										disabled={!$enterpriseLicense}
+										checked={concurrencyOn}
+										on:change={() => {
+											if (flowModule.value.type !== 'rawscript') return
+											flowModule.value.concurrent_limit = concurrencyOn ? undefined : 1
+										}}
+										options={{
+											right: 'Concurrency limit',
+											rightTooltip: 'Allowed concurrency within a given timeframe.',
+											rightDocumentationLink:
+												'https://www.windmill.dev/docs/flows/concurrency_limit'
+										}}
+									/>
+									{#if concurrencyOn}
+										<div class="flex flex-col gap-2 pl-9" transition:slideDynamic>
+											<Label label="Max number of executions within the time window">
+												<input
+													disabled={concurrencyOff}
+													bind:value={flowModule.value.concurrent_limit}
+													type="number"
+													min="1"
+													class="!w-24"
+												/>
+											</Label>
+											<Label label="Time window in seconds">
+												<SecondsInput
+													disabled={concurrencyOff}
+													bind:seconds={flowModule.value.concurrency_time_window_s}
+													clearable
+												/>
+											</Label>
+											<Label label="Custom concurrency key (optional)">
+												{#snippet header()}
+													<Tooltip>
+														Concurrency keys are global, you can have them be workspace specific
+														using the variable `$workspace`. You can also use an argument's value
+														using `$args[name_of_arg]`</Tooltip
+													>
+												{/snippet}
+												<input
+													type="text"
+													disabled={concurrencyOff}
+													bind:value={flowModule.value.custom_concurrency_key}
+													placeholder={`$workspace/script/${$pathStore}-$args[foo]`}
+												/>
+											</Label>
+										</div>
+									{/if}
+								</div>
+							{/if}
+						</div>
+					{/if}
+
+					<div data-setting="priority" class="flex flex-col gap-2">
+						<Toggle
+							size="xs"
+							textClass="text-xs font-normal text-primary"
+							eeOnly
+							disabled={!$enterpriseLicense || isCloudHosted()}
+							checked={flowModule.priority !== undefined}
+							on:change={() => {
+								if (flowModule.priority !== undefined) {
+									flowModule.priority = undefined
+								} else {
+									flowModule.priority = stepSettingDefaults('priority')
+								}
+							}}
+							options={{
+								right: 'High priority',
+								rightTooltip:
+									'Jobs scheduled from this step take precedence over other jobs in the queue when the flow runs.'
+							}}
+						/>
+						{#if flowModule.priority !== undefined}
+							<div class="pl-9" transition:slideDynamic>
+								<Label label="Priority number">
+									{#snippet header()}
+										<Tooltip>The higher the number, the higher the priority.</Tooltip>
+									{/snippet}
+									<input
+										type="number"
+										class="!w-24"
+										bind:value={flowModule.priority}
+										onchange={() => {
+											if (flowModule.priority && flowModule.priority > 100) {
+												flowModule.priority = 100
+											} else if (flowModule.priority && flowModule.priority < 0) {
+												flowModule.priority = 0
+											}
+										}}
+									/>
+								</Label>
+							</div>
+						{/if}
+						<!-- The EE half of this limitation is the toggle's own badge; only the
+						     cloud one needs saying. -->
+						{#if isCloudHosted()}
+							<Alert type="warning" title="Limitation" size="xs">
+								Setting priority is not available on the cloud.
+							</Alert>
+						{/if}
+					</div>
+
+					<div data-setting="cache">
+						<FlowModuleCache
+							bind:flowModule
+							{workspaceScriptCacheTtl}
+							{loadingWorkspaceScript}
+							{workspaceScriptError}
+							{canEditWorkspaceScript}
+							{workspaceScriptNoEditReason}
+							{onEditWorkspaceScript}
+						/>
+					</div>
+
+					<div data-setting="debounce">
+						<FlowModuleDebounce bind:flowModule {selectedId} />
+					</div>
+				{/if}
+			{/if}
+
+			{#if !isFailure}
+				<div data-setting="lifetime">
+					<FlowModuleDeleteAfterUse bind:flowModule disabled={!$enterpriseLicense} />
+				</div>
+			{/if}
+
+			{#if loopSubset}
+				<div data-setting="mock">
+					<FlowModuleMock bind:flowModule />
+				</div>
+			{/if}
+		</div></section
+	>
+
+	{#if s3Language && onApplyS3Snippet && !isFailure}
+		<section class="flex flex-col gap-3" data-setting="s3">
+			{@render sectionHeader('S3 snippets')}
+			<p class="text-xs text-tertiary">
+				Read and write S3 objects, and use Polars or DuckDB to run efficient ETL processes.
+			</p>
+			<div class="flex flex-row items-center justify-between gap-2">
+				<ToggleButtonGroup bind:selected={s3Kind} class="w-auto">
+					{#snippet children({ item })}
+						{#if s3Language === 'deno'}
+							<ToggleButton value="s3_client" small label="S3 lite client" {item} />
+						{:else}
+							<ToggleButton value="s3_client" small label="Boto3" {item} />
+							<ToggleButton value="polars" small label="Polars" {item} />
+							<ToggleButton value="duckdb" small label="DuckDB" {item} />
+						{/if}
+					{/snippet}
+				</ToggleButtonGroup>
+				<Button
+					size="xs"
+					variant="default"
+					on:click={() => s3Snippet && onApplyS3Snippet?.(s3Snippet)}
+				>
+					Apply snippet
+				</Button>
+			</div>
+			{#if s3Snippet}
+				<div class="overflow-auto max-h-64 border rounded-md">
+					<HighlightCode language={s3Language} code={s3Snippet} />
+				</div>
+			{/if}
+		</section>
+	{/if}
+</div>
diff --git a/frontend/src/lib/components/flows/content/FlowSettings.svelte b/frontend/src/lib/components/flows/content/FlowSettings.svelte
index c63921d989..8e78a04269 100644
--- a/frontend/src/lib/components/flows/content/FlowSettings.svelte
+++ b/frontend/src/lib/components/flows/content/FlowSettings.svelte
@@ -47,6 +47,7 @@
 		customUi,
 		preserveOnBehalfOf,
 		savedOnBehalfOfEmail,
+		savedOnBehalfOfPermissionedAs,
 		opWorkspace
 	} = getContext<FlowEditorContext>('FlowEditorContext')
 
@@ -55,6 +56,7 @@
 	let canPreserve = $derived(!!$userStore?.is_admin || !!$userStore?.is_super_admin || isDeployer)
 	let onBehalfOfChoice: OnBehalfOfChoice = $state(undefined)
 	let customOnBehalfOfEmail: string = $state('')
+	let myPermissionedAs = $derived($userStore?.username ? `u/${$userStore.username}` : undefined)
 
 	function asSchema(x: any) {
 		return x as Schema
@@ -114,7 +116,7 @@
 
 <div class="h-full flex flex-col">
 	<FlowCard {noEditor} title="Settings">
-		<div class="grow min-h-0 p-4 h-full flex flex-col gap-6">
+		<div class="grow min-h-0 p-4 h-full flex flex-col gap-6 overflow-y-auto">
 			<!-- Metadata Section -->
 			<div class="gap-6 flex flex-col">
 				<Label label="Summary">
@@ -186,7 +188,7 @@
 				label="Advanced"
 				collapsable={true}
 				small={true}
-				class="h-full grow mt-2 min-h-0 flex flex-col gap-6"
+				class="h-full grow mt-2 min-h-0 flex flex-col gap-6 pb-2"
 			>
 				<!-- Worker Group Section -->
 				{#if customUi?.settingsTabs?.workerGroup != false}
@@ -457,10 +459,12 @@
 						on:change={() => {
 							if (flowStore.val.on_behalf_of_email) {
 								flowStore.val.on_behalf_of_email = undefined
+								flowStore.val.on_behalf_of = undefined
 								$preserveOnBehalfOf = false
 								onBehalfOfChoice = undefined
 							} else {
 								flowStore.val.on_behalf_of_email = $userStore?.email
+								flowStore.val.on_behalf_of = myPermissionedAs
 							}
 						}}
 						options={{
@@ -478,14 +482,19 @@
 								onBehalfOfChoice = choice
 								if (choice === 'me') {
 									flowStore.val.on_behalf_of_email = $userStore?.email
+									flowStore.val.on_behalf_of = myPermissionedAs
 									customOnBehalfOfEmail = ''
 									$preserveOnBehalfOf = false
 								} else if (choice === 'target') {
+									// Keep the saved pair. A flow that has no recorded principal yet
+									// sends the email alone and the backend derives one from it.
 									flowStore.val.on_behalf_of_email = $savedOnBehalfOfEmail
+									flowStore.val.on_behalf_of = $savedOnBehalfOfPermissionedAs
 									customOnBehalfOfEmail = ''
 									$preserveOnBehalfOf = true
 								} else if (choice === 'custom' && details) {
 									flowStore.val.on_behalf_of_email = details.email
+									flowStore.val.on_behalf_of = details.permissionedAs
 									customOnBehalfOfEmail = details.email
 									$preserveOnBehalfOf = true
 								}
@@ -617,11 +626,10 @@
 							flowStore.val.value.priority = 100
 						}
 					}}
+					eeOnly={true}
 					options={{
 						right: `Label as high priority`,
-						rightTooltip: `All jobs scheduled by flows labeled as high priority take precedence over the other jobs in the jobs queue. Higher priority numbers are executed first. ${
-							!$enterpriseLicense ? 'This is a feature only available on enterprise edition.' : ''
-						}`,
+						rightTooltip: `All jobs scheduled by flows labeled as high priority take precedence over the other jobs in the jobs queue. Higher priority numbers are executed first.`,
 						rightDocumentationLink: 'https://www.windmill.dev/docs/flows/priority'
 					}}
 				>
@@ -644,9 +652,6 @@
 								}
 							}}
 						/>
-						{#if !$enterpriseLicense || isCloudHosted()}
-							<EEOnly />
-						{/if}
 					{/snippet}
 				</Toggle>
 
@@ -664,7 +669,7 @@
 					}}
 					options={{
 						right: 'Delete all step results after completion',
-						rightTooltip: `When enabled, the logs, arguments and results of all flow steps will be deleted after the specified delay once the flow completes. Set to 0 for immediate deletion. The deletion is irreversible. ${!$enterpriseLicense ? 'This is a feature only available on enterprise edition.' : ''}`
+						rightTooltip: `When enabled, the logs, arguments and results of all flow steps will be deleted after the specified delay once the flow completes. Set to 0 for immediate deletion. The deletion is irreversible.`
 					}}
 					eeOnly={true}
 				/>
diff --git a/frontend/src/lib/components/flows/content/FlowWhileLoop.svelte b/frontend/src/lib/components/flows/content/FlowWhileLoop.svelte
index abf71498bd..8d2174e87e 100644
--- a/frontend/src/lib/components/flows/content/FlowWhileLoop.svelte
+++ b/frontend/src/lib/components/flows/content/FlowWhileLoop.svelte
@@ -1,24 +1,16 @@
 <script lang="ts">
-	import { getContext } from 'svelte'
+	import { getContext, tick } from 'svelte'
 	import FlowCard from '../common/FlowCard.svelte'
 	import type { FlowEditorContext } from '../types'
 	import Toggle from '$lib/components/Toggle.svelte'
-	import Tooltip from '$lib/components/Tooltip.svelte'
-	import FlowModuleEarlyStop from './FlowModuleEarlyStop.svelte'
-	import FlowModuleSuspend from './FlowModuleSuspend.svelte'
-	// import FlowRetries from './FlowRetries.svelte'
-	import { Button, Drawer, Tab, TabContent, Alert } from '$lib/components/common'
-	import { Pane, Splitpanes } from 'svelte-splitpanes'
-	import { enterpriseLicense } from '$lib/stores'
+	import { Button, Drawer, Alert, Tab, Tabs } from '$lib/components/common'
 
-	import FlowModuleSleep from './FlowModuleSleep.svelte'
-	import FlowModuleMock from './FlowModuleMock.svelte'
 	import { Play } from 'lucide-svelte'
 	import type { FlowModule, Job, WhileloopFlow } from '$lib/gen'
 	import FlowLoopIterationPreview from '$lib/components/FlowLoopIterationPreview.svelte'
-	import FlowModuleDeleteAfterUse from './FlowModuleDeleteAfterUse.svelte'
-	import FlowModuleSkip from './FlowModuleSkip.svelte'
-	import TabsV2 from '$lib/components/common/tabs/TabsV2.svelte'
+	import FlowRunSettings from './FlowRunSettings.svelte'
+	import StepSettingsBadges from './StepSettingsBadges.svelte'
+	import FlowModuleEarlyStop from './FlowModuleEarlyStop.svelte'
 	import { useUiIntent } from '$lib/components/copilot/chat/flow/useUiIntent'
 
 	const { flowStateStore } = getContext<FlowEditorContext>('FlowEditorContext')
@@ -32,7 +24,7 @@
 
 	let { mod = $bindable(), previousModule, parentModule, noEditor }: Props = $props()
 
-	let selected: string = $state('early-stop')
+	let runSettings: FlowRunSettings | undefined = $state(undefined)
 
 	let previewOpen = $state(false)
 	let jobId: string | undefined = $state(undefined)
@@ -40,9 +32,15 @@
 
 	let previewIterationArgs = $derived(flowStateStore.val[mod.id]?.previewArgs ?? {})
 
+	let selectedTab = $state('loop')
+
 	useUiIntent(`whileloopflow-${mod.id}`, {
-		openTab: (tab) => {
-			selected = tab
+		openTab: async (tab) => {
+			// Every setting the intent can name lives in the other tab, which only mounts
+			// `runSettings` once selected.
+			selectedTab = 'settings'
+			await tick()
+			runSettings?.openSetting(tab)
 		}
 	})
 </script>
@@ -64,133 +62,94 @@
 <FlowCard {noEditor} title="While loop">
 	{#snippet header()}
 		<div class="grow">
-			<input bind:value={mod.summary} placeholder={'Summary'} />
+			<div class="flex flex-row gap-2 items-center">
+				<div class="grow">
+					<input bind:value={mod.summary} placeholder={'Summary'} />
+				</div>
+				<div class="justify-end">
+					<Button
+						on:click={() => (previewOpen = true)}
+						startIcon={{ icon: Play }}
+						variant="default"
+						size="sm">Test an iteration</Button
+					>
+				</div>
+			</div>
 		</div>
 	{/snippet}
 
-	<Splitpanes horizontal class="h-full">
-		<Pane size={50} minSize={20} class="p-4">
-			{#if !noEditor}
-				<Alert
-					type="info"
-					title="While loops"
-					class="mb-4"
-					size="xs"
-					documentationLink="https://www.windmill.dev/docs/flows/while_loops"
-				>
-					Add steps inside the while loop but have one of them use early stop/break in their
-					Advanced settings (or do it at the loop level that will watch the last step) to break out
-					of the while loop (otherwise it will loop forever and you will have to cancel the flow
-					manually).
-				</Alert>
-			{/if}
+	<div class="flex h-full min-h-0 flex-col">
+		{#if mod.value.type === 'whileloopflow'}
+			<Tabs bind:selected={selectedTab} wrapperClass="shrink-0">
+				<Tab value="loop" label="Loop" />
+				<Tab value="settings" label="Run settings">
+					{#snippet extra()}
+						<StepSettingsBadges flowModule={mod} />
+					{/snippet}
+				</Tab>
+			</Tabs>
 
-			{#if mod.value.type === 'whileloopflow'}
-				<div class="flex flex-row gap-8 mt-2 mb-6">
-					<div class="flex-shrink-0">
-						<div class="mb-2 text-sm font-bold"
-							>Skip failures <Tooltip
-								documentationLink="https://www.windmill.dev/docs/flows/while_loops"
-								>If disabled, the flow will fail as soon as one of the iteration fail. Otherwise,
-								the error will be collected as the result of the iteration. Regardless of this
-								setting, if a flow level error handler is defined, it will process the error.
-								(Workspace error handlers will NOT be used to process errors if enabled.)</Tooltip
-							></div
+			<div
+				class="flex min-h-0 flex-1 flex-col gap-8 overflow-auto p-4"
+				style="scrollbar-gutter: stable"
+			>
+				{#if selectedTab === 'loop'}
+					{#if !noEditor}
+						<Alert
+							type="info"
+							title="While loops"
+							size="xs"
+							documentationLink="https://www.windmill.dev/docs/flows/while_loops"
 						>
+							Add steps inside the while loop but have one of them use early stop/break in their Run
+							settings (or do it at the loop level that will watch the last step) to break out of
+							the while loop (otherwise it will loop forever and you will have to cancel the flow
+							manually).
+						</Alert>
+					{/if}
+
+					<section class="flex flex-col gap-6">
+						<FlowModuleEarlyStop blocks="stop-after" bind:flowModule={mod} />
+
 						<Toggle
+							size="xs"
+							textClass="text-xs font-normal text-primary"
 							bind:checked={mod.value.skip_failures}
 							options={{
-								right: 'Skip failures'
+								right: 'Skip failures',
+								rightTooltip:
+									'If disabled, the flow will fail as soon as one of the iteration fail. Otherwise, the error will be collected as the result of the iteration. Regardless of this setting, if a flow level error handler is defined, it will process the error. (Workspace error handlers will NOT be used to process errors if enabled.)',
+								rightDocumentationLink: 'https://www.windmill.dev/docs/flows/while_loops'
 							}}
 						/>
-					</div>
-					<div class="flex-shrink-0">
-						<div class="mb-2 text-sm font-bold"
-							>Squash
-							<Tooltip documentationLink="https://www.windmill.dev/docs/flows/while_loops">
-								Squashing a while loop runs all iterations on the same worker, using a single runner
-								per step for the entire loop. This eliminates cold starts between iterations for
-								supported languages (Bun, Deno, and Python).
-							</Tooltip>
-						</div>
 						<Toggle
+							size="xs"
+							textClass="text-xs font-normal text-primary"
 							bind:checked={mod.value.squash}
 							on:change={({ detail }) => {
 								;(mod.value as WhileloopFlow).squash = detail
 							}}
 							options={{
-								right: 'Squash'
+								right: 'Squash',
+								rightTooltip:
+									'Squashing a while loop runs all iterations on the same worker, using a single runner per step for the entire loop. This eliminates cold starts between iterations for supported languages (Bun, Deno, and Python).',
+								rightDocumentationLink: 'https://www.windmill.dev/docs/flows/while_loops'
 							}}
-							class="whitespace-nowrap"
 						/>
-					</div>
-				</div>
-
-				<div class="my-2 flex flex-row gap-2 items-center">
-					<div class="flex w-full justify-end">
-						<Button
-							on:click={() => (previewOpen = true)}
-							startIcon={{ icon: Play }}
-							variant="accent"
-							size="sm">Test an iteration</Button
-						>
-					</div>
-				</div>
-			{/if}
-		</Pane>
-		<Pane size={40} minSize={20} class="flex flex-col flex-1">
-			<TabsV2 bind:selected>
-				<!-- <Tab value="retries">Retries</Tab> -->
-				<Tab value="early-stop" label="Early Stop/Break" />
-				<Tab value="skip" label="Skip" />
-				<Tab value="suspend" label="Suspend/Approval/Prompt" />
-				<Tab value="sleep" label="Sleep" />
-				<Tab value="mock" label="Mock" />
-				<Tab value="lifetime" label="Lifetime" />
-
-				{#snippet content()}
-					<div class="overflow-hidden bg-surface" style="height:calc(100% - 32px);">
-						<!-- <TabContent value="retries" class="flex flex-col flex-1 h-full">
-									<div class="p-4 overflow-y-auto">
-										<FlowRetries bind:flowModule={mod} />
-									</div>
-								</TabContent> -->
-
-						<TabContent value="early-stop" class="flex flex-col flex-1 h-full">
-							<div class="p-4 overflow-y-auto">
-								<FlowModuleEarlyStop bind:flowModule={mod} />
-							</div>
-						</TabContent>
-
-						<TabContent value="skip" class="flex flex-col flex-1 h-full">
-							<div class="p-4 overflow-y-auto">
-								<FlowModuleSkip bind:flowModule={mod} {parentModule} {previousModule} />
-							</div>
-						</TabContent>
-
-						<TabContent value="suspend" class="flex flex-col flex-1 h-full">
-							<div class="p-4 overflow-y-auto">
-								<FlowModuleSuspend previousModuleId={previousModule?.id} bind:flowModule={mod} />
-							</div>
-						</TabContent>
-						<TabContent value="sleep" class="flex flex-col flex-1 h-full">
-							<div class="p-4 overflow-y-auto">
-								<FlowModuleSleep previousModuleId={previousModule?.id} bind:flowModule={mod} />
-							</div>
-						</TabContent>
-						<TabContent value="mock" class="flex flex-col flex-1 h-full">
-							<div class="p-4 overflow-y-auto">
-								<FlowModuleMock bind:flowModule={mod} />
-							</div>
-						</TabContent>
-						<TabContent value="lifetime" class="flex flex-col flex-1 h-full">
-							<div class="p-4 overflow-y-auto">
-								<FlowModuleDeleteAfterUse bind:flowModule={mod} disabled={!$enterpriseLicense} />
-							</div>
-						</TabContent>
-					</div>
-				{/snippet}
-			</TabsV2>
-		</Pane>
-	</Splitpanes>
+					</section>
+				{:else}
+					<FlowRunSettings
+						embedded
+						loopSubset
+						earlyStopBlocks="all-iters"
+						bind:this={runSettings}
+						bind:flowModule={mod}
+						{parentModule}
+						{previousModule}
+						selectedId={mod.id}
+					/>
+				{/if}
+			</div>
+		{/if}
+	</div>
 </FlowCard>
diff --git a/frontend/src/lib/components/flows/content/GenAiQuick.svelte b/frontend/src/lib/components/flows/content/GenAiQuick.svelte
index e0e681d568..5d3814fb63 100644
--- a/frontend/src/lib/components/flows/content/GenAiQuick.svelte
+++ b/frontend/src/lib/components/flows/content/GenAiQuick.svelte
@@ -1,17 +1,18 @@
 <script lang="ts">
-	import { createBubbler } from 'svelte/legacy';
+	import { createBubbler } from 'svelte/legacy'
 
-	const bubble = createBubbler();
+	const bubble = createBubbler()
 	import { Wand2 } from 'lucide-svelte'
 	import { createEventDispatcher } from 'svelte'
 
 	interface Props {
-		funcDesc: string;
-		selected: boolean;
-		lang: string;
+		funcDesc: string
+		selected: boolean
+		lang: string
+		onHover?: () => void
 	}
 
-	let { funcDesc, selected, lang }: Props = $props();
+	let { funcDesc, selected, lang, onHover = undefined }: Props = $props()
 	const dispatch = createEventDispatcher()
 
 	const onKeyDown = (e: KeyboardEvent) => {
@@ -24,10 +25,13 @@
 
 <svelte:window onkeydown={onKeyDown} />
 <button
-	class="px-3 py-2 gap-2 w-full text-left hover:bg-surface-hover flex flex-row items-center transition-all rounded-md {selected
+	class="px-3 py-2 gap-2 w-full text-left flex flex-row items-center transition-all rounded-md {selected
 		? 'bg-surface-hover'
-		: ''}"
+		: onHover
+			? ''
+			: 'hover:bg-surface-hover'}"
 	onclick={bubble('click')}
+	onmousemove={() => onHover?.()}
 >
 	<Wand2 size={14} class="text-ai" />
 
diff --git a/frontend/src/lib/components/flows/content/McpToolEditor.svelte b/frontend/src/lib/components/flows/content/McpToolEditor.svelte
index b73cc93ef9..027766d5d4 100644
--- a/frontend/src/lib/components/flows/content/McpToolEditor.svelte
+++ b/frontend/src/lib/components/flows/content/McpToolEditor.svelte
@@ -18,6 +18,7 @@
 
 <script lang="ts">
 	import type { McpTool } from '../agentToolUtils'
+	import FlowCard from '../common/FlowCard.svelte'
 	import Section from '$lib/components/Section.svelte'
 	import Label from '$lib/components/Label.svelte'
 	import { Button } from '$lib/components/common'
@@ -33,9 +34,10 @@
 
 	interface Props {
 		tool: McpTool
+		noEditor?: boolean
 	}
 
-	let { tool = $bindable() }: Props = $props()
+	let { tool = $bindable(), noEditor = false }: Props = $props()
 
 	const flowEditorContext = getContext<FlowEditorContext>('FlowEditorContext')
 	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $workspaceStore)
@@ -92,124 +94,126 @@
 	}
 </script>
 
-<div class="flex flex-col gap-4 p-4">
-	<Alert type="info" title="MCP Client Configuration">
-		{#snippet children()}
-			<p class="mb-2 text-sm">
-				MCP clients allow AI agents to access and execute a list of tools made available by an MCP
-				server.
-				<br />
-				Choose an MCP resource to make its tools available to the agent.
-				<br />
-				<br />
-				<strong>Note:</strong> Only HTTP streamable MCP servers are supported.
-			</p>
-		{/snippet}
-	</Alert>
+<FlowCard {noEditor} title="MCP tool">
+	<div class="flex flex-col gap-4 overflow-auto p-4" style="scrollbar-gutter: stable">
+		<Alert type="info" title="MCP Client Configuration">
+			{#snippet children()}
+				<p class="mb-2 text-sm">
+					MCP clients allow AI agents to access and execute a list of tools made available by an MCP
+					server.
+					<br />
+					Choose an MCP resource to make its tools available to the agent.
+					<br />
+					<br />
+					<strong>Note:</strong> Only HTTP streamable MCP servers are supported.
+				</p>
+			{/snippet}
+		</Alert>
 
-	<div class="w-full">
-		<Label label="MCP Resource">
-			<ResourcePicker
-				bind:this={resourcePicker}
-				resourceType="mcp"
-				bind:value={tool.value.resource_path}
-				workspace={opWs}
-			/>
-		</Label>
-	</div>
-
-	{#if !resourcePath}
-		{#if !showOAuthForm}
-			<Button size="xs" color="light" onClick={() => (showOAuthForm = true)}>
-				Connect with OAuth
-			</Button>
-		{:else}
-			<McpOAuthConnect
-				onConnected={handleOAuthConnected}
-				onCancel={() => (showOAuthForm = false)}
-			/>
-		{/if}
-	{/if}
-
-	{#if resourcePath?.length > 0}
 		<div class="w-full">
-			<Label label="Summary">
-				<input
-					type="text"
-					bind:value={tool.summary}
-					placeholder="e.g., GitHub MCP"
-					class="text-sm w-full"
+			<Label label="MCP Resource">
+				<ResourcePicker
+					bind:this={resourcePicker}
+					resourceType="mcp"
+					bind:value={tool.value.resource_path}
+					workspace={opWs}
 				/>
 			</Label>
 		</div>
 
-		<Section label="Available Tools">
-			{#snippet action()}
-				<Button
-					size="xs"
-					color="light"
-					onClick={() => (refreshCount += 1)}
-					startIcon={{ icon: RefreshCw }}
-					disabled={tools.status === 'loading'}
-				>
-					{tools.status === 'loading' ? 'Loading...' : 'Refresh Tools'}
+		{#if !resourcePath}
+			{#if !showOAuthForm}
+				<Button size="xs" color="light" onClick={() => (showOAuthForm = true)}>
+					Connect with OAuth
 				</Button>
-			{/snippet}
-			<div class="w-full flex flex-col gap-2">
-				{#if error}
-					<div class="text-xs text-red-600 dark:text-red-400 mb-4"
-						>{`Failed to load tools from MCP server: ${error}`}</div
-					>
-				{:else if tools.status === 'loading'}
-					<div class="max-h-48 overflow-y-auto border rounded p-2 bg-surface-secondary">
-						<div class="text-xs text-secondary italic">Loading tools...</div>
-					</div>
-				{:else if (tools.value ?? []).length === 0 && !error}
-					<div class="max-h-48 overflow-y-auto border rounded p-2 bg-surface-secondary">
-						<div class="text-xs text-secondary italic">
-							No tools loaded yet. Click "Refresh Tools" to fetch tools from the MCP server.
-						</div>
-					</div>
-				{:else if (tools.value ?? []).length > 0}
-					<div class="max-h-48 overflow-y-auto border rounded p-2 bg-surface-secondary">
-						<div class="flex flex-col gap-1">
-							{#each tools.value ?? [] as mcpTool}
-								<div class="text-xs">
-									<span class="font-semibold">{mcpTool.name}</span>
-									{#if mcpTool.description}
-										<span class="text-secondary">— {mcpTool.description}</span>
-									{/if}
-								</div>
-							{/each}
-						</div>
-					</div>
-				{/if}
-			</div>
-		</Section>
+			{:else}
+				<McpOAuthConnect
+					onConnected={handleOAuthConnected}
+					onCancel={() => (showOAuthForm = false)}
+				/>
+			{/if}
+		{/if}
 
-		{#if tool.value.include_tools && tool.value.exclude_tools}
-			<Section label="Tool Filtering">
-				<div class="w-full flex flex-col gap-3">
-					<div class="flex flex-col gap-2">
-						<Label label="Only include specified tools">
-							<MultiSelect
-								bind:value={tool.value.include_tools}
-								items={toolOptions}
-								placeholder="Choose tools to include..."
-							/>
-						</Label>
-					</div>
-					<div class="flex flex-col gap-2">
-						<Label label="Exclude specified tools">
-							<MultiSelect
-								bind:value={tool.value.exclude_tools}
-								items={toolOptions}
-								placeholder="Choose tools to exclude..."
-							/>
-						</Label>
-					</div>
+		{#if resourcePath?.length > 0}
+			<div class="w-full">
+				<Label label="Summary">
+					<input
+						type="text"
+						bind:value={tool.summary}
+						placeholder="e.g., GitHub MCP"
+						class="text-sm w-full"
+					/>
+				</Label>
+			</div>
+
+			<Section label="Available Tools">
+				{#snippet action()}
+					<Button
+						size="xs"
+						color="light"
+						onClick={() => (refreshCount += 1)}
+						startIcon={{ icon: RefreshCw }}
+						disabled={tools.status === 'loading'}
+					>
+						{tools.status === 'loading' ? 'Loading...' : 'Refresh Tools'}
+					</Button>
+				{/snippet}
+				<div class="w-full flex flex-col gap-2">
+					{#if error}
+						<div class="text-xs text-red-600 dark:text-red-400 mb-4"
+							>{`Failed to load tools from MCP server: ${error}`}</div
+						>
+					{:else if tools.status === 'loading'}
+						<div class="max-h-48 overflow-y-auto border rounded p-2 bg-surface-secondary">
+							<div class="text-xs text-secondary italic">Loading tools...</div>
+						</div>
+					{:else if (tools.value ?? []).length === 0 && !error}
+						<div class="max-h-48 overflow-y-auto border rounded p-2 bg-surface-secondary">
+							<div class="text-xs text-secondary italic">
+								No tools loaded yet. Click "Refresh Tools" to fetch tools from the MCP server.
+							</div>
+						</div>
+					{:else if (tools.value ?? []).length > 0}
+						<div class="max-h-48 overflow-y-auto border rounded p-2 bg-surface-secondary">
+							<div class="flex flex-col gap-1">
+								{#each tools.value ?? [] as mcpTool}
+									<div class="text-xs">
+										<span class="font-semibold">{mcpTool.name}</span>
+										{#if mcpTool.description}
+											<span class="text-secondary">— {mcpTool.description}</span>
+										{/if}
+									</div>
+								{/each}
+							</div>
+						</div>
+					{/if}
 				</div>
 			</Section>
+
+			{#if tool.value.include_tools && tool.value.exclude_tools}
+				<Section label="Tool Filtering">
+					<div class="w-full flex flex-col gap-3">
+						<div class="flex flex-col gap-2">
+							<Label label="Only include specified tools">
+								<MultiSelect
+									bind:value={tool.value.include_tools}
+									items={toolOptions}
+									placeholder="Choose tools to include..."
+								/>
+							</Label>
+						</div>
+						<div class="flex flex-col gap-2">
+							<Label label="Exclude specified tools">
+								<MultiSelect
+									bind:value={tool.value.exclude_tools}
+									items={toolOptions}
+									placeholder="Choose tools to exclude..."
+								/>
+							</Label>
+						</div>
+					</div>
+				</Section>
+			{/if}
 		{/if}
-	{/if}
-</div>
+	</div>
+</FlowCard>
diff --git a/frontend/src/lib/components/flows/content/StepSettingsBadges.svelte b/frontend/src/lib/components/flows/content/StepSettingsBadges.svelte
new file mode 100644
index 0000000000..b92a8a05a5
--- /dev/null
+++ b/frontend/src/lib/components/flows/content/StepSettingsBadges.svelte
@@ -0,0 +1,30 @@
+<script lang="ts">
+	import Popover from '$lib/components/Popover.svelte'
+	import type { FlowModule } from '$lib/gen'
+	import { describeStepSettings } from '../flowStepSettings'
+
+	interface Props {
+		flowModule: FlowModule
+	}
+
+	let { flowModule }: Props = $props()
+
+	// Same icons the graph badges a step with, so a setting looks the same wherever it
+	// is surfaced.
+	let configured = $derived(describeStepSettings(flowModule).filter((s) => s.configured))
+</script>
+
+{#if configured.length > 0}
+	<div class="flex flex-row items-center gap-1 text-secondary">
+		{#each configured as s (s.key)}
+			{@const Icon = s.icon}
+			<Popover notClickable>
+				<Icon size={12} />
+				{#snippet text()}
+					{s.tooltip}
+					<span class={s.summary.mono ? 'font-mono' : ''}>· {s.summary.text}</span>
+				{/snippet}
+			</Popover>
+		{/each}
+	</div>
+{/if}
diff --git a/frontend/src/lib/components/flows/content/SuspendDrawer.svelte b/frontend/src/lib/components/flows/content/SuspendDrawer.svelte
index 3ac2afe001..e351c2812c 100644
--- a/frontend/src/lib/components/flows/content/SuspendDrawer.svelte
+++ b/frontend/src/lib/components/flows/content/SuspendDrawer.svelte
@@ -16,21 +16,26 @@
 </script>
 
 <Button
-	size="xs"
-	variant="default"
+	unifiedSize="xs"
+	variant="subtle"
+	btnClasses="text-hint font-normal"
+	endIcon={{ icon: HelpCircle }}
 	on:click={() => {
 		drawer?.openDrawer()
 	}}
-	>{text} <HelpCircle size={12} />
+>
+	{text}
 </Button>
 
 <Drawer bind:this={drawer}>
 	<DrawerContent title="Suspend/Approval/Prompt help" on:close={drawer?.closeDrawer}>
 		<div class="flex flex-col gap-y-6 text-xs text-primary font-normal">
 			<Section label="Form/Payload">
-				To add a form, go to the <b>Form</b> tab, inside the Advanced {'->'} Suspend tab, and add a form.
-				You can then get back the payloads using `resume` (single approver), or `resumes` (multiple approvers)
-				in the next step. Forms are an EE feature only. The approver list itself is fetchable using `approvers`
+				To add a form, open the <b>Form</b> tab of this <b>Suspend until approval/resume</b> setting
+				and click
+				<b>Add a form</b>. You can then get back the payloads using `resume` (single approver), or
+				`resumes` (multiple approvers) in the next step. Forms are an EE feature only. The approver
+				list itself is fetchable using `approvers`
 			</Section>
 			<Section label="Prompt">
 				A prompt is simply an approval step that can be self-approved. To do this, include the
diff --git a/frontend/src/lib/components/flows/content/WebsearchToolDisplay.svelte b/frontend/src/lib/components/flows/content/WebsearchToolDisplay.svelte
index 77e4d07c61..2d679ff665 100644
--- a/frontend/src/lib/components/flows/content/WebsearchToolDisplay.svelte
+++ b/frontend/src/lib/components/flows/content/WebsearchToolDisplay.svelte
@@ -1,10 +1,15 @@
 <script lang="ts">
 	import Alert from '$lib/components/common/alert/Alert.svelte'
+	import FlowCard from '../common/FlowCard.svelte'
+
+	let { noEditor = false }: { noEditor?: boolean } = $props()
 </script>
 
-<div class="flex flex-col gap-4 p-4">
-	<Alert title="Web search tool" type="info">
-		Gives the AI Agent the ability to search the web. Only works for openai, anthropic and google
-		models for now.
-	</Alert>
-</div>
+<FlowCard {noEditor} title="Web search">
+	<div class="flex flex-col gap-4 overflow-auto p-4" style="scrollbar-gutter: stable">
+		<Alert title="Web search tool" type="info">
+			Gives the AI Agent the ability to search the web. Only works for openai, anthropic and google
+			models for now.
+		</Alert>
+	</div>
+</FlowCard>
diff --git a/frontend/src/lib/components/flows/expandedSubflowStep.test.ts b/frontend/src/lib/components/flows/expandedSubflowStep.test.ts
new file mode 100644
index 0000000000..33b5515850
--- /dev/null
+++ b/frontend/src/lib/components/flows/expandedSubflowStep.test.ts
@@ -0,0 +1,52 @@
+import { describe, it, expect } from 'vitest'
+import type { FlowModule } from '$lib/gen'
+import { expandedSubflowParentId, resolveExpandedSubflowStep } from './expandedSubflowStep'
+
+const script = (id: string): FlowModule =>
+	({ id, value: { type: 'rawscript', language: 'bun', content: '', input_transforms: {} } }) as any
+const subflow = (id: string, path: string): FlowModule =>
+	({ id, value: { type: 'flow', path } }) as any
+const forloop = (id: string, modules: FlowModule[]): FlowModule =>
+	({ id, value: { type: 'forloopflow', modules, iterator: { type: 'static', value: [] } } }) as any
+
+// `outer` inlines `f/inner`, which inlines `f/innermost`; each subflow step also sits
+// inside a for loop, which the graph node id does not record.
+const flows: Record<string, FlowModule[]> = {
+	'f/inner': [forloop('l', [subflow('b', 'f/innermost')])],
+	'f/innermost': [forloop('m', [script('leaf')])]
+}
+const rootModules = [forloop('k', [subflow('a', 'f/inner')])]
+const loadFlowModules = async (path: string) => flows[path]
+
+describe('expandedSubflowParentId', () => {
+	// The last segment of `subflowSteps` is the parent's own step, so it belongs to the
+	// parent key: `subflow:a:b` sits in expansion `a`, not in itself.
+	it('is the enclosing expansion, not the expansion itself', () => {
+		expect(expandedSubflowParentId('subflow:a:b')).toBe('a')
+		expect(expandedSubflowParentId('subflow:a:b:c')).toBe('subflow:a:b')
+		expect(expandedSubflowParentId('a')).toBeUndefined()
+	})
+})
+
+describe('resolveExpandedSubflowStep', () => {
+	it('follows every subflow boundary down to the selected step', async () => {
+		const resolved = await resolveExpandedSubflowStep(
+			'subflow:a:b:leaf',
+			rootModules,
+			loadFlowModules
+		)
+		expect(resolved?.pathChain).toEqual(['f/inner', 'f/innermost'])
+		expect(resolved?.containingFlowPath).toBe('f/innermost')
+		expect(resolved?.module?.id).toBe('leaf')
+	})
+
+	it('still reports the containing flow when the step is not one of its modules', async () => {
+		const resolved = await resolveExpandedSubflowStep(
+			'subflow:a:b:leaf-tool-0',
+			rootModules,
+			loadFlowModules
+		)
+		expect(resolved?.containingFlowPath).toBe('f/innermost')
+		expect(resolved?.module).toBeUndefined()
+	})
+})
diff --git a/frontend/src/lib/components/flows/expandedSubflowStep.ts b/frontend/src/lib/components/flows/expandedSubflowStep.ts
new file mode 100644
index 0000000000..0075897b09
--- /dev/null
+++ b/frontend/src/lib/components/flows/expandedSubflowStep.ts
@@ -0,0 +1,62 @@
+import type { FlowModule } from '$lib/gen'
+import { findStepPath, parseExpandedSubflowId } from '$lib/components/restartFromStepPath'
+
+export type ResolvedExpandedSubflowStep = {
+	/** The flow the selected step lives in, i.e. the innermost subflow crossed. */
+	containingFlowPath: string
+	/** Path of each subflow crossed from the edited flow down to the containing one. */
+	pathChain: string[]
+	/** The selected step, or `undefined` when the id points at something that isn't a
+	 * module of the containing flow (an AI agent tool node, a stale selection...). */
+	module: FlowModule | undefined
+}
+
+/**
+ * Graph node id of the expansion an inline-expanded subflow node sits in, i.e. the key
+ * whose modules hold the step it stands for: `subflow:a:b` → `a`, `subflow:a:b:c` →
+ * `subflow:a:b`. `undefined` for a top-level expansion, whose step belongs to the edited
+ * flow itself. Note that the last segment of `subflowSteps` is the parent's own step, so
+ * every segment stays in the parent key.
+ */
+export function expandedSubflowParentId(nodeId: string): string | undefined {
+	const steps = parseExpandedSubflowId(nodeId)?.subflowSteps
+	if (!steps) {
+		return undefined
+	}
+	return steps.length > 1 ? 'subflow:' + steps.join(':') : steps[0]
+}
+
+/**
+ * Resolves a `subflow:A:B:leaf` graph node id (an inline-expanded subflow step) to the
+ * step it stands for, following each `Flow{path}` boundary through the flows it points
+ * at. `loadFlowModules` fetches a flow's modules by path.
+ *
+ * Returns `undefined` when `id` is not an expanded-subflow node or a boundary can't be
+ * followed; a resolution whose `module` is undefined still carries the containing flow,
+ * which is enough to open it in the editor.
+ */
+export async function resolveExpandedSubflowStep(
+	id: string,
+	rootModules: FlowModule[],
+	loadFlowModules: (path: string) => Promise<FlowModule[]>
+): Promise<ResolvedExpandedSubflowStep | undefined> {
+	const parsed = parseExpandedSubflowId(id)
+	if (!parsed) {
+		return undefined
+	}
+	let modules = rootModules
+	const pathChain: string[] = []
+	for (const stepId of parsed.subflowSteps) {
+		const value = findStepPath(modules, stepId)?.target.value
+		if (value?.type !== 'flow') {
+			return undefined
+		}
+		pathChain.push(value.path)
+		modules = await loadFlowModules(value.path)
+	}
+	return {
+		containingFlowPath: pathChain[pathChain.length - 1],
+		pathChain,
+		module: findStepPath(modules, parsed.leaf)?.target
+	}
+}
diff --git a/frontend/src/lib/components/flows/flowDeleteController.test.ts b/frontend/src/lib/components/flows/flowDeleteController.test.ts
index b029ce702f..0a37e1ec7c 100644
--- a/frontend/src/lib/components/flows/flowDeleteController.test.ts
+++ b/frontend/src/lib/components/flows/flowDeleteController.test.ts
@@ -134,7 +134,11 @@ describe('flowDeleteController', () => {
 		expect(flowStore.val.value.modules.map((module) => module.id)).toEqual(['dependent_step'])
 		expect(flowStore.val.value.groups ?? []).toEqual([])
 		expect(Object.keys(flowStateStore.val)).toEqual(['dependent_step'])
-		expect(selectionManager.selectId).toHaveBeenCalledWith('dependent_step')
+		// The surviving step is selected as a side effect of the delete, so it must be
+		// marked as such — otherwise the modal step panel pops open on its own.
+		expect(selectionManager.selectId).toHaveBeenCalledWith('dependent_step', {
+			openPanel: false
+		})
 		expect(onDelete).toHaveBeenCalledWith('agent_step')
 	})
 })
diff --git a/frontend/src/lib/components/flows/flowDeleteController.ts b/frontend/src/lib/components/flows/flowDeleteController.ts
index 5fea6a4cc3..a1933ba080 100644
--- a/frontend/src/lib/components/flows/flowDeleteController.ts
+++ b/frontend/src/lib/components/flows/flowDeleteController.ts
@@ -56,7 +56,9 @@ export function executeDeletePlan(
 	if (plan.selection.kind === 'clear') {
 		args.selectionManager.clearSelection()
 	} else {
-		args.selectionManager.selectId(plan.selection.id)
+		// Whatever remains selected after a delete was not asked for, so it must not
+		// pop the modal panel open.
+		args.selectionManager.selectId(plan.selection.id, { openPanel: false })
 	}
 
 	if (plan.targets.some((target) => target.kind === 'preprocessor')) {
diff --git a/frontend/src/lib/components/flows/flowEditorTelemetry.test.ts b/frontend/src/lib/components/flows/flowEditorTelemetry.test.ts
new file mode 100644
index 0000000000..22174c7e14
--- /dev/null
+++ b/frontend/src/lib/components/flows/flowEditorTelemetry.test.ts
@@ -0,0 +1,71 @@
+import { describe, expect, it } from 'vitest'
+import {
+	createBreakpointTracker,
+	forcedPlacementEvent,
+	type FlowPanelPlacementEvent
+} from './flowEditorTelemetry'
+
+describe('createBreakpointTracker', () => {
+	it('counts a crossing into modal once, however many times the width settles', () => {
+		const events: FlowPanelPlacementEvent[] = []
+		const tracker = createBreakpointTracker((event) => events.push(event))
+
+		tracker.observe('auto', 'docked', true)
+		tracker.observe('auto', 'modal', true)
+		// A window drag re-resolves the mode continuously; the breakpoint activated once.
+		tracker.observe('auto', 'modal', true)
+		tracker.observe('auto', 'docked', true)
+		tracker.observe('auto', 'modal', true)
+
+		expect(events).toEqual(['breakpoint_modal', 'breakpoint_modal'])
+	})
+
+	it('does not re-count when a pin is released back to auto without moving the panel', () => {
+		const events: FlowPanelPlacementEvent[] = []
+		const tracker = createBreakpointTracker((event) => events.push(event))
+
+		tracker.observe('auto', 'modal', true)
+		// Pinning Detached on a narrow editor, then releasing it, leaves the panel modal
+		// throughout — re-arming on the preference alone would read that as a second crossing.
+		tracker.observe('modal', 'modal', true)
+		tracker.observe('auto', 'modal', true)
+
+		expect(events).toEqual(['breakpoint_modal'])
+	})
+
+	it('does not re-count when a remount reports an unmeasured editor', () => {
+		const events: FlowPanelPlacementEvent[] = []
+		const tracker = createBreakpointTracker((event) => events.push(event))
+
+		tracker.observe('auto', 'modal', true)
+		// A reload rebuilds the controller, which resolves to docked until its width lands.
+		// Reading that as the panel having docked would arm the tracker for a second crossing
+		// the user never made.
+		tracker.observe('auto', 'docked', false)
+		tracker.observe('auto', 'modal', true)
+
+		expect(events).toEqual(['breakpoint_modal'])
+	})
+
+	it('ignores a modal the user pinned', () => {
+		const events: FlowPanelPlacementEvent[] = []
+		const tracker = createBreakpointTracker((event) => events.push(event))
+
+		tracker.observe('modal', 'modal', true)
+		tracker.observe('docked', 'docked', true)
+
+		expect(events).toEqual([])
+	})
+})
+
+describe('forcedPlacementEvent', () => {
+	it('reports only the pins that move the panel', () => {
+		expect(forcedPlacementEvent('docked', 'modal')).toBe('force_attach')
+		expect(forcedPlacementEvent('modal', 'docked')).toBe('force_detach')
+		// Already where it is pinned to: a stated preference, not an override.
+		expect(forcedPlacementEvent('docked', 'docked')).toBeUndefined()
+		expect(forcedPlacementEvent('modal', 'modal')).toBeUndefined()
+		expect(forcedPlacementEvent('auto', 'modal')).toBeUndefined()
+		expect(forcedPlacementEvent('auto', 'docked')).toBeUndefined()
+	})
+})
diff --git a/frontend/src/lib/components/flows/flowEditorTelemetry.ts b/frontend/src/lib/components/flows/flowEditorTelemetry.ts
new file mode 100644
index 0000000000..3d826dc8d9
--- /dev/null
+++ b/frontend/src/lib/components/flows/flowEditorTelemetry.ts
@@ -0,0 +1,94 @@
+import { getContext, setContext } from 'svelte'
+import { logFeatureUsage } from '$lib/utils/featureUsage'
+import type { FlowPanelMode, FlowPanelPreference } from './panelPlacement'
+
+// Anonymous counters for where the flow editor's step panel ends up. Same rules as every
+// other `logFeatureUsage` caller: aggregated counts only, and the three keys below are the
+// whole vocabulary — no path, expression or step id ever reaches here.
+
+const FEATURE = 'flow_editor'
+const KIND = 'panel_placement'
+
+export type FlowPanelPlacementEvent =
+	/** The width moved the panel into the modal, under `auto`. */
+	| 'breakpoint_modal'
+	/** The user pinned the panel into the pane while it was in the modal. */
+	| 'force_attach'
+	/** The user pinned the panel out into the modal while it was in the pane. */
+	| 'force_detach'
+
+type Log = (event: FlowPanelPlacementEvent) => void
+
+const log: Log = (event) => logFeatureUsage(FEATURE, KIND, { key: event })
+
+/**
+ * The event a placement pin should produce, or nothing. `auto` is not a placement being
+ * forced, and a pin that matches where the panel already is moves nothing — the counters
+ * carry no width, so counting that would be indistinguishable from the override that did
+ * move the panel.
+ */
+export function forcedPlacementEvent(
+	preference: FlowPanelPreference,
+	mode: FlowPanelMode
+): FlowPanelPlacementEvent | undefined {
+	if (preference === mode) return undefined
+	if (preference === 'docked') return 'force_attach'
+	if (preference === 'modal') return 'force_detach'
+	return undefined
+}
+
+/**
+ * Counts the width moving the panel into the modal, once per crossing — `mode` re-resolves
+ * continuously as a drag settles, so counting per evaluation would read one drag as hundreds.
+ *
+ * Both guards below are there because a modal panel is not by itself a crossing: `wasModal`
+ * follows where the panel was rather than whether the breakpoint put it there, and an
+ * unmeasured editor is no placement at all. Rune-free so each edge is testable directly.
+ */
+export function createBreakpointTracker(emit: Log) {
+	let wasModal = false
+
+	return {
+		observe(preference: FlowPanelPreference, mode: FlowPanelMode, measured: boolean) {
+			if (!measured) return
+			if (mode === 'modal' && !wasModal && preference === 'auto') emit('breakpoint_modal')
+			wasModal = mode === 'modal'
+		}
+	}
+}
+
+export interface FlowPanelPlacementTelemetry {
+	/** The panel's current placement; emits `breakpoint_modal` on a crossing into the modal. */
+	observe(preference: FlowPanelPreference, mode: FlowPanelMode, measured: boolean): void
+	/** A placement the user pinned, against where the panel was when they pinned it. */
+	forced(preference: FlowPanelPreference, mode: FlowPanelMode): void
+}
+
+const CONTEXT_KEY = 'flowPanelPlacementTelemetry'
+
+const NOOP: FlowPanelPlacementTelemetry = { observe: () => {}, forced: () => {} }
+
+/**
+ * Published by `FlowBuilder`, above the `{#key}` that rebuilds the editor on a reload: a
+ * tracker recreated mid-edit would re-arm and count a still-narrow editor again.
+ *
+ * `enabled` is false in session preview tabs. Those stay mounted and laid out at panel width
+ * even while hidden, and that panel is narrower than the breakpoint by construction: their
+ * crossings would bury the ones this measures, and their overrides would then be read
+ * against a denominator that no longer contains them.
+ */
+export function setFlowPanelPlacementTelemetry(enabled: boolean): void {
+	const emit: Log = enabled ? log : () => {}
+	const tracker = createBreakpointTracker(emit)
+	setContext<FlowPanelPlacementTelemetry>(CONTEXT_KEY, {
+		observe: tracker.observe,
+		forced: (preference, mode) => {
+			const event = forcedPlacementEvent(preference, mode)
+			if (event) emit(event)
+		}
+	})
+}
+
+export function useFlowPanelPlacementTelemetry(): FlowPanelPlacementTelemetry {
+	return getContext<FlowPanelPlacementTelemetry | undefined>(CONTEXT_KEY) ?? NOOP
+}
diff --git a/frontend/src/lib/components/flows/flowPanelMode.svelte.ts b/frontend/src/lib/components/flows/flowPanelMode.svelte.ts
new file mode 100644
index 0000000000..1b595c53ea
--- /dev/null
+++ b/frontend/src/lib/components/flows/flowPanelMode.svelte.ts
@@ -0,0 +1,35 @@
+import { resolvePanelMode, type FlowPanelMode, type FlowPanelPreference } from './panelPlacement'
+
+/**
+ * Holds the step panel's placement preference and the editor's measured width, and reads
+ * the resolution off `resolvePanelMode`. The preference is not persisted: it lasts as long
+ * as the editor is open, so every flow opens on `auto` and a pin is a deliberate act each
+ * time.
+ */
+export function useFlowPanelMode(opts: { enabled: () => boolean }) {
+	let preference = $state<FlowPanelPreference>('auto')
+	let width = $state(0)
+
+	return {
+		get preference(): FlowPanelPreference {
+			return preference
+		},
+		set preference(next: FlowPanelPreference) {
+			preference = next
+		},
+		get mode(): FlowPanelMode {
+			return resolvePanelMode({ enabled: opts.enabled(), preference, width })
+		},
+		/**
+		 * Whether `mode` reflects a real layout. Until the first measurement lands, `mode` is
+		 * `docked` because that is the safe thing to render, not because the editor is wide.
+		 */
+		get measured(): boolean {
+			return width > 0
+		},
+		/** Fed by the editor root's measured width; drives `auto` in both directions. */
+		measure(measured: number | null | undefined) {
+			width = measured ?? 0
+		}
+	}
+}
diff --git a/frontend/src/lib/components/flows/flowStepSettings.test.ts b/frontend/src/lib/components/flows/flowStepSettings.test.ts
new file mode 100644
index 0000000000..7ecb138214
--- /dev/null
+++ b/frontend/src/lib/components/flows/flowStepSettings.test.ts
@@ -0,0 +1,140 @@
+import { describe, it, expect } from 'vitest'
+import type { FlowModule } from '$lib/gen'
+import { describeStepSettings, hasInlineConcurrency } from './flowStepSettings'
+
+const stepSettingsByKey = (...args: Parameters<typeof describeStepSettings>) =>
+	Object.fromEntries(describeStepSettings(...args).map((v) => [v.key, v]))
+
+function step(overrides: Partial<FlowModule> = {}): FlowModule {
+	return {
+		id: 'a',
+		value: { type: 'rawscript', language: 'bun', content: '', input_transforms: {} },
+		...overrides
+	} as FlowModule
+}
+
+describe('describeStepSettings', () => {
+	it('reports an untouched step as configured nowhere', () => {
+		expect(describeStepSettings(step()).filter((s) => s.configured)).toEqual([])
+	})
+
+	it('treats a sleep of 0 as configured and says so, rather than claiming it is off', () => {
+		// Switching Sleep on seeds `{ value: 0 }`; the row must not contradict the toggle.
+		const s = stepSettingsByKey(step({ sleep: { type: 'static', value: 0 } }))['sleep']
+		expect(s?.configured).toBe(true)
+		expect(s?.summary.text).toBe('0s after')
+		expect(s?.summary.state).toBe('configured')
+	})
+
+	it('does not let an empty stop_after_if mask a configured stop_after_all_iters_if', () => {
+		// Both can be set on a sequential loop.
+		const s = stepSettingsByKey(
+			step({
+				stop_after_if: { expr: '', skip_if_stopped: false },
+				stop_after_all_iters_if: { expr: 'result.done', skip_if_stopped: false }
+			})
+		)['early-stop']
+		expect(s?.configured).toBe(true)
+		expect(s?.summary.text).toBe('result.done')
+	})
+
+	it('describes retries with zero attempts instead of reporting None', () => {
+		const s = stepSettingsByKey(step({ retry: { constant: { attempts: 0, seconds: 5 } } }))[
+			'retries'
+		]
+		expect(s?.configured).toBe(true)
+		expect(s?.summary.text).toBe('0 attempts, constant')
+	})
+
+	it('reads concurrency and cache from the referenced script for workspace-script steps', () => {
+		const mod = step({ value: { type: 'script', path: 'u/me/s', input_transforms: {} } as any })
+		const off = stepSettingsByKey(mod)
+		expect(off['concurrency']?.configured).toBe(false)
+
+		const on = stepSettingsByKey(mod, { concurrent_limit: 3, cache_ttl: 60 })
+		expect(on['concurrency']?.configured).toBe(true)
+		expect(on['concurrency']?.summary.text).toBe('Max 3')
+		expect(on['cache']?.configured).toBe(true)
+	})
+
+	it("prefers the module's own cache_ttl over the referenced script's, like the worker", () => {
+		const mod = step({
+			cache_ttl: 3600,
+			value: { type: 'script', path: 'u/me/s', input_transforms: {} } as any
+		})
+		// No referenced settings loaded yet (the graph badges never load them), so a
+		// module-level TTL has to stand on its own here.
+		expect(stepSettingsByKey(mod)['cache']?.configured).toBe(true)
+		expect(stepSettingsByKey(mod, { cache_ttl: 60 })['cache']?.summary.text).toBe('1 h')
+	})
+
+	it('reports a non-positive inline concurrency as invalid, not as unset', () => {
+		const s = stepSettingsByKey(
+			step({
+				cache_ttl: -1,
+				value: {
+					type: 'rawscript',
+					language: 'bun',
+					content: '',
+					input_transforms: {},
+					concurrent_limit: -1
+				}
+			} as Partial<FlowModule>)
+		)
+		// `configured` means the step carries the config, so a value the user set counts
+		// even when the runtime ignores it — the summary is what says it is a no-op.
+		expect(s['concurrency']?.configured).toBe(true)
+		expect(s['concurrency']?.summary).toMatchObject({ text: 'Invalid limit', state: 'invalid' })
+		expect(s['cache']?.configured).toBe(true)
+		expect(s['cache']?.summary).toMatchObject({ text: 'No TTL set', state: 'invalid' })
+	})
+
+	it('treats a cleared concurrency input as present, not as unset', () => {
+		// Emptying a number input binds `null`, not `undefined`. Reading that as unset is
+		// what disabled the field the user was editing, so presence must be strict.
+		const mod = step({
+			value: {
+				type: 'rawscript',
+				language: 'bun',
+				content: '',
+				input_transforms: {},
+				concurrent_limit: null
+			}
+		} as unknown as Partial<FlowModule>)
+		// Presence keeps the setting editor's controls live while the field is empty.
+		expect(hasInlineConcurrency(mod)).toBe(true)
+		expect(stepSettingsByKey(mod)['concurrency']?.summary).toMatchObject({
+			text: 'Invalid limit',
+			state: 'invalid'
+		})
+	})
+
+	it('omits settings that do not apply to the step type', () => {
+		const subflow = step({ value: { type: 'flow', path: 'u/me/f' } as any })
+		expect(describeStepSettings(subflow).some((s) => s.key === 'concurrency')).toBe(false)
+		expect(describeStepSettings(step()).some((s) => s.key === 'concurrency')).toBe(true)
+	})
+
+	it('marks an invalid retry config as invalid rather than configured', () => {
+		const s = stepSettingsByKey(
+			step({ retry: { exponential: { attempts: 2, multiplier: 1, seconds: -1 } } })
+		)['retries']
+		expect(s?.summary.state).toBe('invalid')
+	})
+
+	it('labels early stop for trigger steps by what it means there', () => {
+		const trigger = step({
+			value: {
+				type: 'rawscript',
+				language: 'bun',
+				content: '',
+				input_transforms: {},
+				is_trigger: true
+			} as any
+		})
+		expect(stepSettingsByKey(trigger)['early-stop']?.tooltip).toBe(
+			'Stop early if there are no new events'
+		)
+		expect(stepSettingsByKey(step())['early-stop']?.tooltip).toBe('Early stop / break')
+	})
+})
diff --git a/frontend/src/lib/components/flows/flowStepSettings.ts b/frontend/src/lib/components/flows/flowStepSettings.ts
new file mode 100644
index 0000000000..9c995a93a9
--- /dev/null
+++ b/frontend/src/lib/components/flows/flowStepSettings.ts
@@ -0,0 +1,362 @@
+import {
+	ChevronsUp,
+	CircleStop,
+	Combine,
+	Database,
+	Gauge,
+	Hand,
+	Moon,
+	RefreshCw,
+	ShieldAlert,
+	SkipForward,
+	Timer,
+	Trash2
+} from 'lucide-svelte'
+import type { FlowModule } from '$lib/gen'
+import type { ScriptAdvancedSettingsFields } from '$lib/components/scriptSettings'
+import { validateRetryConfig } from '$lib/utils'
+
+// Single source for the per-step runtime settings: which apply, which are configured,
+// and how each reads back. Graph badges, the run-settings accordion and the setting
+// editors all read it here so they cannot drift. Script-level twin: `scriptSettings.ts`.
+
+export type StepSettingKey =
+	| 'skip'
+	| 'early-stop'
+	| 'suspend'
+	| 'sleep'
+	| 'retries'
+	| 'error-handling'
+	| 'timeout'
+	| 'concurrency'
+	| 'priority'
+	| 'cache'
+	| 'debounce'
+	| 'lifetime'
+
+export type StepSettingSummary = {
+	text: string
+	state: 'configured' | 'default' | 'invalid'
+	/** Render the text as code (it is a user-written expression). */
+	mono?: boolean
+}
+
+export type StepSettingView = {
+	key: StepSettingKey
+	label: string
+	/** Longer wording for hover surfaces; falls back to `label`. */
+	tooltip: string
+	icon: any
+	/** The setting's config is present on the step. Deliberately not "the runtime
+	 *  would behave differently" — a configured setting can still be a no-op
+	 *  (a sleep of 0), and `summary` says so rather than claiming it is off. */
+	configured: boolean
+	summary: StepSettingSummary
+}
+
+/** A step whose script polls an external system and returns the new items. */
+export function isTriggerStep(module: FlowModule | undefined): boolean {
+	return (
+		module?.value != undefined &&
+		(module.value.type === 'script' || module.value.type === 'rawscript') &&
+		module.value.is_trigger === true
+	)
+}
+
+const def = (text: string): StepSettingSummary => ({ text, state: 'default' })
+const inv = (text: string): StepSettingSummary => ({ text, state: 'invalid' })
+const cfg = (text: string, mono = false): StepSettingSummary => ({
+	text,
+	state: 'configured',
+	mono
+})
+
+function formatDur(s: number | undefined): string {
+	if (s == null) return ''
+	if (s < 60) return `${s}s`
+	if (s < 3600) return `${Math.round(s / 60)} min`
+	return `${Math.round(s / 3600)} h`
+}
+
+/** Describe a user-written predicate. An empty expression is still configured —
+ *  the setting is on, it just has nothing to evaluate yet. */
+function exprSummary(expr: string | undefined): StepSettingSummary {
+	const e = expr?.trim()
+	if (!e) return cfg('No expression')
+	return e.length <= 24 ? cfg(e, true) : cfg('Expression set')
+}
+
+type Ctx = { referenced?: ScriptAdvancedSettingsFields }
+
+type SettingSpec = {
+	label: string
+	tooltip?: (mod: FlowModule) => string
+	icon: any
+	applies?: (mod: FlowModule) => boolean
+	configured: (mod: FlowModule, ctx: Ctx) => boolean
+	summarize: (mod: FlowModule, ctx: Ctx) => StepSettingSummary
+}
+
+// A value the step itself carries counts as configured even when the runtime would
+// ignore it — `summary` is what reports the no-op, and the setting editors keep their
+// controls live on presence so clearing a field mid-edit can't disable it. Only values
+// read off a referenced workspace script use the runtime's `> 0` test: nobody is typing
+// into those, and 0 there simply means the script has no limit.
+const isWorkspaceScript = (mod: FlowModule) => mod.value.type === 'script'
+const inlineConcurrentLimit = (mod: FlowModule) =>
+	mod.value.type === 'rawscript' ? mod.value.concurrent_limit : undefined
+const effectiveCacheTtl = (mod: FlowModule, ctx: Ctx) =>
+	mod.cache_ttl ?? (isWorkspaceScript(mod) ? ctx.referenced?.cache_ttl : undefined)
+
+/** Whether an inline step carries a concurrency limit at all. The setting editor keeps its
+ *  controls live on presence, so clearing the field mid-edit can't disable the input. A
+ *  present-but-non-positive limit is surfaced as invalid rather than silently as "None".
+ *  Strict: an emptied number input binds to `null`, which is still a value being typed. */
+export function hasInlineConcurrency(mod: FlowModule): boolean {
+	return inlineConcurrentLimit(mod) !== undefined
+}
+
+/** Canonical order — every surface lists settings in this sequence. */
+const SPECS: { key: StepSettingKey; spec: SettingSpec }[] = [
+	{
+		key: 'skip',
+		spec: {
+			label: 'Skip if',
+			icon: SkipForward,
+			configured: (m) => Boolean(m.skip_if),
+			summarize: (m) => (m.skip_if ? exprSummary(m.skip_if.expr) : def('Off'))
+		}
+	},
+	{
+		key: 'early-stop',
+		spec: {
+			label: 'Early stop / break',
+			tooltip: (m) =>
+				isTriggerStep(m) ? 'Stop early if there are no new events' : 'Early stop / break',
+			icon: CircleStop,
+			configured: (m) => m.stop_after_if != undefined || m.stop_after_all_iters_if != undefined,
+			summarize: (m) => {
+				// Both can be set on a sequential loop, so pick the first that carries an
+				// expression instead of letting an empty one mask the other.
+				const exprs = [m.stop_after_if?.expr, m.stop_after_all_iters_if?.expr].filter(
+					(e) => e != undefined
+				)
+				if (exprs.length === 0) return def('Off')
+				return exprSummary(exprs.find((e) => e?.trim()) ?? exprs[0])
+			}
+		}
+	},
+	{
+		key: 'suspend',
+		spec: {
+			label: 'Suspend until approval/resume',
+			icon: Hand,
+			configured: (m) => Boolean(m.suspend),
+			summarize: (m) => {
+				if (!m.suspend) return def('Off')
+				const n = m.suspend.required_events ?? 1
+				return cfg(`${n} approval${n > 1 ? 's' : ''}`)
+			}
+		}
+	},
+	{
+		key: 'sleep',
+		spec: {
+			label: 'Sleep',
+			icon: Moon,
+			configured: (m) => Boolean(m.sleep),
+			summarize: (m) => {
+				const s = m.sleep
+				if (!s) return def('Off')
+				if (s.type === 'static') {
+					const v = Number(s.value)
+					return Number.isFinite(v) ? cfg(`${formatDur(v)} after`) : cfg('Dynamic')
+				}
+				return cfg('Dynamic')
+			}
+		}
+	},
+	{
+		key: 'retries',
+		spec: {
+			label: 'Retries',
+			icon: RefreshCw,
+			configured: (m) => m.retry?.constant != undefined || m.retry?.exponential != undefined,
+			summarize: (m) => {
+				const r = m.retry
+				if (r?.constant == undefined && r?.exponential == undefined) return def('None')
+				if (validateRetryConfig(r)) return { text: 'Invalid', state: 'invalid' }
+				const isConstant = r?.constant != undefined
+				const n = (isConstant ? r?.constant?.attempts : r?.exponential?.attempts) ?? 0
+				const kind = isConstant ? 'constant' : 'exponential'
+				return cfg(`${n} attempt${n === 1 ? '' : 's'}, ${kind}`)
+			}
+		}
+	},
+	{
+		key: 'error-handling',
+		spec: {
+			label: 'Error handling',
+			icon: ShieldAlert,
+			configured: (m) => Boolean(m.continue_on_error),
+			summarize: (m) => (m.continue_on_error ? cfg('Continue on error') : def('Off'))
+		}
+	},
+	{
+		key: 'timeout',
+		spec: {
+			label: 'Timeout',
+			icon: Timer,
+			configured: (m) => m.timeout != null,
+			summarize: (m) => {
+				const t = m.timeout
+				if (t == null) return def('None')
+				if (typeof t === 'number') return cfg(formatDur(t))
+				if (t.type === 'static') {
+					const v = Number(t.value)
+					return Number.isFinite(v) ? cfg(formatDur(v)) : cfg('Dynamic')
+				}
+				return cfg('Dynamic')
+			}
+		}
+	},
+	{
+		key: 'concurrency',
+		spec: {
+			label: 'Concurrency limit',
+			icon: Gauge,
+			applies: (m) => m.value.type === 'rawscript' || m.value.type === 'script',
+			// Presence for the step's own limit (the user may be mid-edit, and `summary` says
+			// when it is a no-op), effectiveness for the referenced script's — a remote
+			// value nobody is typing into, where 0 just means the script has no limit.
+			configured: (m, ctx) =>
+				isWorkspaceScript(m)
+					? ctx.referenced?.concurrent_limit != undefined && ctx.referenced.concurrent_limit > 0
+					: hasInlineConcurrency(m),
+			summarize: (m, ctx) => {
+				if (isWorkspaceScript(m)) {
+					const l = ctx.referenced?.concurrent_limit
+					return l != undefined && l > 0 ? cfg(`Max ${l}`) : def('None')
+				}
+				const l = inlineConcurrentLimit(m)
+				if (l === undefined) return def('None')
+				if (!(l > 0)) return inv('Invalid limit')
+				const key = m.value.type === 'rawscript' ? m.value.custom_concurrency_key : undefined
+				return cfg(`Max ${l}${key ? ' per key' : ''}`)
+			}
+		}
+	},
+	{
+		key: 'priority',
+		spec: {
+			label: 'Priority',
+			icon: ChevronsUp,
+			configured: (m) => m.priority !== undefined,
+			summarize: (m) => {
+				if (m.priority === undefined) return def('Off')
+				// 0 is how the runtime spells "no priority".
+				return m.priority > 0 ? cfg('High priority') : inv('No priority set')
+			}
+		}
+	},
+	{
+		key: 'cache',
+		spec: {
+			label: 'Cache results',
+			icon: Database,
+			// The worker takes the module's cache_ttl over the referenced script's, so a
+			// module-level TTL must show here even for a workspace-script step.
+			configured: (m, ctx) =>
+				m.cache_ttl !== undefined || (isWorkspaceScript(m) && (ctx.referenced?.cache_ttl ?? 0) > 0),
+			summarize: (m, ctx) => {
+				const ttl = effectiveCacheTtl(m, ctx)
+				if (ttl === undefined) return def('Off')
+				return ttl > 0 ? cfg(formatDur(ttl)) : inv('No TTL set')
+			}
+		}
+	},
+	{
+		key: 'debounce',
+		spec: {
+			label: 'Debounce',
+			icon: Combine,
+			configured: (m) => m.debouncing?.debounce_delay_s !== undefined,
+			summarize: (m) => {
+				const d = m.debouncing?.debounce_delay_s
+				if (d === undefined) return def('Off')
+				return d > 0 ? cfg(`${formatDur(d)} debounce`) : inv('No delay set')
+			}
+		}
+	},
+	{
+		key: 'lifetime',
+		spec: {
+			label: 'Lifetime',
+			icon: Trash2,
+			configured: (m) => m.delete_after_secs != null,
+			summarize: (m) => {
+				const s = m.delete_after_secs
+				if (s == null) return def('Off')
+				return s === 0 ? cfg('Delete now') : cfg(`Delete after ${formatDur(s)}`)
+			}
+		}
+	}
+]
+
+/** The settings that apply to this step, in canonical order.
+ *  `referenced` supplies the workspace script's own settings for `script` steps,
+ *  whose concurrency and cache live on the script rather than on the step. */
+export function describeStepSettings(
+	mod: FlowModule,
+	referenced?: ScriptAdvancedSettingsFields
+): StepSettingView[] {
+	const ctx: Ctx = { referenced }
+	return SPECS.filter(({ spec }) => spec.applies?.(mod) ?? true).map(({ key, spec }) => ({
+		key,
+		label: spec.label,
+		tooltip: spec.tooltip?.(mod) ?? spec.label,
+		icon: spec.icon,
+		configured: spec.configured(mod, ctx),
+		summary: spec.summarize(mod, ctx)
+	}))
+}
+
+/** How a trigger step decides it has nothing to process. Stored on the step at
+ *  creation, so changing it only affects newly created steps. */
+// Falsy-or-empty, not `result == undefined`: a trigger returning nothing new may say so
+// with any empty value, and stopping is always the right response.
+const TRIGGER_STOP_EXPR = '!result || (Array.isArray(result) && result.length == 0)'
+
+/** The config a setting is seeded with when it is switched on. Read by the setting
+ *  editors and by every path that creates a step, so both agree. Settings absent from
+ *  this map have no seeded config (the editor writes the value directly). */
+const DEFAULTS = {
+	skip: () => ({ expr: 'false' }),
+	'early-stop': (kind?: 'trigger' | 'end') =>
+		kind === 'trigger'
+			? { expr: TRIGGER_STOP_EXPR, skip_if_stopped: true }
+			: kind === 'end'
+				? { expr: 'true', skip_if_stopped: false }
+				: {
+						expr: 'result == undefined',
+						skip_if_stopped: false,
+						error_message: undefined,
+						error_include_result: false
+					},
+	suspend: () => ({ required_events: 1, timeout: 1800 }),
+	sleep: () => ({ type: 'static' as const, value: 0 }),
+	cache: () => 600,
+	lifetime: () => 0,
+	priority: () => 100
+} satisfies Partial<Record<StepSettingKey, (kind?: 'trigger' | 'end') => unknown>>
+
+export type SeededSettingKey = keyof typeof DEFAULTS
+
+/** Seeded config for a setting. Typed per key, so an unhandled key is a compile
+ *  error rather than a silent `undefined`. */
+export function stepSettingDefaults<K extends SeededSettingKey>(
+	key: K,
+	kind?: 'trigger' | 'end'
+): ReturnType<(typeof DEFAULTS)[K]> {
+	return DEFAULTS[key](kind) as ReturnType<(typeof DEFAULTS)[K]>
+}
diff --git a/frontend/src/lib/components/flows/header/FlowPreviewButtons.svelte b/frontend/src/lib/components/flows/header/FlowPreviewButtons.svelte
index dbebc82f70..0e92ee8a5e 100644
--- a/frontend/src/lib/components/flows/header/FlowPreviewButtons.svelte
+++ b/frontend/src/lib/components/flows/header/FlowPreviewButtons.svelte
@@ -169,7 +169,12 @@
 </Button>
 
 {#if !loading}
-	<Drawer bind:open={previewOpen} size="75%" {preventEscape} alwaysOpen={deferContent}>
+	<Drawer
+		bind:open={previewOpen}
+		size="75%"
+		{preventEscape}
+		alwaysOpen={deferContent}
+	>
 		<FlowPreviewContent
 			bind:this={flowPreviewContent}
 			open={previewOpen}
diff --git a/frontend/src/lib/components/flows/header/FlowYamlEditor.svelte b/frontend/src/lib/components/flows/header/FlowYamlEditor.svelte
index 51d1f07d3f..9879b2899b 100644
--- a/frontend/src/lib/components/flows/header/FlowYamlEditor.svelte
+++ b/frontend/src/lib/components/flows/header/FlowYamlEditor.svelte
@@ -31,6 +31,23 @@
 		editor?.setCode(code)
 	}
 
+	/** `value` is assigned unconditionally below and `FlowEditor` dereferences
+	 * `flowStore.val.value.modules`, so an OpenFlow document missing it takes the
+	 * whole editor down mid-render — after the toast has already claimed success.
+	 * Reject it up front instead. */
+	function validateShape(parsed: unknown) {
+		if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+			throw new Error('the document must be a mapping (key: value)')
+		}
+		const value = (parsed as Record<string, unknown>).value
+		if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+			throw new Error("missing 'value' - paste a whole OpenFlow document, not just its value")
+		}
+		if (!Array.isArray((value as Record<string, unknown>).modules)) {
+			throw new Error("'value.modules' must be a list")
+		}
+	}
+
 	function validateGroups(groups: { start_id: string; end_id: string }[] | undefined) {
 		if (!groups) return
 		const seen = new Set<string>()
@@ -46,6 +63,7 @@
 	function apply() {
 		try {
 			const parsed = YAML.parse(code)
+			validateShape(parsed)
 			validateGroups(parsed.value?.groups)
 			if (parsed.summary && typeof parsed.summary === 'string') {
 				flowStore.val.summary = parsed.summary
@@ -65,6 +83,9 @@
 			if (parsed['on_behalf_of_email'] !== undefined) {
 				flowStore.val.on_behalf_of_email = parsed['on_behalf_of_email']
 			}
+			if (parsed['on_behalf_of'] !== undefined) {
+				flowStore.val.on_behalf_of = parsed['on_behalf_of']
+			}
 			flowStore.val.value = parsed.value
 			flowStore.val.schema = parsed.schema
 			flowStore.val.tag = parsed.tag
@@ -101,6 +122,7 @@
 						minHeight={editorHeight}
 						bind:code
 						lang="yaml"
+						leadingChangeSync
 					/>
 				</div>
 			{/await}
diff --git a/frontend/src/lib/components/flows/map/FlowErrorHandlerItem.svelte b/frontend/src/lib/components/flows/map/FlowErrorHandlerItem.svelte
index fbf909bba9..9e6a18d82c 100644
--- a/frontend/src/lib/components/flows/map/FlowErrorHandlerItem.svelte
+++ b/frontend/src/lib/components/flows/map/FlowErrorHandlerItem.svelte
@@ -61,6 +61,13 @@
 		refreshFlowStateStore(flowStore)
 	}
 
+	function deleteFailureModule() {
+		flowStore.val.value.failure_module = undefined
+		// The panel has to land somewhere once the error handler is gone, but that is a
+		// consequence of the delete — not a request to see the flow's settings.
+		selectionManager.selectId('settings-metadata', { openPanel: false })
+	}
+
 	const smallFailureModule = $derived(!(failureModuleId && diffManager && moduleAction) && compact)
 </script>
 
@@ -103,10 +110,7 @@
 					title="Delete failure script"
 					type="button"
 					class="ml-1"
-					onclick={() => {
-						flowStore.val.value.failure_module = undefined
-						selectionManager.selectId('settings-metadata')
-					}}
+					onclick={deleteFailureModule}
 				>
 					<X size={12} />
 				</button>
@@ -117,10 +121,7 @@
 				title="Delete failure script"
 				type="button"
 				class="absolute -top-1.5 -right-1.5 rounded-full bg-surface border border-border p-0.5 hover:bg-surface-hover"
-				onclick={() => {
-					flowStore.val.value.failure_module = undefined
-					selectionManager.selectId('settings-metadata')
-				}}
+				onclick={deleteFailureModule}
 			>
 				<X size={10} />
 			</button>
diff --git a/frontend/src/lib/components/flows/map/FlowModuleSchemaItem.svelte b/frontend/src/lib/components/flows/map/FlowModuleSchemaItem.svelte
index de949a6dd9..6aeaa14f35 100644
--- a/frontend/src/lib/components/flows/map/FlowModuleSchemaItem.svelte
+++ b/frontend/src/lib/components/flows/map/FlowModuleSchemaItem.svelte
@@ -4,23 +4,8 @@
 	import Popover from '$lib/components/Popover.svelte'
 	import DropdownV2 from '$lib/components/DropdownV2.svelte'
 	import { classNames, type Item, type StateStore } from '$lib/utils'
-	import {
-		Bed,
-		Database,
-		Gauge,
-		EllipsisVertical,
-		PhoneIncoming,
-		Repeat,
-		Square,
-		SkipForward,
-		Pin,
-		X,
-		Play,
-		Loader2,
-		TriangleAlert,
-		Timer,
-		Maximize2
-	} from 'lucide-svelte'
+	import { EllipsisVertical, Pin, X, Play, Loader2, TriangleAlert, Maximize2 } from 'lucide-svelte'
+	import type { StepSettingView } from '../flowStepSettings'
 	import { createEventDispatcher, getContext, untrack } from 'svelte'
 	import { fade } from 'svelte/transition'
 	import type { FlowEditorContext } from '../types'
@@ -55,12 +40,8 @@
 		selected?: boolean
 		deletable?: boolean
 		moduleAction: ModuleActionInfo | undefined
-		retry?: boolean
-		cache?: boolean
-		earlyStop?: boolean
-		skip?: boolean
-		suspend?: boolean
-		sleep?: boolean
+		/** Configured settings to badge, from flowStepSettings. */
+		settings?: StepSettingView[]
 		mock?:
 			| {
 					enabled?: boolean
@@ -72,12 +53,8 @@
 		label: string
 		path?: string
 		nodeState?: FlowNodeState
-		concurrency?: boolean
-		// TODO: Implement for this one. See how concurrency is implemented.
-		debouncing?: boolean
 		retries?: number | undefined
 		warningMessage?: string | undefined
-		isTrigger?: boolean
 		editMode?: boolean
 		alwaysShowOutputPicker?: boolean
 		loopStatus?: { type: 'inside' | 'self'; flow: 'forloopflow' | 'whileloopflow' } | undefined
@@ -97,23 +74,15 @@
 		selected = false,
 		deletable = false,
 		moduleAction = undefined,
-		retry = false,
-		cache = false,
-		earlyStop = false,
-		skip = false,
-		suspend = false,
-		sleep = false,
+		settings = [],
 		mock = { enabled: false },
 		bold = false,
 		id = undefined,
 		label,
 		path = '',
 		nodeState,
-		concurrency = false,
-		debouncing = false,
 		retries = undefined,
 		warningMessage = undefined,
-		isTrigger = false,
 		editMode = false,
 		alwaysShowOutputPicker = false,
 		loopStatus = undefined,
@@ -304,112 +273,23 @@
 			class="absolute text-sm right-2 flex flex-row gap-1 z-10 transition-all duration-100"
 			style={`bottom: ${outputPickerBarOpen ? '-38px' : '-12px'}`}
 		>
-			{#if retry}
+			{#each settings as s (s.key)}
+				{@const Icon = s.icon}
 				<Popover notClickable>
 					<div
 						transition:fade|local={{ duration: 200 }}
 						class="center-center rounded border bg-surface border-gray-400 text-secondary px-1 py-0.5"
 					>
-						{#if retries}<span class="text-red-400 mr-2">{retries}</span>{/if}
-						<Repeat size={12} />
+						{#if s.key === 'retries' && retries}<span class="text-red-400 mr-2">{retries}</span
+							>{/if}
+						<Icon size={12} />
 					</div>
 					{#snippet text()}
-						Retries
+						{s.tooltip}
+						<span class={s.summary.mono ? 'font-mono' : ''}>· {s.summary.text}</span>
 					{/snippet}
 				</Popover>
-			{/if}
-
-			{#if concurrency}
-				<Popover notClickable>
-					<div
-						transition:fade|local={{ duration: 200 }}
-						class="center-center rounded border bg-surface border-gray-400 text-secondary px-1 py-0.5"
-					>
-						<Gauge size={12} />
-					</div>
-					{#snippet text()}
-						Concurrency Limits
-					{/snippet}
-				</Popover>
-			{/if}
-			{#if debouncing}
-				<Popover notClickable>
-					<div
-						transition:fade|local={{ duration: 200 }}
-						class="center-center rounded border bg-surface border-gray-400 text-secondary px-1 py-0.5"
-					>
-						<Timer size={12} />
-					</div>
-					{#snippet text()}
-						Debouncing
-					{/snippet}
-				</Popover>
-			{/if}
-			{#if cache}
-				<Popover notClickable>
-					<div
-						transition:fade|local={{ duration: 200 }}
-						class="center-center rounded border bg-surface border-gray-400 text-secondary px-1 py-0.5"
-					>
-						<Database size={12} />
-					</div>
-					{#snippet text()}
-						Cached
-					{/snippet}
-				</Popover>
-			{/if}
-			{#if earlyStop}
-				<Popover notClickable>
-					<div
-						transition:fade|local={{ duration: 200 }}
-						class="center-center bg-surface rounded border border-gray-400 text-secondary px-1 py-0.5"
-					>
-						<Square size={12} />
-					</div>
-					{#snippet text()}
-						{isTrigger ? 'Stop early if there are no new events' : 'Early stop/break'}
-					{/snippet}
-				</Popover>
-			{/if}
-			{#if skip}
-				<Popover notClickable>
-					<div
-						transition:fade|local={{ duration: 200 }}
-						class="center-center bg-surface rounded border border-gray-400 text-secondary px-1 py-0.5"
-					>
-						<SkipForward size={12} />
-					</div>
-					{#snippet text()}
-						Skip
-					{/snippet}
-				</Popover>
-			{/if}
-			{#if suspend}
-				<Popover notClickable>
-					<div
-						transition:fade|local={{ duration: 200 }}
-						class="center-center bg-surface rounded border border-gray-400 text-secondary px-1 py-0.5"
-					>
-						<PhoneIncoming size={12} />
-					</div>
-					{#snippet text()}
-						Suspend
-					{/snippet}
-				</Popover>
-			{/if}
-			{#if sleep}
-				<Popover notClickable>
-					<div
-						transition:fade|local={{ duration: 200 }}
-						class="center-center bg-surface rounded border border-gray-400 text-secondary px-1 py-0.5"
-					>
-						<Bed size={12} />
-					</div>
-					{#snippet text()}
-						Sleep
-					{/snippet}
-				</Popover>
-			{/if}
+			{/each}
 			{#if mock?.enabled}
 				<Popover notClickable>
 					<button
@@ -469,6 +349,7 @@
 							{onUpdateMock}
 							{path}
 							{loopStatus}
+							logsToggle
 							rightMargin
 							historyOffset={{ mainAxis: 12, crossAxis: -9 }}
 							clazz="p-1"
diff --git a/frontend/src/lib/components/flows/map/FlowModuleSchemaItemViewer.svelte b/frontend/src/lib/components/flows/map/FlowModuleSchemaItemViewer.svelte
index 00fc9e2c9b..a0ec4759f5 100644
--- a/frontend/src/lib/components/flows/map/FlowModuleSchemaItemViewer.svelte
+++ b/frontend/src/lib/components/flows/map/FlowModuleSchemaItemViewer.svelte
@@ -3,6 +3,12 @@
 	import Badge from '$lib/components/common/badge/Badge.svelte'
 	import type { FlowNodeColorClasses } from '$lib/components/graph'
 	import { twMerge } from 'tailwind-merge'
+	import { getContext } from 'svelte'
+
+	// Detached mode (sessions): a step's editor is hidden until asked for, so add the
+	// hint to the name tooltip. Provided by FlowEditor; absent (=> false) elsewhere.
+	const stepExploreHint = getContext<(() => boolean) | undefined>('flowGraphStepExploreHint')
+	const showExploreHint = $derived(stepExploreHint?.() ?? false)
 
 	let iconWidth: number = $state(0)
 	let idBadgeWidth: number | undefined = $state(undefined)
@@ -55,6 +61,9 @@
 			<div>
 				<div>{label}</div>
 				{#if path != ''}<div>{path}</div>{/if}
+				{#if showExploreHint}
+					<div class="mt-1 text-tertiary">double click, or click again, to explore</div>
+				{/if}
 			</div>
 		{/snippet}
 	</Popover>
diff --git a/frontend/src/lib/components/flows/map/FlowModuleSchemaMap.svelte b/frontend/src/lib/components/flows/map/FlowModuleSchemaMap.svelte
index 82f91306c0..c98c10b1a2 100644
--- a/frontend/src/lib/components/flows/map/FlowModuleSchemaMap.svelte
+++ b/frontend/src/lib/components/flows/map/FlowModuleSchemaMap.svelte
@@ -8,7 +8,6 @@
 		createBranches,
 		createLoop,
 		createWhileLoop,
-		deleteFlowStateById,
 		emptyModule,
 		pickScript,
 		pickFlow,
@@ -17,12 +16,14 @@
 	} from '$lib/components/flows/flowStateUtils.svelte'
 	import type { FlowModule, Job, ScriptLang } from '$lib/gen'
 	import { emptyFlowModuleState } from '../utils.svelte'
+	import { stepSettingDefaults } from '../flowStepSettings'
 
 	import { dfs } from '../dfs'
 	import { nextId, copyId } from '../flowModuleNextId'
 	import { push } from '$lib/history.svelte'
 	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
 	import Portal from '$lib/components/Portal.svelte'
+	import { overlayPortalTarget } from '$lib/components/common/overlayHost.svelte'
 
 	import { locateModules, groupByParent } from '../multiSelectUtils'
 	import { workspaceStore } from '$lib/stores'
@@ -34,6 +35,7 @@
 	import type { PropPickerContext } from '$lib/components/prop_picker'
 	import { JobService } from '$lib/gen'
 	import { findModuleInFlow } from '../flowTree'
+	import { addBranch as addBranchOp, removeBranch as removeBranchOp } from '../branchOps'
 	import type { InlineScript, InsertKind } from '$lib/components/graph/graphBuilder.svelte'
 	import { MoveManager } from '$lib/components/graph/moveManager.svelte'
 	import { refreshFlowStateStore } from '../flowStoreRefresh.svelte'
@@ -202,15 +204,12 @@
 		flowStateStore.val[module.id] = state
 
 		if (kind == 'approval') {
-			module.suspend = { required_events: 1, timeout: 1800 }
+			module.suspend = stepSettingDefaults('suspend')
 		} else if (kind == 'trigger') {
-			module.stop_after_if = {
-				expr: '!result || (Array.isArray(result) && result.length == 0)',
-				skip_if_stopped: true
-			}
+			module.stop_after_if = stepSettingDefaults('early-stop', 'trigger')
 		} else if (kind == 'end') {
 			module.summary = 'Terminate flow'
-			module.stop_after_if = { skip_if_stopped: false, expr: 'true' }
+			module.stop_after_if = stepSettingDefaults('early-stop', 'end')
 		}
 
 		return module
@@ -271,55 +270,40 @@
 	}
 
 	export async function addBranch(id: string) {
-		push(history, flowStore.val)
-		let module = findModuleById(id)
-
-		if (!module) {
-			throw new Error(`Node ${id} not found`)
-		}
-
-		if (module.value.type === 'branchone' || module.value.type === 'branchall') {
-			module.value.branches.splice(module.value.branches.length, 0, {
-				summary: '',
-				expr: 'false',
-				modules: []
-			})
-		}
+		addBranchOp(id, { flowStore, history })
 	}
 
 	export function removeBranch(id: string, index: number) {
-		push(history, flowStore.val)
-		let module = findModuleById(id)
-
-		if (!module) {
-			throw new Error(`Node ${id} not found`)
-		}
-
-		if (module.value.type === 'branchone' || module.value.type === 'branchall') {
-			const offset = module.value.type === 'branchone' ? 1 : 0
-
-			if (module.value.branches[index - offset]?.modules) {
-				const leaves = dfs(module.value.branches[index - offset].modules, (mod) => mod.id)
-				leaves.forEach((leafId: string) => deleteFlowStateById(leafId, flowStateStore))
-			}
-
-			module.value.branches.splice(index - offset, 1)
-		}
+		removeBranchOp(id, index, { flowStore, flowStateStore, history })
 	}
 
-	type PendingDeleteConfirmation = {
-		plan: DeletePlan
-	}
-
-	type PendingGroupAction = {
-		groups: FlowGroup[]
+	// A single delete can have several consequences at once (emptied groups *and*
+	// dependent steps); they are confirmed together so one user action never raises
+	// more than one dialog.
+	type PendingModuleAction = {
 		label: 'delete' | 'move'
+		stepCount: number
+		groups: FlowGroup[]
+		dependents: Record<string, string[]>
 		confirm: () => void
 		cancel?: () => void
 	}
 
-	let pendingDeleteConfirmation: PendingDeleteConfirmation | undefined = $state(undefined)
-	let pendingGroupAction: PendingGroupAction | undefined = $state(undefined)
+	// The modal keeps rendering `pendingModuleAction` while it fades out, so visibility is
+	// driven by `moduleActionOpen` rather than by clearing the value — clearing it would
+	// blank the dialog mid-transition. `moduleActionOpen` also makes confirm/cancel
+	// one-shot: the buttons stay clickable until the fade ends.
+	let pendingModuleAction: PendingModuleAction | undefined = $state(undefined)
+	let moduleActionOpen = $state(false)
+
+	function askModuleAction(action: PendingModuleAction) {
+		pendingModuleAction = action
+		moduleActionOpen = true
+	}
+
+	function stepNoun(action: PendingModuleAction | undefined) {
+		return (action?.stepCount ?? 1) > 1 ? 'steps' : 'step'
+	}
 
 	let graph: FlowGraphV2 | undefined = $state(undefined)
 	let noteMode = $state(false)
@@ -336,6 +320,10 @@
 		graph?.enableNotes?.()
 	}
 
+	export function reloadExpandedSubflows(): void {
+		graph?.reloadExpandedSubflows?.()
+	}
+
 	function toggleNoteMode() {
 		noteMode = !noteMode
 	}
@@ -362,23 +350,20 @@
 			return
 		}
 
-		const proceed = () => {
-			if (request.needsDependencyConfirmation) {
-				pendingDeleteConfirmation = { plan: request.plan }
-			} else {
-				applyDeletePlan(request.plan)
-			}
+		const affectedGroups = request.plan.structureDelete?.affectedGroups ?? []
+
+		if (affectedGroups.length === 0 && !request.needsDependencyConfirmation) {
+			applyDeletePlan(request.plan)
+			return
 		}
 
-		if ((request.plan.structureDelete?.affectedGroups.length ?? 0) > 0) {
-			pendingGroupAction = {
-				groups: request.plan.structureDelete!.affectedGroups,
-				label: 'delete',
-				confirm: proceed
-			}
-		} else {
-			proceed()
-		}
+		askModuleAction({
+			label: 'delete',
+			stepCount: request.plan.targets.length,
+			groups: affectedGroups,
+			dependents: request.plan.dependents,
+			confirm: () => applyDeletePlan(request.plan)
+		})
 	}
 
 	export function deleteMultiple(ids: string[]) {
@@ -488,65 +473,64 @@
 	$effect(() => {
 		sidebarMode == 'graph' ? (sidebarSize = 40) : (sidebarSize = 20)
 	})
+
+	const portalTarget = overlayPortalTarget('body')
 </script>
 
-<Portal name="flow-module">
+<Portal name="flow-module" target={portalTarget()}>
 	<ConfirmationModal
-		title="Confirm deleting step with dependents"
-		confirmationText="Delete step"
-		open={Boolean(pendingDeleteConfirmation)}
+		title={`${pendingModuleAction?.label === 'move' ? 'Move' : 'Delete'} ${stepNoun(
+			pendingModuleAction
+		)}?`}
+		confirmationText={`${pendingModuleAction?.label === 'move' ? 'Move' : 'Delete'} ${stepNoun(
+			pendingModuleAction
+		)}`}
+		open={moduleActionOpen}
 		on:confirmed={() => {
-			if (pendingDeleteConfirmation) {
-				applyDeletePlan(pendingDeleteConfirmation.plan)
-				pendingDeleteConfirmation = undefined
-			}
+			if (!moduleActionOpen) return
+			moduleActionOpen = false
+			pendingModuleAction?.confirm()
 		}}
 		on:canceled={() => {
-			pendingDeleteConfirmation = undefined
+			if (!moduleActionOpen) return
+			moduleActionOpen = false
+			pendingModuleAction?.cancel?.()
 		}}
 	>
-		<div class="text-primary pb-2"
-			>Found the following steps that will require changes after this step is deleted:</div
-		>
-		{#each Object.entries(pendingDeleteConfirmation?.plan.dependents ?? {}) as [k, v]}
-			<div class="pb-3">
-				<h3 class="text-secondary font-semibold">{k}</h3>
-				<ul class="text-sm">
-					{#each v as dep}
-						<li>{dep}</li>
+		{#if pendingModuleAction}
+			{@const action = pendingModuleAction}
+			{@const dependents = Object.entries(action.dependents)}
+			{#if action.groups.length === 1}
+				{@const group = action.groups[0]}
+				<p
+					>The group{group.summary ? ` "${group.summary}"` : ''} will be removed (empty or duplicate).</p
+				>
+			{:else if action.groups.length > 1}
+				<p>The following groups will be removed (empty or duplicate):</p>
+				<ul class="list-disc pl-4 mt-1">
+					{#each action.groups as group}
+						<li>{group.summary || `${group.start_id} → ${group.end_id}`}</li>
 					{/each}
 				</ul>
-			</div>
-		{/each}
-	</ConfirmationModal>
-
-	<ConfirmationModal
-		title={pendingGroupAction?.groups.length === 1 ? 'Remove group?' : 'Remove groups?'}
-		confirmationText={pendingGroupAction?.label === 'delete' ? 'Delete step' : 'Move step'}
-		open={Boolean(pendingGroupAction)}
-		on:confirmed={() => {
-			pendingGroupAction?.confirm()
-			pendingGroupAction = undefined
-		}}
-		on:canceled={() => {
-			pendingGroupAction?.cancel?.()
-			pendingGroupAction = undefined
-		}}
-	>
-		{#if pendingGroupAction?.groups.length === 1}
-			{@const group = pendingGroupAction.groups[0]}
-			<p
-				>The group{group.summary ? ` "${group.summary}"` : ''} will be removed (empty or duplicate).
-				Are you sure you want to {pendingGroupAction.label} the step?</p
-			>
-		{:else}
-			<p>The following groups will be removed (empty or duplicate):</p>
-			<ul class="list-disc pl-4 mt-1">
-				{#each pendingGroupAction?.groups ?? [] as group}
-					<li>{group.summary || `${group.start_id} → ${group.end_id}`}</li>
-				{/each}
-			</ul>
-			<p class="mt-2">Are you sure you want to {pendingGroupAction?.label} the step?</p>
+			{/if}
+			{#if dependents.length > 0}
+				<p class={action.groups.length > 0 ? 'mt-3' : ''}
+					>The following steps will require changes afterwards:</p
+				>
+				<div class="mt-1">
+					{#each dependents as [k, v]}
+						<div class="pb-2">
+							<h3 class="text-secondary font-semibold">{k}</h3>
+							<ul class="text-sm">
+								{#each v as dep}
+									<li>{dep}</li>
+								{/each}
+							</ul>
+						</div>
+					{/each}
+				</div>
+			{/if}
+			<p class="mt-2">Are you sure you want to {action.label} the {stepNoun(action)}?</p>
 		{/if}
 	</ConfirmationModal>
 </Portal>
@@ -689,12 +673,14 @@
 					}
 
 					if (affectedGroups.length > 0) {
-						pendingGroupAction = {
-							groups: affectedGroups,
+						askModuleAction({
 							label: 'move',
+							stepCount: movedIds.length,
+							groups: affectedGroups,
+							dependents: {},
 							confirm: doMove,
 							cancel: () => moveManager.clearMoving()
-						}
+						})
 					} else {
 						doMove()
 					}
@@ -751,7 +737,9 @@
 							toolKind
 						)
 						const id = tools[tools.length - 1].id
-						selectionManager.selectId(id)
+						// Reveal the new tool's config right away — in modal (unanchored)
+						// panel mode its editor is otherwise hidden behind the graph.
+						selectionManager.selectId(id, { openPanel: true })
 					}
 					refreshFlowStateStore(flowStore)
 					dispatch('change')
@@ -810,7 +798,9 @@
 					{ extraModules, displayState: groupDisplayState }
 				)
 
-				selectionManager.selectId(module.id)
+				// Inserting is a deliberate "now edit this": in modal mode the new step's
+				// editor is otherwise hidden behind the graph.
+				selectionManager.selectId(module.id, { openPanel: true })
 
 				if (detail.inlineScript?.instructions) {
 					dispatch('generateStep', {
@@ -937,7 +927,7 @@
 
 				targetModules.splice(targetIndex + 1, 0, clone)
 				refreshFlowStateStore(flowStore)
-				selectionManager.selectId(clone.id)
+				selectionManager.selectId(clone.id, { openPanel: true })
 			}}
 			onUpdateMock={(detail) => {
 				let module = findModuleById(detail.id)
diff --git a/frontend/src/lib/components/flows/map/InsertModuleInner.svelte b/frontend/src/lib/components/flows/map/InsertModuleInner.svelte
index 5aa844ec47..0b3e77a848 100644
--- a/frontend/src/lib/components/flows/map/InsertModuleInner.svelte
+++ b/frontend/src/lib/components/flows/map/InsertModuleInner.svelte
@@ -19,6 +19,9 @@
 		kind?: 'script' | 'trigger' | 'preprocessor' | 'failure'
 		allowTrigger?: boolean
 		toolMode?: boolean
+		/** Narrow layout (450px instead of 650px). Defaults on for the preprocessor
+		 *  and failure pickers; set it when the container cannot fit the wide one. */
+		small?: boolean
 	}
 
 	let {
@@ -27,7 +30,8 @@
 		disableAi = false,
 		kind = 'script',
 		allowTrigger = true,
-		toolMode = false
+		toolMode = false,
+		small: smallProp = undefined
 	}: Props = $props()
 
 	let customUi: undefined | FlowBuilderWhitelabelCustomUi = getContext('customUi')
@@ -41,24 +45,23 @@
 		| 'aisandbox' = $state(untrack(() => kind))
 	let preFilter: 'all' | 'workspace' | 'hub' = $state('all')
 	let loading = $state(false)
-	let small = $derived(kind === 'preprocessor' || kind === 'failure')
+	let small = $derived(smallProp ?? (kind === 'preprocessor' || kind === 'failure'))
 
-	let width = $state(0)
 	let height = $state(0)
 	let owners = $state([])
-	let displayPath = $derived(width > 650 || height > 400)
+	// Only the content-sized host (TriggersWrapper) grows past this. The fixed-height hosts top out
+	// at 464px and must stay under the threshold, or every workspace row goes two-line in the step
+	// picker.
+	let displayPath = $derived(height > 480)
 </script>
 
 <div
 	id="flow-editor-insert-module"
-	class="flex flex-col h-full {small ? 'w-[450px]' : 'w-[650px]'} gap-2 {small
-		? 'min-w-[450px]'
-		: 'min-w-[650px]'}"
+	class="flex flex-col h-full gap-2 max-w-full {small ? 'w-[450px]' : 'w-[650px]'}"
 	onwheel={(e) => {
 		e.stopPropagation()
 	}}
 	role="none"
-	bind:clientWidth={width}
 	bind:clientHeight={height}
 >
 	<div class="flex flex-row items-center gap-2">
@@ -84,7 +87,7 @@
 
 	<div class="flex flex-row grow min-h-0 gap-2">
 		{#if kind === 'script'}
-			<div class="flex-none flex flex-col text-xs text-primary overflow-auto gap-1">
+			<div class="flex-none w-40 flex flex-col text-xs text-primary overflow-auto gap-1">
 				<TopLevelNode
 					label="Action"
 					selected={selectedKind === 'script'}
@@ -188,14 +191,14 @@
 						/>
 					{/if}
 					{#if customUi?.aiSandbox != false}
-					<TopLevelNode
-						label="AI Sandbox"
-						selected={selectedKind === 'aisandbox'}
-						onSelect={() => {
-							selectedKind = 'aisandbox'
-						}}
-					/>
-				{/if}
+						<TopLevelNode
+							label="AI Sandbox"
+							selected={selectedKind === 'aisandbox'}
+							onSelect={() => {
+								selectedKind = 'aisandbox'
+							}}
+						/>
+					{/if}
 				{/if}
 			</div>
 		{/if}
diff --git a/frontend/src/lib/components/flows/map/InsertModulePopover.svelte b/frontend/src/lib/components/flows/map/InsertModulePopover.svelte
index fa626f42ab..2e319c91f7 100644
--- a/frontend/src/lib/components/flows/map/InsertModulePopover.svelte
+++ b/frontend/src/lib/components/flows/map/InsertModulePopover.svelte
@@ -1,6 +1,7 @@
 <script lang="ts">
 	import InsertModuleInner from './InsertModuleInner.svelte'
 	import Popover from '$lib/components/meltComponents/Popover.svelte'
+	import { overlayPortalTarget } from '$lib/components/common/overlayHost.svelte'
 
 	import type { Placement } from '@floating-ui/core'
 
@@ -23,6 +24,8 @@
 		gutter = 0
 	}: Props = $props()
 
+	const portalTarget = overlayPortalTarget('#flow-editor')
+
 	let popover: Popover
 
 	$effect(() => {
@@ -32,8 +35,8 @@
 
 <Popover
 	bind:this={popover}
-	portal="#flow-editor"
-	contentClasses="p-2 max-w-lg h-[400px] !resize bg-surface"
+	portal={portalTarget()}
+	contentClasses="p-2 max-w-lg h-[480px] bg-surface"
 	class="inline-block"
 	usePointerDownOutside
 	floatingConfig={{
diff --git a/frontend/src/lib/components/flows/map/MapItem.svelte b/frontend/src/lib/components/flows/map/MapItem.svelte
index f65a565247..29d10d5ca3 100644
--- a/frontend/src/lib/components/flows/map/MapItem.svelte
+++ b/frontend/src/lib/components/flows/map/MapItem.svelte
@@ -7,10 +7,8 @@
 	import { prettyLanguage } from '$lib/common'
 	import { msToSec, type Item } from '$lib/utils'
 	import FlowJobsMenu from './FlowJobsMenu.svelte'
-	import {
-		isTriggerStep,
-		type OnSelectedIteration
-	} from '$lib/components/graph/graphBuilder.svelte'
+	import { type OnSelectedIteration } from '$lib/components/graph/graphBuilder.svelte'
+	import { describeStepSettings } from '$lib/components/flows/flowStepSettings'
 	import { checkIfParentLoop } from '$lib/components/flows/utils.svelte'
 	import type { FlowEditorContext } from '$lib/components/flows/types'
 	import { twMerge } from 'tailwind-merge'
@@ -24,6 +22,9 @@
 		insertable: boolean
 		moduleAction: ModuleActionInfo | undefined
 		annotation?: string | undefined
+		annotationTitle?: string | undefined
+		sideAnnotation?: string | undefined
+		sideAnnotationTitle?: string | undefined
 		nodeState?: FlowNodeState
 		duration_ms?: number | undefined
 		retries?: number | undefined
@@ -57,6 +58,9 @@
 		insertable,
 		moduleAction = undefined,
 		annotation = undefined,
+		annotationTitle = undefined,
+		sideAnnotation = undefined,
+		sideAnnotationTitle = undefined,
 		nodeState,
 		duration_ms = undefined,
 		retries = undefined,
@@ -86,14 +90,8 @@
 
 	let itemProps = $derived({
 		selected: selectionManager && selectionManager.isNodeSelected(mod.id),
-		retry: mod.retry?.constant != undefined || mod.retry?.exponential != undefined,
-		earlyStop: mod.stop_after_if != undefined || mod.stop_after_all_iters_if != undefined,
-		skip: Boolean(mod.skip_if),
-		suspend: Boolean(mod.suspend),
-		sleep: Boolean(mod.sleep),
-		cache: Boolean(mod.cache_ttl),
 		mock: mod.mock,
-		concurrency: Boolean(mod?.value?.['concurrent_limit'])
+		settings: describeStepSettings(mod).filter((s) => s.configured)
 	})
 
 	let parentLoop = $derived(
@@ -142,8 +140,17 @@
 				{msToSec(duration_ms)}s
 			</div>
 		{/if}
+		{#if sideAnnotation && sideAnnotation != ''}
+			<div
+				title={sideAnnotationTitle}
+				class="nodrag nopan absolute z-10 left-full ml-2 top-1/2 -translate-y-1/2 whitespace-nowrap text-2xs text-tertiary cursor-default"
+			>
+				{sideAnnotation}
+			</div>
+		{/if}
 		{#if annotation && annotation != ''}
 			<div
+				title={annotationTitle}
 				class={twMerge(
 					'absolute z-10 left-0 -top-5 center-center text-primary',
 					editMode ? '-top-4 text-gray-400 dark:text-gray-500 text-xs font-normal' : ''
@@ -212,6 +219,11 @@
 					on:delete
 					on:move
 					on:pointerdown={handlePointerDown}
+					onUpdateMock={(mock) => {
+						mod.mock = mock
+						onUpdateMock?.({ id: mod.id, mock })
+					}}
+					alwaysShowOutputPicker
 					{...itemProps}
 					id={mod.id}
 					label={mod.summary || 'Run one branch'}
@@ -232,6 +244,11 @@
 					on:delete
 					on:move
 					on:pointerdown={handlePointerDown}
+					onUpdateMock={(mock) => {
+						mod.mock = mock
+						onUpdateMock?.({ id: mod.id, mock })
+					}}
+					alwaysShowOutputPicker
 					id={mod.id}
 					{...itemProps}
 					label={mod.summary || `Run all branches${mod.value.parallel ? ' (parallel)' : ''}`}
@@ -253,8 +270,6 @@
 					on:delete
 					on:move
 					onUpdateMock={(mock) => {
-						console.log('onUpdateMock', mock)
-
 						mod.mock = mock
 						onUpdateMock?.({ id: mod.id, mock })
 					}}
@@ -274,7 +289,6 @@
 							? `Inline ${prettyLanguage(mod.value.language)}`
 							: 'To be defined')}
 					path={`path` in mod.value ? mod.value.path : ''}
-					isTrigger={isTriggerStep(mod)}
 					alwaysShowOutputPicker={!mod.id.startsWith('subflow:') && mod.id !== 'preprocessor'}
 					loopStatus={parentLoop ? { type: 'inside', flow: parentLoop.type } : undefined}
 					inputTransform={mod.value.type !== 'identity' ? mod.value.input_transforms : undefined}
diff --git a/frontend/src/lib/components/flows/map/VirtualItem.svelte b/frontend/src/lib/components/flows/map/VirtualItem.svelte
index 652cf4041d..b7c9b58611 100644
--- a/frontend/src/lib/components/flows/map/VirtualItem.svelte
+++ b/frontend/src/lib/components/flows/map/VirtualItem.svelte
@@ -165,6 +165,7 @@
 							clazz="p-1"
 							{onEditInput}
 							selectionId={id ?? label ?? ''}
+							logsToggle={nodeKind === 'result'}
 							testJob={job}
 							disableMock
 							disableHistory
diff --git a/frontend/src/lib/components/flows/moduleSlot.test.ts b/frontend/src/lib/components/flows/moduleSlot.test.ts
new file mode 100644
index 0000000000..8ba7438468
--- /dev/null
+++ b/frontend/src/lib/components/flows/moduleSlot.test.ts
@@ -0,0 +1,90 @@
+import { describe, it, expect } from 'vitest'
+import type { FlowModule } from '$lib/gen'
+import { moduleSlot, savedModuleById } from './moduleSlot'
+
+function mod(id: string, content = ''): FlowModule {
+	return {
+		id,
+		value: { type: 'rawscript', language: 'bun', content, input_transforms: {} }
+	} as FlowModule
+}
+
+describe('moduleSlot', () => {
+	it('follows its step when a preceding sibling is deleted', () => {
+		const modules = [mod('a'), mod('b'), mod('c')]
+		const slot = moduleSlot(() => modules, 'b', modules[1])
+		modules.splice(0, 1)
+		expect(slot.get().id).toBe('b')
+	})
+
+	it('drops a write once its own step is gone, instead of hitting the step that took its place', () => {
+		// This is the whole point: an editor flushes its trailing keystrokes on unmount, and
+		// the delete has already spliced the array by then.
+		const b = mod('b')
+		const modules = [mod('a'), b, mod('c')]
+		const slot = moduleSlot(() => modules, 'b', b)
+		modules.splice(1, 1)
+
+		const target = slot.get()
+		;(target.value as { content: string }).content = 'typed into b'
+
+		expect(target).toBe(b)
+		expect(modules.map((m) => m.id)).toEqual(['a', 'c'])
+		expect((modules[1].value as { content: string }).content).toBe('')
+	})
+
+	it('ignores a whole-module replacement aimed at a deleted step', () => {
+		const b = mod('b')
+		const modules = [mod('a'), b]
+		const slot = moduleSlot(() => modules, 'b', b)
+		modules.splice(1, 1)
+		slot.set(mod('replacement'))
+		expect(modules.map((m) => m.id)).toEqual(['a'])
+	})
+})
+
+describe('savedModuleById', () => {
+	function branchOne(id: string, branches: FlowModule[][]): FlowModule {
+		return {
+			id,
+			value: {
+				type: 'branchone',
+				default: [],
+				branches: branches.map((modules) => ({ expr: 'true', modules }))
+			}
+		} as unknown as FlowModule
+	}
+
+	it('finds a step whose branch has moved, where its old position now holds another step', () => {
+		// The deployed flow keeps the order it was deployed in. Matching by position would
+		// pair the step with the other branch's step and diff against the wrong code.
+		const deployed = branchOne('a', [[mod('x', 'code-x')], [mod('y', 'code-y')]])
+
+		const found = savedModuleById(deployed, 'y')
+
+		expect((found?.value as { content: string }).content).toBe('code-y')
+	})
+
+	it('reaches into a loop nested in a branch', () => {
+		const loop = {
+			id: 'l',
+			value: { type: 'forloopflow', modules: [mod('deep', 'code-deep')] }
+		} as unknown as FlowModule
+		const deployed = branchOne('a', [[loop]])
+
+		expect((savedModuleById(deployed, 'deep')?.value as { content: string }).content).toBe(
+			'code-deep'
+		)
+	})
+
+	it('returns undefined for a step that has no deployed counterpart yet', () => {
+		expect(savedModuleById(branchOne('a', [[mod('x')]]), 'brand-new')).toBeUndefined()
+	})
+
+	it('searches the deployed top-level module list when given one', () => {
+		// Inserting a step at the top shifts every later one, so position and id disagree.
+		const deployed = [mod('a', 'code-a'), mod('b', 'code-b')]
+
+		expect((savedModuleById(deployed, 'b')?.value as { content: string }).content).toBe('code-b')
+	})
+})
diff --git a/frontend/src/lib/components/flows/moduleSlot.ts b/frontend/src/lib/components/flows/moduleSlot.ts
new file mode 100644
index 0000000000..66c005d602
--- /dev/null
+++ b/frontend/src/lib/components/flows/moduleSlot.ts
@@ -0,0 +1,62 @@
+import type { FlowModule } from '$lib/gen'
+
+/**
+ * A read/write slot for one step, anchored by id rather than by array position. Editors
+ * write through their binding as they unmount, and a delete has already spliced the array
+ * by then — by index that write would hit whichever step took the deleted one's place.
+ *
+ * Svelte extracts the getter once per block instance, so the anchor cannot drift; the
+ * hosting `{#each}` must therefore be keyed by id, or a reused block keeps a dead anchor.
+ */
+export function moduleSlot(
+	getModules: () => FlowModule[],
+	id: string | undefined,
+	detached: FlowModule
+) {
+	return {
+		get: (): FlowModule => getModules().find((m) => m.id === id) ?? detached,
+		set: (v: FlowModule) => {
+			const modules = getModules()
+			const i = modules.findIndex((m) => m.id === id)
+			if (i !== -1) {
+				modules[i] = v
+			}
+		}
+	}
+}
+
+/**
+ * The deployed counterpart of a step, matched by id rather than by position. Takes either
+ * one deployed step to search under, or the deployed flow's top-level module list.
+ *
+ * The saved flow keeps the order it was deployed in, so any structural edit since —
+ * reordering branches, inserting or deleting a step — shifts positions apart. Matching by
+ * index would then pair a step with a different step's deployed code, which surfaces as
+ * the wrong "last deployed" in the diff.
+ */
+export function savedModuleById(
+	saved: FlowModule | FlowModule[] | undefined,
+	id: string | undefined
+): FlowModule | undefined {
+	if (!saved || !id) return undefined
+	let found: FlowModule | undefined = undefined
+	const walk = (modules: FlowModule[]) => {
+		for (const m of modules) {
+			if (found) return
+			if (m.id === id) {
+				found = m
+				return
+			}
+			const v = m.value
+			if (v.type === 'forloopflow' || v.type === 'whileloopflow') walk(v.modules)
+			else if (v.type === 'branchone') {
+				walk(v.default)
+				for (const b of v.branches) walk(b.modules)
+			} else if (v.type === 'branchall') {
+				for (const b of v.branches) walk(b.modules)
+			}
+		}
+	}
+	walk(Array.isArray(saved) ? saved : [saved])
+	return found
+}
diff --git a/frontend/src/lib/components/flows/panelPlacement.test.ts b/frontend/src/lib/components/flows/panelPlacement.test.ts
new file mode 100644
index 0000000000..a81c69348a
--- /dev/null
+++ b/frontend/src/lib/components/flows/panelPlacement.test.ts
@@ -0,0 +1,25 @@
+import { describe, it, expect } from 'vitest'
+import { resolvePanelMode, MODAL_PANEL_BREAKPOINT } from './panelPlacement'
+
+const auto = { enabled: true, preference: 'auto' as const }
+
+describe('resolvePanelMode', () => {
+	it('detaches on auto once the editor is narrower than the breakpoint', () => {
+		expect(resolvePanelMode({ ...auto, width: MODAL_PANEL_BREAKPOINT - 1 })).toBe('modal')
+		expect(resolvePanelMode({ ...auto, width: MODAL_PANEL_BREAKPOINT })).toBe('docked')
+	})
+
+	it('stays docked at zero width, which means unlaid-out rather than narrow', () => {
+		expect(resolvePanelMode({ ...auto, width: 0 })).toBe('docked')
+	})
+
+	it('holds a pinned preference against the width that contradicts it', () => {
+		const wide = MODAL_PANEL_BREAKPOINT + 400
+		expect(resolvePanelMode({ enabled: true, preference: 'modal', width: wide })).toBe('modal')
+		expect(resolvePanelMode({ enabled: true, preference: 'docked', width: 400 })).toBe('docked')
+	})
+
+	it('keeps whitelabel embeds docked whatever was picked', () => {
+		expect(resolvePanelMode({ enabled: false, preference: 'modal', width: 400 })).toBe('docked')
+	})
+})
diff --git a/frontend/src/lib/components/flows/panelPlacement.ts b/frontend/src/lib/components/flows/panelPlacement.ts
new file mode 100644
index 0000000000..0febd63a6b
--- /dev/null
+++ b/frontend/src/lib/components/flows/panelPlacement.ts
@@ -0,0 +1,29 @@
+/** Below this editor width the step-details pane doesn't fit alongside the graph. */
+export const MODAL_PANEL_BREAKPOINT = 1280
+
+/**
+ * What the user asked for, which is not the same as where the panel ends up: `auto`
+ * follows the editor's width, the other two pin it regardless of width.
+ */
+export type FlowPanelPreference = 'auto' | 'docked' | 'modal'
+
+/** Where the panel actually is. */
+export type FlowPanelMode = 'docked' | 'modal'
+
+/**
+ * Resolves where the step panel goes. Split from the controller that holds the state so
+ * the rule can be tested without a component: the zero-width case below is the one a
+ * refactor gets wrong silently, since an unlaid-out editor and a narrow one both measure
+ * small and only one of them should detach.
+ */
+export function resolvePanelMode(input: {
+	enabled: boolean
+	preference: FlowPanelPreference
+	width: number
+}): FlowPanelMode {
+	if (!input.enabled) return 'docked'
+	if (input.preference !== 'auto') return input.preference
+	// A zero width means the editor has not been laid out yet. That is not evidence of a
+	// narrow screen, so stay docked rather than flashing through a modal.
+	return input.width > 0 && input.width < MODAL_PANEL_BREAKPOINT ? 'modal' : 'docked'
+}
diff --git a/frontend/src/lib/components/flows/pickers/FlowScriptPicker.svelte b/frontend/src/lib/components/flows/pickers/FlowScriptPicker.svelte
index 0484762705..93909d13f3 100644
--- a/frontend/src/lib/components/flows/pickers/FlowScriptPicker.svelte
+++ b/frontend/src/lib/components/flows/pickers/FlowScriptPicker.svelte
@@ -32,9 +32,6 @@
 				<LanguageIcon {lang} />
 			{/if}
 			<span class="text-xs">{label}</span>
-			{#if lang === 'claudesandbox'}
-				<span class="text-primary !text-xs">(new)</span>
-			{/if}
 		</div>
 	</Button>
 	{#snippet text()}
diff --git a/frontend/src/lib/components/flows/pickers/FlowScriptPickerQuick.svelte b/frontend/src/lib/components/flows/pickers/FlowScriptPickerQuick.svelte
index 480ab2a2ee..3ac279556f 100644
--- a/frontend/src/lib/components/flows/pickers/FlowScriptPickerQuick.svelte
+++ b/frontend/src/lib/components/flows/pickers/FlowScriptPickerQuick.svelte
@@ -11,6 +11,7 @@
 		selected?: boolean
 		eeRestricted: boolean
 		enterpriseLangs?: string[]
+		onHover?: () => void
 	}
 
 	let {
@@ -18,7 +19,8 @@
 		lang = undefined,
 		selected = false,
 		eeRestricted,
-		enterpriseLangs = []
+		enterpriseLangs = [],
+		onHover = undefined
 	}: Props = $props()
 
 	const dispatch = createEventDispatcher()
@@ -44,21 +46,18 @@
 
 <Button
 	id={`flow-editor-new-${lang}`}
-	{selected}
 	onClick={click}
+	onmousemove={() => onHover?.()}
 	role="menuitem"
 	variant="subtle"
 	unifiedSize="sm"
-	btnClasses="justify-start"
+	btnClasses="justify-start {selected ? 'bg-surface-hover' : onHover ? 'hover:bg-transparent' : ''}"
 >
 	{#if lang}
 		<LanguageIcon {lang} width={13} height={13} />
 	{/if}
 	<span class="grow truncate text-left {eeRestricted ? 'text-disabled' : ''}">
 		{label}{#if eeRestricted}&nbsp;(EE){/if}
-		{#if lang === 'claudesandbox'}
-			<span class="text-primary !text-xs">(new)</span>
-		{/if}
 	</span>
 	{#if selected}
 		<kbd class="!text-xs">&crarr;</kbd>
diff --git a/frontend/src/lib/components/flows/pickers/FlowToplevelNode.svelte b/frontend/src/lib/components/flows/pickers/FlowToplevelNode.svelte
index 1b0e6ae58a..71c4143ef7 100644
--- a/frontend/src/lib/components/flows/pickers/FlowToplevelNode.svelte
+++ b/frontend/src/lib/components/flows/pickers/FlowToplevelNode.svelte
@@ -3,11 +3,12 @@
 	import TopLevelNode from './TopLevelNode.svelte'
 
 	interface Props {
-		label: string;
-		selected?: boolean;
+		label: string
+		selected?: boolean
+		onHover?: () => void
 	}
 
-	let { label, selected = false }: Props = $props();
+	let { label, selected = false, onHover = undefined }: Props = $props()
 	const dispatch = createEventDispatcher()
 	function handleKeydown(event: KeyboardEvent & { currentTarget: EventTarget & Window }) {
 		if (selected && event.key === 'Enter') {
@@ -23,4 +24,4 @@
 
 <svelte:window onkeydown={handleKeydown} />
 
-<TopLevelNode {label} {selected} returnIcon onSelect={click} />
+<TopLevelNode {label} {selected} returnIcon neutral onSelect={click} {onHover} />
diff --git a/frontend/src/lib/components/flows/pickers/PickHubScriptQuick.svelte b/frontend/src/lib/components/flows/pickers/PickHubScriptQuick.svelte
index c26359434c..c9acf3121b 100644
--- a/frontend/src/lib/components/flows/pickers/PickHubScriptQuick.svelte
+++ b/frontend/src/lib/components/flows/pickers/PickHubScriptQuick.svelte
@@ -74,6 +74,7 @@
 		displayPath?: boolean
 		apps?: string[]
 		refreshCount?: number
+		onHover?: (index: number) => void
 	}
 
 	let {
@@ -85,7 +86,8 @@
 		items = $bindable([]),
 		displayPath = false,
 		apps = $bindable([]),
-		refreshCount = 0
+		refreshCount = 0,
+		onHover = undefined
 	}: Props = $props()
 
 	let allApps: string[] = $state([])
@@ -199,7 +201,14 @@
 	<ul class="gap-1 flex flex-col">
 		{#each items as item, index (item.path)}
 			<li class="w-full">
-				<Popover class="w-full" placement="right" forceOpen={index === selected}>
+				<!-- Only the selected row may show a tooltip: the Popover opens on its own hover too, and a
+				     row scrolled under a stationary cursor would otherwise open a second one. -->
+				<Popover
+					class="w-full"
+					placement="right"
+					forceOpen={index === selected}
+					disablePopup={index !== selected}
+				>
 					{#snippet text()}
 						<div class="flex flex-col">
 							<div class="text-left text-xs font-normal leading-tight py-0"
@@ -211,10 +220,14 @@
 						</div>
 					{/snippet}
 					<Button
-						selected={selected === index}
 						variant="subtle"
 						unifiedSize="sm"
-						btnClasses="justify-start"
+						btnClasses="justify-start h-auto min-h-7 py-1 {selected === index
+							? 'bg-surface-hover'
+							: onHover
+								? 'hover:bg-transparent'
+								: ''}"
+						onmousemove={() => onHover?.(index)}
 						onClick={() => handlePickScript(item)}
 					>
 						<div class={classNames('flex justify-center items-center')}>
@@ -229,11 +242,11 @@
 						</div>
 
 						<div class="flex flex-col grow min-w-0">
-							<div class="grow truncate text-left font-normal leading-tight py-0.5"
+							<div class="min-w-0 truncate text-left font-normal leading-tight"
 								>{item.summary ?? ''}</div
 							>
 							{#if displayPath && item.path}
-								<div class="grow truncate text-left text-2xs font-thin">
+								<div class="min-w-0 truncate text-left text-2xs font-thin leading-tight">
 									{item.path}
 								</div>
 							{/if}
diff --git a/frontend/src/lib/components/flows/pickers/TopLevelNode.svelte b/frontend/src/lib/components/flows/pickers/TopLevelNode.svelte
index 1e6e4600ca..48c4506592 100644
--- a/frontend/src/lib/components/flows/pickers/TopLevelNode.svelte
+++ b/frontend/src/lib/components/flows/pickers/TopLevelNode.svelte
@@ -19,10 +19,14 @@
 		label: string
 		selected?: boolean
 		returnIcon?: boolean
+		/** Highlight with the neutral hover surface instead of the accent, for transient
+		 * (hover/keyboard) selection rather than the persistent category selection. */
+		neutral?: boolean
 		onSelect: () => void
+		onHover?: () => void
 	}
 
-	let { label, selected, returnIcon, onSelect }: Props = $props()
+	let { label, selected, returnIcon, neutral = false, onSelect, onHover }: Props = $props()
 
 	interface IconConfig {
 		icon: ComponentType
@@ -43,7 +47,7 @@
 		'AI Agent': { icon: BotIcon, iconClass: 'text-ai' },
 		'AI Sandbox': { icon: BotIcon, showChevron: true, iconClass: 'text-ai' },
 		'Claude Code': { icon: BotIcon, iconClass: 'text-ai' },
-		MCP: { icon: Plug, showChevron: true },
+		MCP: { icon: Plug },
 		'Web Search': { icon: Globe }
 	}
 
@@ -51,21 +55,23 @@
 </script>
 
 {#snippet iconWithText(icon: ComponentType, showChevron = false, iconClass = '')}
-	{label}
+	<span class="truncate">{label}</span>
 	{#if showChevron}
-		<ChevronRight size={12} class="ml-auto text-secondary" />
+		<ChevronRight size={12} class="ml-auto shrink-0 text-secondary" />
 	{/if}
 {/snippet}
 
 <Button
 	id={`flow-editor-flow-kind-${label.replaceAll(' ', '-').toLowerCase()}`}
-	{selected}
+	selected={neutral ? false : selected}
 	onClick={onSelect}
+	onmousemove={() => onHover?.()}
 	variant="subtle"
 	unifiedSize="sm"
 	startIcon={{ icon: config?.icon }}
+	btnClasses={neutral ? (selected ? 'bg-surface-hover' : 'hover:bg-transparent') : ''}
 >
-	<span class="grow flex items-center gap-2">
+	<span class="grow min-w-0 flex items-center gap-2">
 		{#if config}
 			{@render iconWithText(config.icon, config.showChevron, config.iconClass ?? '')}
 		{/if}
diff --git a/frontend/src/lib/components/flows/pickers/WorkspaceScriptPicker.svelte b/frontend/src/lib/components/flows/pickers/WorkspaceScriptPicker.svelte
index 3b93e0c05c..8659fd5404 100644
--- a/frontend/src/lib/components/flows/pickers/WorkspaceScriptPicker.svelte
+++ b/frontend/src/lib/components/flows/pickers/WorkspaceScriptPicker.svelte
@@ -131,7 +131,7 @@
 					<button
 						class="p-4 gap-1 flex flex-row grow hover:bg-surface-hover bg-surface transition-all text-primary"
 						onclick={() => {
-							dispatch('pick', { path, hash: lockHash ? hash : undefined })
+							dispatch('pick', { path, hash: lockHash ? hash : undefined, summary })
 						}}
 					>
 						<div class="flex flex-col">
diff --git a/frontend/src/lib/components/flows/pickers/WorkspaceScriptPickerQuick.svelte b/frontend/src/lib/components/flows/pickers/WorkspaceScriptPickerQuick.svelte
index 9cb65b46b3..07df5bd5c5 100644
--- a/frontend/src/lib/components/flows/pickers/WorkspaceScriptPickerQuick.svelte
+++ b/frontend/src/lib/components/flows/pickers/WorkspaceScriptPickerQuick.svelte
@@ -80,6 +80,7 @@
 			| { kind: 'inline' | 'owner' | 'integrations'; name: string | undefined }
 			| undefined
 		refreshCount?: number
+		onHover?: (index: number) => void
 	}
 
 	let {
@@ -91,7 +92,8 @@
 		filter = '',
 		owners = $bindable([]),
 		ownerFilter = $bindable(undefined),
-		refreshCount = 0
+		refreshCount = 0,
+		onHover = undefined
 	}: Props = $props()
 
 	const dispatch = createEventDispatcher()
@@ -108,9 +110,14 @@
 			e.preventDefault()
 			let item = filteredWithOwner[selected]
 			if (kind == 'flow') {
-				dispatch('pickFlow', { path: item.path })
+				dispatch('pickFlow', { path: item.path, summary: item.summary })
 			} else {
-				dispatch('pickScript', { path: item.path, hash: lockHash ? item.hash : undefined, kind })
+				dispatch('pickScript', {
+					path: item.path,
+					hash: lockHash ? item.hash : undefined,
+					summary: item.summary,
+					kind
+				})
 			}
 		}
 	}
@@ -163,7 +170,14 @@
 	<ul class="gap-1 flex flex-col">
 		{#each filteredWithOwner ?? [] as { path, hash, summary, marked }, index}
 			<li class="w-full">
-				<Popover class="w-full " placement="right" forceOpen={index === selected}>
+				<!-- Only the selected row may show a tooltip: the Popover opens on its own hover too, and a
+				     row scrolled under a stationary cursor would otherwise open a second one. -->
+				<Popover
+					class="w-full "
+					placement="right"
+					forceOpen={index === selected}
+					disablePopup={index !== selected}
+				>
 					{#snippet text()}
 						<div class="flex flex-col">
 							<div class="text-left text-xs font-normal leading-tight py-0">{summary ?? ''}</div>
@@ -173,15 +187,19 @@
 						</div>
 					{/snippet}
 					<Button
-						selected={selected === index}
 						variant="subtle"
 						unifiedSize="sm"
-						btnClasses="justify-start transition-all"
+						btnClasses="justify-start transition-all h-auto min-h-7 py-1 {selected === index
+							? 'bg-surface-hover'
+							: onHover
+								? 'hover:bg-transparent'
+								: ''}"
+						onmousemove={() => onHover?.(index)}
 						onClick={() => {
 							if (kind == 'flow') {
-								dispatch('pickFlow', { path: path })
+								dispatch('pickFlow', { path, summary })
 							} else {
-								dispatch('pickScript', { path: path, hash: lockHash ? hash : undefined, kind })
+								dispatch('pickScript', { path, hash: lockHash ? hash : undefined, summary, kind })
 							}
 						}}
 						startIcon={{
@@ -189,7 +207,7 @@
 						}}
 					>
 						<div class="flex flex-col grow min-w-0">
-							<div class="grow min-w-0 truncate text-left">
+							<div class="min-w-0 truncate text-left leading-tight">
 								{#if marked}
 									{@html marked}
 								{:else}
@@ -197,7 +215,7 @@
 								{/if}
 							</div>
 							{#if displayPath && path}
-								<div class="grow min-w-0 truncate text-left text-2xs font-thin">
+								<div class="min-w-0 truncate text-left text-2xs font-thin leading-tight">
 									{path}
 								</div>
 							{/if}
diff --git a/frontend/src/lib/components/flows/propPicker/OutputPicker.svelte b/frontend/src/lib/components/flows/propPicker/OutputPicker.svelte
index 593ba12101..0bdc1a5194 100644
--- a/frontend/src/lib/components/flows/propPicker/OutputPicker.svelte
+++ b/frontend/src/lib/components/flows/propPicker/OutputPicker.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
 	import Popover from '$lib/components/meltComponents/Popover.svelte'
+	import { overlayPortalTarget } from '$lib/components/common/overlayHost.svelte'
 	import { twMerge } from 'tailwind-merge'
 	import { getContext, onMount } from 'svelte'
 	import type { PropPickerContext } from '$lib/components/prop_picker'
@@ -40,6 +41,9 @@
 		onEditInput
 	}: Props = $props()
 
+	// Sized and positioned against the graph pane, so that stays the fallback.
+	const portalTarget = overlayPortalTarget('#flow-graph-v2')
+
 	const context = getContext<PropPickerContext>('PropPickerContext')
 	const flowPropPickerConfig = context?.flowPropPickerConfig
 	const MIN_WIDTH = 375
@@ -159,7 +163,7 @@
 					class="flex-1 h-full"
 					bind:isOpen={inputOpen}
 					bind:this={inputPopover}
-					portal="#flow-graph-v2"
+					portal={portalTarget()}
 				>
 					{#snippet trigger({ isOpen })}
 						<Button
@@ -207,7 +211,7 @@
 				closeOnOtherPopoverOpen
 				class="flex-1 h-full"
 				bind:isOpen={outputOpen}
-				portal="#flow-graph-v2"
+				portal={portalTarget()}
 			>
 				{#snippet trigger({ isOpen })}
 					<AnimatedButton
diff --git a/frontend/src/lib/components/flows/propPicker/OutputPickerInner.svelte b/frontend/src/lib/components/flows/propPicker/OutputPickerInner.svelte
index 8a809f6931..fa251c35c6 100644
--- a/frontend/src/lib/components/flows/propPicker/OutputPickerInner.svelte
+++ b/frontend/src/lib/components/flows/propPicker/OutputPickerInner.svelte
@@ -67,6 +67,9 @@
 		initial?: boolean
 		onResetInitial?: () => void
 		customEmptyJobMessage?: string
+		/** Offer a result/logs toggle. Only for viewers that show the result alone —
+		 *  where a log pane sits alongside it, the toggle just hides what is already there. */
+		logsToggle?: boolean
 	}
 
 	let {
@@ -96,7 +99,8 @@
 		onEditInput,
 		selectionId,
 		initial,
-		customEmptyJobMessage
+		customEmptyJobMessage,
+		logsToggle = false
 	}: Props = $props()
 
 	let jsonView = $state(false)
@@ -523,7 +527,7 @@
 				{/if}
 
 				<!-- Logs button -->
-				{#if selectedJob?.type === 'CompletedJob' && selectedJob?.['logs']}
+				{#if logsToggle && selectedJob?.type === 'CompletedJob' && selectedJob?.['logs']}
 					<Tooltip>
 						<Button
 							size="xs2"
@@ -624,7 +628,7 @@
 				hoveringResult = false
 			}}
 		>
-			{#if showLogs && selectedJob?.type === 'CompletedJob' && selectedJob?.['logs']}
+			{#if logsToggle && showLogs && selectedJob?.type === 'CompletedJob' && selectedJob?.['logs']}
 				<LogViewer
 					small
 					jobId={selectedJob.id}
diff --git a/frontend/src/lib/components/flows/propPicker/PropPickerWrapper.svelte b/frontend/src/lib/components/flows/propPicker/PropPickerWrapper.svelte
index ead5ad9ad3..8bbe9b9792 100644
--- a/frontend/src/lib/components/flows/propPicker/PropPickerWrapper.svelte
+++ b/frontend/src/lib/components/flows/propPicker/PropPickerWrapper.svelte
@@ -13,6 +13,25 @@
 		inputMatches: Writable<{ word: string; value: string }[] | undefined>
 		connectProp: (propName: string, onSelect: SelectCallback) => void
 		clearConnect: () => void
+		/** Reveal a `sidePane` column: its input is being written in. Reaching for the editor
+		 *  again after dismissing the column has to say so, since an editor that kept focus
+		 *  throughout emits no new focus event. */
+		openPicker: () => void
+		/** Where the properties are offered, and therefore what a pick does:
+		 *  - 'pane': the step's input form — a pick replaces the argument outright.
+		 *  - 'sidePane': a settings row — a pick lands at the expression's cursor, since a
+		 *    half-written predicate must survive it. */
+		pickerMode: () => 'pane' | 'sidePane'
+		/** The single input a `sidePane` column belongs to. It stays a destination for as
+		 *  long as its field is mounted, so a pick lands whether or not a connect is armed —
+		 *  a static field has no editor for the host's own `select` handler to write into.
+		 *  `undefined` (the setting was switched off) leaves the column with nowhere to
+		 *  deliver, so it closes. */
+		setPickTarget: (target: { id: string; onSelect: (path: string) => void } | undefined) => void
+		/** Deliver a pick the way the pane does — as a `select` event, so each setting's own
+		 *  handler inserts it at the cursor. Replacing the whole value is right for a step
+		 *  input but destroys a half-written predicate. */
+		onPick: (path: string) => void
 		exprBeingEdited: Writable<string[]>
 	}
 </script>
@@ -22,12 +41,13 @@
 	import PropPickerResult from '$lib/components/propertyPicker/PropPickerResult.svelte'
 	import { clickOutside } from '$lib/utils'
 	import { createEventDispatcher, getContext, setContext } from 'svelte'
+	import { fade } from 'svelte/transition'
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
 	import { writable, type Writable } from 'svelte/store'
 	import type { PickableProperties } from '../previousResults'
 	import AnimatedButton from '$lib/components/common/button/AnimatedButton.svelte'
 	import type { PropPickerContext } from '$lib/components/prop_picker'
-
+	import { useConnect } from './useConnect.svelte'
 
 	interface Props {
 		pickableProperties: PickableProperties | undefined
@@ -39,7 +59,10 @@
 		notSelectable?: boolean
 		noPadding?: boolean
 		paneClass?: string
-		noFlowPlugConnect?: boolean
+		/** Settings rows reuse the step-input form for one argument but are not the input
+		 *  form: their picker is a column beside the row, revealed while the expression is
+		 *  being written, rather than a permanent split of the panel. */
+		sidePane?: boolean
 		children?: import('svelte').Snippet
 	}
 
@@ -53,7 +76,7 @@
 		notSelectable = false,
 		noPadding = false,
 		paneClass = '',
-		noFlowPlugConnect = false,
+		sidePane = false,
 		children
 	}: Props = $props()
 
@@ -62,41 +85,40 @@
 	>(undefined)
 
 	const inputMatches = writable<{ word: string; value: string }[] | undefined>(undefined)
+	const exprBeingEdited = writable<string[]>([])
 	const dispatch = createEventDispatcher()
 
-	const { flowPropPickerConfig } = getContext<PropPickerContext>('PropPickerContext')
+	const propPickerContext = getContext<PropPickerContext>('PropPickerContext')
+	const { flowPropPickerConfig } = propPickerContext
 	flowPropPickerConfig.set(undefined)
 
+	// The modal panel covers the graph, so a connect armed there could never be resolved by
+	// clicking a step — this pane is the only picker in that mode. See `graphParticipates`.
+	const inModalPanel = $derived(propPickerContext.inModalPanel?.() ?? false)
 
+	const connect = useConnect({
+		inModalPanel: () => inModalPanel,
+		hasPickableProperties: () => pickableProperties != undefined,
+		flowPropPickerConfig,
+		localConfig: propPickerConfig
+	})
 
 	setContext<PropPickerWrapperContext>('PropPickerWrapper', {
 		propPickerConfig,
 		inputMatches,
 		connectProp: (propName, onSelect) => {
-			const config = {
-				propName,
-				onSelect,
-				clearFocus: () => {
-					propPickerConfig.set(undefined)
-					flowPropPickerConfig.set(undefined)
-				}
-			}
-			propPickerConfig.set(config)
-			if (!noFlowPlugConnect) {
-				flowPropPickerConfig.set({
-					...config,
-					clearFocus: () => {
-						propPickerConfig.set(undefined)
-						flowPropPickerConfig.set(undefined)
-					}
-				})
-			}
+			connect.arm({ id: propName, onSelect })
+			openPicker()
 		},
-		clearConnect: () => {
-			flowPropPickerConfig.set(undefined)
-			propPickerConfig.set(undefined)
+		clearConnect: closePicker,
+		openPicker,
+		pickerMode: () => (sidePane ? 'sidePane' : 'pane'),
+		setPickTarget: (target) => {
+			pickTarget = target
+			if (!target) closePicker()
 		},
-		exprBeingEdited: writable<string[]>([])
+		onPick: (path) => dispatch('select', path),
+		exprBeingEdited
 	})
 
 	async function getPropPickerElements(): Promise<HTMLElement[]> {
@@ -106,69 +128,103 @@
 	}
 
 	let rightPaneHeight: number = $state(0)
+
+	let pickTarget: { id: string; onSelect: (path: string) => void } | undefined = $state(undefined)
+
+	// Opened and dismissed on demand rather than derived from focus: picking a property blurs
+	// the editor, so a column that followed focus would vanish mid-click — and one that
+	// latched onto focus would never let go of an editor unmounted by its own setting.
+	let sidePaneOpen = $state(false)
+
+	function openPicker() {
+		sidePaneOpen = true
+	}
+
+	function closePicker() {
+		connect.disarm()
+		sidePaneOpen = false
+	}
 </script>
 
+{#snippet pickerBody()}
+	<!-- Exactly one destination per pick, or a cursor insertion lands twice: the armed input
+	     if there is one, else the column's own input, else the form's `select` handler. -->
+	{@const deliver = (path: string) =>
+		connect.armed
+			? connect.resolve(path)
+			: pickTarget
+				? pickTarget.onSelect(path)
+				: dispatch('select', path)}
+	<div bind:clientHeight={rightPaneHeight} class="min-h-40 h-full !bg-surface">
+		<AnimatedButton
+			animate={$propPickerConfig != undefined}
+			baseRadius="4px"
+			wrapperClasses="prop-picker-inputs h-full w-full pt-1"
+			marginWidth="3px"
+			ringColor="transparent"
+			animationDuration="4s"
+		>
+			{#if result != undefined && !pickableProperties}
+				<PropPickerResult
+					{result}
+					{extraResults}
+					{flow_input}
+					allowCopy={!notSelectable && !$propPickerConfig}
+					on:select={({ detail }) => deliver(detail)}
+				/>
+			{:else if pickableProperties}
+				<PropPicker
+					{result}
+					{extraResults}
+					{displayContext}
+					{error}
+					previousId={pickableProperties?.previousId}
+					{pickableProperties}
+					allowCopy={!notSelectable && !$propPickerConfig}
+					on:select={({ detail }) => deliver(detail)}
+				/>
+			{/if}
+		</AnimatedButton>
+	</div>
+{/snippet}
+
 <div
 	class="h-full w-full"
 	data-prop-picker-root
 	use:clickOutside={{
 		capture: true,
 		exclude: getPropPickerElements,
-		onClickOutside: () => {
-			propPickerConfig.set(undefined)
-			flowPropPickerConfig.set(undefined)
-		}
+		// Through the controller, not the stores: it owns the armed target, and a
+		// target left armed here would make the next click on that same input
+		// read as a toggle-off.
+		onClickOutside: closePicker
 	}}
 >
-	<Splitpanes class={$propPickerConfig ? 'splitpanes-remove-splitter' : ''}>
-		<Pane minSize={20} size={60} class={'relative !transition-none'}>
-			<div style="height: {rightPaneHeight}px;" class={noPadding ? '' : 'p-2'}>
-				{@render children?.()}
-			</div>
-		</Pane>
-		<Pane minSize={20} size={40} class="!transition-none z-1000 relative {paneClass}">
-			<div bind:clientHeight={rightPaneHeight} class="min-h-40 h-full !bg-surface-secondary">
-				<AnimatedButton
-					animate={$propPickerConfig != undefined}
-					baseRadius="4px"
-					wrapperClasses="prop-picker-inputs h-full w-full pt-1"
-					marginWidth="3px"
-					ringColor="transparent"
-					animationDuration="4s"
+	{#if sidePane}
+		<!-- The row keeps its own spacing, since the setting around it lays that out. -->
+		<div class="flex w-full items-start gap-3">
+			<div class="min-w-0 grow">{@render children?.()}</div>
+			{#if sidePaneOpen && (pickableProperties != undefined || result != undefined)}
+				<!-- A set height, not the row's: the picker scrolls its own categories, and an
+				     expression editor is one line tall next to them. -->
+				<div
+					class="shrink-0 w-[38%] min-w-52 max-w-xs h-72 overflow-auto border-l pl-2 {paneClass}"
+					transition:fade={{ duration: 100 }}
 				>
-					{#if result != undefined && !pickableProperties}
-						<PropPickerResult
-							{result}
-							{extraResults}
-							{flow_input}
-							allowCopy={!notSelectable && !$propPickerConfig}
-							on:select={({ detail }) => {
-								dispatch('select', detail)
-								if ($propPickerConfig?.onSelect(detail)) {
-									$propPickerConfig?.clearFocus()
-								}
-							}}
-						/>
-					{:else if pickableProperties}
-						<PropPicker
-							{result}
-							{extraResults}
-							{displayContext}
-							{error}
-							previousId={pickableProperties?.previousId}
-							{pickableProperties}
-							allowCopy={!notSelectable && !$propPickerConfig}
-							on:select={({ detail }) => {
-								// console.log('selecting', detail)
-								dispatch('select', detail)
-								if ($propPickerConfig?.onSelect(detail)) {
-									$propPickerConfig?.clearFocus()
-								}
-							}}
-						/>
-					{/if}
-				</AnimatedButton>
-			</div>
-		</Pane>
-	</Splitpanes>
+					{@render pickerBody()}
+				</div>
+			{/if}
+		</div>
+	{:else}
+		<Splitpanes class={$propPickerConfig ? 'splitpanes-remove-splitter' : ''}>
+			<Pane minSize={20} size={60} class={'relative !transition-none'}>
+				<div style="height: {rightPaneHeight}px;" class={noPadding ? '' : 'p-2'}>
+					{@render children?.()}
+				</div>
+			</Pane>
+			<Pane minSize={20} size={40} class="!transition-none z-1000 relative {paneClass}">
+				{@render pickerBody()}
+			</Pane>
+		</Splitpanes>
+	{/if}
 </div>
diff --git a/frontend/src/lib/components/flows/propPicker/connectPolicy.test.ts b/frontend/src/lib/components/flows/propPicker/connectPolicy.test.ts
new file mode 100644
index 0000000000..e27e5d677d
--- /dev/null
+++ b/frontend/src/lib/components/flows/propPicker/connectPolicy.test.ts
@@ -0,0 +1,37 @@
+import { describe, it, expect } from 'vitest'
+import { graphParticipates, nextArmed, type ArmedTarget } from './connectPolicy'
+
+const target = (id: string): ArmedTarget => ({ id, onSelect: () => {} })
+
+describe('nextArmed', () => {
+	it('replaces the previous target so a pick has one destination', () => {
+		expect(nextArmed(target('iterator'), target('region'))?.id).toBe('region')
+	})
+
+	it('disarms when the already-armed input is clicked again', () => {
+		expect(nextArmed(target('region'), target('region'))).toBeUndefined()
+	})
+})
+
+describe('graphParticipates', () => {
+	const docked = { inModalPanel: false, hasPickableProperties: true }
+
+	it('offers the graph while a target is armed in a docked panel', () => {
+		expect(graphParticipates(target('region'), docked)).toBe(true)
+	})
+
+	it('never offers the graph from a modal panel, which covers it', () => {
+		expect(graphParticipates(target('region'), { ...docked, inModalPanel: true })).toBe(false)
+	})
+
+	it('stays out of it when the input has nothing to pick from', () => {
+		// Sleep and suspend show previous results but expose no pickable properties.
+		expect(graphParticipates(target('sleep'), { ...docked, hasPickableProperties: false })).toBe(
+			false
+		)
+	})
+
+	it('is off whenever nothing is armed', () => {
+		expect(graphParticipates(undefined, docked)).toBe(false)
+	})
+})
diff --git a/frontend/src/lib/components/flows/propPicker/connectPolicy.ts b/frontend/src/lib/components/flows/propPicker/connectPolicy.ts
new file mode 100644
index 0000000000..bed01900cf
--- /dev/null
+++ b/frontend/src/lib/components/flows/propPicker/connectPolicy.ts
@@ -0,0 +1,29 @@
+/** An input waiting to receive the next picked property. */
+export type ArmedTarget = {
+	/** Distinguishes targets within a panel — an argument name, or the input's own id. */
+	id: string
+	onSelect: (path: string) => void
+}
+
+/**
+ * Arming is exclusive: a panel has at most one target, so a pick — from the picker or from
+ * a step node — always has exactly one destination. Clicking the armed input again disarms.
+ */
+export function nextArmed(
+	current: ArmedTarget | undefined,
+	clicked: ArmedTarget
+): ArmedTarget | undefined {
+	return current?.id === clicked.id ? undefined : clicked
+}
+
+/**
+ * Whether the graph offers its step outputs while this target is armed. The modal panel
+ * covers the graph, so connecting there could never be completed; with nothing pickable
+ * there is nothing for a node click to contribute.
+ */
+export function graphParticipates(
+	armed: ArmedTarget | undefined,
+	opts: { inModalPanel: boolean; hasPickableProperties: boolean }
+): boolean {
+	return armed != undefined && !opts.inModalPanel && opts.hasPickableProperties
+}
diff --git a/frontend/src/lib/components/flows/propPicker/useConnect.svelte.ts b/frontend/src/lib/components/flows/propPicker/useConnect.svelte.ts
new file mode 100644
index 0000000000..f6179bb0fe
--- /dev/null
+++ b/frontend/src/lib/components/flows/propPicker/useConnect.svelte.ts
@@ -0,0 +1,84 @@
+import type { Writable } from 'svelte/store'
+import type { FlowPropPickerConfig } from '$lib/components/prop_picker'
+import { graphParticipates, nextArmed, type ArmedTarget } from './connectPolicy'
+
+/**
+ * Holds the panel's single armed connect target and keeps the graph in step with it.
+ *
+ * The graph is driven imperatively from `arm`/`disarm` rather than from an `$effect`:
+ * an effect that both reads the armed state and writes the shared store is the shape that
+ * self-invalidates.
+ */
+export function useConnect(opts: {
+	inModalPanel: () => boolean
+	hasPickableProperties: () => boolean
+	flowPropPickerConfig: Writable<FlowPropPickerConfig | undefined>
+	/** Mirrors the armed target for an in-panel picker, which filters by its prop name. */
+	localConfig?: Writable<
+		{ propName?: string; onSelect: (path: string) => boolean; clearFocus: () => void } | undefined
+	>
+}) {
+	let armed = $state<ArmedTarget | undefined>(undefined)
+
+	function sync() {
+		opts.localConfig?.set(
+			armed
+				? {
+						propName: armed.id,
+						onSelect: (path: string) => {
+							resolve(path)
+							return true
+						},
+						clearFocus: disarm
+					}
+				: undefined
+		)
+		const participates = graphParticipates(armed, {
+			inModalPanel: opts.inModalPanel(),
+			hasPickableProperties: opts.hasPickableProperties()
+		})
+		opts.flowPropPickerConfig.set(
+			participates
+				? {
+						onSelect: (path: string) => {
+							resolve(path)
+							return true
+						},
+						clearFocus: disarm
+					}
+				: undefined
+		)
+	}
+
+	function arm(target: ArmedTarget) {
+		armed = nextArmed(armed, target)
+		sync()
+	}
+
+	function disarm() {
+		// `flowPropPickerConfig` is shared by every connect surface in the panel, so a component
+		// that holds nothing must not clear it — otherwise closing any picker cancels whichever
+		// input is actually armed, and the pick that follows has nowhere to land.
+		if (!armed) return
+		armed = undefined
+		opts.localConfig?.set(undefined)
+		opts.flowPropPickerConfig.set(undefined)
+	}
+
+	/** Deliver a picked property. Disarms first, so a target can never be written twice. */
+	function resolve(path: string) {
+		const target = armed
+		disarm()
+		target?.onSelect(path)
+	}
+
+	return {
+		get armed() {
+			return armed
+		},
+		isArmed: (id: string) => armed?.id === id,
+		arm,
+		disarm,
+		resolve
+	}
+}
diff --git a/frontend/src/lib/components/flows/types.ts b/frontend/src/lib/components/flows/types.ts
index a527bd765d..eeeb6e10b5 100644
--- a/frontend/src/lib/components/flows/types.ts
+++ b/frontend/src/lib/components/flows/types.ts
@@ -17,6 +17,7 @@ import type { ModulesTestStates } from '../modulesTest.svelte'
 import type { ButtonProp } from '$lib/components/diffEditorTypes'
 
 import type { SelectionManager } from '../graph/selectionUtils.svelte'
+import type { FlowPanelPreference } from './panelPlacement'
 import type { InferAssetsSqlQueryDetails } from '$lib/infer'
 
 export type FlowInput = Record<
@@ -39,6 +40,7 @@ export type ExtendedOpenFlow = OpenFlow & {
 	dedicated_worker?: boolean
 	visible_to_runner_only?: boolean
 	on_behalf_of_email?: string
+	on_behalf_of?: string
 }
 
 export type FlowInputEditorState = {
@@ -96,6 +98,7 @@ export type FlowEditorContext = {
 	outputPickerOpenFns: Record<string, () => void>
 	preserveOnBehalfOf: Writable<boolean>
 	savedOnBehalfOfEmail: Writable<string | undefined>
+	savedOnBehalfOfPermissionedAs: Writable<string | undefined>
 	// Only set by the local dev page (Dev.svelte): path -> temp-storage hash of
 	// locally-edited workspace scripts, passed as temp_script_refs on preview
 	// runs so relative imports resolve from local (not-yet-deployed) content
@@ -133,3 +136,21 @@ export type OutputViewerJob =
 			  }
 	  ) & { result_stream?: string; result?: unknown })
 	| undefined
+
+/** Set by FlowEditor so a panel's card header can host the panel's own chrome inline.
+ *  A mounted host calls `claim` (keeping the returned unregister for teardown), which
+ *  hides FlowEditor's fallback strip. */
+export type FlowPanelDetachContext = {
+	claim: () => () => void
+	/** True while the detached modal is open. Its chrome lives in the panel's card header,
+	 *  so the modal draws no header of its own. */
+	modalOpen: () => boolean
+	close: () => void
+	/** False for whitelabel embeds that keep the classic always-docked pane — they get no
+	 *  panel-position control at all, in the graph or anywhere else. */
+	enabled: () => boolean
+	/** The Auto/Attached/Detached choice, picked from the graph's control bar. Distinct
+	 *  from where the panel currently is: `auto` resolves against the editor's width. */
+	preference: () => FlowPanelPreference
+	setPreference: (preference: FlowPanelPreference) => void
+}
diff --git a/frontend/src/lib/components/flows/utils.svelte.ts b/frontend/src/lib/components/flows/utils.svelte.ts
index 3c2308089e..d62138868f 100644
--- a/frontend/src/lib/components/flows/utils.svelte.ts
+++ b/frontend/src/lib/components/flows/utils.svelte.ts
@@ -97,6 +97,9 @@ export function filteredContentForExport(flow: ExtendedOpenFlow) {
 	if (flow.on_behalf_of_email) {
 		o['on_behalf_of_email'] = flow.on_behalf_of_email
 	}
+	if (flow.on_behalf_of) {
+		o['on_behalf_of'] = flow.on_behalf_of
+	}
 	if (flow.ws_error_handler_muted) {
 		o['ws_error_handler_muted'] = flow.ws_error_handler_muted
 	}
@@ -115,6 +118,7 @@ export function cleanFlow(flow: OpenFlow | any): OpenFlow & {
 	dedicated_worker?: boolean
 	visible_to_runner_only?: boolean
 	on_behalf_of_email?: string
+	on_behalf_of?: string
 } {
 	const newFlow: Flow = $state.snapshot(flow)
 
diff --git a/frontend/src/lib/components/git_sync/GitSyncContext.svelte.ts b/frontend/src/lib/components/git_sync/GitSyncContext.svelte.ts
index 5856c3bfee..0150e329ce 100644
--- a/frontend/src/lib/components/git_sync/GitSyncContext.svelte.ts
+++ b/frontend/src/lib/components/git_sync/GitSyncContext.svelte.ts
@@ -197,7 +197,14 @@ export function createGitSyncContext(workspace: string) {
 				include_path: ['f/**'],
 				exclude_path: [],
 				extra_include_path: [],
-				include_type: ['script', 'flow', 'app', 'folder', 'workspacedependencies']
+				include_type: [
+					'script',
+					'flow',
+					'app',
+					'folder',
+					'workspacedependencies',
+					'datatablemigration'
+				]
 			},
 			exclude_types_override: [],
 			legacyImported: false,
@@ -417,7 +424,14 @@ export function createGitSyncContext(workspace: string) {
 							const defaultTypes: GitSyncObjectType[] =
 								workspaceLegacyIncludeType.length > 0
 									? [...workspaceLegacyIncludeType]
-									: ['script', 'flow', 'app', 'folder', 'workspacedependencies']
+									: [
+											'script',
+											'flow',
+											'app',
+											'folder',
+											'workspacedependencies',
+											'datatablemigration'
+										]
 
 							let repoSettings: SettingsObject
 							if (isRepoLegacy) {
@@ -447,7 +461,8 @@ export function createGitSyncContext(workspace: string) {
 										'flow',
 										'app',
 										'folder',
-										'workspacedependencies'
+										'workspacedependencies',
+										'datatablemigration'
 									]
 								}
 							}
@@ -675,7 +690,14 @@ export function createGitSyncContext(workspace: string) {
 				include_path: ['f/**'],
 				exclude_path: [],
 				extra_include_path: [],
-				include_type: ['script', 'flow', 'app', 'folder', 'workspacedependencies']
+				include_type: [
+					'script',
+					'flow',
+					'app',
+					'folder',
+					'workspacedependencies',
+					'datatablemigration'
+				]
 			},
 			exclude_types_override: [],
 			legacyImported: false,
@@ -705,7 +727,14 @@ export function createGitSyncContext(workspace: string) {
 				include_path: ['f/**'],
 				exclude_path: [],
 				extra_include_path: [],
-				include_type: ['script', 'flow', 'app', 'folder', 'workspacedependencies']
+				include_type: [
+					'script',
+					'flow',
+					'app',
+					'folder',
+					'workspacedependencies',
+					'datatablemigration'
+				]
 			},
 			exclude_types_override: [],
 			legacyImported: false,
diff --git a/frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte b/frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte
index 18a8adddfc..7c422db205 100644
--- a/frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte
+++ b/frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte
@@ -141,7 +141,7 @@
 	let targetBranch = $state<string | undefined>(undefined) // Default to main, will be updated when resource is available
 	// The branch this fork workspace syncs with, mirroring the CLI/hub-script
 	// naming: a dev workspace uses its environment-label branch verbatim
-	// (dev/staging); a wm-fork-<slug> throwaway fork keeps only the slug.
+	// (dev, staging, ...); a wm-fork-<slug> throwaway fork keeps only the slug.
 	const forkBranch = $derived(
 		currentWorkspaceData?.is_dev_workspace
 			? (currentWorkspaceData?.dev_workspace_label ?? 'dev')
diff --git a/frontend/src/lib/components/git_sync/PullWorkspaceModal.svelte b/frontend/src/lib/components/git_sync/PullWorkspaceModal.svelte
index b42e290215..6f347c2f2d 100644
--- a/frontend/src/lib/components/git_sync/PullWorkspaceModal.svelte
+++ b/frontend/src/lib/components/git_sync/PullWorkspaceModal.svelte
@@ -148,7 +148,7 @@
 			const workspace = $workspaceStore
 			if (!workspace) return
 
-			// A dev workspace pulls from its environment-label branch (dev/staging)
+			// A dev workspace pulls from its environment-label branch (dev, staging, ...)
 			// and a fork from its wm-fork/<tracked>/<id> branch, not the resource's
 			// tracked branch. clone_ref falls back to the tracked branch in the
 			// pull script when the override branch doesn't exist yet.
diff --git a/frontend/src/lib/components/graph/FlowGraphV2.svelte b/frontend/src/lib/components/graph/FlowGraphV2.svelte
index bb43e1dc22..0855ac33e6 100644
--- a/frontend/src/lib/components/graph/FlowGraphV2.svelte
+++ b/frontend/src/lib/components/graph/FlowGraphV2.svelte
@@ -1,6 +1,13 @@
 <script lang="ts">
+	import GraphZoomControls from './GraphZoomControls.svelte'
+	import FlowPanelPlacementPicker from '$lib/components/flows/common/FlowPanelPlacementPicker.svelte'
+	import { overlayStack } from '$lib/components/common/overlayHost.svelte'
 	import { FlowService, type FlowModule, type FlowNote, type Job, type OpenFlow } from '../../gen'
+	import { findStepPath, parseExpandedSubflowId } from '$lib/components/restartFromStepPath'
+	import { expandedSubflowParentId } from '../flows/expandedSubflowStep'
+	import { sendUserToast } from '$lib/utils'
 	import { AI_OR_ASSET_NODE_TYPES, NODE, type GraphModuleState } from '.'
+	import { isTriggerStep } from '$lib/components/flows/flowStepSettings'
 	import { getContext, onDestroy, onMount, tick, untrack, type Snippet } from 'svelte'
 	import { createFlowDiffManager } from '../flows/flowDiffManager.svelte'
 
@@ -19,7 +26,6 @@
 	} from '@xyflow/svelte'
 	import {
 		graphBuilder,
-		isTriggerStep,
 		type InlineScript,
 		type InsertKind,
 		type NodeLayout,
@@ -85,18 +91,19 @@
 	import { getAllModules } from '../flows/flowExplorer'
 	import SelectionTool from './SelectionTool.svelte'
 	import PaneContextMenu from './PaneContextMenu.svelte'
-	import { SelectionManager } from './selectionUtils.svelte'
+	import { SelectionManager, isFlowLevelPanelTarget } from './selectionUtils.svelte'
 	import { ChangeTracker } from '$lib/svelte5Utils.svelte'
 	import { NoteManager } from './noteManager.svelte'
 	import type { MoveManager } from './moveManager.svelte'
 	import DragCoordinator from './DragCoordinator.svelte'
-	import type { ModulesTestStates } from '../modulesTest.svelte'
+	import { jobToGraphModuleState, type ModulesTestStates } from '../modulesTest.svelte'
 	import { compoundLayout } from './compoundLayout'
 	import { deepEqual } from 'fast-equals'
 	import type { AssetWithAltAccessType } from '../assets/lib'
 	import { computeNodeExtraSpace } from './nodeExtraSpace'
 	import type { ModuleActionInfo } from '$lib/components/flows/flowDiff'
 	import { setGraphContext } from './graphContext'
+	import { setFlowRunStatusContext } from './flowRunStatus.svelte'
 	import { computeNoteNodes } from './noteUtils.svelte'
 	import { Tooltip } from '../meltComponents'
 	import { getNoteEditorContext } from './noteEditor.svelte'
@@ -111,6 +118,7 @@
 	let showNotes = $state(true)
 
 	const triggerContext = getContext<TriggerContext>('TriggerContext')
+	const overlays = overlayStack()
 
 	// Create diffManager instance for this FlowGraphV2
 	const diffManager = createFlowDiffManager()
@@ -364,6 +372,37 @@
 		groupDisplayState
 	} as any)
 
+	const flowRunStatus = setFlowRunStatusContext()
+	$effect(() => {
+		flowRunStatus.flowJob = flowJob
+	})
+	$effect(() => {
+		flowRunStatus.suspendStatus = suspendStatus
+	})
+	$effect(() => {
+		// Each step's state object is replaced rather than mutated, so reading the top level
+		// catches every status change. Walking deeper would subscribe to every step's args and
+		// result on the hottest path in the graph.
+		Object.values(flowModuleStates ?? {})
+		// The loader mutates `flow_status` on the job it already handed us, so subscribing to the
+		// test state alone would never see an agent's calls land.
+		Object.values(testModuleStates?.states ?? {}).forEach((s) => [
+			s.loading,
+			s.testJob?.['flow_status']?.modules?.[0]?.agent_actions?.length
+		])
+		untrack(() => {
+			// Testing one step is its own small run, and its agent calls arrive on the test job
+			// rather than the flow's states. Fold them in so the renderers keep a single source.
+			let states = flowModuleStates
+			for (const [id, testState] of Object.entries(testModuleStates?.states ?? {})) {
+				const tested = jobToGraphModuleState(testState)
+				if (!tested?.agent_actions) continue
+				states = { ...(states ?? {}), [id]: { ...(states?.[id] ?? {}), ...tested } }
+			}
+			flowRunStatus.setModuleStates(states)
+		})
+	})
+
 	if (triggerContext && untrack(() => allowSimplifiedPoll)) {
 		if (isSimplifiable(untrack(() => modules))) {
 			triggerContext?.simplifiedPoll?.set(true)
@@ -474,10 +513,15 @@
 		insert: (detail) => {
 			onInsert?.(detail)
 		},
-		select: (modId) => {
+		select: (modId, opts) => {
 			// AI tools are not selectable by the flow. Selection has to be refactored to be simplier.
-			if (nodes.find((n) => n.data?.moduleId === modId)?.type === 'aiTool' || modId === 'Trigger') {
-				selectionManager.selectId(modId)
+			// Flow-level panels reach selection only through here, so they must go through
+			// selectId or their intent (and the modal panel) never fires.
+			if (
+				nodes.find((n) => n.data?.moduleId === modId)?.type === 'aiTool' ||
+				isFlowLevelPanelTarget(modId)
+			) {
+				selectionManager.selectId(modId, opts)
 			}
 			if (!notSelectable) {
 				onSelect?.(modId)
@@ -505,7 +549,25 @@
 			triggerContext?.simplifiedPoll.set(detail)
 		},
 		expandSubflow: async (id: string, path: string) => {
-			const flow = await FlowService.getFlowByPath({ workspace: workspace, path })
+			// Reads the subflow's *current* definition, which a share link deliberately does
+			// not cover: it authorizes the run's job subtree, not the workspace's flow
+			// library. So a share-link viewer (and any anonymous one) is refused here — name
+			// that case, but only when the error actually says so.
+			let flow: OpenFlow
+			try {
+				flow = await FlowService.getFlowByPath({ workspace: workspace, path })
+			} catch (err) {
+				const denied = err?.status === 401 || err?.status === 403
+				sendUserToast(
+					`Could not expand subflow ${path}: ${
+						denied
+							? "viewing a subflow's definition requires being logged in with access to it"
+							: (err?.body ?? err)
+					}`,
+					true
+				)
+				return
+			}
 			expandedSubflows[id] = { modules: flow.value.modules, groups: flow.value.groups }
 			expandedSubflows = expandedSubflows
 		},
@@ -601,20 +663,58 @@
 
 	let height = $state(0)
 
+	/**
+	 * A run only changes what the steps display, never the shape of the graph, but every
+	 * status poll rebuilds these arrays from scratch. xyflow re-measures every node it is
+	 * handed a new object for, and Svelte destroys and re-creates every edge, so handing
+	 * back fresh identities re-renders a graph that did not change. Reuse the previous
+	 * object wherever it still deep-equals the new one.
+	 */
+	function reuseUnchanged<T extends { id: string }>(previous: T[], next: T[]): T[] {
+		const previousById = new Map(previous.map((item) => [item.id, item]))
+		let changed = previous.length !== next.length
+		const reconciled = next.map((item, index) => {
+			const before = previousById.get(item.id)
+			if (before && deepEqual(before, item)) {
+				changed ||= previous[index] !== before
+				return before
+			}
+			changed = true
+			return item
+		})
+		return changed ? reconciled : previous
+	}
+
+	// Keyed by the source node, so a node that survived reconciliation keeps its offset
+	// object too — remapping every node would undo the identity reuse above.
+	let offsetNodeCache = new WeakMap<Node, Node>()
+	let offsetCacheKey: string | undefined = undefined
+
 	// Derived nodes with yOffset applied to all nodes uniformly and selectable flag set to false if notSelectable is true
 	const nodesWithOffset = $derived.by(() => {
+		const cacheKey = `${yOffset}:${notSelectable}`
+		if (cacheKey !== offsetCacheKey) {
+			offsetNodeCache = new WeakMap<Node, Node>()
+			offsetCacheKey = cacheKey
+		}
 		return nodes.map((node) => {
-			if (node.type && !AI_OR_ASSET_NODE_TYPES.includes(node.type)) {
-				return {
-					...node,
-					position: { ...node.position, y: node.position.y + yOffset },
-					selectable: notSelectable ? false : node.selectable
-				}
-			}
-			return {
-				...node,
-				selectable: notSelectable ? false : node.selectable
+			const cached = offsetNodeCache.get(node)
+			if (cached) {
+				return cached
 			}
+			const mapped =
+				node.type && !AI_OR_ASSET_NODE_TYPES.includes(node.type)
+					? {
+							...node,
+							position: { ...node.position, y: node.position.y + yOffset },
+							selectable: notSelectable ? false : node.selectable
+						}
+					: {
+							...node,
+							selectable: notSelectable ? false : node.selectable
+						}
+			offsetNodeCache.set(node, mapped)
+			return mapped
 		})
 	})
 
@@ -634,6 +734,10 @@
 
 	// Clear SvelteFlow's internal selection by creating new nodes array
 	function clearFlowSelection() {
+		// xyflow owns `selected` on the objects it was handed, and drops it only when it sees a
+		// node it does not recognise. Serving the cached mapping back would hand it the very
+		// object it marked selected, so the clear has to go through fresh objects.
+		offsetNodeCache = new WeakMap<Node, Node>()
 		nodes = nodes.map((node) => {
 			if (node.selected) {
 				return { ...node, selected: false }
@@ -644,6 +748,12 @@
 
 	// Keyboard event handling
 	function handleKeyDown(event: KeyboardEvent) {
+		// Escape belongs to the topmost overlay. This listener is on `document` and theirs
+		// are on `window`, so this one always runs first — without the guard, dismissing a
+		// modal or picker would also clear the selection under it and lose the user's step.
+		if (event.key === 'Escape' && overlays.val.length > 0) {
+			return
+		}
 		selectionManager.handleKeyDown(event)
 		noteManager.handleKeyDown(event)
 		if (event.key === 'Escape') {
@@ -779,13 +889,13 @@
 			: undefined
 
 		// update nodes
-		nodes = [...finalNodes, ...(noteNodesResult?.noteNodes ?? [])]
+		nodes = reuseUnchanged(nodes, [...finalNodes, ...(noteNodesResult?.noteNodes ?? [])])
 
-		edges = [
+		edges = reuseUnchanged(edges, [
 			...(assetNodesResult?.newAssetEdges ?? []),
 			...aiToolNodesResult.toolEdges,
 			...graph.edges
-		]
+		])
 
 		await tick()
 		updateHeight()
@@ -871,6 +981,13 @@
 		moduleTracker.counter
 		effectiveModuleActions
 		currentGroups
+		// The poll replaces `flowJob` on every tick and is what makes the untracked
+		// `flowModuleStates` above get re-read, so it stays a dependency. It is deliberately
+		// not handed to graphBuilder: anything put there lands in every node and edge's data,
+		// and a per-tick value there re-creates the whole graph. Renderers read it from
+		// FlowRunStatus instead.
+		flowJob
+		suspendStatus
 
 		const collapsedGroupIds = new Set(
 			allGroups
@@ -921,9 +1038,7 @@
 				isOwner,
 				isRunning,
 				individualStepTests,
-				flowJob,
 				showJobStatus,
-				suspendStatus,
 				flowHasChanged,
 				chatInputEnabled,
 				additionalAssetsMap: flowGraphAssetsCtx?.val.additionalAssetsMap
@@ -963,6 +1078,27 @@
 	// Track groups for re-layout when groups change
 	let currentGroups = $derived(groups ?? [])
 
+	/**
+	 * An agent's tool calls become nodes, and they land one at a time while the step runs.
+	 * Nothing else the graph reads changes as they arrive — the run only appends to an
+	 * existing step's state — so without this the tools all appear at once when the step ends.
+	 */
+	let agentActionsVersion = $derived.by(() => {
+		// The editor draws the agent's declared tools and ignores the run's calls, so neither the
+		// layout nor the tool nodes can change as they land.
+		if (insertable) return ''
+		let version = ''
+		for (const [id, state] of Object.entries(flowModuleStates ?? {})) {
+			const actions = state?.agent_actions
+			if (!actions) continue
+			version += `${id}:${actions.length}:`
+			for (const action of actions) {
+				version += `${action.type}/${(action as { function_name?: string }).function_name ?? ''},`
+			}
+		}
+		return version
+	})
+
 	$effect(() => {
 		;[
 			graph,
@@ -972,6 +1108,7 @@
 			noteManager.renderCount,
 			currentGroups,
 			groupDisplayState.renderCount,
+			agentActionsVersion,
 			// A linked step's tools resolve asynchronously; recompute tool nodes when they land.
 			linkedAgentToolsVersion()
 		]
@@ -1091,6 +1228,54 @@
 		}
 	}
 
+	let latestReload = 0
+
+	/** Flow an expanded subflow node stands for, read from the step it inlines: the edited
+	 * flow for a top-level expansion, the enclosing expansion's modules otherwise. */
+	function expandedSubflowPath(nodeId: string): string | undefined {
+		const parentId = expandedSubflowParentId(nodeId)
+		const parentModules = parentId == undefined ? modules : expandedSubflows[parentId]?.modules
+		const stepId = parseExpandedSubflowId(nodeId)?.leaf ?? nodeId
+		const value = parentModules && findStepPath(parentModules, stepId)?.target.value
+		return value && value.type === 'flow' ? value.path : undefined
+	}
+
+	/** Refetch the steps inlined by every expanded subflow, e.g. after one was deployed from
+	 * the flow editor drawer. Outermost first, so a nested expansion resolves its path from
+	 * its refreshed parent: a step now pointing at another flow must not keep rendering the
+	 * one it pointed at when it was expanded. */
+	export async function reloadExpandedSubflows() {
+		const reload = ++latestReload
+		const ids = Object.keys(expandedSubflows).sort(
+			(a, b) =>
+				(parseExpandedSubflowId(a)?.subflowSteps.length ?? 0) -
+				(parseExpandedSubflowId(b)?.subflowSteps.length ?? 0)
+		)
+		for (const id of ids) {
+			// A later reload owns the state from here on.
+			if (reload !== latestReload) return
+			const expansion = expandedSubflows[id]
+			if (expansion == undefined) continue
+			const path = expandedSubflowPath(id)
+			if (path == undefined) {
+				delete expandedSubflows[id]
+				continue
+			}
+			try {
+				const flow = await FlowService.getFlowByPath({ workspace: workspace, path })
+				if (reload !== latestReload) return
+				// While this request was in flight the user may have collapsed the expansion, or
+				// collapsed it and re-expanded onto another flow: only commit onto the very
+				// expansion this response was fetched for.
+				if (expandedSubflows[id] !== expansion) continue
+				expandedSubflows[id] = { modules: flow.value.modules, groups: flow.value.groups }
+			} catch (err) {
+				sendUserToast(`Could not reload expanded subflow ${path}: ${err.body ?? err}`, true)
+			}
+		}
+		expandedSubflows = expandedSubflows
+	}
+
 	export function createGroupFromSelection(ids: string[]) {
 		if (groupEditorCtx?.groupEditor) {
 			groupEditorCtx.groupEditor.createGroup(ids, currentGraphNodeDeps)
@@ -1230,12 +1415,17 @@
 						{@render leftHeader()}
 					</div>
 				{:else}
+					<!-- Their built-in glyphs are fill-based and sized differently from every other
+					     icon in the editor, so the bar is built from lucide throughout. -->
 					<Controls
+						class="wm-flow-controls"
 						position={controlsPosition === 'bottom' ? 'bottom-right' : 'top-right'}
 						orientation="horizontal"
+						showZoom={false}
+						showFitView={false}
 						showLock={false}
-						fitViewOptions={{ nodes: nodes.filter((n) => n.type !== 'note') }}
 					>
+						<GraphZoomControls fitViewNodes={nodes.filter((n) => n.type !== 'note')} />
 						{#if multiSelectEnabled}
 							<div class="flex items-center gap-2">
 								<Tooltip>
@@ -1291,6 +1481,7 @@
 								<Expand size="14" />
 							</ControlButton>
 						{/if}
+						<FlowPanelPlacementPicker variant="control" placement="top-end" />
 					</Controls>
 
 					<Controls
@@ -1323,12 +1514,40 @@
 		opacity: 0;
 	}
 
-	:global(.svelte-flow__controls-button) {
-		@apply bg-surface border-0;
+	/* xy-flow's own rules are nested, so `.svelte-flow__controls-button svg` and the like
+	   match ours exactly and load order decides. Scoping by the class we pass to <Controls>
+	   outranks them instead of racing them. */
+	:global(.svelte-flow__controls.wm-flow-controls) {
+		/* Name the colour rather than leaning on the base layer's bare `.border`: preflight
+		   sets a light `border-color` on every element, so whenever that base rule does not
+		   make it into the bundle alongside this one the bar draws a white outline. */
+		@apply overflow-hidden rounded-md border border-border-light;
+		box-shadow: none;
 	}
-	:global(.svelte-flow__controls-button:hover) {
+	:global(.wm-flow-controls .svelte-flow__controls-button) {
+		@apply bg-surface text-primary;
+		width: 32px;
+		height: 30px;
+		padding: 8px;
+	}
+	:global(.wm-flow-controls .svelte-flow__controls-button:hover) {
 		@apply bg-surface-hover;
 	}
+	:global(.wm-flow-controls.horizontal .svelte-flow__controls-button) {
+		@apply border-r border-gray-200 dark:border-gray-700;
+	}
+	:global(.wm-flow-controls.horizontal .svelte-flow__controls-button:last-child) {
+		@apply border-r-0;
+	}
+	/* Every glyph in this bar is lucide, so undo their base `fill: currentColor` — it beats
+	   lucide's inline fill="none" and would flood the stroke icons solid — and lift the
+	   12px cap that keeps them off the editor's icon scale. */
+	:global(.wm-flow-controls .svelte-flow__controls-button svg) {
+		max-width: 16px;
+		max-height: 16px;
+		fill: none;
+		stroke: currentColor;
+	}
 
 	:global(.svelte-flow__edgelabel-renderer) {
 		@apply z-50;
diff --git a/frontend/src/lib/components/graph/GraphZoomControls.svelte b/frontend/src/lib/components/graph/GraphZoomControls.svelte
new file mode 100644
index 0000000000..b023dd4941
--- /dev/null
+++ b/frontend/src/lib/components/graph/GraphZoomControls.svelte
@@ -0,0 +1,35 @@
+<script lang="ts">
+	import { ControlButton, useSvelteFlow, type Node } from '@xyflow/svelte'
+	import { Maximize, ZoomIn, ZoomOut } from 'lucide-svelte'
+	import { Tooltip } from '$lib/components/meltComponents'
+
+	interface Props {
+		/** Nodes to frame; notes are decorative and would skew the fit. */
+		fitViewNodes?: Node[]
+	}
+
+	let { fitViewNodes }: Props = $props()
+
+	// Its own component so the hook runs inside the provider, like DragGhost and
+	// PaneContextMenu do.
+	const { zoomIn, zoomOut, fitView } = useSvelteFlow()
+</script>
+
+<Tooltip>
+	<ControlButton onclick={() => zoomIn()}>
+		<ZoomIn size="14" />
+	</ControlButton>
+	{#snippet text()}Zoom in{/snippet}
+</Tooltip>
+<Tooltip>
+	<ControlButton onclick={() => zoomOut()}>
+		<ZoomOut size="14" />
+	</ControlButton>
+	{#snippet text()}Zoom out{/snippet}
+</Tooltip>
+<Tooltip>
+	<ControlButton onclick={() => fitView(fitViewNodes ? { nodes: fitViewNodes } : undefined)}>
+		<Maximize size="14" />
+	</ControlButton>
+	{#snippet text()}Fit view{/snippet}
+</Tooltip>
diff --git a/frontend/src/lib/components/graph/GroupModuleIcons.svelte b/frontend/src/lib/components/graph/GroupModuleIcons.svelte
index 3df1aecfaa..09c1a6812f 100644
--- a/frontend/src/lib/components/graph/GroupModuleIcons.svelte
+++ b/frontend/src/lib/components/graph/GroupModuleIcons.svelte
@@ -5,17 +5,17 @@
 	import { getGraphContext } from './graphContext'
 	import { getNodeColorClasses } from '$lib/components/graph'
 	import type { FlowNodeState } from '$lib/components/graph/util'
-	import type { GraphModuleState } from './model'
 	import type { FlowModule } from '$lib/gen'
 	import type { GraphEventHandlers } from './graphBuilder.svelte'
+	import { getFlowRunStatusContext } from './flowRunStatus.svelte'
 
 	interface Props {
 		modules: FlowModule[]
-		flowModuleStates?: Record<string, GraphModuleState> | undefined
 		eventHandlers?: GraphEventHandlers
 	}
 
-	let { modules, flowModuleStates, eventHandlers }: Props = $props()
+	let { modules, eventHandlers }: Props = $props()
+	const flowRunStatus = getFlowRunStatusContext()
 
 	const { selectionManager } = getGraphContext()
 
@@ -75,11 +75,11 @@
 	}
 
 	let overflowAggregateState = $derived.by<FlowNodeState | undefined>(() => {
-		if (!flowModuleStates) return undefined
+		if (!flowRunStatus) return undefined
 		let best: FlowNodeState | undefined = undefined
 		let bestPriority = 0
 		for (const mod of overflowModules) {
-			const state = flowModuleStates[mod.id]?.type
+			const state = flowRunStatus.getModuleState(mod.id)?.type
 			if (state) {
 				const p = STATE_PRIORITY[state] ?? 0
 				if (p > bestPriority) {
@@ -105,15 +105,17 @@
 	}
 
 	function selectModule(mod: FlowModule) {
-		selectionManager.selectId(mod.id)
-		eventHandlers?.select(mod.id)
+		// These icons stand in for nodes the graph marks unselectable, so there is no
+		// node to double-click — the click itself has to open the panel.
+		selectionManager.selectId(mod.id, { openPanel: true })
+		eventHandlers?.select(mod.id, { openPanel: true })
 	}
 </script>
 
 <div class="flex items-center gap-1">
 	{#each displayModules as mod (mod.id)}
 		{@const selected = selectionManager.isNodeSelected(mod.id)}
-		{@const nodeState = flowModuleStates?.[mod.id]?.type}
+		{@const nodeState = flowRunStatus?.getModuleState(mod.id)?.type}
 		{@const colorClasses = getNodeColorClasses(nodeState, selected)}
 		<Tooltip placement="bottom">
 			{#snippet children()}
@@ -155,7 +157,7 @@
 					style="max-height: 50vh;"
 				>
 					{#each overflowModules as mod (mod.id)}
-						{@const nodeState = flowModuleStates?.[mod.id]?.type}
+						{@const nodeState = flowRunStatus?.getModuleState(mod.id)?.type}
 						{@const colorClasses = getNodeColorClasses(nodeState, false)}
 						{@const selected = selectionManager.isNodeSelected(mod.id)}
 						<!-- svelte-ignore a11y_click_events_have_key_events -->
diff --git a/frontend/src/lib/components/graph/PaneContextMenu.svelte b/frontend/src/lib/components/graph/PaneContextMenu.svelte
index b6b6b49ac9..37be64bffc 100644
--- a/frontend/src/lib/components/graph/PaneContextMenu.svelte
+++ b/frontend/src/lib/components/graph/PaneContextMenu.svelte
@@ -1,5 +1,7 @@
 <script lang="ts">
 	import { useSvelteFlow } from '@xyflow/svelte'
+	import { getOverlayHost } from '$lib/components/common/overlayHost.svelte'
+	import ConditionalPortal from '$lib/components/common/drawer/ConditionalPortal.svelte'
 	import { StickyNote } from 'lucide-svelte'
 	import { getNoteEditorContext } from './noteEditor.svelte'
 	import { DEFAULT_NOTE_COLOR } from './noteColors'
@@ -26,6 +28,19 @@
 	let contextMenuPosition = $state<{ x: number; y: number }>({ x: 0, y: 0 })
 	let pendingFlowPosition = $state<{ x: number; y: number } | null>(null)
 
+	// Coordinates come from the pointer event, so they are viewport-relative. Inside a pane
+	// the menu is portalled into it and positioned against it, or its click-catcher would
+	// blanket the app chrome around it. The portal is what makes the pane the offset parent
+	// the coordinates are then rebased onto — this component otherwise renders inside the
+	// graph's `overflow-clip` box, which would both displace and clip the menu.
+	const overlayHost = getOverlayHost()
+	const hostEl = $derived(overlayHost?.el())
+	const posClass = $derived(hostEl ? 'absolute' : 'fixed')
+	const menuOrigin = $derived.by(() => {
+		const rect = contextMenuVisible ? hostEl?.getBoundingClientRect() : undefined
+		return { x: rect?.left ?? 0, y: rect?.top ?? 0 }
+	})
+
 	function handlePaneContextMenu(event: MouseEvent) {
 		// Only show context menu in edit mode
 		if (!editMode || !noteEditorContext?.noteEditor) {
@@ -73,43 +88,46 @@
 	}
 </script>
 
-{#if contextMenuVisible}
-	<!-- Context menu -->
-	<div
-		class="fixed {getContextMenuContainerClass('z-[9999]')}"
-		style="left: {contextMenuPosition.x}px; top: {contextMenuPosition.y}px;"
-		transition:fly={{ duration: 150, y: -10 }}
-		role="menu"
-		tabindex="-1"
-		onclick={(e) => {
-			e.stopPropagation()
-		}}
-		onkeydown={(e) => {
-			if (e.key === 'Escape') {
-				contextMenuVisible = false
-			}
-		}}
-	>
-		<button
-			class="{CONTEXT_MENU_ITEM_BASE_CLASS} {CONTEXT_MENU_ITEM_HOVER_CLASS}"
-			onclick={handleAddStickyNote}
-			type="button"
+<ConditionalPortal condition={!!hostEl} target={hostEl} class="contents">
+	{#if contextMenuVisible}
+		<!-- Context menu -->
+		<div
+			class="{posClass} {getContextMenuContainerClass('z-[9999]')}"
+			style="left: {contextMenuPosition.x - menuOrigin.x}px; top: {contextMenuPosition.y -
+				menuOrigin.y}px;"
+			transition:fly={{ duration: 150, y: -10 }}
+			role="menu"
+			tabindex="-1"
+			onclick={(e) => {
+				e.stopPropagation()
+			}}
+			onkeydown={(e) => {
+				if (e.key === 'Escape') {
+					contextMenuVisible = false
+				}
+			}}
 		>
-			<StickyNote size={14} class="mr-2" />
-			<span>Add sticky note</span>
-		</button>
-	</div>
+			<button
+				class="{CONTEXT_MENU_ITEM_BASE_CLASS} {CONTEXT_MENU_ITEM_HOVER_CLASS}"
+				onclick={handleAddStickyNote}
+				type="button"
+			>
+				<StickyNote size={14} class="mr-2" />
+				<span>Add sticky note</span>
+			</button>
+		</div>
 
-	<!-- Invisible click catcher to close context menu -->
-	<div
-		class="fixed inset-0 z-[9998]"
-		role="presentation"
-		onclick={() => {
-			contextMenuVisible = false
-		}}
-		oncontextmenu={(e) => {
-			e.preventDefault()
-			contextMenuVisible = false
-		}}
-	></div>
-{/if}
+		<!-- Invisible click catcher to close context menu -->
+		<div
+			class="{posClass} inset-0 z-[9998]"
+			role="presentation"
+			onclick={() => {
+				contextMenuVisible = false
+			}}
+			oncontextmenu={(e) => {
+				e.preventDefault()
+				contextMenuVisible = false
+			}}
+		></div>
+	{/if}
+</ConditionalPortal>
diff --git a/frontend/src/lib/components/graph/flowRunStatus.svelte.ts b/frontend/src/lib/components/graph/flowRunStatus.svelte.ts
new file mode 100644
index 0000000000..8f5ee97641
--- /dev/null
+++ b/frontend/src/lib/components/graph/flowRunStatus.svelte.ts
@@ -0,0 +1,56 @@
+import { getContext, hasContext, setContext } from 'svelte'
+import { SvelteMap } from 'svelte/reactivity'
+import type { Job } from '$lib/gen'
+import type { GraphModuleState } from './model'
+
+const FLOW_RUN_STATUS_KEY = 'FlowRunStatus'
+
+export type SuspendStatus = Record<string, { job: Job; nb: number }>
+
+/**
+ * Run status is read straight from here by the node and edge renderers rather than
+ * being carried in their `data`. Baking it into `data` means the only way to show a
+ * status change is to rebuild every node and edge, which re-runs the sugiyama layout
+ * and makes xyflow re-measure and re-create the whole graph on every poll.
+ */
+export class FlowRunStatus {
+	#moduleStates = new SvelteMap<string, GraphModuleState>()
+	flowJob = $state.raw<Job | undefined>(undefined)
+	suspendStatus = $state.raw<SuspendStatus>({})
+
+	getModuleState(id: string | undefined): GraphModuleState | undefined {
+		return id == undefined ? undefined : this.#moduleStates.get(id)
+	}
+
+	setModuleStates(next: Record<string, GraphModuleState> | undefined) {
+		const incoming = next ?? {}
+		for (const id of [...this.#moduleStates.keys()]) {
+			if (!(id in incoming)) {
+				this.#moduleStates.delete(id)
+			}
+		}
+		// Writing a key invalidates only that key's readers, so one step finishing
+		// never re-renders the other steps.
+		for (const [id, state] of Object.entries(incoming)) {
+			if (this.#moduleStates.get(id) !== state) {
+				this.#moduleStates.set(id, state)
+			}
+		}
+	}
+}
+
+export function setFlowRunStatusContext(): FlowRunStatus {
+	const status = new FlowRunStatus()
+	setContext(FLOW_RUN_STATUS_KEY, status)
+	return status
+}
+
+/**
+ * Graphs that never show run status (mini graph, diff viewer) provide no context, so
+ * every reader has to tolerate its absence.
+ */
+export function getFlowRunStatusContext(): FlowRunStatus | undefined {
+	return hasContext(FLOW_RUN_STATUS_KEY)
+		? getContext<FlowRunStatus>(FLOW_RUN_STATUS_KEY)
+		: undefined
+}
diff --git a/frontend/src/lib/components/graph/graphBuilder.svelte.ts b/frontend/src/lib/components/graph/graphBuilder.svelte.ts
index 3e56a5cd5b..450debbef4 100644
--- a/frontend/src/lib/components/graph/graphBuilder.svelte.ts
+++ b/frontend/src/lib/components/graph/graphBuilder.svelte.ts
@@ -1,9 +1,10 @@
-import type { FlowModule, Job, PathScript, RawScript, Script } from '$lib/gen'
+import type { FlowModule, PathScript, RawScript, Script } from '$lib/gen'
 import { type Edge } from '@xyflow/svelte'
 import { getAllModules, getDependeeAndDependentComponents } from '../flows/flowExplorer'
 import { dfsByModule } from '../flows/previousResults'
 import { defaultIfEmptyString } from '$lib/utils'
 import type { GraphModuleState } from './model'
+import type { SelectIntentOptions } from './selectionUtils.svelte'
 import { getFlowModuleAssets, type AssetWithAltAccessType } from '../assets/lib'
 import { assetDisplaysAsOutputInFlowGraph } from './renderers/nodes/AssetNode.svelte'
 import type { ModulesTestStates, ModuleTestState } from '../modulesTest.svelte'
@@ -60,7 +61,7 @@ export type GraphEventHandlers = {
 		isPreprocessor?: boolean
 	}) => void
 	deleteBranch: (detail: { id: string; index: number }, label: string) => void
-	select: (mod: string | FlowModule) => void
+	select: (mod: string | FlowModule, opts?: SelectIntentOptions) => void
 	delete: (detail: { id: string }, label: string) => void
 	/** Drop a node that only mirrors run state (the error handler marker). Never edits the flow. */
 	dismissRunNode: (id: string) => void
@@ -84,14 +85,6 @@ export type GraphEventHandlers = {
 
 export type SimplifiableFlow = { simplifiedFlow: boolean }
 
-export function isTriggerStep(module: FlowModule | undefined): boolean {
-	return (
-		module?.value != undefined &&
-		(module.value.type === 'script' || module.value.type === 'rawscript') &&
-		module.value.is_trigger === true
-	)
-}
-
 export function buildPrefix(prefix: string | undefined, id: string): string {
 	return (prefix ?? '') + id + ':'
 }
@@ -139,7 +132,6 @@ export type InputN = {
 		editMode: boolean
 		isRunning: boolean
 		individualStepTests: boolean
-		flowJob: Job | undefined
 		showJobStatus: boolean
 		flowHasChanged: boolean
 		chatInputEnabled: boolean
@@ -155,11 +147,9 @@ export type ModuleN = {
 		id: string
 		parentIds: string[]
 		eventHandlers: GraphEventHandlers
-		flowModuleState: GraphModuleState | undefined
 		testModuleState: ModuleTestState | undefined
 		insertable: boolean
 		editMode: boolean
-		flowJob: Job | undefined
 		isOwner: boolean
 		assets: AssetWithAltAccessType[] | undefined
 		moduleAction: ModuleActionInfo | undefined
@@ -174,7 +164,6 @@ export type FailureModuleN = {
 		id: string
 		module: FlowModule
 		eventHandlers: GraphEventHandlers
-		flowModuleState: GraphModuleState | undefined
 	}
 }
 
@@ -185,7 +174,6 @@ export type BranchAllStartN = {
 		id: string
 		branchIndex: number
 		eventHandlers: GraphEventHandlers
-		flowModuleState: GraphModuleState | undefined
 		insertable: boolean
 		branchOne: boolean
 	}
@@ -196,7 +184,6 @@ export type BranchAllEndN = {
 	data: {
 		id: string
 		eventHandlers: GraphEventHandlers
-		flowModuleState: GraphModuleState | undefined
 	}
 }
 
@@ -206,7 +193,6 @@ export type ForLoopEndN = {
 		id: string
 		eventHandlers: GraphEventHandlers
 		simplifiedTriggerView: boolean
-		flowModuleState: GraphModuleState | undefined
 	}
 }
 
@@ -215,7 +201,6 @@ export type ForLoopStartN = {
 	data: {
 		id: string
 		eventHandlers: GraphEventHandlers
-		flowModuleState: GraphModuleState | undefined
 		selectedId: string | undefined
 		editMode: boolean
 		simplifiedTriggerView: boolean
@@ -229,7 +214,6 @@ export type ResultN = {
 		success: boolean | undefined
 		eventHandlers: GraphEventHandlers
 		editMode: boolean
-		job: Job | undefined
 		showJobStatus: boolean
 	}
 }
@@ -251,7 +235,6 @@ export type BranchOneStartN = {
 	data: {
 		id: string
 		eventHandlers: GraphEventHandlers
-		flowModuleState: GraphModuleState | undefined
 		selected: boolean
 		insertable: boolean
 		label: string
@@ -266,7 +249,6 @@ export type BranchOneEndN = {
 	data: {
 		id: string
 		eventHandlers: GraphEventHandlers
-		flowModuleState: GraphModuleState | undefined
 	}
 }
 
@@ -287,7 +269,6 @@ export type NoBranchN = {
 	data: {
 		id: string
 		eventHandlers: GraphEventHandlers
-		flowModuleState: GraphModuleState | undefined
 		branchOne: boolean
 		label: string
 		branchIndex: number
@@ -330,6 +311,11 @@ export type AiToolN = {
 		nameError?: string
 		eventHandlers: GraphEventHandlers
 		moduleId: string
+		/** An MCP tool's server, which its calls are keyed to. */
+		resourcePath?: string
+		/** The agent step this tool hangs off. The editor draws the declared tools, whose ids the
+		 * run's per-call state is not keyed by, so the node needs its agent to find its calls. */
+		agentModuleId: string
 		// Set on a linked agent's display-only tools: clicking selects this module (the agent step)
 		// instead of the tool, whose resource-owned id is not flow-unique.
 		selectTarget?: string
@@ -337,7 +323,6 @@ export type AiToolN = {
 		// Tool of a linked agent: its inputs are editable but its structure comes from the resource,
 		// so it can't be deleted here.
 		readOnly?: boolean
-		flowModuleStates: Record<string, GraphModuleState> | undefined
 	}
 }
 
@@ -359,10 +344,7 @@ export type CollapsedGroupN = {
 		autocollapse: boolean | undefined
 		stepCount: number
 		modules: FlowModule[]
-		flowModuleStates: Record<string, GraphModuleState> | undefined
-		flowJob: Job | undefined
 		isOwner: boolean
-		suspendStatus: Record<string, { job: Job; nb: number }>
 		showNotes: boolean
 		editMode: boolean
 		eventHandlers: GraphEventHandlers
@@ -423,6 +405,9 @@ export function graphBuilder(
 	extra: {
 		disableAi: boolean
 		insertable: boolean
+		// Only for the parts of the graph's shape a run decides: which loop iteration is
+		// expanded and where the error-handler marker attaches. Everything a step merely
+		// displays comes from FlowRunStatus, never from here.
 		flowModuleStates: Record<string, GraphModuleState> | undefined
 		testModuleStates: ModulesTestStates | undefined
 		moduleActions?: Record<string, ModuleActionInfo>
@@ -435,9 +420,7 @@ export function graphBuilder(
 		isOwner: boolean
 		isRunning: boolean
 		individualStepTests: boolean
-		flowJob: Job | undefined
 		showJobStatus: boolean
-		suspendStatus: Record<string, { job: Job; nb: number }>
 		flowHasChanged: boolean
 		chatInputEnabled: boolean
 		additionalAssetsMap?: Record<string, AssetWithAltAccessType[]>
@@ -488,12 +471,10 @@ export function graphBuilder(
 					id: module.id,
 					parentIds: [],
 					eventHandlers: eventHandlers,
-					flowModuleState: extra.flowModuleStates?.[module.id],
 					testModuleState: extra.testModuleStates?.states?.[module.id],
 					insertable: extra.insertable && !module.id.startsWith('subflow:'),
 					editMode: extra.editMode,
 					isOwner: extra.isOwner,
-					flowJob: extra.flowJob,
 					assets: getFlowModuleAssets(module, extra.additionalAssetsMap),
 					moduleAction: extra.moduleActions?.[module.id],
 					...extraData
@@ -518,8 +499,7 @@ export function graphBuilder(
 				data: {
 					id: module.id,
 					module,
-					eventHandlers: eventHandlers,
-					flowModuleState: extra.flowModuleStates?.[module.id]
+					eventHandlers: eventHandlers
 				},
 				type: 'failureModule',
 				selectable: false
@@ -616,7 +596,11 @@ export function graphBuilder(
 					disableMoveIds: options?.disableMoveIds,
 					enableTrigger: sourceId === 'Input',
 					index,
-					...extra,
+					// Only what the edge renderer reads. Anything listed here lands on every edge,
+					// so a value that changes each poll invalidates the whole edge set and makes
+					// Svelte re-create each one.
+					disableAi: extra.disableAi,
+					isOwner: extra.isOwner,
 					insertable: extra.insertable && !options?.disableInsert && prefix == undefined,
 					shouldOffsetInsertBtnDueToAssetNode: nodeIdsWithOutputAssets.has(sourceId)
 				},
@@ -638,7 +622,6 @@ export function graphBuilder(
 				editMode: extra.editMode,
 				isRunning: extra.isRunning,
 				individualStepTests: extra.individualStepTests,
-				flowJob: extra.flowJob,
 				showJobStatus: extra.showJobStatus,
 				flowHasChanged: extra.flowHasChanged,
 				chatInputEnabled: extra.chatInputEnabled,
@@ -679,7 +662,6 @@ export function graphBuilder(
 				eventHandlers: eventHandlers,
 				success: success,
 				editMode: extra.editMode,
-				job: extra.flowJob,
 				showJobStatus: extra.showJobStatus
 			},
 			type: 'result'
@@ -748,10 +730,7 @@ export function graphBuilder(
 									modules: leafIds
 										.map((id) => moduleMap.get(id))
 										.filter((m): m is FlowModule => !!m),
-									flowModuleStates: extra.flowModuleStates,
-									flowJob: extra.flowJob,
 									isOwner: extra.isOwner,
-									suspendStatus: extra.suspendStatus,
 									showNotes,
 									editMode: prefix == undefined && extra.editMode,
 									eventHandlers
@@ -873,8 +852,7 @@ export function graphBuilder(
 							id: `${module.id}-end`,
 							data: {
 								id: module.id,
-								eventHandlers: eventHandlers,
-								flowModuleState: extra.flowModuleStates?.[module.id]
+								eventHandlers: eventHandlers
 							},
 							type: 'branchAllEnd'
 						}
@@ -889,7 +867,6 @@ export function graphBuilder(
 									id: module.id,
 									branchIndex: -1,
 									eventHandlers: eventHandlers,
-									flowModuleState: extra.flowModuleStates?.[module.id],
 									branchOne: false,
 									label: 'No branches'
 								},
@@ -915,7 +892,6 @@ export function graphBuilder(
 										id: module.id,
 										branchIndex: branchIndex,
 										eventHandlers: eventHandlers,
-										flowModuleState: extra.flowModuleStates?.[module.id],
 										insertable: extra.insertable,
 										branchOne: false
 									},
@@ -961,7 +937,6 @@ export function graphBuilder(
 								simplifiedTriggerView,
 								eventHandlers: eventHandlers,
 								editMode: extra.editMode,
-								flowModuleState: extra.flowModuleStates?.[module.id],
 								selectedId: extra.selectedId
 							},
 							type: 'forLoopStart'
@@ -982,8 +957,7 @@ export function graphBuilder(
 							data: {
 								id: module.id,
 								eventHandlers: eventHandlers,
-								simplifiedTriggerView,
-								flowModuleState: extra.flowModuleStates?.[module.id]
+								simplifiedTriggerView
 							},
 							type: 'forLoopEnd'
 						}
@@ -1053,7 +1027,6 @@ export function graphBuilder(
 							id: `${module.id}-end`,
 							data: {
 								eventHandlers: eventHandlers,
-								flowModuleState: extra.flowModuleStates?.[module.id],
 								id: module.id
 							},
 							type: 'branchOneEnd'
@@ -1069,7 +1042,6 @@ export function graphBuilder(
 								eventHandlers: eventHandlers,
 								insertable: extra.insertable,
 								preLabel: undefined,
-								flowModuleState: extra.flowModuleStates?.[module.id],
 								selected: false,
 								modules: module.value.default
 							},
@@ -1105,7 +1077,6 @@ export function graphBuilder(
 									branchIndex: branchIndex,
 									eventHandlers: eventHandlers,
 									insertable: extra.insertable,
-									flowModuleState: extra.flowModuleStates?.[module.id],
 									selected: false,
 									modules: branch.modules
 								},
diff --git a/frontend/src/lib/components/graph/model.ts b/frontend/src/lib/components/graph/model.ts
index 3618406371..07c7fb0e19 100644
--- a/frontend/src/lib/components/graph/model.ts
+++ b/frontend/src/lib/components/graph/model.ts
@@ -66,6 +66,9 @@ export type GraphModuleState = {
 	isListJob?: boolean
 	skipped?: boolean
 	agent_actions?: FlowStatusModule['agent_actions']
+	/** Positionally aligned with `agent_actions`: every push of an action appends one entry, so a
+	 * missing entry means that action has not finished yet. */
+	agent_actions_success?: FlowStatusModule['agent_actions_success']
 	script_hash?: string
 	workflow_as_code_status?: WorkflowStatus
 }
diff --git a/frontend/src/lib/components/graph/renderers/edges/BaseEdge.svelte b/frontend/src/lib/components/graph/renderers/edges/BaseEdge.svelte
index 5fbf084374..89e7c88c94 100644
--- a/frontend/src/lib/components/graph/renderers/edges/BaseEdge.svelte
+++ b/frontend/src/lib/components/graph/renderers/edges/BaseEdge.svelte
@@ -6,15 +6,15 @@
 	import { getStraightLinePath } from '../utils'
 	import { twMerge } from 'tailwind-merge'
 	import { NODE_WITH_WRITE_ASSET_Y_OFFSET } from '../nodes/AssetNode.svelte'
-	import { workspaceStore } from '$lib/stores'
 	import FlowStatusWaitingForEvents from '$lib/components/FlowStatusWaitingForEvents.svelte'
 	import type { Job } from '$lib/gen'
-	import type { GraphModuleState } from '../../model'
 	import InsertModuleButton from '$lib/components/flows/map/InsertModuleButton.svelte'
 	import { getGraphContext } from '../../graphContext'
+	import { getFlowRunStatusContext } from '../../flowRunStatus.svelte'
 	import { GROUP_TOP_PADDING } from '$lib/components/graph/compoundLayout'
 
 	const { useDataflow, showAssets, moveManager } = getGraphContext()
+	const flowRunStatus = getFlowRunStatusContext()
 
 	let {
 		id,
@@ -40,10 +40,7 @@
 			enableTrigger: boolean
 			disableAi: boolean
 			disableMoveIds: string[]
-			flowModuleStates: Record<string, GraphModuleState> | undefined
 			isOwner: boolean
-			flowJob: Job | undefined
-			suspendStatus?: Record<string, { job: Job; nb: number }>
 			shouldOffsetInsertBtnDueToAssetNode?: boolean
 		}
 	} = $props()
@@ -76,12 +73,13 @@
 	// TODO: this is a hack to show the waiting for events indicator on the edge a proper way would be to have a edge state
 	// and handle the edge state in the graph builder
 	let waitingForEvents = $derived(
-		data?.flowModuleStates?.[data.targetId]?.type === 'WaitingForEvents' ||
-			data?.flowModuleStates?.[`${data.sourceId}-v`]?.type === 'WaitingForEvents'
+		flowRunStatus?.getModuleState(data.targetId)?.type === 'WaitingForEvents' ||
+			flowRunStatus?.getModuleState(`${data.sourceId}-v`)?.type === 'WaitingForEvents'
 	)
 
+	let flowJob: Job | undefined = $derived(flowRunStatus?.flowJob)
 	let suspendStatus: Record<string, { job: Job; nb: number }> | undefined = $derived(
-		data?.suspendStatus
+		flowRunStatus?.suspendStatus
 	)
 
 	let centerY = $derived(
@@ -133,7 +131,7 @@
 </script>
 
 <EdgeLabel x={sourceX} y={centerY} class="base-edge" style="">
-	{#if waitingForEvents && data.flowJob && data.flowJob.type === 'QueuedJob'}
+	{#if waitingForEvents && flowJob && flowJob.type === 'QueuedJob'}
 		<div
 			class="px-2 py-0.5 rounded-md bg-surface shadow-md text-violet-700 dark:text-violet-400 text-xs flex items-center gap-1"
 		>
@@ -147,10 +145,10 @@
 		<div
 			class={'fixed top-1/2 -translate-y-1/2 left-[170px] h-fit w-fit rounded-md bg-surface flex items-center justify-center p-2 ml-2 shadow-md'}
 		>
-			{#if data?.flowJob && data.flowJob.flow_status?.modules?.[data.flowJob.flow_status?.step]?.type === 'WaitingForEvents'}
+			{#if flowJob && flowJob.flow_status?.modules?.[flowJob.flow_status?.step]?.type === 'WaitingForEvents'}
 				<FlowStatusWaitingForEvents
-					job={data.flowJob}
-					workspaceId={$workspaceStore!}
+					job={flowJob}
+					workspaceId={flowJob.workspace_id}
 					isOwner={data.isOwner}
 					light
 				/>
@@ -159,7 +157,7 @@
 					{#each Object.values(suspendStatus) as suspendCount (suspendCount.job.id)}
 						<FlowStatusWaitingForEvents
 							job={suspendCount.job}
-							workspaceId={$workspaceStore!}
+							workspaceId={suspendCount.job.workspace_id}
 							isOwner={data.isOwner}
 							light
 						/>
diff --git a/frontend/src/lib/components/graph/renderers/nodes/AIToolNode.svelte b/frontend/src/lib/components/graph/renderers/nodes/AIToolNode.svelte
index 9660ee3fa7..9465f5b49f 100644
--- a/frontend/src/lib/components/graph/renderers/nodes/AIToolNode.svelte
+++ b/frontend/src/lib/components/graph/renderers/nodes/AIToolNode.svelte
@@ -43,7 +43,7 @@
 	let computeAIToolNodesCache:
 		| {
 				nodes: (Node & NodeLayout)[]
-				hasFlowModuleStates: boolean
+				agentActions: Record<string, unknown>
 				linkedAgentTools: Record<string, AgentTool[]> | undefined
 				ret: ReturnType<typeof computeAIToolNodes>
 		  }
@@ -55,6 +55,58 @@
 			: AI_TOOL_MESSAGE_PREFIX + '-' + agentModuleId + '-' + idx
 	}
 
+	export type AgentAction = NonNullable<GraphModuleState['agent_actions']>[number]
+
+	function bareResourcePath(path: string | undefined): string | undefined {
+		return path?.startsWith('$res:') ? path.slice('$res:'.length) : path
+	}
+
+	/** Whether a run's action was a call of this declared tool. The editor keeps one node per
+	 * declared tool, so each kind of action has to find its way back to the right one: a flow
+	 * module by id, web search by being the only one of its kind, an MCP server by its resource
+	 * path. A miss leaves the node undecorated rather than decorating the wrong tool. */
+	export function agentActionMatchesTool(
+		action: AgentAction,
+		tool: { moduleId: string; type?: string; resourcePath?: string }
+	): boolean {
+		switch (action.type) {
+			case 'tool_call':
+				return action.module_id === tool.moduleId
+			case 'web_search':
+				return tool.type === 'websearch'
+			case 'mcp_tool_call':
+				// One MCP node stands for a whole server and many function names, so the server path
+				// is the only join that holds. The worker strips `$res:` before building the action,
+				// while a flow authored outside the resource picker can still carry it.
+				return (
+					tool.type === 'mcp' &&
+					bareResourcePath(action.resource_path) === bareResourcePath(tool.resourcePath)
+				)
+			case 'message':
+				return false
+		}
+	}
+
+	/** The one id an agent action's state is written and read under. Every writer and reader has
+	 * to rebuild the same key, so they all come here; a switch with no default makes a new action
+	 * kind a compile error rather than a status that silently never resolves. */
+	export function getAgentActionStateId(
+		idx: number,
+		agentModuleId: string,
+		action: AgentAction
+	): string {
+		switch (action.type) {
+			case 'tool_call':
+				return getToolCallId(idx, agentModuleId, action.module_id)
+			case 'mcp_tool_call':
+				return AI_MCP_TOOL_CALL_PREFIX + '-' + agentModuleId + '-' + idx
+			case 'web_search':
+				return AI_WEBSEARCH_PREFIX + '-' + agentModuleId + '-' + idx
+			case 'message':
+				return getToolCallId(idx, agentModuleId)
+		}
+	}
+
 	function getComparableNode(node: Node & NodeLayout): Node & NodeLayout {
 		if (node.type === 'module' && node.data.module.value.type === 'aiagent') {
 			return {
@@ -69,6 +121,22 @@
 		}
 	}
 
+	function agentActionsOf(
+		nodes: (Node & NodeLayout)[],
+		flowModuleStates: Record<string, GraphModuleState> | undefined,
+		insertable: boolean
+	): Record<string, unknown> {
+		const actions: Record<string, unknown> = {}
+		// The editor renders the static tool set and ignores the run's actions, so snapshotting
+		// them there would deep-clone a value that changes every poll and never matches.
+		if (insertable) return actions
+		for (const node of nodes) {
+			if (node.type !== 'module' || node.data.module.value.type !== 'aiagent') continue
+			actions[node.id] = $state.snapshot(flowModuleStates?.[node.id]?.agent_actions)
+		}
+		return actions
+	}
+
 	export function computeAIToolNodes(
 		nodes: (Node & NodeLayout)[],
 		eventHandlers: GraphEventHandlers,
@@ -83,7 +151,10 @@
 	} {
 		if (
 			computeAIToolNodesCache &&
-			!!flowModuleStates === computeAIToolNodesCache.hasFlowModuleStates &&
+			deepEqual(
+				agentActionsOf(nodes, flowModuleStates, insertable),
+				computeAIToolNodesCache.agentActions
+			) &&
 			deepEqual(nodes.map(getComparableNode), computeAIToolNodesCache.nodes) &&
 			deepEqual(linkedAgentTools, computeAIToolNodesCache.linkedAgentTools)
 		) {
@@ -109,6 +180,7 @@
 				name: string
 				type?: string
 				stateType?: GraphModuleState['type']
+				resourcePath?: string
 			}[] = sourceTools.map((t, idx) => {
 				// Handle FlowModule, MCP, and Websearch tools
 				const toolType =
@@ -122,7 +194,8 @@
 				return {
 					id: t.id,
 					name: t.summary ?? '',
-					type: toolType
+					type: toolType,
+					resourcePath: t.value.tool_type === 'mcp' ? t.value.resource_path : undefined
 				}
 			})
 
@@ -132,26 +205,13 @@
 				baseOffset = BELOW_ADDITIONAL_OFFSET + AI_TOOL_BASE_OFFSET
 				rowOffset = AI_TOOL_ROW_OFFSET
 				tools = agentActions.map((a, idx) => {
+					const id = getAgentActionStateId(idx, node.id, a)
 					if (a.type === 'tool_call' || a.type === 'mcp_tool_call') {
-						const id =
-							a.type === 'tool_call'
-								? getToolCallId(idx, node.id, a.module_id)
-								: AI_MCP_TOOL_CALL_PREFIX + '-' + node.id + '-' + idx
-						return {
-							id,
-							name: a.function_name
-						}
+						return { id, name: a.function_name }
 					} else if (a.type === 'web_search') {
-						return {
-							id: AI_WEBSEARCH_PREFIX + '-' + node.id + '-' + idx,
-							name: 'Web Search',
-							type: 'websearch'
-						}
+						return { id, name: 'Web Search', type: 'websearch' }
 					} else {
-						return {
-							id: getToolCallId(idx, node.id),
-							name: 'Message'
-						}
+						return { id, name: 'Message' }
 					}
 				})
 			}
@@ -192,7 +252,8 @@
 						selectTarget: isLinkedAgent && !agentActions ? node.id : undefined,
 						insertable,
 						readOnly: isLinkedAgent,
-						flowModuleStates
+						agentModuleId: node.id,
+						resourcePath: tool.resourcePath
 					},
 					id: `${node.id}-tool-${tool.id}`,
 					width: inputToolWidth,
@@ -253,7 +314,7 @@
 
 		computeAIToolNodesCache = {
 			nodes: nodes.map(getComparableNode),
-			hasFlowModuleStates: !!flowModuleStates,
+			agentActions: agentActionsOf(nodes, flowModuleStates, insertable),
 			linkedAgentTools: $state.snapshot(linkedAgentTools),
 			ret
 		}
@@ -277,6 +338,7 @@
 	import { getNodeColorClasses } from '../../util'
 	import { deepEqual } from 'fast-equals'
 	import { getGraphContext } from '../../graphContext'
+	import { getFlowRunStatusContext } from '../../flowRunStatus.svelte'
 
 	let hover = $state(false)
 
@@ -286,13 +348,48 @@
 	}
 
 	let { data, id }: Props = $props()
+	const flowRunStatus = getFlowRunStatusContext()
 
 	const { selectionManager } = getGraphContext()
 
-	const flowModuleState = $derived(data.flowModuleStates?.[data.moduleId])
+	const flowModuleState = $derived(flowRunStatus?.getModuleState(data.moduleId))
+
+	/**
+	 * The editor draws the agent's declared tools, one node per tool, while a run keys its state
+	 * per call. Roll every call of this tool into the one node it already has, so a run shows up
+	 * here without adding nodes and shifting the graph. A run graph looks its own state up
+	 * directly, so it never gets here.
+	 */
+	const toolCalls = $derived.by(() => {
+		if (flowModuleState) return undefined
+		const agentState = flowRunStatus?.getModuleState(data.agentModuleId)
+		const actions = agentState?.agent_actions
+		if (!actions) return undefined
+		let count = 0
+		let failed = 0
+		let pending = 0
+		actions.forEach((action, index) => {
+			if (
+				!agentActionMatchesTool(action, {
+					moduleId: data.moduleId,
+					type: data.type,
+					resourcePath: data.resourcePath
+				})
+			)
+				return
+			count++
+			const success = agentState?.agent_actions_success?.[index]
+			if (success === undefined) pending++
+			else if (!success) failed++
+		})
+		if (count === 0) return undefined
+		const type = pending > 0 ? 'InProgress' : failed > 0 ? 'Failure' : 'Success'
+		return { type, count } as const
+	})
+
 	let colorClasses = $derived(
 		getNodeColorClasses(
-			data.nameError ? 'Failure' : flowModuleState?.type,
+			data.nameError ? 'Failure' : (flowModuleState?.type ?? toolCalls?.type),
 			selectionManager?.getSelectedId() === (data.selectTarget ?? data.moduleId)
 		)
 	)
@@ -303,9 +400,9 @@
 	// agent's module id through the manual path would race the agent node's own click selection.
 	function onSelect() {
 		if (data.selectTarget) {
-			selectionManager?.selectId(data.selectTarget)
+			selectionManager?.selectId(data.selectTarget, { openPanel: true })
 		}
-		data.eventHandlers.select(data.selectTarget ?? data.moduleId)
+		data.eventHandlers.select(data.selectTarget ?? data.moduleId, { openPanel: true })
 	}
 </script>
 
@@ -343,6 +440,17 @@
 				<span class={twMerge('text-3xs truncate flex-1', data.nameError && 'text-red-400')}>
 					{data.tool || 'Missing name'}
 				</span>
+
+				<!-- Sits inside the button's fixed width, so the label truncates instead of the node
+				     growing and pushing the graph around. -->
+				{#if toolCalls && toolCalls.count > 1}
+					<span
+						class="text-3xs tabular-nums shrink-0 mr-1 px-1 rounded bg-surface/70 text-secondary"
+						title={`Called ${toolCalls.count} times in this run`}
+					>
+						{toolCalls.count}
+					</span>
+				{/if}
 			</button>
 			{#if data.insertable && !data.readOnly}
 				<button
diff --git a/frontend/src/lib/components/graph/renderers/nodes/AIToolNode.test.ts b/frontend/src/lib/components/graph/renderers/nodes/AIToolNode.test.ts
index cdc6fa3f3b..85ba23aaa0 100644
--- a/frontend/src/lib/components/graph/renderers/nodes/AIToolNode.test.ts
+++ b/frontend/src/lib/components/graph/renderers/nodes/AIToolNode.test.ts
@@ -4,7 +4,7 @@ import { describe, it, expect, vi } from 'vitest'
 // full render-time dependency graph.
 vi.mock('./NodeWrapper.svelte', () => ({ default: {} }))
 
-import { computeAIToolNodes } from './AIToolNode.svelte'
+import { agentActionMatchesTool, computeAIToolNodes } from './AIToolNode.svelte'
 
 const eventHandlers = {} as any
 
@@ -83,6 +83,30 @@ describe('computeAIToolNodes', () => {
 		}
 	})
 
+	it('picks up a tool call that arrives without moving any node', () => {
+		// Run status lives outside node data, so the memo has to key on the agent's actions
+		// itself. Two calls occupy one row, i.e. identical positions, so a memo keyed only on
+		// the nodes would serve the stale single-tool result forever.
+		const node = aiAgentNode('agent', [
+			{ id: 'tool_a', summary: 'my_tool', value: { tool_type: 'flowmodule', type: 'script' } }
+		])
+		const stateWith = (n: number) =>
+			({
+				agent: {
+					type: 'InProgress',
+					agent_actions: Array.from({ length: n }, (_, i) => ({
+						type: 'tool_call',
+						function_name: 'my_tool',
+						module_id: 'tool_a',
+						job_id: `j${i}`
+					}))
+				}
+			}) as any
+
+		expect(computeAIToolNodes([node], eventHandlers, false, stateWith(1)).toolNodes.length).toBe(1)
+		expect(computeAIToolNodes([node], eventHandlers, false, stateWith(2)).toolNodes.length).toBe(2)
+	})
+
 	it('still flags genuinely duplicate tool names in the editor (static tool set)', () => {
 		const node = aiAgentNode('agent2', [
 			{ id: 't1', summary: 'dup', value: { tool_type: 'flowmodule', type: 'script' } },
@@ -97,4 +121,50 @@ describe('computeAIToolNodes', () => {
 			expect((n.data as any).nameError).toBe('Duplicate tool name')
 		}
 	})
+
+	// The editor keeps one node per declared tool, so each kind of action has to find its way back
+	// to the right one. Only the flowmodule join is reachable in a local run — web search needs a
+	// provider that emits it server-side, MCP needs a live server — so pin all four here.
+	describe('agentActionMatchesTool', () => {
+		const flowTool = { moduleId: 'tool_a', type: 'script' }
+		const searchTool = { moduleId: 'tool_s', type: 'websearch' }
+		const mcpTool = { moduleId: 'tool_m', type: 'mcp', resourcePath: 'u/admin/mcp' }
+
+		it('binds a flow module call to the tool it names', () => {
+			const call = { type: 'tool_call', module_id: 'tool_a' } as any
+			expect(agentActionMatchesTool(call, flowTool)).toBe(true)
+			expect(agentActionMatchesTool(call, { moduleId: 'tool_b', type: 'script' })).toBe(false)
+			expect(agentActionMatchesTool(call, searchTool)).toBe(false)
+		})
+
+		it('binds a web search to the declared web search tool', () => {
+			const search = { type: 'web_search' } as any
+			expect(agentActionMatchesTool(search, searchTool)).toBe(true)
+			expect(agentActionMatchesTool(search, flowTool)).toBe(false)
+		})
+
+		it('binds an MCP call by server, not by function name', () => {
+			// One MCP node stands for a whole server and many function names.
+			const call = {
+				type: 'mcp_tool_call',
+				function_name: 'anything',
+				resource_path: 'u/admin/mcp'
+			} as any
+			expect(agentActionMatchesTool(call, mcpTool)).toBe(true)
+			expect(
+				agentActionMatchesTool(call, {
+					moduleId: 'tool_m2',
+					type: 'mcp',
+					resourcePath: 'u/admin/other'
+				})
+			).toBe(false)
+		})
+
+		it("binds the agent's own replies to no tool at all", () => {
+			const message = { type: 'message' } as any
+			for (const tool of [flowTool, searchTool, mcpTool]) {
+				expect(agentActionMatchesTool(message, tool)).toBe(false)
+			}
+		})
+	})
 })
diff --git a/frontend/src/lib/components/graph/renderers/nodes/BranchAllStart.svelte b/frontend/src/lib/components/graph/renderers/nodes/BranchAllStart.svelte
index 9682d941b6..2f93567cc0 100644
--- a/frontend/src/lib/components/graph/renderers/nodes/BranchAllStart.svelte
+++ b/frontend/src/lib/components/graph/renderers/nodes/BranchAllStart.svelte
@@ -7,17 +7,19 @@
 	import type { BranchAllStartN } from '../../graphBuilder.svelte'
 	import { getGraphContext } from '../../graphContext'
 	import { computeBorderStatus } from '../utils'
+	import { getFlowRunStatusContext } from '../../flowRunStatus.svelte'
 	interface Props {
 		data: BranchAllStartN['data']
 		id: string
 	}
 
 	let { data, id }: Props = $props()
+	const flowRunStatus = getFlowRunStatusContext()
 
 	const { selectionManager } = getGraphContext()
 
 	let borderStatus = $derived(
-		computeBorderStatus(data.branchIndex, 'branchall', data.flowModuleState)
+		computeBorderStatus(data.branchIndex, 'branchall', flowRunStatus?.getModuleState(data.id))
 	)
 </script>
 
diff --git a/frontend/src/lib/components/graph/renderers/nodes/BranchOneStart.svelte b/frontend/src/lib/components/graph/renderers/nodes/BranchOneStart.svelte
index 9902582ee0..3ba33a33b0 100644
--- a/frontend/src/lib/components/graph/renderers/nodes/BranchOneStart.svelte
+++ b/frontend/src/lib/components/graph/renderers/nodes/BranchOneStart.svelte
@@ -7,6 +7,7 @@
 	import type { BranchOneStartN } from '../../graphBuilder.svelte'
 	import { getGraphContext } from '../../graphContext'
 	import { computeBorderStatus } from '../utils'
+	import { getFlowRunStatusContext } from '../../flowRunStatus.svelte'
 	interface Props {
 		data: BranchOneStartN['data']
 		id: string
@@ -14,11 +15,12 @@
 	const { selectionManager } = getGraphContext()
 
 	let { data, id }: Props = $props()
+	const flowRunStatus = getFlowRunStatusContext()
 
 	// branchIndex is -1 for the default branch and 0-based for explicit branches;
 	// branchChosen is 0 for default and 1-based, hence the +1.
 	let borderStatus = $derived(
-		computeBorderStatus(data.branchIndex + 1, 'branchone', data.flowModuleState)
+		computeBorderStatus(data.branchIndex + 1, 'branchone', flowRunStatus?.getModuleState(data.id))
 	)
 </script>
 
diff --git a/frontend/src/lib/components/graph/renderers/nodes/CollapsedGroupNode.svelte b/frontend/src/lib/components/graph/renderers/nodes/CollapsedGroupNode.svelte
index d2f3a373b8..a4c3917075 100644
--- a/frontend/src/lib/components/graph/renderers/nodes/CollapsedGroupNode.svelte
+++ b/frontend/src/lib/components/graph/renderers/nodes/CollapsedGroupNode.svelte
@@ -6,9 +6,9 @@
 	import { NoteColor, NOTE_COLORS } from '../../noteColors'
 	import { NODE } from '../../util'
 	import { Hourglass } from 'lucide-svelte'
-	import { workspaceStore } from '$lib/stores'
 	import FlowStatusWaitingForEvents from '$lib/components/FlowStatusWaitingForEvents.svelte'
 	import { dfs } from '$lib/components/flows/dfs'
+	import { getFlowRunStatusContext } from '../../flowRunStatus.svelte'
 
 	interface Props {
 		data: CollapsedGroupN['data']
@@ -17,6 +17,8 @@
 
 	let { data, id }: Props = $props()
 
+	const flowRunStatus = getFlowRunStatusContext()
+
 	let outlineColorClass = $derived(
 		(NOTE_COLORS[(data.color as NoteColor) ?? NoteColor.BLUE] ?? NOTE_COLORS[NoteColor.BLUE])
 			.outline
@@ -32,8 +34,8 @@
 	let waitingForEvents = $derived(
 		allModuleIds.some(
 			(mid) =>
-				data.flowModuleStates?.[mid]?.type === 'WaitingForEvents' ||
-				data.flowModuleStates?.[`${mid}-v`]?.type === 'WaitingForEvents'
+				flowRunStatus?.getModuleState(mid)?.type === 'WaitingForEvents' ||
+				flowRunStatus?.getModuleState(`${mid}-v`)?.type === 'WaitingForEvents'
 		)
 	)
 </script>
@@ -56,16 +58,12 @@
 			/>
 			{#if data.modules && data.modules.length > 0}
 				<div class="flex items-center justify-center w-full gap-1.5 px-2 h-[34px] overflow-hidden">
-					<GroupModuleIcons
-						modules={data.modules}
-						flowModuleStates={data.flowModuleStates}
-						eventHandlers={data.eventHandlers}
-					/>
+					<GroupModuleIcons modules={data.modules} eventHandlers={data.eventHandlers} />
 				</div>
 			{/if}
 		</div>
 
-		{#if waitingForEvents && data.flowJob && data.flowJob.type === 'QueuedJob'}
+		{#if waitingForEvents && flowRunStatus?.flowJob && flowRunStatus.flowJob.type === 'QueuedJob'}
 			<div
 				class="absolute top-1/2 -translate-y-1/2 left-full ml-2 flex items-center gap-2 nodrag nowheel"
 			>
@@ -80,19 +78,19 @@
 					</div>
 				</div>
 				<div class="rounded-md bg-surface flex items-center justify-center p-2 shadow-md">
-					{#if data.flowJob.flow_status?.modules?.[data.flowJob.flow_status?.step]?.type === 'WaitingForEvents'}
+					{#if flowRunStatus?.flowJob?.flow_status?.modules?.[flowRunStatus.flowJob.flow_status?.step]?.type === 'WaitingForEvents'}
 						<FlowStatusWaitingForEvents
-							job={data.flowJob}
-							workspaceId={$workspaceStore!}
+							job={flowRunStatus.flowJob}
+							workspaceId={flowRunStatus.flowJob.workspace_id}
 							isOwner={data.isOwner}
 							light
 						/>
-					{:else if data.suspendStatus && Object.keys(data.suspendStatus).length > 0}
+					{:else if flowRunStatus?.suspendStatus && Object.keys(flowRunStatus.suspendStatus).length > 0}
 						<div class="flex gap-2 flex-col">
-							{#each Object.values(data.suspendStatus) as suspendCount (suspendCount.job.id)}
+							{#each Object.values(flowRunStatus.suspendStatus) as suspendCount (suspendCount.job.id)}
 								<FlowStatusWaitingForEvents
 									job={suspendCount.job}
-									workspaceId={$workspaceStore!}
+									workspaceId={suspendCount.job.workspace_id}
 									isOwner={data.isOwner}
 									light
 								/>
diff --git a/frontend/src/lib/components/graph/renderers/nodes/FailureModuleNode.svelte b/frontend/src/lib/components/graph/renderers/nodes/FailureModuleNode.svelte
index 49ccbe46d6..63288fe7bb 100644
--- a/frontend/src/lib/components/graph/renderers/nodes/FailureModuleNode.svelte
+++ b/frontend/src/lib/components/graph/renderers/nodes/FailureModuleNode.svelte
@@ -6,14 +6,16 @@
 	import type { FailureModuleN } from '../../graphBuilder.svelte'
 	import { getNodeColorClasses, NODE } from '$lib/components/graph'
 	import { msToSec } from '$lib/utils'
+	import { getFlowRunStatusContext } from '../../flowRunStatus.svelte'
 
 	interface Props {
 		data: FailureModuleN['data']
 	}
 
 	let { data }: Props = $props()
+	const flowRunStatus = getFlowRunStatusContext()
 
-	let state = $derived(data.flowModuleState)
+	let state = $derived(flowRunStatus?.getModuleState(data.id))
 	let colorClasses = $derived(getNodeColorClasses(state?.skipped ? '_Skipped' : state?.type, false))
 </script>
 
diff --git a/frontend/src/lib/components/graph/renderers/nodes/InputNode.svelte b/frontend/src/lib/components/graph/renderers/nodes/InputNode.svelte
index 195f920d03..c59a775bd2 100644
--- a/frontend/src/lib/components/graph/renderers/nodes/InputNode.svelte
+++ b/frontend/src/lib/components/graph/renderers/nodes/InputNode.svelte
@@ -12,6 +12,7 @@
 	import type { FlowEditorContext } from '$lib/components/flows/types'
 	import { MessageSquare } from 'lucide-svelte'
 	import { getGraphContext } from '../../graphContext'
+	import { getFlowRunStatusContext } from '../../flowRunStatus.svelte'
 	import FunnelCog from '$lib/components/icons/FunnelCog.svelte'
 
 	interface Props {
@@ -21,6 +22,7 @@
 	let { data }: Props = $props()
 
 	const { selectionManager, diffManager } = getGraphContext()
+	const flowRunStatus = getFlowRunStatusContext()
 
 	const flowEditorContext = getContext<FlowEditorContext | undefined>('FlowEditorContext')
 	const { previewArgs, flowStore } = flowEditorContext || {}
@@ -110,7 +112,7 @@
 				data.eventHandlers.hideJobStatus()
 			}}
 			individualStepTests={data.individualStepTests}
-			job={data.flowJob}
+			job={flowRunStatus?.flowJob}
 			showJobStatus={data.showJobStatus}
 			flowHasChanged={data.flowHasChanged}
 		>
diff --git a/frontend/src/lib/components/graph/renderers/nodes/ModuleNode.svelte b/frontend/src/lib/components/graph/renderers/nodes/ModuleNode.svelte
index c15c23a13e..4ba08a57a8 100644
--- a/frontend/src/lib/components/graph/renderers/nodes/ModuleNode.svelte
+++ b/frontend/src/lib/components/graph/renderers/nodes/ModuleNode.svelte
@@ -1,11 +1,14 @@
 <script lang="ts">
 	import MapItem from '$lib/components/flows/map/MapItem.svelte'
-	import { GitBranchPlus, Move, Copy, Trash2, StickyNote } from 'lucide-svelte'
+	import { GitBranchPlus, Move, Copy, Trash2, StickyNote, PictureInPicture2 } from 'lucide-svelte'
 	import NodeWrapper from './NodeWrapper.svelte'
 	import type { ModuleN } from '../../graphBuilder.svelte'
 	import { jobToGraphModuleState } from '$lib/components/modulesTest.svelte'
 	import { getNoteEditorContext } from '../../noteEditor.svelte'
 	import { isMac, type Item } from '$lib/utils'
+	import { getContext } from 'svelte'
+	import { getGraphContext } from '../../graphContext'
+	import { getFlowRunStatusContext } from '../../flowRunStatus.svelte'
 
 	interface Props {
 		data: ModuleN['data']
@@ -15,11 +18,65 @@
 
 	// Get NoteEditor context for group note creation
 	const noteEditorContext = getNoteEditorContext()
+	const flowRunStatus = getFlowRunStatusContext()
 
 	let state = $derived.by(() => {
 		return data.testModuleState
-			? (jobToGraphModuleState(data.testModuleState) ?? data.flowModuleState)
-			: data.flowModuleState
+			? (jobToGraphModuleState(data.testModuleState) ?? flowRunStatus?.getModuleState(data.id))
+			: flowRunStatus?.getModuleState(data.id)
+	})
+
+	// A `message` is the one action with no tool node of its own, so the annotation is the only
+	// place it can show.
+	const AGENT_ACTION_KINDS = [
+		{ type: 'tool_call', singular: 'tool call', plural: 'tool calls' },
+		{ type: 'mcp_tool_call', singular: 'MCP call', plural: 'MCP calls' },
+		{ type: 'web_search', singular: 'web search', plural: 'web searches' },
+		{ type: 'message', singular: 'message', plural: 'messages' }
+	] as const
+
+	/**
+	 * The editor draws an agent's declared tools, not the calls a run makes, so a run would
+	 * otherwise leave no trace on the step. It is drawn beside the step, out of the flow and clear
+	 * of the tool rows above, so it reports the run without moving anything.
+	 */
+	let agentToolSummary = $derived.by(() => {
+		if (!data.insertable || data.module?.value?.type !== 'aiagent') return undefined
+		const agentState = flowRunStatus?.getModuleState(data.id)
+		const actions = agentState?.agent_actions
+		if (!actions?.length) return undefined
+		const tally = new Map<string, { count: number; pending: number }>()
+		let calls = 0
+		let pending = 0
+		let failed = 0
+		actions.forEach((action, index) => {
+			const entry = tally.get(action.type) ?? { count: 0, pending: 0 }
+			entry.count++
+			// A missing entry in the parallel success array means the action is still running.
+			const success = agentState?.agent_actions_success?.[index]
+			if (success === undefined) entry.pending++
+			else if (!success) failed++
+			tally.set(action.type, entry)
+			if (action.type !== 'message') {
+				calls++
+				if (success === undefined) pending++
+			}
+		})
+		const detail: string[] = []
+		for (const kind of AGENT_ACTION_KINDS) {
+			const entry = tally.get(kind.type)
+			if (!entry) continue
+			detail.push(`${entry.count} ${entry.count > 1 ? kind.plural : kind.singular}`)
+		}
+		if (failed > 0) detail.push(`${failed} failed`)
+		// The visible line sits beside the step where a long string would run into the canvas, so
+		// it stays a total and the per-kind breakdown rides the tooltip.
+		const messages = tally.get('message')?.count ?? 0
+		const short =
+			calls > 0
+				? `${calls} call${calls > 1 ? 's' : ''}${pending > 0 ? '…' : ''}${failed > 0 ? ` · ${failed}✗` : ''}`
+				: `${messages} msg${messages > 1 ? 's' : ''}`
+		return { short, detail: detail.join(' · ') }
 	})
 
 	let flowJobs = $derived(
@@ -49,9 +106,25 @@
 
 	let isPreprocessor = $derived(data.id === 'preprocessor')
 
+	// In modal-panel mode (sessions) step details open on double-click, or on a click on the
+	// already selected step. Surface the action in the ellipsis menu too, with the gesture
+	// that works from any state as its shortcut.
+	const stepExploreHint = getContext<(() => boolean) | undefined>('flowGraphStepExploreHint')
+	const selectionManager = getGraphContext()?.selectionManager
+
 	const menuItems: Item[] = $derived(
 		data.editMode
 			? [
+					...(stepExploreHint?.()
+						? [
+								{
+									displayName: 'Open details',
+									icon: PictureInPicture2,
+									shortcut: 'Double click',
+									action: () => selectionManager?.selectId(data.id, { openPanel: true })
+								}
+							]
+						: []),
 					...(isPreprocessor
 						? []
 						: [
@@ -98,6 +171,8 @@
 			editMode={data.editMode}
 			moduleAction={data.moduleAction}
 			{menuItems}
+			sideAnnotation={agentToolSummary?.short}
+			sideAnnotationTitle={agentToolSummary?.detail}
 			annotation={flowJobs &&
 			(data.module?.value?.type === 'forloopflow' || data.module?.value?.type === 'whileloopflow')
 				? 'Iteration: ' +
@@ -134,7 +209,7 @@
 				data.eventHandlers.updateMock(detail)
 			}}
 			onEditInput={data.eventHandlers.editInput}
-			flowJob={data.flowJob}
+			flowJob={flowRunStatus?.flowJob}
 			isOwner={data.isOwner}
 			maximizeSubflow={data.module?.value?.type == 'flow' && 'path' in data.module.value
 				? () => {
diff --git a/frontend/src/lib/components/graph/renderers/nodes/NewAIToolNode.svelte b/frontend/src/lib/components/graph/renderers/nodes/NewAIToolNode.svelte
index fa26a64080..d67a0a74be 100644
--- a/frontend/src/lib/components/graph/renderers/nodes/NewAIToolNode.svelte
+++ b/frontend/src/lib/components/graph/renderers/nodes/NewAIToolNode.svelte
@@ -3,6 +3,7 @@
 	import InsertModuleInner from '$lib/components/flows/map/InsertModuleInner.svelte'
 	import { Plus } from 'lucide-svelte'
 	import Popover from '$lib/components/meltComponents/Popover.svelte'
+	import { overlayPortalTarget } from '$lib/components/common/overlayHost.svelte'
 	import { Button } from '$lib/components/common'
 	import { getGraphContext } from '../../graphContext'
 
@@ -16,103 +17,104 @@
 	let isMoving = $derived(!!moveManager?.dragging || !!moveManager?.movingModuleId)
 
 	let open = $state(false)
+	const portalTarget = overlayPortalTarget('#flow-editor')
 </script>
 
 {#if !isMoving}
-<!-- svelte-ignore a11y_no_static_element_interactions -->
-<Popover
-	bind:isOpen={open}
-	portal="#flow-editor"
-	contentClasses="p-2 max-w-lg h-[400px] bg-surface"
-	class="inline-block"
-	usePointerDownOutside
-	floatingConfig={{
-		placement: 'bottom',
-		strategy: 'absolute',
-		gutter: 8,
-		overflowPadding: 16,
-		flip: true,
-		fitViewport: true,
-		overlap: false
-	}}
->
-	{#snippet trigger()}
-		<Button
-			size="xs3"
-			variant="default"
-			nonCaptureEvent
-			selected={open}
-			startIcon={{ icon: Plus }}
-			wrapperClasses="{open
-				? 'bg-surface-secondary'
-				: 'bg-surface-tertiary'} transition-colors drop-shadow-base"
-			btnClasses="gap-1 text-2xs px-1"
-		>
-			Tool
-		</Button>
-	{/snippet}
-	{#snippet content({ close })}
-		<InsertModuleInner
-			bind:funcDesc
-			toolMode
-			on:close={() => {
-				close()
-			}}
-			on:new={(e) => {
-				data.eventHandlers.insert({
-					index: -1, // ignored when agentId is set
-					agentId: data.agentModuleId,
-					...e.detail
-				})
-				close()
-			}}
-			on:insert={(e) => {
-				data.eventHandlers.insert({
-					index: -1, // ignored when agentId is set
-					agentId: data.agentModuleId,
-					...e.detail
-				})
-				close()
-			}}
-			on:pickScript={(e) => {
-				data.eventHandlers.insert({
-					index: -1, // ignored when agentId is set
-					agentId: data.agentModuleId,
-					kind: e.detail.kind,
-					script: {
-						...e.detail,
-						summary: e.detail.summary
-							? e.detail.summary.replace(/\s/, '_').replace(/[^a-zA-Z0-9_]/g, '')
-							: e.detail.path.split('/').pop()
-					}
-				})
-				close()
-			}}
-			on:pickMcpTool={(e) => {
-				data.eventHandlers.insert({
-					index: -1,
-					agentId: data.agentModuleId,
-					kind: 'mcpTool'
-				})
-				close()
-			}}
-			on:pickWebsearchTool={(e) => {
-				data.eventHandlers.insert({
-					index: -1,
-					agentId: data.agentModuleId,
-					kind: 'websearchTool'
-				})
-				close()
-			}}
-			on:pickAiAgentTool={(e) => {
-				data.eventHandlers.insert({
-					index: -1,
-					agentId: data.agentModuleId,
-					kind: 'aiAgentTool'
-				})
-				close()
-			}}
-		/>
-	{/snippet}
-</Popover>
+	<!-- svelte-ignore a11y_no_static_element_interactions -->
+	<Popover
+		bind:isOpen={open}
+		portal={portalTarget()}
+		contentClasses="p-2 max-w-full h-[400px] bg-surface"
+		class="inline-block"
+		usePointerDownOutside
+		floatingConfig={{
+			placement: 'bottom',
+			strategy: 'absolute',
+			gutter: 8,
+			overflowPadding: 16,
+			flip: true,
+			fitViewport: true,
+			overlap: false
+		}}
+	>
+		{#snippet trigger()}
+			<Button
+				size="xs3"
+				variant="default"
+				nonCaptureEvent
+				selected={open}
+				startIcon={{ icon: Plus }}
+				wrapperClasses="{open
+					? 'bg-surface-secondary'
+					: 'bg-surface-tertiary'} transition-colors drop-shadow-base"
+				btnClasses="gap-1 text-2xs px-1"
+			>
+				Tool
+			</Button>
+		{/snippet}
+		{#snippet content({ close })}
+			<InsertModuleInner
+				bind:funcDesc
+				toolMode
+				on:close={() => {
+					close()
+				}}
+				on:new={(e) => {
+					data.eventHandlers.insert({
+						index: -1, // ignored when agentId is set
+						agentId: data.agentModuleId,
+						...e.detail
+					})
+					close()
+				}}
+				on:insert={(e) => {
+					data.eventHandlers.insert({
+						index: -1, // ignored when agentId is set
+						agentId: data.agentModuleId,
+						...e.detail
+					})
+					close()
+				}}
+				on:pickScript={(e) => {
+					data.eventHandlers.insert({
+						index: -1, // ignored when agentId is set
+						agentId: data.agentModuleId,
+						kind: e.detail.kind,
+						script: {
+							...e.detail,
+							summary: e.detail.summary
+								? e.detail.summary.replace(/\s/, '_').replace(/[^a-zA-Z0-9_]/g, '')
+								: e.detail.path.split('/').pop()
+						}
+					})
+					close()
+				}}
+				on:pickMcpTool={(e) => {
+					data.eventHandlers.insert({
+						index: -1,
+						agentId: data.agentModuleId,
+						kind: 'mcpTool'
+					})
+					close()
+				}}
+				on:pickWebsearchTool={(e) => {
+					data.eventHandlers.insert({
+						index: -1,
+						agentId: data.agentModuleId,
+						kind: 'websearchTool'
+					})
+					close()
+				}}
+				on:pickAiAgentTool={(e) => {
+					data.eventHandlers.insert({
+						index: -1,
+						agentId: data.agentModuleId,
+						kind: 'aiAgentTool'
+					})
+					close()
+				}}
+			/>
+		{/snippet}
+	</Popover>
 {/if}
diff --git a/frontend/src/lib/components/graph/renderers/nodes/ResultNode.svelte b/frontend/src/lib/components/graph/renderers/nodes/ResultNode.svelte
index 13ede87991..88febcd6ca 100644
--- a/frontend/src/lib/components/graph/renderers/nodes/ResultNode.svelte
+++ b/frontend/src/lib/components/graph/renderers/nodes/ResultNode.svelte
@@ -3,6 +3,7 @@
 	import NodeWrapper from './NodeWrapper.svelte'
 	import type { ResultN } from '../../graphBuilder.svelte'
 	import { getGraphContext } from '../../graphContext'
+	import { getFlowRunStatusContext } from '../../flowRunStatus.svelte'
 
 	interface Props {
 		data: ResultN['data']
@@ -12,6 +13,7 @@
 	let { data, id }: Props = $props()
 
 	const { selectionManager } = getGraphContext()
+	const flowRunStatus = getFlowRunStatusContext()
 </script>
 
 <NodeWrapper enableSourceHandle={false}>
@@ -27,7 +29,7 @@
 			}}
 			nodeKind="result"
 			editMode={data.editMode}
-			job={data.job}
+			job={flowRunStatus?.flowJob}
 			showJobStatus={data.showJobStatus}
 		/>
 	{/snippet}
diff --git a/frontend/src/lib/components/graph/renderers/nodes/TriggersNode.svelte b/frontend/src/lib/components/graph/renderers/nodes/TriggersNode.svelte
index 58f95d4b33..43af1fef48 100644
--- a/frontend/src/lib/components/graph/renderers/nodes/TriggersNode.svelte
+++ b/frontend/src/lib/components/graph/renderers/nodes/TriggersNode.svelte
@@ -84,13 +84,15 @@
 				}}
 				on:select={() => data?.eventHandlers?.select('Trigger')}
 				onSelect={async (triggerIndex: number) => {
-					data?.eventHandlers?.select('Trigger')
+					data?.eventHandlers?.select('Trigger', { openPanel: true })
 					await tick()
 					triggersState.selectedTriggerIndex = triggerIndex
 				}}
 				onAddDraftTrigger={async (type: TriggerType) => {
 					const newTrigger = triggersState.addDraftTrigger(triggersCount, type)
-					data?.eventHandlers?.select('Trigger')
+					// A scheduled poll continues in the trigger-script picker that opens
+					// alongside this, so revealing the panel would cover it.
+					data?.eventHandlers?.select('Trigger', { openPanel: type !== 'poll' })
 					await tick()
 					triggersState.selectedTriggerIndex = newTrigger
 				}}
diff --git a/frontend/src/lib/components/graph/renderers/triggers/TriggersWrapper.svelte b/frontend/src/lib/components/graph/renderers/triggers/TriggersWrapper.svelte
index ccc5643981..3755b5cf77 100644
--- a/frontend/src/lib/components/graph/renderers/triggers/TriggersWrapper.svelte
+++ b/frontend/src/lib/components/graph/renderers/triggers/TriggersWrapper.svelte
@@ -1,6 +1,7 @@
 <script lang="ts">
+	import Disposable from '$lib/components/common/drawer/Disposable.svelte'
 	import { NODE, type FlowNodeColorClasses } from '../../util'
-	import { createEventDispatcher } from 'svelte'
+	import { createEventDispatcher, untrack } from 'svelte'
 	import type { TriggerType } from '$lib/components/triggers/utils'
 	import TriggersBadge from './TriggersBadge.svelte'
 	import { Plus } from 'lucide-svelte'
@@ -8,8 +9,10 @@
 	import AddTriggersButton from '$lib/components/triggers/AddTriggersButton.svelte'
 	import { twMerge } from 'tailwind-merge'
 	import Portal from '$lib/components/Portal.svelte'
-	import { flip, offset } from 'svelte-floating-ui/dom'
+	import { flip, offset, shift } from 'svelte-floating-ui/dom'
 	import { createFloatingActions, type ComputeConfig } from 'svelte-floating-ui'
+	import { clickOutside } from '$lib/utils'
+	import { overlayPortalTarget } from '$lib/components/common/overlayHost.svelte'
 
 	interface Props {
 		path: string
@@ -36,6 +39,16 @@
 	}: Props = $props()
 
 	let showTriggerScriptPicker = $state(false)
+
+	let pickerDisposable: Disposable | undefined = $state(undefined)
+	// Disposable joins the stack through its methods rather than by watching `open` — the
+	// menu item that opens the picker sets the flag directly, so mirror it across.
+	$effect(() => {
+		showTriggerScriptPicker
+		untrack(() => {
+			showTriggerScriptPicker ? pickerDisposable?.openDrawer() : pickerDisposable?.closeDrawer()
+		})
+	})
 	let numberOfTriggers = $state(0)
 
 	const dispatch = createEventDispatcher()
@@ -44,11 +57,13 @@
 		strategy: 'fixed',
 		// @ts-ignore
 		placement: 'bottom',
-		middleware: [offset(8), flip()],
+		middleware: [offset(8), flip(), shift({ padding: 8 })],
 		autoUpdate: true
 	}
 
 	const [floatingRef, floatingContent] = createFloatingActions(floatingConfig)
+
+	const pickerTarget = overlayPortalTarget('#flow-editor')
 </script>
 
 <div style={`width: ${NODE.width}px;`} use:floatingRef>
@@ -98,25 +113,35 @@
 	</button>
 </div>
 
-{#if showTriggerScriptPicker}
-	<Portal target="#flow-editor">
-		<div
-			class="border rounded-lg shadow-lg bg-surface z5000"
-			style="position:absolute"
-			use:floatingContent
-		>
-			<InsertModuleInner
-				{disableAi}
-				on:new={(e) => {
-					showTriggerScriptPicker = false
-					dispatch('new', e.detail)
-				}}
-				on:pickScript={(e) => {
-					showTriggerScriptPicker = false
-					dispatch('pickScript', e.detail)
-				}}
-				kind="trigger"
-			/>
-		</div>
-	</Portal>
-{/if}
+<!-- Disposable owns the overlay stack: it takes a place while open and answers Escape only
+     when it is the topmost overlay in a pane that is on screen. -->
+<Disposable bind:open={showTriggerScriptPicker} bind:this={pickerDisposable}>
+	{#snippet children()}
+		{#if showTriggerScriptPicker}
+			<Portal target={pickerTarget()}>
+				<!-- Not a Popover: this opens from a menu item inside AddTriggersButton, which
+				     closes before the picker renders, so there is no trigger element to bind to.
+				     Same box and dismiss behaviour as the other module pickers. -->
+				<div
+					class="border rounded-lg shadow-lg bg-surface z5000 p-2 h-[400px]"
+					use:floatingContent
+					use:clickOutside={{ onClickOutside: () => (showTriggerScriptPicker = false) }}
+				>
+					<InsertModuleInner
+						small
+						{disableAi}
+						on:new={(e) => {
+							showTriggerScriptPicker = false
+							dispatch('new', e.detail)
+						}}
+						on:pickScript={(e) => {
+							showTriggerScriptPicker = false
+							dispatch('pickScript', e.detail)
+						}}
+						kind="trigger"
+					/>
+				</div>
+			</Portal>
+		{/if}
+	{/snippet}
+</Disposable>
diff --git a/frontend/src/lib/components/graph/selectionUtils.svelte.ts b/frontend/src/lib/components/graph/selectionUtils.svelte.ts
index daa9de3ecf..eddbae4fca 100644
--- a/frontend/src/lib/components/graph/selectionUtils.svelte.ts
+++ b/frontend/src/lib/components/graph/selectionUtils.svelte.ts
@@ -1,9 +1,34 @@
 import type { Node } from '@xyflow/svelte'
 
+/** Intent attached to a `selectId` call. `true` opens the panel even for ids that
+ * would not normally trigger it; `false` marks an incidental selection (what remains
+ * after a delete) and keeps it shut; omitted uses the default rules. */
+export type SelectIntentOptions = {
+	openPanel?: boolean
+}
+
+/** Panels reached from toolbar buttons or dedicated graph nodes rather than step
+ * modules. They open on a single selection; step modules deliberately do not. */
+const FLOW_LEVEL_PANEL_IDS = new Set([
+	'constants',
+	'failure',
+	'preprocessor',
+	'Input',
+	'Result',
+	'Trigger'
+])
+
+export function isFlowLevelPanelTarget(id: string): boolean {
+	// 'settings-' prefixed, not 'settings' prefixed: step ids are user-editable, so a
+	// step renamed settings_v2 must not be mistaken for the flow's settings panel.
+	return id === 'settings' || id.startsWith('settings-') || FLOW_LEVEL_PANEL_IDS.has(id)
+}
+
 export class SelectionManager {
 	#selectedNodes = $state<Node[] | { id: string }[]>([])
 	#selectionMode = $state<'normal' | 'rect-select'>('normal')
 	#clearGraphSelection: () => void = () => {}
+	#onSelectIntent: ((id: string, opts?: SelectIntentOptions) => void) | undefined = undefined
 
 	constructor() {}
 
@@ -11,7 +36,15 @@ export class SelectionManager {
 		this.#clearGraphSelection = clearGraphSelection
 	}
 
-	selectId(id: string) {
+	/** Fires on every `selectId` call, BEFORE the same-id dedup early-return — so a
+	 * consumer can react even when the id is re-selected (e.g. clicking the already
+	 * selected "Settings" toolbar button to re-open a modal panel). */
+	setOnSelectIntent(cb: ((id: string, opts?: SelectIntentOptions) => void) | undefined) {
+		this.#onSelectIntent = cb
+	}
+
+	selectId(id: string, opts?: SelectIntentOptions) {
+		this.#onSelectIntent?.(id, opts)
 		if (this.#selectedNodes.length === 1 && this.#selectedNodes[0].id === id) {
 			return
 		}
@@ -77,6 +110,12 @@ export class SelectionManager {
 			return
 		}
 
+		// Before the same-id early return, like `selectId`: re-selecting an already
+		// selected node must still be able to reopen its panel.
+		if (nodes.length === 1) {
+			this.#onSelectIntent?.(nodes[0].id)
+		}
+
 		// If the new selection is the same as the current selection, do nothing
 		const newIds = nodes.map((n) => n.id).join(',')
 		const currentIds = this.#selectedNodes.map((n) => n.id).join(',')
diff --git a/frontend/src/lib/components/home/BulkActionsBar.svelte b/frontend/src/lib/components/home/BulkActionsBar.svelte
new file mode 100644
index 0000000000..f36ed4848a
--- /dev/null
+++ b/frontend/src/lib/components/home/BulkActionsBar.svelte
@@ -0,0 +1,340 @@
+<script lang="ts">
+	/**
+	 * Contextual bar for the Home page's multi-selection: what can be done to the
+	 * current selection, why the rest can't, and the confirmation + per-item
+	 * outcome of the run.
+	 */
+	import { Alert, Button } from '$lib/components/common'
+	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
+	import DropdownV2 from '$lib/components/DropdownV2.svelte'
+	import Select from '$lib/components/select/Select.svelte'
+	import Label from '$lib/components/Label.svelte'
+	import { sendUserToast } from '$lib/toast'
+	import { invalidateWorkspaceDrafts } from '$lib/workspaceDrafts.svelte'
+	import { Archive, ArchiveRestore, FolderInput, MoreHorizontal, Trash, X } from 'lucide-svelte'
+	import {
+		blockedReason,
+		eligible,
+		movedPath,
+		runBulk,
+		type BulkAction,
+		type BulkContext,
+		type BulkOutcome
+	} from './bulkActions'
+	import type { BulkItem, HomeSelection } from './homeSelection.svelte'
+
+	interface Props {
+		selection: HomeSelection
+		workspace: string
+		isAdmin: boolean
+		/** Owner prefixes (`f/<folder>` / `u/<user>`) the user may move items into. */
+		moveTargets: string[]
+		/** Refresh the list and its counts once the batch is done. */
+		onDone: () => Promise<void> | void
+	}
+
+	let { selection, workspace, isAdmin, moveTargets, onDone }: Props = $props()
+
+	let ctx: BulkContext = $derived({ workspace, isAdmin })
+	let items = $derived(selection.items)
+
+	const plural = (n: number) => (n === 1 ? '' : 's')
+	const ACTION_LABEL: Record<BulkAction, string> = {
+		move: 'Move',
+		archive: 'Archive',
+		unarchive: 'Unarchive',
+		delete: 'Delete',
+		discard: 'Discard drafts'
+	}
+	const MODAL_TITLE: Record<BulkAction, (n: number) => string> = {
+		move: (n) => `Move ${n} item${plural(n)}`,
+		archive: (n) => `Archive ${n} item${plural(n)}`,
+		unarchive: (n) => `Unarchive ${n} item${plural(n)}`,
+		delete: (n) => `Delete ${n} item${plural(n)}`,
+		discard: (n) => `Discard ${n} draft${plural(n)}`
+	}
+
+	function targets(action: BulkAction): BulkItem[] {
+		return eligible(action, items, ctx)
+	}
+
+	/** Every distinct reason the ineligible rows are out, so both the disabled
+	 * action and the modal can say whether the limit comes from permissions, the
+	 * item's kind, or its state. Empty when the whole selection is eligible. */
+	function blockedSummary(action: BulkAction): string {
+		return [
+			...new Set(
+				items.map((i) => blockedReason(action, i, ctx)).filter((r): r is string => r != undefined)
+			)
+		].join('; ')
+	}
+
+	function actionTitle(action: BulkAction): string {
+		const n = targets(action).length
+		// Selection mode is entered from the toolbar with nothing picked yet, so this
+		// is the state the primary entry point lands on — it has no blocked reason.
+		if (items.length === 0) return `Select items to ${ACTION_LABEL[action].toLowerCase()}`
+		if (n === 0) return `Cannot ${ACTION_LABEL[action].toLowerCase()}: ${blockedSummary(action)}`
+		if (n < items.length) return `${ACTION_LABEL[action]} ${n} of the ${items.length} selected`
+		return `${ACTION_LABEL[action]} ${n} item${plural(n)}`
+	}
+
+	function countSuffix(action: BulkAction): string {
+		const n = targets(action).length
+		return n > 0 && n < items.length ? ` (${n})` : ''
+	}
+
+	let pending = $state<BulkAction | undefined>(undefined)
+	let moveTarget = $state<string | undefined>(undefined)
+	let running = $state(false)
+	let progress = $state(0)
+	let outcomes = $state<BulkOutcome[] | undefined>(undefined)
+
+	let pendingItems = $derived(pending ? targets(pending) : [])
+	let failures = $derived(outcomes?.filter((o) => o.error != undefined) ?? [])
+	// A discard removes a draft-only item outright but only the draft of a
+	// deployed one — the modal has to name which paths go for good.
+	let discardDeletes = $derived(pendingItems.filter((i) => i.draftOnly))
+	let discardReverts = $derived(pendingItems.filter((i) => !i.draftOnly))
+
+	function open(action: BulkAction) {
+		if (targets(action).length === 0) return
+		pending = action
+		outcomes = undefined
+		progress = 0
+		moveTarget = action === 'move' ? moveTargets[0] : undefined
+	}
+
+	// The dialog's Escape fires this even while its Cancel button is disabled by
+	// `loading`. A batch in flight cannot be called off, and closing over it would
+	// hide the progress and drop the per-item failures it is about to report.
+	function close() {
+		if (running) return
+		pending = undefined
+		outcomes = undefined
+	}
+
+	async function confirm() {
+		const action = pending
+		if (!action || running) return
+		if (action === 'move' && !moveTarget) return
+		running = true
+		progress = 0
+		outcomes = undefined
+		const batch = pendingItems
+		let finished = false
+		try {
+			const res = await runBulk(action, batch, ctx, {
+				target: moveTarget,
+				onProgress: (done) => (progress = done)
+			})
+			if (action === 'discard') invalidateWorkspaceDrafts(workspace)
+			const failed = res.filter((o) => o.error != undefined)
+			// `running` is still set across the refetch: it is what keeps the dialog's
+			// Enter from starting the same batch again over an untrimmed selection.
+			await onDone()
+			// Only what the batch actually changed leaves the selection. The rows it
+			// skipped as ineligible stay ticked so the next action can still address
+			// them — a partial failure must not drop them along with the successes.
+			const untouched = items.filter((i) => !batch.some((b) => b.key === i.key)).map((i) => i.key)
+			if (failed.length === 0) {
+				sendUserToast(`${ACTION_LABEL[action]}: ${res.length} item${plural(res.length)}`)
+				selection.keepOnly(untouched)
+				finished = true
+				return
+			}
+			// Keep the failures ticked too (and the modal open, listing them) so they
+			// can be retried without rebuilding the selection.
+			outcomes = res
+			selection.keepOnly([...untouched, ...failed.map((o) => o.item.key)])
+		} finally {
+			// Released here and nowhere else: while it is set, Escape can't dismiss the
+			// dialog and both its buttons are disabled, so a throw would wedge it shut.
+			running = false
+			if (finished) close()
+		}
+	}
+</script>
+
+<div
+	class="fixed bottom-6 left-1/2 -translate-x-1/2 z-40 flex items-center gap-2 rounded-md border bg-surface px-3 py-2 shadow-lg"
+>
+	<span class="text-xs font-semibold text-emphasis whitespace-nowrap">
+		{selection.size} selected
+	</span>
+	<div class="h-4 border-l"></div>
+	<Button
+		variant="subtle"
+		unifiedSize="sm"
+		startIcon={{ icon: FolderInput }}
+		disabled={targets('move').length === 0}
+		title={actionTitle('move')}
+		on:click={() => open('move')}
+	>
+		Move{countSuffix('move')}
+	</Button>
+	<!-- Both render when both have targets: a selection mixing archived and active
+	     rows would otherwise be a dead end for whichever action lost the toss. With
+	     no targets either way, Archive stands alone and disabled, explaining why. -->
+	{#if targets('archive').length > 0 || targets('unarchive').length === 0}
+		<Button
+			variant="subtle"
+			unifiedSize="sm"
+			startIcon={{ icon: Archive }}
+			disabled={targets('archive').length === 0}
+			title={actionTitle('archive')}
+			on:click={() => open('archive')}
+		>
+			Archive{countSuffix('archive')}
+		</Button>
+	{/if}
+	{#if targets('unarchive').length > 0}
+		<Button
+			variant="subtle"
+			unifiedSize="sm"
+			startIcon={{ icon: ArchiveRestore }}
+			title={actionTitle('unarchive')}
+			on:click={() => open('unarchive')}
+		>
+			Unarchive{countSuffix('unarchive')}
+		</Button>
+	{/if}
+	<DropdownV2
+		placement="top-end"
+		items={[
+			{
+				displayName: `Discard drafts${countSuffix('discard')}`,
+				icon: Trash,
+				action: () => open('discard'),
+				disabled: targets('discard').length === 0,
+				// Only while blocked: a disabled entry can't open its modal, so the reason
+				// has to live here — and an enabled one would render a pointless ⓘ.
+				tooltip: targets('discard').length === 0 ? actionTitle('discard') : undefined
+			},
+			{
+				displayName: `Delete${countSuffix('delete')}`,
+				icon: Trash,
+				type: 'delete' as const,
+				action: () => open('delete'),
+				disabled: targets('delete').length === 0,
+				tooltip: targets('delete').length === 0 ? actionTitle('delete') : undefined
+			}
+		]}
+	>
+		{#snippet buttonReplacement()}
+			<Button
+				nonCaptureEvent
+				variant="subtle"
+				unifiedSize="sm"
+				startIcon={{ icon: MoreHorizontal }}
+				title="More actions"
+			>
+				More
+			</Button>
+		{/snippet}
+	</DropdownV2>
+	<div class="h-4 border-l"></div>
+	<Button
+		variant="subtle"
+		unifiedSize="sm"
+		iconOnly
+		startIcon={{ icon: X }}
+		title="Cancel selection (Esc)"
+		on:click={() => selection.exit()}
+	/>
+</div>
+
+<ConfirmationModal
+	open={pending != undefined}
+	title={pending ? MODAL_TITLE[pending](pendingItems.length) : ''}
+	confirmationText={failures.length > 0 ? 'Retry' : pending ? ACTION_LABEL[pending] : ''}
+	type={pending === 'delete' || pending === 'discard' ? 'danger' : 'info'}
+	loading={running}
+	onCanceled={close}
+	onConfirmed={confirm}
+>
+	<div class="flex flex-col w-full gap-4 text-sm">
+		{#if pending === 'move'}
+			<Label label="Destination folder">
+				<Select
+					items={moveTargets.map((t) => ({ label: t, value: t }))}
+					bind:value={moveTarget}
+					placeholder="Select a folder"
+				/>
+			</Label>
+			{#if moveTarget}
+				{@const target = moveTarget}
+				{@render pathList(
+					'Will be moved to',
+					pendingItems.map((i) => `${i.path} → ${movedPath(i, target)}`)
+				)}
+			{/if}
+		{:else if pending === 'discard'}
+			{#if discardDeletes.length > 0}
+				<Alert type="warning" title="Permanently removed">
+					These exist only as your draft, so discarding deletes them outright.
+				</Alert>
+				{@render pathList(
+					'',
+					discardDeletes.map((i) => i.displayPath)
+				)}
+			{/if}
+			{#if discardReverts.length > 0}
+				{@render pathList(
+					'Draft removed, deployed version kept',
+					discardReverts.map((i) => i.displayPath)
+				)}
+			{/if}
+		{:else if pending === 'delete'}
+			<Alert type="warning" title="Permanently deleted">
+				Deleted items are gone from the workspace; only a workspace admin can recover them from the
+				trash bin.
+			</Alert>
+			{@render pathList(
+				'',
+				pendingItems.map((i) => i.displayPath)
+			)}
+		{:else if pending != undefined}
+			{@render pathList(
+				'',
+				pendingItems.map((i) => i.displayPath)
+			)}
+		{/if}
+
+		{#if pending && pendingItems.length < items.length}
+			{@const skipped = items.length - pendingItems.length}
+			<div class="text-xs text-hint">
+				{skipped} selected item{plural(skipped)} left untouched: {blockedSummary(pending)}
+			</div>
+		{/if}
+
+		{#if running}
+			<div class="text-xs text-secondary">{progress} / {pendingItems.length} done…</div>
+		{/if}
+
+		{#if failures.length > 0}
+			<Alert type="error" title="{failures.length} failed">
+				<div class="flex flex-col gap-1 mt-1 max-h-48 overflow-y-auto">
+					{#each failures as f (f.item.key)}
+						<div class="text-2xs">
+							<span class="font-mono">{f.item.displayPath}</span>: {f.error}
+						</div>
+					{/each}
+				</div>
+			</Alert>
+		{/if}
+	</div>
+</ConfirmationModal>
+
+{#snippet pathList(title: string, paths: string[])}
+	<div class="flex flex-col gap-1">
+		{#if title}
+			<span class="text-xs font-semibold text-secondary">{title}</span>
+		{/if}
+		<div class="flex flex-col gap-0.5 max-h-48 overflow-y-auto border rounded-md p-2">
+			{#each paths as p, i (i)}
+				<span class="text-2xs font-mono text-primary truncate" title={p}>{p}</span>
+			{/each}
+		</div>
+	</div>
+{/snippet}
diff --git a/frontend/src/lib/components/home/Item.svelte b/frontend/src/lib/components/home/Item.svelte
index 6621e60fef..f9e30eaf65 100644
--- a/frontend/src/lib/components/home/Item.svelte
+++ b/frontend/src/lib/components/home/Item.svelte
@@ -10,6 +10,9 @@
 	import ShareModal from '../ShareModal.svelte'
 	import { createEventDispatcher } from 'svelte'
 	import { ArrowBigUp } from 'lucide-svelte'
+	import { userStore, workspaceStore } from '$lib/stores'
+	import { getHomeSelection, toBulkItem } from './homeSelection.svelte'
+	import type { RowSelection } from '../common/table/rowSelection'
 
 	const dispatch = createEventDispatcher()
 
@@ -34,6 +37,35 @@
 		showEditButton = true,
 		keyboardSelected = false
 	}: Props = $props()
+
+	// Read from context rather than threaded down: the tree renders items through
+	// several nested levels that have no other reason to know about selection.
+	const homeSelection = getHomeSelection()
+	// A raw app the listing returns is an `app` row carrying `raw_app`, and is
+	// selectable like any other app. The separate `raw_app` type is the legacy
+	// listing shape, which renders through RawAppRow — no selection control there,
+	// so it must not enter the selection either.
+	let bulkItem = $derived(
+		homeSelection?.available && item.type !== 'raw_app'
+			? toBulkItem(item, $userStore, $workspaceStore)
+			: undefined
+	)
+	$effect(() => {
+		const b = bulkItem
+		if (!b || !homeSelection) return
+		homeSelection.register(b)
+		return () => homeSelection.unregister(b.key)
+	})
+	let rowSelection: RowSelection | undefined = $derived(
+		bulkItem && homeSelection
+			? {
+					key: bulkItem.key,
+					selected: homeSelection.has(bulkItem.key),
+					active: homeSelection.active,
+					onToggle: (e) => bulkItem && homeSelection.toggle(bulkItem, 'shiftKey' in e && e.shiftKey)
+				}
+			: undefined
+	)
 </script>
 
 {#if item.type == 'script'}
@@ -54,6 +86,7 @@
 		{showCode}
 		{showEditButton}
 		{keyboardSelected}
+		{rowSelection}
 	/>
 {:else if item.type == 'flow'}
 	<FlowRow
@@ -72,6 +105,7 @@
 		bind:menuOpen
 		{showEditButton}
 		{keyboardSelected}
+		{rowSelection}
 	/>
 {:else if item.type == 'app'}
 	<AppRow
@@ -86,6 +120,7 @@
 		bind:menuOpen
 		{showEditButton}
 		{keyboardSelected}
+		{rowSelection}
 	/>
 {:else if item.type == 'raw_app'}
 	<RawAppRow
diff --git a/frontend/src/lib/components/home/ItemsList.svelte b/frontend/src/lib/components/home/ItemsList.svelte
index 041d8fc58e..d7717d1e04 100644
--- a/frontend/src/lib/components/home/ItemsList.svelte
+++ b/frontend/src/lib/components/home/ItemsList.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
 	import CenteredPage from '$lib/components/CenteredPage.svelte'
+	import { PIPELINE_DRAFT_KIND, pipelineFolderFromBundlePath } from '$lib/pipelinePaths'
 	import { Badge, Button, Skeleton } from '$lib/components/common'
 	import Toggle from '$lib/components/Toggle.svelte'
 	import {
@@ -19,6 +20,7 @@
 	import type uFuzzy from '@leeoniya/ufuzzy'
 	import {
 		ArrowDownUp,
+		CheckSquare,
 		ChevronsDownUp,
 		ChevronsUpDown,
 		Code2,
@@ -38,7 +40,7 @@
 	import ToggleButtonGroup from '../common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from '../common/toggleButton-v2/ToggleButton.svelte'
 	import FlowIcon from './FlowIcon.svelte'
-	import { canWrite, getLocalSetting, storeLocalSetting } from '$lib/utils'
+	import { canWrite, getLocalSetting, isOwner, storeLocalSetting } from '$lib/utils'
 	import { sendUserToast } from '$lib/toast'
 	import { page } from '$app/state'
 	import { setQuery } from '$lib/navigation'
@@ -54,6 +56,8 @@
 	import TextInput from '../text_input/TextInput.svelte'
 	import { NetworkIcon } from 'lucide-svelte'
 	import { base } from '$lib/base'
+	import BulkActionsBar from './BulkActionsBar.svelte'
+	import { HomeSelection, setHomeSelection, toBulkItem } from './homeSelection.svelte'
 	interface Props {
 		filter?: string
 		subtab?: 'flow' | 'script' | 'app'
@@ -104,9 +108,9 @@
 			}
 			try {
 				for (const d of await getDraftItems(ws)) {
-					if (d.kind !== 'data_pipeline') continue
-					const m = d.path.match(/^f\/([^/]+)\/data_pipeline$/)
-					if (m) folders.add(m[1])
+					if (d.kind !== PIPELINE_DRAFT_KIND) continue
+					const folder = pipelineFolderFromBundlePath(d.path)
+					if (folder) folders.add(folder)
 				}
 			} catch {
 				// Drafts unavailable — show deployed pipelines only.
@@ -343,37 +347,41 @@
 		}
 	}
 
-	// Per-top-level-folder lazy loading for tree view: expanding a folder loads its
-	// items on demand (server-scoped to that folder), paginated within the folder,
-	// instead of relying on the global browse window. Keyed by folder name (the
-	// `f/<name>` node).
+	// Per-folder lazy loading for tree view, keyed by the full path prefix a node covers —
+	// an owner (`f/<name>` / `u/<name>`) or any folder under one — since the listing
+	// endpoint scopes on an arbitrary `path_start`. That is what lets a subfolder be
+	// completed on its own instead of only by paging its whole owner.
 	//
-	// Every top-level namespace — a folder (`f/<name>`) OR a user (`u/<name>`) — is a
-	// lazily-loaded owner, keyed here by its full path prefix. Its items live in their
-	// OWN store (`treeOwnerItems`), never merged into the global browse arrays: those
-	// advance by a single `serverCursor`, so injecting out-of-window rows there would
-	// make the flat stream non-contiguous and, once pagination reached those rows,
-	// duplicate them. Loading users lazily too (rather than sourcing them from the
-	// loaded window) is why a user node no longer vanishes under a name sort whose
-	// first page happens to be all folder rows. `treeGen` ties every request to the
-	// active scope (order/archived/library/kind/workspace); a reset bumps it so an
-	// in-flight response from a stale scope is discarded.
+	// Rows for every prefix live in ONE store (`treeOwnerItems`), never in the global
+	// browse arrays: those advance by a single `serverCursor`, so out-of-window rows there
+	// would make the flat stream non-contiguous and duplicate once pagination reached them.
+	//
+	// `treeGen` ties every request to the active scope (order/archived/library/kind/
+	// workspace); a reset bumps it so an in-flight response from a stale scope is dropped.
 	type OwnerLoadState = {
 		cursor?: string
 		hasMore: boolean
 		loading: boolean
 		loaded: boolean
 		gen: number
-		// Total rows fetched for this owner so far (leaves + subfolder rows) — the tree
-		// node's own children count undercounts because rows nest into subfolders.
-		count: number
 	}
+	// Rows per request when loading a prefix in the tree. Larger than the flat list's
+	// page because a tree row is a single line and a folder is opened to see what it
+	// holds — most folders come in whole on the first click.
+	const OWNER_PAGE_SIZE = 300
+	// How far one "Load more" will page past rows it already has before giving up and
+	// leaving the rest to another click (see the catch-up loop in loadOwnerItems).
+	const OWNER_CATCH_UP_PAGES = 5
+	// Ceiling on the pages one "Load all" issues. It exists so a prefix that never stops
+	// handing back a cursor can't spin forever; hitting it leaves `hasMore` set, so the
+	// footer stays and another click resumes where this one stopped.
+	const OWNER_LOAD_ALL_PAGES = 100
 	let ownerLoad = $state<Record<string, OwnerLoadState>>({})
 	let treeOwnerItems = $state<ItemType[]>([])
 	let treeGen = 0
-	// Owners the user currently has expanded (full path prefixes). A reload re-fetches
-	// only these: ownerLoad also retains collapsed owners as a cache, so keying reloads
-	// off its entries would re-request every owner ever opened in this scope.
+	// Prefixes currently loaded and on screen. A reload re-fetches only these: ownerLoad
+	// also retains collapsed nodes as a cache, so keying reloads off its entries would
+	// re-request every folder ever opened in this scope.
 	let openOwners = new Set<string>()
 
 	// The endpoint returns a unified `edited_at` per row; combinedItems derives every
@@ -386,14 +394,21 @@
 		} as unknown as ItemType
 	}
 
-	// `owner` is the full prefix: `f/<folder>` or `u/<username>`.
-	// `force` re-fetches an owner's first page even if already loaded (a re-sort /
-	// re-filter reload uses it to refresh the loaded rows in place).
-	async function loadOwnerItems(owner: string, more = false, force = false): Promise<void> {
+	// `owner` is the full prefix a node covers: `f/<folder>`, `u/<username>`, or any
+	// folder under one. `force` re-fetches its first page even if already loaded (a
+	// re-sort / re-filter reload uses it to refresh the loaded rows in place); `all`
+	// keeps paging until the prefix's stream is exhausted instead of stopping at a page.
+	async function loadOwnerItems(
+		owner: string,
+		more = false,
+		opts?: { force?: boolean; all?: boolean }
+	): Promise<void> {
+		const force = opts?.force ?? false
+		const all = opts?.all ?? false
 		const ws = $workspaceStore
 		if (!ws || !$userStore) return
-		// Track the owner as open first — even a no-op call (re-expanding a cached owner)
-		// means it's expanded, so later reloads must refresh it.
+		// Track the prefix as open first — even a no-op call (re-expanding a cached node)
+		// means it's on screen, so later reloads must refresh it.
 		openOwners.add(owner)
 		const st = ownerLoad[owner]
 		// Only a load for the CURRENT generation blocks a new one. A load left in flight
@@ -407,60 +422,101 @@
 			hasMore: st?.hasMore ?? false,
 			loading: true,
 			loaded: st?.loaded ?? false,
-			gen,
-			// A fresh (non-more) load replaces this owner's rows, so its count restarts.
-			count: more ? (st?.count ?? 0) : 0
+			gen
 		}
 		const { orderBy, orderDesc } = sortToParams(sortOrder)
-		let res: { items: RunnableItem[]; next_cursor?: string }
-		try {
-			res = await ScriptService.listRunnables({
-				workspace: ws,
-				orderBy,
-				orderDesc,
-				showArchived: archived ? true : undefined,
-				includeWithoutMain: includeWithoutMain ? true : undefined,
-				kinds: itemKind !== 'all' ? itemKind : undefined,
-				pathStart: `${owner}/`,
-				includeDraftOnly: true,
-				perPage: 100,
-				cursor: more ? st?.cursor : undefined
-			})
-		} catch (e: any) {
-			if (gen !== treeGen) return
-			ownerLoad[owner] = { ...ownerLoad[owner], loading: false }
-			sendUserToast(`Failed to load ${owner}: ${e?.body ?? e?.message ?? e}`, true)
-			return
-		}
-		// The scope moved on while this was in flight (order/archive/library/kind/
-		// workspace changed and reset the tree); drop the response so stale rows from
-		// another scope can't appear under the current one.
-		if (gen !== treeGen) return
-		// A fresh load REPLACES this owner's rows (drop its previous ones, keep every
-		// other owner's untouched) so a re-sort/re-filter swaps its items atomically
-		// without blanking the whole tree; load-more appends to what's already shown.
 		const prefix = `${owner}/`
-		const base = more
-			? treeOwnerItems
-			: treeOwnerItems.filter((x) => !effectivePath(x).startsWith(prefix))
-		const have = new Set(base.map(itemKey))
-		const merged = [...base]
-		for (const it of res.items ?? []) {
-			// Pipeline-member scripts are folded into their folder's Pipeline entry, so
-			// they never render as their own tree leaf (visiblePipelineFolders drives it).
-			if (it.type === 'script' && it.auto_kind === 'pipeline') continue
-			if (have.has(itemKey(it))) continue
-			merged.push({ ...toTreeItem(it), ord: fetchOrd++ })
+		// Only a forced refresh replaces this prefix's rows, so a re-sort swaps them without
+		// blanking the tree. Everything else merges: a nested prefix inherits rows from an
+		// ancestor's pages, and one page of its own can cover fewer of them than are shown —
+		// replacing would delete rows on the click meant to add them.
+		const replacing = !more && force
+		// Merges a page and answers how many rows it actually added. Reads the live store
+		// each time rather than a snapshot, so a page landing while another prefix loads
+		// doesn't drop that prefix's rows.
+		let firstMerge = true
+		const mergePage = (items: RunnableItem[] | undefined): number => {
+			const current =
+				replacing && firstMerge
+					? treeOwnerItems.filter((x) => !effectivePath(x).startsWith(prefix))
+					: treeOwnerItems
+			firstMerge = false
+			const have = new Set(current.map(itemKey))
+			const merged = [...current]
+			let added = 0
+			for (const it of items ?? []) {
+				// Pipeline-member scripts are folded into their folder's Pipeline entry, so
+				// they never render as their own tree leaf (visiblePipelineFolders drives it).
+				if (it.type === 'script' && it.auto_kind === 'pipeline') continue
+				if (have.has(itemKey(it))) continue
+				merged.push({ ...toTreeItem(it), ord: fetchOrd++ })
+				added++
+			}
+			treeOwnerItems = merged
+			return added
 		}
-		treeOwnerItems = merged
-		ownerLoad[owner] = {
-			cursor: res.next_cursor,
-			hasMore: !!res.next_cursor,
-			loading: false,
-			loaded: true,
-			gen,
-			count: merged.filter((x) => x.path.startsWith(prefix)).length
+		let cursor = more ? st?.cursor : undefined
+		let nextCursor: string | undefined
+		// A nested prefix's own stream restarts at its first row, which an ancestor's pages
+		// may already have brought in — that page then adds nothing and the click would read
+		// as broken. Keep paging until one adds something or the stream ends, bounded so a
+		// single click can't turn into an unbounded fetch loop. "Load all" instead stops
+		// only at the end of the stream, so `loading` stays set for the whole run and the
+		// footer resolves to an exact count in one click.
+		for (let page = 0; page < (all ? OWNER_LOAD_ALL_PAGES : OWNER_CATCH_UP_PAGES); page++) {
+			let res: { items: RunnableItem[]; next_cursor?: string }
+			try {
+				res = await ScriptService.listRunnables({
+					workspace: ws,
+					orderBy,
+					orderDesc,
+					showArchived: archived ? true : undefined,
+					includeWithoutMain: includeWithoutMain ? true : undefined,
+					kinds: itemKind !== 'all' ? itemKind : undefined,
+					pathStart: prefix,
+					includeDraftOnly: true,
+					perPage: OWNER_PAGE_SIZE,
+					cursor
+				})
+			} catch (e: any) {
+				if (gen !== treeGen) return
+				// Keep the cursor the pages that did land reached, so the next click resumes
+				// instead of re-reading pages that now dedup to nothing. `loaded` moves with
+				// it: a node still marked unloaded is retried as a first load, which starts
+				// from no cursor and throws the saved one away.
+				const prev = ownerLoad[owner]
+				const advanced = nextCursor != undefined
+				ownerLoad[owner] = {
+					...prev,
+					cursor: nextCursor ?? prev?.cursor,
+					hasMore: advanced || (prev?.hasMore ?? false),
+					loaded: advanced || (prev?.loaded ?? false),
+					loading: false
+				}
+				sendUserToast(`Failed to load ${owner}: ${e?.body ?? e?.message ?? e}`, true)
+				return
+			}
+			// The scope moved on while this was in flight (order/archive/library/kind/
+			// workspace changed and reset the tree); drop the response so stale rows from
+			// another scope can't appear under the current one.
+			if (gen !== treeGen) return
+			const added = mergePage(res.items)
+			nextCursor = res.next_cursor
+			cursor = nextCursor
+			// Collapsing the node is the only way to stop a run that spans many pages;
+			// without this it would keep paging a folder that is no longer on screen. What
+			// it reached is committed below, so its footer resumes from there.
+			if (nextCursor == undefined || !openOwners.has(owner) || (!all && added > 0)) break
 		}
+		ownerLoad = Object.fromEntries([
+			// A replacing load dropped every row under this prefix, so a nested folder that
+			// had paged itself is back to whatever this page holds: its load state has to go
+			// with its rows. Left behind, a subfolder marked complete would keep an exact
+			// count and no "Load more" over rows this response truncated. Reloads re-fetch
+			// the ones still open (see reloadItems), which re-establishes their state.
+			...Object.entries(ownerLoad).filter(([p]) => !replacing || !p.startsWith(prefix)),
+			[owner, { cursor: nextCursor, hasMore: !!nextCursor, loading: false, loaded: true, gen }]
+		])
 	}
 
 	function collapseOwner(owner: string): void {
@@ -493,18 +549,38 @@
 			ownerLoad = Object.fromEntries(Object.entries(ownerLoad).filter(([o]) => open.has(o)))
 		}
 		await loadRunnables(true)
-		// force: the owners are still marked loaded, so re-fetch their first page and
-		// swap it in place (loadOwnerItems replaces each owner's rows atomically — the
-		// old rows stay visible until the new ones arrive, so nothing blanks mid-reorder).
-		for (const o of toReload) loadOwnerItems(o, false, true)
+		// force: the prefixes are still marked loaded, so re-fetch their first page and
+		// swap it in place (loadOwnerItems replaces a prefix's rows atomically — the old
+		// rows stay visible until the new ones arrive, so nothing blanks mid-reorder).
+		// Shallowest first, one depth at a time: a fresh load drops every row under its
+		// prefix, so a parent landing after a nested subfolder would wipe the rows that
+		// subfolder just re-fetched and leave it short until clicked again.
+		// Awaited so a caller reconciling against the rendered rows sees the reloaded
+		// tree rather than the pre-reload ones; each swap stays atomic either way.
+		const byDepth = new Map<number, string[]>()
+		for (const p of toReload) {
+			const d = p.split('/').length
+			byDepth.set(d, [...(byDepth.get(d) ?? []), p])
+		}
+		for (const d of [...byDepth.keys()].sort((a, b) => a - b)) {
+			await Promise.all(
+				(byDepth.get(d) ?? []).map((p) => loadOwnerItems(p, false, { force: true }))
+			)
+		}
 	}
 
 	// For row mutations (create/delete/move/archive), which also change how many
 	// runnables an owner holds. A scope change (sort/archive/kind/…) doesn't go
 	// through here: the counts resource keys on those itself.
 	async function reloadItemsAndCounts(): Promise<void> {
+		// A mutated row can be gone, or sit at a new path, afterwards: snapshot what
+		// was on screen so the selection can drop what this reload removes instead of
+		// keeping a dead path. `tick` lets the reloaded rows re-register first.
+		const renderedBefore = homeSelection.renderedKeys
 		void ownerCountsRes.refetch()
 		await reloadItems()
+		await tick()
+		homeSelection.dropVanished(renderedBefore)
 	}
 
 	function filterItemsPathsBaseOnUserFilters(
@@ -1135,16 +1211,41 @@
 		selectedIndex = previousNbDisplayed
 	}
 
+	// Elements that own the keyboard themselves (menus, dialogs, comboboxes): the
+	// list's own shortcuts stand down while one of them has focus.
+	const SKIP_SELECTOR =
+		'[role="menu"], [role="menuitem"], [role="dialog"], [role="listbox"], [role="combobox"], [aria-expanded="true"], [data-menu], [data-chat-keyboard-scope]'
+
+	// The marker sits on the row itself, not on its title link — selection mode
+	// drops the link, and the action buttons must stay keyboard-reachable there too.
 	function getSelectedRowActionButtons(): HTMLElement[] {
-		const anchor = document.querySelector<HTMLElement>('a[data-row-keyboard-selected="true"]')
-		const actions = anchor?.parentElement?.querySelector<HTMLElement>('[data-row-actions]')
+		const actions = document.querySelector<HTMLElement>(
+			'[data-row-keyboard-selected="true"] [data-row-actions]'
+		)
 		return actions ? Array.from(actions.querySelectorAll<HTMLElement>('button, a[href]')) : []
 	}
 
 	function handleGlobalKeydown(e: KeyboardEvent) {
-		if (treeView) return
+		// An open dialog owns the keyboard. Testing the focused element alone misses it
+		// (a modal opened from a button leaves focus on that button), and this capture
+		// listener runs before the dialog's, so Enter would tick a row into the batch
+		// being confirmed. Dialogs are in the DOM only while open.
+		if (document.querySelector('[role="dialog"]')) return
+
 		const target = e.target as HTMLElement | null
 
+		// Escape leaves selection mode from either view; everything below is flat-list
+		// navigation. A menu that owns the key closes itself first.
+		if (e.key === 'Escape' && homeSelection.active) {
+			const active = document.activeElement as HTMLElement | null
+			if (!target?.closest(SKIP_SELECTOR) && !active?.closest(SKIP_SELECTOR)) {
+				e.preventDefault()
+				homeSelection.exit()
+				return
+			}
+		}
+		if (treeView) return
+
 		// When focus is inside a row's action buttons, handle arrow keys ourselves:
 		//  - Left/Right cycle between buttons (Left from the first returns to search).
 		//  - Up/Down move to the same-position button on the previous/next row.
@@ -1223,8 +1324,7 @@
 			return
 		}
 
-		const skipSelector =
-			'[role="menu"], [role="menuitem"], [role="dialog"], [role="listbox"], [role="combobox"], [aria-expanded="true"], [data-menu], [data-chat-keyboard-scope]'
+		const skipSelector = SKIP_SELECTOR
 		if (target) {
 			const tag = target.tagName
 			const isEditable =
@@ -1285,12 +1385,32 @@
 				selectedIndex = selectedIndex - 1
 			}
 		} else if (e.key === 'Enter') {
-			if (selectedIndex === loadMoreIndex && hasMore) {
+			// Enter belongs to whatever control has focus — the action bar's buttons,
+			// a row's own actions, a link. Claiming it there would both suppress that
+			// control and act on the highlighted row instead.
+			if (target?.closest('button, a[href], [role="button"]')) return
+			// In selection mode the rows carry no link, so Enter ticks the highlighted
+			// row instead of opening it. Never for a legacy raw-app row, which carries
+			// no selection control — that falls through to opening it below.
+			if (
+				homeSelection.active &&
+				selectedIndex >= 0 &&
+				selectedIndex < displayedItems.length &&
+				displayedItems[selectedIndex].type !== 'raw_app'
+			) {
+				e.preventDefault()
+				homeSelection.toggle(
+					toBulkItem(displayedItems[selectedIndex], $userStore, $workspaceStore),
+					e.shiftKey
+				)
+			} else if (selectedIndex === loadMoreIndex && hasMore) {
 				e.preventDefault()
 				loadMoreAndPreselectFirstNew()
 			} else if (selectedIndex >= 0 && selectedIndex < displayedItems.length) {
+				// Direct child only: that is the title link. Selection mode drops it, and
+				// a descendant match would find the row's Edit link and open the editor.
 				const anchor = document.querySelector<HTMLAnchorElement>(
-					'a[data-row-keyboard-selected="true"]'
+					'[data-row-keyboard-selected="true"] > a[href]'
 				)
 				if (anchor) {
 					e.preventDefault()
@@ -1313,6 +1433,29 @@
 	$effect(() => {
 		storeLocalSetting(INCLUDE_WITHOUT_MAIN_SETTING_NAME, includeWithoutMain ? 'true' : undefined)
 	})
+
+	// Multi-selection + bulk actions. Published through context so the tree's
+	// nested levels don't have to carry it; `Item` is the only reader.
+	const homeSelection = new HomeSelection()
+	setHomeSelection(homeSelection)
+	$effect(() => {
+		homeSelection.available = showEditButtons && !!$userStore && !$userStore.operator
+	})
+	// A selected path means nothing in another workspace. Narrowing the view
+	// within one (kind, owner, label, search) keeps the selection instead, so
+	// items can be gathered across several filters; every action lists the paths
+	// it will touch, so nothing acts invisibly.
+	$effect(() => {
+		$workspaceStore
+		untrack(() => homeSelection.exit())
+	})
+	// Only folders/user spaces the user owns: a move into any other lands as a
+	// per-item permission error the user could have been spared.
+	let moveTargets = $derived(
+		[...allFolderOwners, ...($userStore?.username ? [`u/${$userStore.username}`] : [])].filter(
+			(o) => isOwner(`${o}/x`, $userStore, $workspaceStore)
+		)
+	)
 </script>
 
 <SearchItems
@@ -1547,6 +1690,21 @@
 						{/if}
 					</Button>
 				{/if}
+				{#if homeSelection.available && !homeSelection.active}
+					<!-- Last child of a flex-row-reverse row, so `mr-auto` absorbs the free
+					     space and pins it to the far left, away from the view/sort controls. -->
+					<Button
+						wrapperClasses="mr-auto"
+						startIcon={{ icon: CheckSquare }}
+						iconOnly
+						size="xs"
+						color="light"
+						variant="default"
+						spacingSize="xs2"
+						title="Select items — move, archive, delete or discard several at once"
+						on:click={() => homeSelection.enter()}
+					/>
+				{/if}
 			</div>
 		{/if}
 	</div>
@@ -1580,7 +1738,6 @@
 			{#key treeKey}
 				<TreeViewRoot
 					items={treeSource}
-					{nbDisplayed}
 					{collapseAll}
 					sortCompare={compareItems}
 					groupDesc={sortOrder === 'name_desc'}
@@ -1589,7 +1746,7 @@
 					pipelineFolders={visiblePipelineFolders}
 					allFolders={treeInjectFolders}
 					allUsers={treeInjectUsers}
-					ownerCounts={treeLazyMode ? ownerCounts : undefined}
+					ownerCounts={!searching && labelFilter == undefined ? ownerCounts : undefined}
 					selfUsername={$userStore?.username}
 					ownerLoad={treeLazyMode ? ownerLoad : undefined}
 					onExpandOwner={treeLazyMode ? loadOwnerItems : undefined}
@@ -1601,6 +1758,7 @@
 					on:rawAppChanged={reloadItemsAndCounts}
 					on:reload={reloadItemsAndCounts}
 					{showCode}
+					showEditButton={showEditButtons}
 				/>
 			{/key}
 		{:else}
@@ -1660,5 +1818,20 @@
 				{/if}
 			</div>
 		{/if}
+		{#if homeSelection.active}
+			<!-- The bar floats over the page bottom; without this the last rows sit
+			     under it with no way to scroll them clear. -->
+			<div class="h-20"></div>
+		{/if}
 	</div>
 </CenteredPage>
+
+{#if homeSelection.active && $workspaceStore}
+	<BulkActionsBar
+		selection={homeSelection}
+		workspace={$workspaceStore}
+		isAdmin={!!($userStore?.is_admin || $userStore?.is_super_admin)}
+		{moveTargets}
+		onDone={reloadItemsAndCounts}
+	/>
+{/if}
diff --git a/frontend/src/lib/components/home/ListFiltersQuick.svelte b/frontend/src/lib/components/home/ListFiltersQuick.svelte
index 4a35aef352..bca020b482 100644
--- a/frontend/src/lib/components/home/ListFiltersQuick.svelte
+++ b/frontend/src/lib/components/home/ListFiltersQuick.svelte
@@ -49,8 +49,9 @@
 				startIcon={icon}
 				unifiedSize="sm"
 				btnClasses="justify-start"
+				title={filter}
 			>
-				{filter}
+				<span class="truncate">{filter}</span>
 			</Button>
 		</div>
 	{/each}
diff --git a/frontend/src/lib/components/home/TreeView.svelte b/frontend/src/lib/components/home/TreeView.svelte
index 7646de3ba0..e688c5b1a2 100644
--- a/frontend/src/lib/components/home/TreeView.svelte
+++ b/frontend/src/lib/components/home/TreeView.svelte
@@ -4,10 +4,11 @@
 
 	import { ChevronDown, ChevronUp, Folder, FolderTree, NetworkIcon, User } from 'lucide-svelte'
 	import Item from './Item.svelte'
-	import type { FolderItem, ItemType, UserItem } from './treeViewUtils'
+	import { countLeaves, type FolderItem, type ItemType, type UserItem } from './treeViewUtils'
 	import { twMerge } from 'tailwind-merge'
 	import { pluralize } from '$lib/utils'
 	import { base } from '$lib/base'
+	import { Button } from '$lib/components/common'
 
 	interface Props {
 		item: ItemType | FolderItem | UserItem
@@ -19,18 +20,28 @@
 		// How many runnables each `f/<folder>` / `u/<user>` holds for this user, keyed by
 		// full prefix. Known before an owner is expanded, unlike its loaded rows.
 		ownerCounts?: Record<string, number>
-		// Lazy per-owner loading (top-level folders and users only): expanding an owner
-		// loads its items on demand and paginates within it. `ownerLoad` keys are full
-		// path prefixes (`f/<name>` / `u/<name>`).
+		// Lazy loading state, keyed by the full path prefix a node covers: `f/<name>` /
+		// `u/<name>` for a top-level owner, `<parent>/<subfolder>` deeper. A node paginates
+		// within its own prefix, so a subfolder can be completed without paging everything
+		// its owner holds.
 		ownerLoad?: Record<
 			string,
-			{ cursor?: string; hasMore: boolean; loading: boolean; loaded: boolean; count: number }
+			{ cursor?: string; hasMore: boolean; loading: boolean; loaded: boolean }
 		>
-		onExpandOwner?: (owner: string, more?: boolean) => void
-		onCollapseOwner?: (owner: string) => void
+		// `all` pages the prefix to the end in one call instead of fetching a single page.
+		onExpandOwner?: (prefix: string, more?: boolean, opts?: { all?: boolean }) => void
+		onCollapseOwner?: (prefix: string) => void
 		// Position of this node among the rendered root nodes; "expand all" only
 		// auto-loads the first EXPAND_ALL_LOAD_LIMIT of them (see the effect below).
 		rootIndex?: number
+		showEditButton?: boolean
+		// Path prefix of the parent node, so this one can name its own (`ownerLoad` and
+		// the listing endpoint are both keyed by full prefix). Unset at the top level.
+		parentPrefix?: string
+		// The nearest ancestor that was loaded directly still has unloaded pages, so what
+		// is grouped under this node is only part of it: counts render as "N+" and the
+		// node offers to load the rest of itself.
+		ancestorHasMore?: boolean
 	}
 
 	let {
@@ -44,12 +55,15 @@
 		ownerLoad,
 		onExpandOwner,
 		onCollapseOwner,
-		rootIndex = 0
+		rootIndex = 0,
+		showEditButton = true,
+		parentPrefix,
+		ancestorHasMore = false
 	}: Props = $props()
 
-	// Bounds the request burst from "expand all": however many root owners are rendered
-	// (nbDisplayed can grow via "load 30 more"), it fetches at most this many. Lazy
-	// owners past the cap stay collapsed and load on a single click (see the effect).
+	// Bounds the request burst from "expand all": however many root owners the tree
+	// renders (its slice grows as you scroll), it fetches at most this many. Lazy owners
+	// past the cap stay collapsed and load on a single click (see the effect).
 	const EXPAND_ALL_LOAD_LIMIT = 20
 
 	const isFolderItem = (i: typeof item): i is FolderItem => i && 'folderName' in i
@@ -66,7 +80,11 @@
 			(pipelineFolders?.has(item.folderName) ?? false)
 	)
 
-	let opened: boolean = $state(true)
+	// Starts closed and is opened by the collapseAll effect below, which runs after the
+	// first render. Starting open instead would mount this node's whole loaded subtree for
+	// that one frame — thousands of rows once a few pages are in, since a node in lazy mode
+	// renders every loaded row — every time an ancestor opens or remounts.
+	let opened: boolean = $state(false)
 
 	// Full path prefix of this node when it's a top-level owner (folder or user).
 	let ownerKey = $derived(
@@ -78,34 +96,85 @@
 					: undefined
 			: undefined
 	)
+	// Full path prefix this node covers, at any depth: the owner at the top level, then
+	// the parent's prefix plus this folder's segment. It is what both `ownerLoad` and the
+	// listing endpoint's `pathStart` are keyed by.
+	let nodePrefix = $derived(
+		depth === 0
+			? ownerKey
+			: parentPrefix != undefined && isFolder(item)
+				? `${parentPrefix}/${item.folderName}`
+				: undefined
+	)
 	// A top-level owner in lazy mode: its items load on demand into a separate store
-	// (ownerLoad tracks per-owner state), so its count/pagination differ from a node
+	// (ownerLoad tracks per-prefix state), so its count/pagination differ from a node
 	// whose items are already grouped from the loaded window.
 	let isLazyOwner = $derived(ownerKey != undefined && ownerLoad != undefined)
 	let ownerState = $derived(ownerKey != undefined ? ownerLoad?.[ownerKey] : undefined)
+	// This node's own load state — set once it has been loaded directly (an owner on
+	// expand, a subfolder only when its "Load more" was used).
+	let nodeState = $derived(nodePrefix != undefined ? ownerLoad?.[nodePrefix] : undefined)
+	// Whether rows under this node are still incomplete: its own pagination once it has
+	// been loaded directly, otherwise whatever its nearest loaded ancestor reports.
+	let nodeHasMore = $derived(nodeState?.loaded ? nodeState.hasMore : ancestorHasMore)
+	// Rows loaded under this node. Its children count a subfolder as one entry, which
+	// would label a folder holding 133 rows in one subfolder as "1 item"; every count this
+	// node shows (badge and pager alike) means leaves, so they can't contradict.
+	let loadedHere = $derived(isFolder(item) || isUser(item) ? countLeaves(item) : 0)
+	// The owner's runnable count alone (no pipeline row), so it lines up with the rows
+	// actually fetched for it — what the partial-load footer compares against. An owner
+	// missing from `ownerCounts` holds nothing (the response omits those), so it reads as
+	// 0 rather than unknown. Floored by what is already rendered under the node: the count
+	// can come in under that (it can miss an item shared individually out of a folder the
+	// viewer isn't in), and a total below the rows beneath it reads as a bug. The owner
+	// chips floor the same way.
+	let ownerTotal = $derived(
+		ownerKey != undefined && ownerCounts != undefined
+			? Math.max(ownerCounts[ownerKey] ?? 0, loadedHere)
+			: undefined
+	)
 	// What this owner renders, known without expanding it. Preferred over the loaded
-	// rows, which are one page deep and count a subfolder as a single child. An owner
-	// missing from `ownerCounts` holds nothing (the response omits those), so it reads
-	// as 0 rather than unknown. The pipeline entry is a row of its own and its member
-	// scripts are excluded from the count, so it adds one where it renders.
-	let ownerCount = $derived.by(() => {
-		if (ownerKey == undefined || ownerCounts == undefined) return undefined
-		return (ownerCounts[ownerKey] ?? 0) + (hasPipeline ? 1 : 0)
-	})
+	// rows, which are one page deep and count a subfolder as a single child. The pipeline
+	// entry is a row of its own and its member scripts are excluded from the count, so it
+	// adds one where it renders.
+	let ownerCount = $derived(
+		ownerTotal != undefined ? ownerTotal + (hasPipeline ? 1 : 0) : undefined
+	)
 
-	let showMax = $state(15)
-	// A lazy owner paginates server-side ("Load more"), so when opened on its own it
-	// shows all its already-loaded rows (no second, confusing client "Show more").
-	// EXCEPT under "expand all" (collapseAll=false), which opens every visible owner at
-	// once — rendering all of each would be thousands of rows and freeze the tab — so
-	// there we cap to the client slice and let "Show more" reveal the rest per owner.
+	// How many children a node renders before "Show more". Kept well above a screenful
+	// so a subfolder's contents don't look truncated, but bounded: under "expand all"
+	// this applies to every open owner at once (see effectiveMax).
+	let showMax = $state(30)
+	// Ceiling on what one node mounts at once. Comfortably past a server page, so the
+	// usual node still shows everything it loaded, but "Load all" can leave thousands of
+	// rows under one prefix and mounting all of them locks up the tab.
+	const LAZY_RENDER_MAX = 500
+	// A node that paginates server-side ("Load more") shows all its already-loaded rows
+	// when opened on its own, so there is one control to reach the rest and not a second,
+	// confusing client "Show more" in front of it. EXCEPT under "expand all"
+	// (collapseAll=false), which opens every visible node at once — rendering all of each
+	// would be thousands of rows and freeze the tab — so there we cap to the client slice
+	// and let "Show more" reveal the rest per node.
 	let effectiveMax = $derived(
-		isLazyOwner && ownerState != undefined && (isFolder(item) || isUser(item))
-			? collapseAll
-				? item.items.length
+		isFolder(item) || isUser(item)
+			? ownerLoad != undefined && nodePrefix != undefined && collapseAll
+				? Math.min(item.items.length, Math.max(showMax, LAZY_RENDER_MAX))
 				: Math.min(item.items.length, showMax)
 			: showMax
 	)
+	// Which of the two footer buttons started the run in flight, so only that one spins: a
+	// "Load all" can take minutes where a "Load more" takes one request.
+	let loadingAll = $state(false)
+	$effect(() => {
+		if (!nodeState?.loading) loadingAll = false
+	})
+	// One "Show more" reveals a slice the size of the ceiling once a node holds more than
+	// that, so thousands of loaded rows don't take hundreds of clicks to unfold. Keyed off
+	// what the node holds rather than what it renders: under "expand all" only the small
+	// client slice is on screen however many rows arrived.
+	let showMoreStep = $derived(
+		(isFolder(item) || isUser(item)) && item.items.length >= LAZY_RENDER_MAX ? LAZY_RENDER_MAX : 30
+	)
 
 	$effect(() => {
 		const expandAll = !collapseAll
@@ -141,7 +210,9 @@
 	// stays registered and every later reload re-fetches it forever. Remounting
 	// re-registers it (see the collapseAll effect above).
 	onDestroy(() => {
-		const key = untrack(() => ownerKey)
+		// nodePrefix, not ownerKey: a subfolder that was loaded directly is tracked under
+		// its own prefix and has to be untracked the same way.
+		const key = untrack(() => nodePrefix)
 		if (key != undefined) onCollapseOwner?.(key)
 	})
 
@@ -155,9 +226,21 @@
 		if (now - lastToggle < 300) return
 		lastToggle = now
 		opened = !opened
-		if (ownerKey != undefined) {
-			if (opened) onExpandOwner?.(ownerKey)
-			else onCollapseOwner?.(ownerKey)
+		if (opened) {
+			// A top-level owner loads on expand. A subfolder's rows come from an ancestor's
+			// pages, so opening one must not fire a request per subfolder — its own "Load
+			// more" is the explicit way to complete it. One exception, and it costs nothing:
+			// a subfolder that has paged itself — `nodeState` exists once it has, including
+			// while that first load is still in flight — re-registers so later reloads keep
+			// refreshing the rows it is showing, instead of letting a parent refresh silently
+			// truncate them. loadOwnerItems starts no second request for either state.
+			if (nodePrefix != undefined && (ownerKey != undefined || nodeState != undefined))
+				onExpandOwner?.(nodePrefix)
+		} else if (nodePrefix != undefined) {
+			// Any depth: a closed node stays mounted, so without this a subfolder that
+			// had paged itself would keep being re-fetched by every later reload while
+			// none of its rows are on screen.
+			onCollapseOwner?.(nodePrefix)
 		}
 	}
 </script>
@@ -195,10 +278,13 @@
 							<!-- Lazy owner not expanded yet and no count for it: its true item count
 							     is unknown until loaded, so showing "(0 items)" would be misleading. -->
 							&nbsp;
-						{:else if isLazyOwner && ownerState?.hasMore}
-							({item.items.length}+ items)
+						{:else if nodeHasMore}
+							<!-- Partial: this node still has pages to load (its own once it has been
+							     loaded directly, otherwise its ancestor's), so what is grouped under
+							     it is only what has arrived so far. -->
+							({loadedHere}+ items)
 						{:else}
-							({pluralize(item.items.length, ' item')})
+							({pluralize(loadedHere, ' item')})
 						{/if}
 					</div>
 				</div>
@@ -232,43 +318,94 @@
 						{collapseAll}
 						item={subItem}
 						{pipelineFolders}
+						{ownerLoad}
+						{onExpandOwner}
+						{onCollapseOwner}
+						parentPrefix={nodePrefix}
+						ancestorHasMore={nodeHasMore}
 						on:scriptChanged
 						on:flowChanged
 						on:appChanged
 						on:rawAppChanged
 						on:reload
 						{showCode}
+						{showEditButton}
 						depth={depth + 1}
 					/>
 				{/each}
 				{#if effectiveMax < item.items.length}
-					<!-- svelte-ignore a11y_click_events_have_key_events -->
-					<!-- svelte-ignore a11y_no_static_element_interactions -->
 					<div
-						class="text-center text-xs py-2 text-secondary cursor-pointer hover:text-primary"
-						onclick={() => {
-							showMax += Math.min(30, item.items.length - showMax)
-						}}
+						class="px-4 py-2 border-b flex flex-row items-center justify-between gap-4 bg-surface-secondary"
+						style="padding-left: {(depth + 1) * 16}px;"
 					>
-						Show more ({showMax}/{item.items.length})
+						<!-- Rows, not items: this slices the node's own entries, where a subfolder
+						     is one row standing for everything under it. -->
+						<span class="text-xs text-secondary">
+							Showing {effectiveMax} of {item.items.length} loaded rows
+						</span>
+						<Button
+							unifiedSize="sm"
+							variant="subtle"
+							on:click={() => {
+								// Grown from what is rendered, not from showMax: the lazy ceiling can
+								// already be showing more than showMax, and stepping that would take
+								// several clicks to change anything on screen.
+								showMax = Math.min(item.items.length, effectiveMax + showMoreStep)
+							}}
+						>
+							Show more
+						</Button>
 					</div>
 				{/if}
-				{#if ownerKey != undefined}
-					{#if ownerState?.loading && item.items.length === 0}
+				{#if nodePrefix != undefined && ownerLoad != undefined}
+					{#if nodeState?.loading && item.items.length === 0}
 						<!-- Show the spinner only on the first load, when there's nothing yet. A
 						     re-sort/re-filter re-fetch keeps the old rows visible and swaps them
 						     in place, so flashing "Loading…" under them would just be noise. -->
 						<div class="text-center text-xs py-2 text-secondary">Loading…</div>
-					{:else if !ownerState?.loading && ownerState?.hasMore && effectiveMax >= item.items.length}
-						<!-- Fetch the next server page only once every already-loaded row is shown
-						     (in "expand all" the client "Show more" above reveals those first). -->
-						<!-- svelte-ignore a11y_click_events_have_key_events -->
-						<!-- svelte-ignore a11y_no_static_element_interactions -->
+					{:else if nodeHasMore && (collapseAll || nodeState?.loading || effectiveMax >= item.items.length)}
+						<!-- Every folder pages within its own prefix, so completing a subfolder
+						     doesn't mean paging everything its owner holds. Under "expand all" this
+						     waits for the client "Show more" above, so the two pagers don't stack
+						     under every open node at once — but never while loading, or a long run
+						     would unmount its own spinner on its first page. Spelling out the counts
+						     is the point: without them this reads as an optional extra rather than
+						     as rows still missing. -->
 						<div
-							class="text-center text-xs py-2 text-primary cursor-pointer hover:text-emphasis"
-							onclick={() => ownerKey != undefined && onExpandOwner?.(ownerKey, true)}
+							class="px-4 py-2 border-b flex flex-row items-center justify-between gap-4 bg-surface-secondary"
+							style="padding-left: {(depth + 1) * 16}px;"
 						>
-							Load more in {ownerKey} ({ownerState?.count ?? item.items.length} loaded)
+							<span class="text-xs text-secondary">
+								Showing {loadedHere}{ownerTotal != undefined ? ` of ${ownerTotal}` : ''} items in {nodePrefix}
+							</span>
+							<div class="flex flex-row items-center gap-2 shrink-0">
+								<Button
+									unifiedSize="sm"
+									variant="subtle"
+									loading={nodeState?.loading && !loadingAll}
+									disabled={nodeState?.loading}
+									on:click={() =>
+										nodePrefix != undefined &&
+										onExpandOwner?.(nodePrefix, nodeState?.loaded ?? false)}
+								>
+									Load more
+								</Button>
+								<!-- Same call, paged to the end: a folder several pages deep otherwise
+								     takes a click per page to reach an exact count. -->
+								<Button
+									unifiedSize="sm"
+									variant="subtle"
+									loading={nodeState?.loading && loadingAll}
+									disabled={nodeState?.loading}
+									on:click={() => {
+										if (nodePrefix == undefined) return
+										loadingAll = true
+										onExpandOwner?.(nodePrefix, nodeState?.loaded ?? false, { all: true })
+									}}
+								>
+									Load all
+								</Button>
+							</div>
 						</div>
 					{/if}
 				{/if}
@@ -279,6 +416,7 @@
 	<Item
 		{item}
 		{showCode}
+		{showEditButton}
 		on:scriptChanged
 		on:flowChanged
 		on:appChanged
diff --git a/frontend/src/lib/components/home/TreeViewRoot.svelte b/frontend/src/lib/components/home/TreeViewRoot.svelte
index da3ad985eb..39c2188e59 100644
--- a/frontend/src/lib/components/home/TreeViewRoot.svelte
+++ b/frontend/src/lib/components/home/TreeViewRoot.svelte
@@ -2,11 +2,11 @@
 	import { untrack } from 'svelte'
 	import TreeView from './TreeView.svelte'
 	import { groupItems, type ItemType } from './treeViewUtils'
+	import { Button } from '$lib/components/common'
 
 	interface Props {
 		collapseAll: boolean
 		showCode: (path: string, summary: string) => void
-		nbDisplayed: number
 		items: ItemType[] | undefined
 		isSearching?: boolean
 		pipelineFolders?: Set<string>
@@ -33,16 +33,16 @@
 		selfUsername?: string
 		ownerLoad?: Record<
 			string,
-			{ cursor?: string; hasMore: boolean; loading: boolean; loaded: boolean; count: number }
+			{ cursor?: string; hasMore: boolean; loading: boolean; loaded: boolean }
 		>
-		onExpandOwner?: (owner: string, more?: boolean) => void
+		onExpandOwner?: (owner: string, more?: boolean, opts?: { all?: boolean }) => void
 		onCollapseOwner?: (owner: string) => void
+		showEditButton?: boolean
 	}
 
 	let {
 		collapseAll,
 		showCode,
-		nbDisplayed = $bindable(),
 		items,
 		isSearching = false,
 		pipelineFolders,
@@ -56,9 +56,21 @@
 		selfUsername,
 		ownerLoad,
 		onExpandOwner,
-		onCollapseOwner
+		onCollapseOwner,
+		showEditButton = true
 	}: Props = $props()
 
+	// How many root nodes render at once. A root node is a collapsed owner row that
+	// fetches nothing until expanded, so a large slice costs a row each and no request
+	// — and an owner sliced off the end is indistinguishable from one that doesn't
+	// exist, so keep it well above the number of folders a workspace typically has.
+	const ROOT_PAGE = 100
+	// Ceiling on what scrolling alone reveals: root rows aren't virtualized, so on a
+	// workspace with thousands of owners one long scroll gesture would otherwise mount
+	// every one of them. Past this the footer stays put and its button reveals the rest.
+	const AUTO_REVEAL_LIMIT = 500
+	let nbDisplayed = $state(ROOT_PAGE)
+
 	let groupedItems: ReturnType<typeof groupItems> | 'loading' = $state('loading')
 	$effect(() => {
 		items
@@ -140,6 +152,29 @@
 			groupedItems = grouped
 		})
 	})
+
+	let footerEl: HTMLDivElement | undefined = $state()
+	// Reveal the next slice of root nodes as the footer comes into view. Only the
+	// client-side slice auto-grows — those nodes are already grouped and render
+	// collapsed, so this issues no request; paging the server stays behind the button.
+	$effect(() => {
+		const el = footerEl
+		if (!el) return
+		const observer = new IntersectionObserver((entries) => {
+			if (!entries.some((e) => e.isIntersecting)) return
+			const grouped = groupedItems
+			if (!Array.isArray(grouped) || nbDisplayed >= grouped.length) return
+			if (nbDisplayed >= AUTO_REVEAL_LIMIT) return
+			nbDisplayed = Math.min(nbDisplayed + ROOT_PAGE, grouped.length)
+			// Revealing more doesn't change whether the footer intersects, so no further
+			// callback would fire and scrolling would stall with rows left unrevealed.
+			// Re-observing re-delivers the current intersection after the rows render.
+			observer.unobserve(el)
+			observer.observe(el)
+		})
+		observer.observe(el)
+		return () => observer.disconnect()
+	})
 </script>
 
 {#if groupedItems === 'loading'}
@@ -162,6 +197,7 @@
 					{item}
 					{pipelineFolders}
 					{ownerCounts}
+					ancestorHasMore={hasMoreServer}
 					{ownerLoad}
 					{onExpandOwner}
 					{onCollapseOwner}
@@ -171,22 +207,38 @@
 					on:rawAppChanged
 					on:reload
 					{showCode}
+					{showEditButton}
 				/>
 			{/if}
 		{/each}
+		{#if nbDisplayed < groupedItems.length || hasMoreServer}
+			<!-- Last row of the tree's own frame, not a caption under it: what is missing
+			     has to read as part of the list to be noticed at all. -->
+			<div
+				bind:this={footerEl}
+				class="px-4 py-3 flex flex-row items-center justify-between gap-4 bg-surface-secondary"
+			>
+				<span class="text-xs text-secondary">
+					{#if nbDisplayed < groupedItems.length}
+						Showing {nbDisplayed} of {groupedItems.length} folders and users
+					{:else}
+						<!-- Scoped to one owner: the tree groups the paged browse stream, so what
+						     is missing is items, not root nodes. -->
+						Not all items are loaded yet
+					{/if}
+				</span>
+				<Button
+					unifiedSize="sm"
+					variant="subtle"
+					on:click={() => {
+						if (nbDisplayed < groupedItems.length)
+							nbDisplayed = Math.min(nbDisplayed + ROOT_PAGE, groupedItems.length)
+						else onLoadMore?.()
+					}}
+				>
+					{nbDisplayed < groupedItems.length ? 'Show more' : 'Load more'}
+				</Button>
+			</div>
+		{/if}
 	</div>
-	{#if nbDisplayed < groupedItems.length || hasMoreServer}
-		<span class="text-xs font-normal text-secondary"
-			>{Math.min(nbDisplayed, groupedItems.length)} root nodes{hasMoreServer
-				? ''
-				: ` out of ${groupedItems.length}`}
-			<button
-				class="ml-4 text-xs font-normal text-primary hover:text-emphasis"
-				onclick={() => {
-					if (nbDisplayed < groupedItems.length) nbDisplayed += 30
-					else onLoadMore?.()
-				}}>load 30 more</button
-			></span
-		>
-	{/if}
 {/if}
diff --git a/frontend/src/lib/components/home/bulkActions.test.ts b/frontend/src/lib/components/home/bulkActions.test.ts
new file mode 100644
index 0000000000..4710019671
--- /dev/null
+++ b/frontend/src/lib/components/home/bulkActions.test.ts
@@ -0,0 +1,78 @@
+import { describe, it, expect } from 'vitest'
+import { blockedReason, movedPath, type BulkContext } from './bulkActions'
+import type { BulkItem } from './homeSelection.svelte'
+
+/** A fully-permitted, deployed row; each case overrides only what it is about. */
+function item(over: Partial<BulkItem> = {}): BulkItem {
+	return {
+		key: 'script/f/alpha/x',
+		kind: 'script',
+		path: 'f/alpha/x',
+		displayPath: 'f/alpha/x',
+		summary: '',
+		canWrite: true,
+		owner: true,
+		archived: false,
+		draftOnly: false,
+		isDraft: false,
+		rawApp: false,
+		...over
+	}
+}
+
+const admin: BulkContext = { workspace: 'w', isAdmin: true }
+const member: BulkContext = { workspace: 'w', isAdmin: false }
+
+// Each action's gate has to keep matching what the equivalent per-row menu entry
+// allows (common/table/{Script,Flow,App}Row.svelte, MoveDrawer.svelte) — a bulk
+// action that drifts looser than the single-row one is a permission hole.
+describe('blockedReason', () => {
+	it('lets a fully-permitted deployed row through every action it applies to', () => {
+		expect(blockedReason('move', item(), admin)).toBeUndefined()
+		expect(blockedReason('archive', item(), admin)).toBeUndefined()
+		expect(blockedReason('delete', item(), admin)).toBeUndefined()
+		expect(blockedReason('unarchive', item({ archived: true }), admin)).toBeUndefined()
+		expect(blockedReason('discard', item({ isDraft: true }), admin)).toBeUndefined()
+	})
+
+	it('gates delete per kind: script needs admin, flow needs owner, app needs write', () => {
+		expect(blockedReason('delete', item({ kind: 'script' }), member)).toBeDefined()
+		expect(blockedReason('delete', item({ kind: 'flow', owner: false }), member)).toBeDefined()
+		expect(blockedReason('delete', item({ kind: 'flow' }), member)).toBeUndefined()
+		// An app is deletable without ownership, matching AppRow's `disabled: !canEdit`.
+		expect(blockedReason('delete', item({ kind: 'app', owner: false }), member)).toBeUndefined()
+		expect(blockedReason('delete', item({ kind: 'app', canWrite: false }), member)).toBeDefined()
+	})
+
+	it('requires ownership to move, and refuses archived rows', () => {
+		expect(blockedReason('move', item({ owner: false }), admin)).toBeDefined()
+		expect(blockedReason('move', item({ canWrite: false }), admin)).toBeDefined()
+		expect(blockedReason('move', item({ archived: true }), admin)).toBeDefined()
+	})
+
+	it('archives only scripts and flows, and only in the matching state', () => {
+		expect(blockedReason('archive', item({ kind: 'app' }), admin)).toBeDefined()
+		expect(blockedReason('archive', item({ archived: true }), admin)).toBeDefined()
+		expect(blockedReason('unarchive', item({ archived: false }), admin)).toBeDefined()
+	})
+
+	it('routes a draft-only row to discard, never to move/archive/delete', () => {
+		const draftOnly = item({ draftOnly: true, isDraft: true })
+		expect(blockedReason('discard', draftOnly, admin)).toBeUndefined()
+		expect(blockedReason('move', draftOnly, admin)).toBeDefined()
+		expect(blockedReason('archive', draftOnly, admin)).toBeDefined()
+		expect(blockedReason('delete', draftOnly, admin)).toBeDefined()
+	})
+
+	it('has nothing to discard on a row with no draft of yours', () => {
+		expect(blockedReason('discard', item(), admin)).toBeDefined()
+	})
+})
+
+describe('movedPath', () => {
+	it('keeps everything below the owner prefix, so nested paths keep their shape', () => {
+		expect(movedPath(item({ path: 'f/alpha/x' }), 'f/beta')).toBe('f/beta/x')
+		expect(movedPath(item({ path: 'f/alpha/sub/x' }), 'f/beta')).toBe('f/beta/sub/x')
+		expect(movedPath(item({ path: 'u/ana/x' }), 'f/beta')).toBe('f/beta/x')
+	})
+})
diff --git a/frontend/src/lib/components/home/bulkActions.ts b/frontend/src/lib/components/home/bulkActions.ts
new file mode 100644
index 0000000000..161ddb0d72
--- /dev/null
+++ b/frontend/src/lib/components/home/bulkActions.ts
@@ -0,0 +1,168 @@
+/**
+ * Bulk operations behind the Home page's selection bar. Each runner performs
+ * exactly what the matching per-row menu entry does, once per selected item, so
+ * a batch can never take a path the single-row action wouldn't.
+ *
+ * Delete and discard stay distinct: discarding a draft on a deployed item only
+ * removes the draft, discarding a draft-only item removes the item, and deleting
+ * addresses the deployed row. A draft-only item is therefore not deletable —
+ * there is nothing deployed at its path.
+ */
+import { AppService, FlowService, ScriptService } from '$lib/gen'
+import { updateItemPathAndSummary } from '$lib/components/moveRenameManager'
+import { discardDraft } from '$lib/utils_draft_deploy'
+import type { BulkItem } from './homeSelection.svelte'
+
+export type BulkAction = 'move' | 'archive' | 'unarchive' | 'delete' | 'discard'
+
+export type BulkContext = {
+	workspace: string
+	/** Deleting a script is admin-only, mirroring the row menu. */
+	isAdmin: boolean
+}
+
+/** Why `action` cannot be applied to `item`; `undefined` means it can. The
+ * string is surfaced verbatim, so it has to say whether the limit comes from
+ * permissions, the item's kind, or its state. */
+export function blockedReason(
+	action: BulkAction,
+	item: BulkItem,
+	ctx: BulkContext
+): string | undefined {
+	const notOwner = 'you are not an owner of this path'
+	switch (action) {
+		case 'move':
+			if (item.draftOnly) return 'a draft-only item has no deployed path to move'
+			if (item.archived) return 'archived items cannot be moved'
+			if (!item.owner) return notOwner
+			if (!item.canWrite) return 'you do not have write permission on this path'
+			return undefined
+		case 'archive':
+		case 'unarchive':
+			if (item.kind !== 'script' && item.kind !== 'flow')
+				return 'only scripts and flows can be archived'
+			if (item.draftOnly) return 'a draft-only item has nothing deployed to archive'
+			if (!item.owner) return notOwner
+			if (!item.canWrite) return 'you do not have write permission on this path'
+			if (action === 'archive' && item.archived) return 'already archived'
+			if (action === 'unarchive' && !item.archived) return 'not archived'
+			return undefined
+		case 'delete':
+			if (item.draftOnly) return 'a draft-only item is removed by discarding its draft'
+			if (item.kind === 'script' && !ctx.isAdmin)
+				return 'deleting a script requires being a workspace admin'
+			if (item.kind === 'flow' && !item.owner) return notOwner
+			if (!item.canWrite) return 'you do not have write permission on this path'
+			return undefined
+		case 'discard':
+			if (!item.isDraft && !item.draftOnly) return 'no draft of yours on this item'
+			return undefined
+	}
+}
+
+export function eligible(action: BulkAction, items: BulkItem[], ctx: BulkContext): BulkItem[] {
+	return items.filter((i) => blockedReason(action, i, ctx) == undefined)
+}
+
+/** Where an item lands under `target` (`f/<folder>` or `u/<user>`): everything
+ * below its own owner prefix is preserved, so nested paths keep their shape. */
+export function movedPath(item: BulkItem, target: string): string {
+	const rest = item.path.split('/').slice(2).join('/')
+	return `${target}/${rest}`
+}
+
+async function moveItem(ctx: BulkContext, item: BulkItem, target: string): Promise<void> {
+	const newPath = movedPath(item, target)
+	// Re-saving a script at its current path would mint a pointless new version.
+	if (newPath === item.path) return
+	await updateItemPathAndSummary({
+		workspace: ctx.workspace,
+		kind: item.kind,
+		initialPath: item.path,
+		newPath,
+		newSummary: item.summary
+	})
+}
+
+async function setArchived(ctx: BulkContext, item: BulkItem, archived: boolean): Promise<void> {
+	if (item.kind === 'flow') {
+		await FlowService.archiveFlowByPath({
+			workspace: ctx.workspace,
+			path: item.path,
+			requestBody: { archived }
+		})
+		return
+	}
+	if (archived) {
+		await ScriptService.archiveScriptByPath({ workspace: ctx.workspace, path: item.path })
+		return
+	}
+	// Scripts have no unarchive route: redeploying the current version as its own
+	// child clears the flag, exactly as the row menu does.
+	const r = await ScriptService.getScriptByPath({ workspace: ctx.workspace, path: item.path })
+	await ScriptService.createScript({
+		workspace: ctx.workspace,
+		requestBody: { ...r, parent_hash: r.hash, lock: r.lock }
+	})
+}
+
+async function deleteItem(ctx: BulkContext, item: BulkItem): Promise<void> {
+	if (item.kind === 'script') {
+		await ScriptService.deleteScriptByPath({ workspace: ctx.workspace, path: item.path })
+	} else if (item.kind === 'flow') {
+		await FlowService.deleteFlowByPath({ workspace: ctx.workspace, path: item.path })
+	} else {
+		await AppService.deleteApp({ workspace: ctx.workspace, path: item.path })
+	}
+}
+
+async function discardItemDraft(ctx: BulkContext, item: BulkItem): Promise<void> {
+	// The draft overlay is the one place a raw app is its own kind.
+	const kind = item.kind === 'app' && item.rawApp ? 'raw_app' : item.kind
+	// invalidate=false: the caller refreshes the draft list once for the batch.
+	const res = await discardDraft(kind, item.path, ctx.workspace, item.draftOnly, false, false)
+	if (!res.success) throw new Error(res.error ?? 'discard failed')
+}
+
+export type BulkOutcome = { item: BulkItem; error?: string }
+
+/**
+ * Apply `action` to each item in turn, never aborting the batch on a failure —
+ * every item gets its own outcome so partial success is reported rather than
+ * hidden. `onProgress` is called after each item with the number completed.
+ */
+export async function runBulk(
+	action: BulkAction,
+	items: BulkItem[],
+	ctx: BulkContext,
+	opts: { target?: string; onProgress?: (done: number) => void } = {}
+): Promise<BulkOutcome[]> {
+	const outcomes: BulkOutcome[] = []
+	for (const item of items) {
+		try {
+			switch (action) {
+				case 'move':
+					if (!opts.target) throw new Error('no target folder')
+					await moveItem(ctx, item, opts.target)
+					break
+				case 'archive':
+					await setArchived(ctx, item, true)
+					break
+				case 'unarchive':
+					await setArchived(ctx, item, false)
+					break
+				case 'delete':
+					await deleteItem(ctx, item)
+					break
+				case 'discard':
+					await discardItemDraft(ctx, item)
+					break
+			}
+			outcomes.push({ item })
+		} catch (e: any) {
+			outcomes.push({ item, error: e?.body ?? e?.message ?? String(e) })
+		}
+		opts.onProgress?.(outcomes.length)
+	}
+	return outcomes
+}
diff --git a/frontend/src/lib/components/home/homeSelection.svelte.ts b/frontend/src/lib/components/home/homeSelection.svelte.ts
new file mode 100644
index 0000000000..fa755aabb3
--- /dev/null
+++ b/frontend/src/lib/components/home/homeSelection.svelte.ts
@@ -0,0 +1,195 @@
+/**
+ * Multi-selection state for the Home page, shared by the flat list and the tree
+ * view. `ItemsList` owns the instance and publishes it through context; each
+ * `Item` reads it to render its row's selection affordance, so the state doesn't
+ * have to be threaded through `TreeViewRoot`/`TreeView`.
+ */
+import { getContext, setContext } from 'svelte'
+import { SvelteMap } from 'svelte/reactivity'
+import { isOwner } from '$lib/utils'
+import { effectivePath } from './treeViewUtils'
+import type { UserExt } from '$lib/stores'
+
+/** A raw app is not a kind of its own here: the listing returns it as an `app`
+ * row carrying `raw_app`, which every action addresses through `BulkItem.rawApp`
+ * (only the draft overlay distinguishes the two). */
+export type BulkKind = 'script' | 'flow' | 'app'
+
+/** The flattened row facts every bulk action needs, snapshotted at selection
+ * time so an action still knows what it is acting on after the list reloads. */
+export type BulkItem = {
+	key: string
+	kind: BulkKind
+	/** Storage path — what every API call addresses. */
+	path: string
+	/** What the row shows: a draft-only item is parked at a generated path but
+	 * named by the path typed in the editor. */
+	displayPath: string
+	summary: string
+	canWrite: boolean
+	owner: boolean
+	archived: boolean
+	draftOnly: boolean
+	/** The authed user has a draft at this path (the listing only flags their own). */
+	isDraft: boolean
+	rawApp: boolean
+}
+
+type RawItem = {
+	type?: string
+	path: string
+	summary?: string
+	canWrite?: boolean
+	archived?: boolean
+	draft_only?: boolean | null
+	draft_path?: string | null
+	is_draft?: boolean
+	raw_app?: boolean
+}
+
+/** Row identity for selection. Deliberately hash-free: archiving or renaming
+ * mints a new script hash, and a key that moved would orphan the selection. */
+export function bulkKey(item: { type?: string; path: string }): string {
+	return `${item.type}/${item.path}`
+}
+
+export function toBulkItem(
+	item: RawItem,
+	user: UserExt | undefined,
+	workspace: string | undefined
+): BulkItem {
+	return {
+		key: bulkKey(item),
+		kind: (item.type ?? 'script') as BulkKind,
+		path: item.path,
+		displayPath: effectivePath(item),
+		summary: item.summary ?? '',
+		canWrite: item.canWrite ?? false,
+		owner: isOwner(item.path, user, workspace),
+		archived: item.archived ?? false,
+		draftOnly: !!item.draft_only,
+		isDraft: !!item.is_draft,
+		rawApp: !!item.raw_app
+	}
+}
+
+export class HomeSelection {
+	/** The page offers multi-selection at all (never to an operator, and not on
+	 * the embedded read-only variants of the list). */
+	available = $state(false)
+	/** Selection mode is on even with nothing selected yet — entered from the
+	 * toolbar, so every row reveals its checkbox before the first pick. */
+	private explicit = $state(false)
+	private selected = new SvelteMap<string, BulkItem>()
+	/** Every rendered selectable row, so a shift-click range can resolve the keys
+	 * between the anchor and the clicked row back to items. */
+	private registry = new SvelteMap<string, BulkItem>()
+	private anchor: string | undefined = undefined
+
+	get active(): boolean {
+		return this.available && (this.explicit || this.selected.size > 0)
+	}
+
+	get size(): number {
+		return this.selected.size
+	}
+
+	get items(): BulkItem[] {
+		return [...this.selected.values()]
+	}
+
+	has(key: string): boolean {
+		return this.selected.has(key)
+	}
+
+	/** Keys of the rows currently on screen. */
+	get renderedKeys(): Set<string> {
+		return new Set(this.registry.keys())
+	}
+
+	/**
+	 * Drop selections whose row was on screen before a reload and is gone after it —
+	 * deleted, or moved to a new path and so a new key. A row that was never on
+	 * screen is left alone: a selection deliberately survives narrowing the view, so
+	 * absence there is not evidence the item is gone.
+	 */
+	dropVanished(renderedBefore: Set<string>): void {
+		for (const key of [...this.selected.keys()]) {
+			if (renderedBefore.has(key) && !this.registry.has(key)) this.selected.delete(key)
+		}
+		if (this.selected.size === 0) this.anchor = undefined
+	}
+
+	register(item: BulkItem): void {
+		this.registry.set(item.key, item)
+		// Refresh the snapshot of an already-selected row too: the per-row menu stays
+		// usable during a selection and every action reloads the list, so a row that
+		// was archived or lost write access meanwhile must not keep passing the
+		// eligibility gates on its stale copy.
+		if (this.selected.has(item.key)) this.selected.set(item.key, item)
+	}
+
+	unregister(key: string): void {
+		this.registry.delete(key)
+	}
+
+	enter(): void {
+		this.explicit = true
+	}
+
+	exit(): void {
+		this.explicit = false
+		this.selected.clear()
+		this.anchor = undefined
+	}
+
+	/** Keep only these keys selected (a bulk run leaves its failures ticked so
+	 * they can be retried); an empty result leaves selection mode entirely. */
+	keepOnly(keys: string[]): void {
+		const keep = new Set(keys)
+		for (const key of [...this.selected.keys()]) {
+			if (!keep.has(key)) this.selected.delete(key)
+		}
+		if (this.selected.size === 0) this.exit()
+		else this.anchor = undefined
+	}
+
+	toggle(item: BulkItem, range = false): void {
+		this.explicit = true
+		if (range && this.anchor != undefined && this.anchor !== item.key) {
+			if (this.selectRange(this.anchor, item.key)) return
+		}
+		if (this.selected.has(item.key)) this.selected.delete(item.key)
+		else this.selected.set(item.key, item)
+		this.anchor = item.key
+	}
+
+	/** Visual order is read back from the DOM: the tree nests rows and pages them
+	 * in lazily, so no single array holds the rendered order of both views.
+	 * Returns false when either end is off-screen, so the caller falls back to a
+	 * plain toggle rather than selecting an arbitrary span. */
+	private selectRange(from: string, to: string): boolean {
+		const keys = Array.from(document.querySelectorAll<HTMLElement>('[data-row-selection-key]')).map(
+			(el) => el.dataset.rowSelectionKey ?? ''
+		)
+		const a = keys.indexOf(from)
+		const b = keys.indexOf(to)
+		if (a < 0 || b < 0) return false
+		for (const key of keys.slice(Math.min(a, b), Math.max(a, b) + 1)) {
+			const it = this.registry.get(key)
+			if (it) this.selected.set(key, it)
+		}
+		this.anchor = to
+		return true
+	}
+}
+
+const HOME_SELECTION_KEY = 'homeSelection'
+
+export function setHomeSelection(selection: HomeSelection): void {
+	setContext(HOME_SELECTION_KEY, selection)
+}
+
+export function getHomeSelection(): HomeSelection | undefined {
+	return getContext<HomeSelection | undefined>(HOME_SELECTION_KEY)
+}
diff --git a/frontend/src/lib/components/home/homeSelection.test.ts b/frontend/src/lib/components/home/homeSelection.test.ts
new file mode 100644
index 0000000000..1daf18563e
--- /dev/null
+++ b/frontend/src/lib/components/home/homeSelection.test.ts
@@ -0,0 +1,83 @@
+import { describe, it, expect } from 'vitest'
+import { HomeSelection, type BulkItem } from './homeSelection.svelte'
+
+function bulk(key: string, over: Partial<BulkItem> = {}): BulkItem {
+	return {
+		key,
+		kind: 'script',
+		path: key.split('/').slice(1).join('/'),
+		displayPath: key.split('/').slice(1).join('/'),
+		summary: '',
+		canWrite: true,
+		owner: true,
+		archived: false,
+		draftOnly: false,
+		isDraft: false,
+		rawApp: false,
+		...over
+	}
+}
+
+function selectionOf(...items: BulkItem[]): HomeSelection {
+	const s = new HomeSelection()
+	s.available = true
+	for (const i of items) {
+		s.register(i)
+		s.toggle(i)
+	}
+	return s
+}
+
+// A row can be moved or deleted from its own menu while a selection is active,
+// and a bulk action addressing the dead path afterwards is the failure mode.
+describe('HomeSelection.dropVanished', () => {
+	it('drops a selected row that was on screen before the reload and is gone after', () => {
+		const a = bulk('script/f/a/one')
+		const b = bulk('script/f/a/two')
+		const s = selectionOf(a, b)
+		const before = s.renderedKeys
+
+		// `b` was deleted: its row unmounts and does not come back.
+		s.unregister(b.key)
+		s.dropVanished(before)
+
+		expect(s.items.map((i) => i.key)).toEqual([a.key])
+	})
+
+	it('re-keys a moved row: the old key goes, the new one is a fresh selection', () => {
+		const a = bulk('script/f/a/one')
+		const s = selectionOf(a)
+		const before = s.renderedKeys
+
+		// A move changes the path, hence the key — the row comes back as a new one.
+		s.unregister(a.key)
+		s.register(bulk('script/f/b/one'))
+		s.dropVanished(before)
+
+		expect(s.items).toEqual([])
+	})
+
+	it('keeps a selected row that was never on screen', () => {
+		// Selections survive narrowing the view, so a row absent from the reload is
+		// not evidence that it is gone.
+		const offScreen = bulk('script/f/other/one')
+		const s = selectionOf(offScreen)
+		s.unregister(offScreen.key)
+
+		s.dropVanished(new Set())
+
+		expect(s.items.map((i) => i.key)).toEqual([offScreen.key])
+	})
+})
+
+describe('HomeSelection.register', () => {
+	it('refreshes the snapshot of an already-selected row', () => {
+		const item = bulk('script/f/a/one')
+		const s = selectionOf(item)
+
+		// The row was archived from its own menu and re-rendered.
+		s.register(bulk('script/f/a/one', { archived: true }))
+
+		expect(s.items[0].archived).toBe(true)
+	})
+})
diff --git a/frontend/src/lib/components/home/treeViewUtils.ts b/frontend/src/lib/components/home/treeViewUtils.ts
index 6103096547..2196d19409 100644
--- a/frontend/src/lib/components/home/treeViewUtils.ts
+++ b/frontend/src/lib/components/home/treeViewUtils.ts
@@ -42,6 +42,14 @@ export function effectivePath(item: {
 	return (item.draft_only && item.draft_path) || item.path
 }
 
+/** Rows loaded under a node, counting nested subfolders' rows rather than the subfolder
+ *  as one child — what "N items are on screen here" means to someone reading the tree. */
+export function countLeaves(node: FolderItem | UserItem): number {
+	let n = 0
+	for (const child of node.items) n += 'items' in child ? countLeaves(child) : 1
+	return n
+}
+
 function insertItemInFolder(
 	root: (ItemType | FolderItem | UserItem)[],
 	item: ItemType,
diff --git a/frontend/src/lib/components/icons/AssetGenericIcon.svelte b/frontend/src/lib/components/icons/AssetGenericIcon.svelte
index 1e10f38d8a..4f60b75280 100644
--- a/frontend/src/lib/components/icons/AssetGenericIcon.svelte
+++ b/frontend/src/lib/components/icons/AssetGenericIcon.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-	import { BoxesIcon, DatabaseIcon, FileIcon, HardDriveIcon, Pyramid } from 'lucide-svelte'
+	import { BoxesIcon, DatabaseIcon, FileIcon, HardDriveIcon, Pyramid, Table2 } from 'lucide-svelte'
 	import type { AssetKind } from '../assets/lib'
 	import DucklakeIcon from './DucklakeIcon.svelte'
 
@@ -22,6 +22,8 @@
 	<BoxesIcon {size} class={className} />
 {:else if assetKind == 'volume'}
 	<HardDriveIcon {size} class={className} />
+{:else if assetKind == 'dbt'}
+	<Table2 {size} class={className} />
 {:else}
 	<Pyramid {size} class={className} />
 {/if}
diff --git a/frontend/src/lib/components/icons/DbtIcon.svelte b/frontend/src/lib/components/icons/DbtIcon.svelte
new file mode 100644
index 0000000000..b647cb215e
--- /dev/null
+++ b/frontend/src/lib/components/icons/DbtIcon.svelte
@@ -0,0 +1,27 @@
+<script lang="ts">
+	interface Props {
+		height?: number
+		width?: number
+	}
+
+	let { height = 24, width = 24 }: Props = $props()
+</script>
+
+<svg
+	xmlns="http://www.w3.org/2000/svg"
+	{width}
+	{height}
+	viewBox="0 0 256 256"
+	preserveAspectRatio="xMidYMid"
+	role="img"
+	aria-label="dbt"
+>
+	<circle cx="128" cy="128" r="120" fill="#FF694A" />
+	<!-- The three crossing bars of the dbt mark. -->
+	<g stroke="#fff" stroke-width="26" stroke-linecap="round">
+		<line x1="128" y1="52" x2="128" y2="204" />
+		<line x1="62" y1="90" x2="194" y2="166" />
+		<line x1="62" y1="166" x2="194" y2="90" />
+	</g>
+	<circle cx="128" cy="128" r="30" fill="#FF694A" />
+</svg>
diff --git a/frontend/src/lib/components/icons/index.ts b/frontend/src/lib/components/icons/index.ts
index d6ac00a755..194d1392fe 100644
--- a/frontend/src/lib/components/icons/index.ts
+++ b/frontend/src/lib/components/icons/index.ts
@@ -275,6 +275,7 @@ export const APP_TO_ICON_COMPONENT = {
 	appwrite: AppwriteIcon,
 	linkding: LinkdingIconSvelte,
 	aws: AwsIcon,
+	redshift: AwsIcon,
 	microsoft: MicrosoftIcon,
 	bcrypt: BcryptIcon,
 	google: GoogleIcon,
diff --git a/frontend/src/lib/components/instanceSettings.ts b/frontend/src/lib/components/instanceSettings.ts
index ee2ef823ba..603021ab74 100644
--- a/frontend/src/lib/components/instanceSettings.ts
+++ b/frontend/src/lib/components/instanceSettings.ts
@@ -1291,6 +1291,13 @@ export function extractMarkedLabel(marked: string | undefined, labelLength: numb
 		if (marked[markedIdx] === '<') {
 			while (markedIdx < marked.length && marked[markedIdx] !== '>') markedIdx++
 			markedIdx++
+		} else if (marked[markedIdx] === '&') {
+			// SearchItems escapes the haystack, so one plain character can arrive
+			// as an entity. Skipping the whole entity keeps this offset walk in
+			// step with `labelLength`, which counts unescaped characters.
+			const end = marked.indexOf(';', markedIdx)
+			markedIdx = end === -1 ? markedIdx + 1 : end + 1
+			plainIdx++
 		} else {
 			plainIdx++
 			markedIdx++
diff --git a/frontend/src/lib/components/instanceSettings/InstanceAISettings.svelte b/frontend/src/lib/components/instanceSettings/InstanceAISettings.svelte
index 91b08eb46e..8d7d107940 100644
--- a/frontend/src/lib/components/instanceSettings/InstanceAISettings.svelte
+++ b/frontend/src/lib/components/instanceSettings/InstanceAISettings.svelte
@@ -145,5 +145,8 @@
 		link="https://www.windmill.dev/docs/core_concepts/ai_generation"
 		promptScope="instance"
 		customSave={handleCustomSave}
+		onSave={(savedConfig) => {
+			initialConfig = savedConfig
+		}}
 	/>
 {/if}
diff --git a/frontend/src/lib/components/instanceSettings/SmtpSettings.svelte b/frontend/src/lib/components/instanceSettings/SmtpSettings.svelte
index f7607c5d6c..f87dce7ed6 100644
--- a/frontend/src/lib/components/instanceSettings/SmtpSettings.svelte
+++ b/frontend/src/lib/components/instanceSettings/SmtpSettings.svelte
@@ -12,7 +12,7 @@
 </script>
 
 <script lang="ts">
-	import { Button } from '$lib/components/common'
+	import { Alert, Button } from '$lib/components/common'
 	import Password from '../Password.svelte'
 	import Toggle from '../Toggle.svelte'
 	import { SettingService } from '$lib/gen'
@@ -29,8 +29,19 @@
 	let { values, disabled = false }: Props = $props()
 
 	let testEmail = $state('')
+	let testing = $state(false)
+	let lastFailure = $state<{ settings: string; message: string } | undefined>(undefined)
+
+	// The failure describes one exact set of settings, so editing any of them retires it. The
+	// settings object is mutated in place, hence comparing content rather than identity.
+	let smtpSettingsKey = $derived(JSON.stringify($values['smtp_settings'] ?? {}))
+	let testError = $derived(
+		lastFailure?.settings === smtpSettingsKey ? lastFailure.message : undefined
+	)
 
 	async function testSmtpSettings() {
+		testing = true
+		lastFailure = undefined
 		try {
 			await SettingService.testSmtp({
 				requestBody: {
@@ -48,7 +59,15 @@
 			})
 			sendUserToast('Test email sent successfully')
 		} catch (error) {
-			sendUserToast('Failed to send test email: ' + error.message, true)
+			// The backend spells out which SMTP step failed and which setting to change, so it goes
+			// in a persistent alert rather than a toast that scrolls away while it is read.
+			lastFailure = {
+				settings: smtpSettingsKey,
+				message: error.body || error.message || 'Unknown error'
+			}
+			sendUserToast('Failed to send test email', true)
+		} finally {
+			testing = false
 		}
 	}
 </script>
@@ -171,6 +190,7 @@
 					unifiedSize="md"
 					variant="accent"
 					onclick={testSmtpSettings}
+					loading={testing}
 					disabled={!testEmail || !isSmtpSettingsValid($values['smtp_settings']) || disabled}
 					btnClasses="text-xs"
 					startIcon={{ icon: Mail }}
@@ -178,6 +198,11 @@
 					Send test email
 				</Button>
 			</div>
+			{#if testError}
+				<Alert type="error" title="Test email failed" size="xs" class="mt-1">
+					<span class="whitespace-pre-wrap break-words">{testError}</span>
+				</Alert>
+			{/if}
 		</div>
 	</div>
 </div>
diff --git a/frontend/src/lib/components/instanceSettingsMarkedLabel.test.ts b/frontend/src/lib/components/instanceSettingsMarkedLabel.test.ts
new file mode 100644
index 0000000000..c06f182018
--- /dev/null
+++ b/frontend/src/lib/components/instanceSettingsMarkedLabel.test.ts
@@ -0,0 +1,27 @@
+import { describe, it, expect } from 'vitest'
+import { extractMarkedLabel } from './instanceSettings'
+
+// SearchItems escapes the haystack before highlighting, so `marked` carries
+// entities where the label had `& < > " '`. The offset walk counts unescaped
+// characters, so an entity must advance it by one — otherwise the label is
+// truncated early and can be sliced mid-entity.
+describe('extractMarkedLabel', () => {
+	it('counts an escaped character as one, not as its entity length', () => {
+		const label = 'A & B'
+		expect(extractMarkedLabel('A &amp; B — category', label.length)).toBe('A &amp; B')
+	})
+
+	it('keeps the mark wrapper and stops at the label boundary', () => {
+		const label = 'Base URL'
+		expect(extractMarkedLabel('<mark>Base</mark> URL — general', label.length)).toBe(
+			'<mark>Base</mark> URL'
+		)
+	})
+
+	it('never slices an entity in half', () => {
+		const label = '"q" & <x>'
+		const out = extractMarkedLabel('&quot;q&quot; &amp; &lt;x&gt; — trailing', label.length)
+		expect(out).toBe('&quot;q&quot; &amp; &lt;x&gt;')
+		expect(out.endsWith(';')).toBe(true)
+	})
+})
diff --git a/frontend/src/lib/components/jobs/MissingWorkerTagAlert.svelte b/frontend/src/lib/components/jobs/MissingWorkerTagAlert.svelte
new file mode 100644
index 0000000000..6d996e76e4
--- /dev/null
+++ b/frontend/src/lib/components/jobs/MissingWorkerTagAlert.svelte
@@ -0,0 +1,47 @@
+<script lang="ts">
+	import { base } from '$app/paths'
+	import Alert from '$lib/components/common/alert/Alert.svelte'
+	import { WorkerService } from '$lib/gen'
+	import { workspaceStore } from '$lib/stores'
+	import { resource } from 'runed'
+	import { hasWorkerForTag } from './missingWorker'
+
+	interface Props {
+		/** Worker tag the feature's jobs run on. */
+		tag: string
+		/** What breaks without it, used as the sentence subject, e.g. "Data table queries". */
+		subject: string
+		workspace?: string
+		class?: string
+	}
+
+	let { tag, subject, workspace = undefined, class: className = '' }: Props = $props()
+
+	let ws = $derived(workspace ?? $workspaceStore)
+
+	// With per-workspace default tags, jobs run on a workspace-suffixed variant of
+	// `tag`, so probing the bare tag would warn about a tag nothing uses. The
+	// in-flight check in `pollJobResult` reads the job's real tag and still covers
+	// those instances.
+	const served = resource(
+		() => [ws, tag] as const,
+		async ([ws, tag]) => {
+			if (!ws || (await WorkerService.isDefaultTagsPerWorkspace())) return true
+			return await hasWorkerForTag(ws, tag)
+		}
+	)
+</script>
+
+{#if served.current === false}
+	<div class={className}>
+		<!-- Deliberately not phrased as "this tag is not configured": a correctly
+			tagged group sitting at zero replicas is indistinguishable from one in
+			`worker_ping`, and queueing a job is what scales it back up. -->
+		<Alert type="warning" title="No worker is running for the &quot;{tag}&quot; tag" size="xs">
+			{subject} run as Windmill jobs tagged <b>{tag}</b>, and no worker is currently listening to
+			that tag, so they stay queued until one is. If no worker group is meant to serve it, add
+			<b>{tag}</b>
+			to a group's worker tags on the <a href="{base}/workers">workers page</a>.
+		</Alert>
+	</div>
+{/if}
diff --git a/frontend/src/lib/components/jobs/missingWorker.test.ts b/frontend/src/lib/components/jobs/missingWorker.test.ts
new file mode 100644
index 0000000000..01f591aece
--- /dev/null
+++ b/frontend/src/lib/components/jobs/missingWorker.test.ts
@@ -0,0 +1,121 @@
+import { describe, expect, it, vi, beforeEach, afterEach } from 'vitest'
+
+const getCompletedJobResultMaybe = vi.fn()
+const getJob = vi.fn()
+const cancelQueuedJob = vi.fn()
+const existsWorkersWithTags = vi.fn()
+
+vi.mock('$lib/gen', () => ({
+	JobService: {
+		getCompletedJobResultMaybe: (...a: unknown[]) => getCompletedJobResultMaybe(...(a as [])),
+		getJob: (...a: unknown[]) => getJob(...(a as [])),
+		cancelQueuedJob: (...a: unknown[]) => cancelQueuedJob(...(a as []))
+	},
+	WorkerService: {
+		existsWorkersWithTags: (...a: unknown[]) => existsWorkersWithTags(...(a as []))
+	}
+}))
+
+import { pollJobResult } from './utils'
+import { hasWorkerForTag, NoWorkerForTagError } from './missingWorker'
+
+function settlementTracker(promise: Promise<unknown>) {
+	const state = { settled: false }
+	promise.then(
+		() => (state.settled = true),
+		() => (state.settled = true)
+	)
+	return state
+}
+
+beforeEach(() => {
+	getCompletedJobResultMaybe.mockReset()
+	getJob.mockReset()
+	cancelQueuedJob.mockReset()
+	existsWorkersWithTags.mockReset()
+	getCompletedJobResultMaybe.mockResolvedValue({ completed: false })
+	getJob.mockResolvedValue({ type: 'QueuedJob', running: false, tag: 'postgresql' })
+	cancelQueuedJob.mockResolvedValue(undefined)
+	vi.useFakeTimers()
+})
+
+afterEach(() => {
+	vi.useRealTimers()
+})
+
+// Long enough for the whole confirmation window (first probe + 2 intervals).
+const PAST_CONFIRMATION_WINDOW_MS = 120_000
+
+describe('pollJobResult', () => {
+	it('reports a queued read whose tag stays unserved without cancelling it', async () => {
+		existsWorkersWithTags.mockResolvedValue({ postgresql: false })
+
+		const promise = pollJobResult('job-1', 'ws')
+		const rejects = expect(promise).rejects.toBeInstanceOf(NoWorkerForTagError)
+		await vi.advanceTimersByTimeAsync(PAST_CONFIRMATION_WINDOW_MS)
+		await rejects
+		// The backlog is what the autoscaler scales up on: cancelling would stop a
+		// group coming back from zero from ever recovering.
+		expect(cancelQueuedJob).not.toHaveBeenCalled()
+	})
+
+	it('never abandons a write, and reports once why it is waiting', async () => {
+		existsWorkersWithTags.mockResolvedValue({ postgresql: false })
+		const onNoWorkerForTag = vi.fn()
+
+		const promise = pollJobResult('job-1', 'ws', { sideEffecting: true, onNoWorkerForTag })
+		const tracker = settlementTracker(promise)
+
+		await vi.advanceTimersByTimeAsync(PAST_CONFIRMATION_WINDOW_MS * 3)
+		// Reporting failure while the write stays executable would let it apply after
+		// the caller gave up and duplicate on retry; cancelling it first cannot be
+		// done atomically from the client.
+		expect(tracker.settled).toBe(false)
+		expect(cancelQueuedJob).not.toHaveBeenCalled()
+		expect(onNoWorkerForTag).toHaveBeenCalledTimes(1)
+		expect(onNoWorkerForTag).toHaveBeenCalledWith('postgresql')
+
+		getCompletedJobResultMaybe.mockResolvedValue({ completed: true, success: true, result: 7 })
+		await vi.advanceTimersByTimeAsync(3_000)
+		await expect(promise).resolves.toBe(7)
+	})
+
+	it('does not give up while a worker group could still be coming up', async () => {
+		// A worker group booting is absent from worker_ping exactly like an unserved
+		// tag; only a run of empty lookups distinguishes them.
+		existsWorkersWithTags.mockResolvedValueOnce({ postgresql: false })
+		existsWorkersWithTags.mockResolvedValueOnce({ postgresql: false })
+		existsWorkersWithTags.mockResolvedValue({ postgresql: true })
+
+		const promise = pollJobResult('job-1', 'ws')
+		const tracker = settlementTracker(promise)
+
+		await vi.advanceTimersByTimeAsync(PAST_CONFIRMATION_WINDOW_MS)
+		expect(tracker.settled).toBe(false)
+		expect(cancelQueuedJob).not.toHaveBeenCalled()
+	})
+
+	it('keeps waiting on a job queued behind a busy worker that serves its tag', async () => {
+		existsWorkersWithTags.mockResolvedValue({ postgresql: true })
+
+		const promise = pollJobResult('job-1', 'ws')
+		const tracker = settlementTracker(promise)
+
+		await vi.advanceTimersByTimeAsync(PAST_CONFIRMATION_WINDOW_MS)
+		expect(tracker.settled).toBe(false)
+
+		getCompletedJobResultMaybe.mockResolvedValue({ completed: true, success: true, result: 42 })
+		await vi.advanceTimersByTimeAsync(3_000)
+		await expect(promise).resolves.toBe(42)
+	})
+})
+
+describe('hasWorkerForTag', () => {
+	it('treats an answer it did not get as a worker being there', async () => {
+		// `existsWorkersWithTags` returns an empty map when TAGS_ARE_SENSITIVE hides
+		// the tag from the caller. Reading that as "unserved" would diagnose a
+		// perfectly healthy instance.
+		existsWorkersWithTags.mockResolvedValue({})
+		await expect(hasWorkerForTag('ws', 'postgresql')).resolves.toBe(true)
+	})
+})
diff --git a/frontend/src/lib/components/jobs/missingWorker.ts b/frontend/src/lib/components/jobs/missingWorker.ts
new file mode 100644
index 0000000000..e392e06d3e
--- /dev/null
+++ b/frontend/src/lib/components/jobs/missingWorker.ts
@@ -0,0 +1,76 @@
+import { JobService, WorkerService } from '$lib/gen'
+
+/**
+ * A queued job whose tag no running worker serves is never picked up: without
+ * this the UI polls until the server-side `run_wait_result` timeout (10min by
+ * default) or, for the client-side pollers, forever.
+ *
+ * The most common cause is a language that defaults to a native tag
+ * (`postgresql`, `mysql`, `bigquery`, …) on an instance whose worker groups
+ * only declare the default tags.
+ */
+export class NoWorkerForTagError extends Error {
+	tag: string
+
+	constructor(tag: string) {
+		super(
+			`No worker has been listening to the tag "${tag}" while this job waited, so it was never ` +
+				`picked up. It stays queued and will run once a worker with that tag comes online. ` +
+				`Add "${tag}" to the worker tags of one of your worker groups (Workers page), or run a ` +
+				`worker that serves it.`
+		)
+		this.name = 'NoWorkerForTagError'
+		this.tag = tag
+	}
+}
+
+/** Shown while a write waits, which is never abandoned (see `sideEffecting`). */
+export function queuedWithoutWorkerMessage(tag: string): string {
+	return (
+		`No worker is listening to the tag "${tag}", so this operation is queued and will only run ` +
+		`once one is. Add "${tag}" to the worker tags of one of your worker groups (Workers page), ` +
+		`or run a worker that serves it.`
+	)
+}
+
+/** How long a job may sit un-started before the first lookup for a worker serving its tag. */
+export const NO_WORKER_FIRST_PROBE_MS = 10_000
+/** How long to wait between lookups while the job stays queued. */
+export const NO_WORKER_PROBE_INTERVAL_MS = 40_000
+/**
+ * How many consecutive lookups must come back empty before the caller stops
+ * waiting. A worker group scaling from zero, or every worker down for a rollout,
+ * is indistinguishable from an unserved tag in any single lookup, so no single
+ * empty reading is acted on.
+ */
+export const NO_WORKER_CONFIRMATIONS = 3
+
+/**
+ * Whether any worker pinged in the last minute declares `tag`. Unknown answers
+ * (the endpoint returns an empty map when tags are sensitive and the caller may
+ * not see them) count as "yes", so an opaque instance never gets a wrong
+ * diagnosis.
+ */
+export async function hasWorkerForTag(workspace: string, tag: string): Promise<boolean> {
+	const existing = await WorkerService.existsWorkersWithTags({ workspace, tags: tag })
+	return existing[tag] !== false
+}
+
+/**
+ * The tag of `jobId` when it is still queued and no worker serves it, else
+ * undefined. Never throws: a failed lookup means "can't tell", and the caller
+ * keeps waiting rather than reporting a cause it did not establish.
+ */
+export async function missingWorkerTagOfQueuedJob(
+	workspace: string,
+	jobId: string
+): Promise<string | undefined> {
+	try {
+		const job = await JobService.getJob({ workspace, id: jobId, noCode: true, noLogs: true })
+		if (job.type !== 'QueuedJob' || job.running || !job.tag) return undefined
+		return (await hasWorkerForTag(workspace, job.tag)) ? undefined : job.tag
+	} catch (err) {
+		console.warn('Could not determine whether a worker serves the job tag', err)
+		return undefined
+	}
+}
diff --git a/frontend/src/lib/components/jobs/utils.ts b/frontend/src/lib/components/jobs/utils.ts
index 294df7c3ff..735484c1f2 100644
--- a/frontend/src/lib/components/jobs/utils.ts
+++ b/frontend/src/lib/components/jobs/utils.ts
@@ -1,4 +1,11 @@
 import { JobService, type RunScriptByPathData, type RunScriptPreviewData } from '$lib/gen'
+import {
+	missingWorkerTagOfQueuedJob,
+	NoWorkerForTagError,
+	NO_WORKER_CONFIRMATIONS,
+	NO_WORKER_FIRST_PROBE_MS,
+	NO_WORKER_PROBE_INTERVAL_MS
+} from './missingWorker'
 
 function isRunScriptByPathData(
 	arg: RunScriptPreviewData | RunScriptByPathData
@@ -9,13 +16,26 @@ function isRunScriptByPathData(
 type RunScriptOptions = {
 	maxRetries?: number
 	withJobData?: boolean
+	/** Set to false to keep polling a job that no worker can pick up. */
+	failIfNoWorkerForTag?: boolean
+	/**
+	 * The job writes (insert/update/delete, DDL, arbitrary SQL). Such a job is
+	 * never given up on: reporting it as failed while it stays executable invites
+	 * a duplicate retry, and cancelling it first is not something the client can
+	 * do atomically: a worker can claim it between the tag probe and the cancel,
+	 * and a soft-cancelled statement may already have committed. `onNoWorkerForTag`
+	 * is what tells the user why it is waiting.
+	 */
+	sideEffecting?: boolean
+	/** Called once when the job has stayed queued on a tag no worker serves. */
+	onNoWorkerForTag?: (tag: string) => void
 }
 
 /**
  * @function runScript
  * @param {RunScriptPreviewData | RunScriptByPathData} data - Data for running the script.
  * @returns {Promise<string>} A UUID representing the running script.
- * 
+ *
  * @example
  * const uuid = await runScript(data)
  */
@@ -29,6 +49,15 @@ export async function runScript(data: RunScriptPreviewData | RunScriptByPathData
 	return uuid
 }
 
+/** Tight at first so a quick job feels instant, then slower: a schema
+ * introspection or a DDL migration can run for minutes, and a fixed sub-second
+ * tick would cost hundreds of round-trips for it. */
+function pollDelayMs(poll: number): number {
+	if (poll < 4) return 375
+	if (poll < 12) return 750
+	return 2000
+}
+
 /**
  * @function pollJobResult
  * @description Polls a job result by UUID until success, failure, or max retries reached.
@@ -36,19 +65,35 @@ export async function runScript(data: RunScriptPreviewData | RunScriptByPathData
  * @param {string} workspace - Workspace identifier.
  * @param {RunScriptOptions} [options] - Optional settings like retries and job data inclusion.
  * @returns {Promise<unknown>} Final job result or throws error if it fails.
- * 
+ *
  * @example
  * const result = await pollJobResult(uuid, 'my-workspace', { maxRetries: 5, withJobData: true });
  */
 export async function pollJobResult(
 	uuid: string,
 	workspace: string,
-	{ maxRetries = 7, withJobData }: RunScriptOptions = {}
+	{
+		maxRetries = 7,
+		withJobData,
+		failIfNoWorkerForTag = true,
+		sideEffecting = false,
+		onNoWorkerForTag
+	}: RunScriptOptions = {}
 ): Promise<unknown> {
 	let attempts = 0
+	let polls = 0
+	// `attempts` only advances on errors, so a queued job would poll forever. The
+	// one case that never resolves on its own is a tag no worker serves, which
+	// takes NO_WORKER_CONFIRMATIONS consecutive empty lookups to establish, since
+	// a worker group booting reads like an unserved tag in any single one.
+	let noWorkerProbeAt = Date.now() + NO_WORKER_FIRST_PROBE_MS
+	let unservedProbes = 0
+	let reportedNoWorker = false
 	while (attempts < maxRetries) {
 		try {
-			await new Promise((resolve) => setTimeout(resolve, 500 * (attempts || 0.75)))
+			await new Promise((resolve) =>
+				setTimeout(resolve, attempts ? 500 * attempts : pollDelayMs(polls++))
+			)
 			const job = await JobService.getCompletedJobResultMaybe({
 				id: uuid,
 				workspace
@@ -65,8 +110,26 @@ export async function pollJobResult(
 				if (typeof errorMsg !== 'string') errorMsg = undefined
 				console.error('JOB FAILED', job.result)
 				throw new Error(errorMsg ?? 'Job failed')
+			} else if (failIfNoWorkerForTag && Date.now() >= noWorkerProbeAt) {
+				const tag = await missingWorkerTagOfQueuedJob(workspace, uuid)
+				noWorkerProbeAt = Date.now() + NO_WORKER_PROBE_INTERVAL_MS
+				unservedProbes = tag ? unservedProbes + 1 : 0
+				if (tag && unservedProbes >= NO_WORKER_CONFIRMATIONS) {
+					if (!reportedNoWorker) {
+						reportedNoWorker = true
+						onNoWorkerForTag?.(tag)
+					}
+					// Reads give up the wait but leave the job queued: cancelling one would
+					// remove the very backlog the autoscaler scales up on, so a group coming
+					// back from zero (300s cooldown) would never recover. Writes keep
+					// waiting instead (see `sideEffecting`).
+					if (!sideEffecting) throw new NoWorkerForTagError(tag)
+				}
 			}
 		} catch (e) {
+			if (e instanceof NoWorkerForTagError) {
+				throw e
+			}
 			if (attempts == maxRetries) {
 				throw e
 			}
diff --git a/frontend/src/lib/components/jobs/writingJob.ts b/frontend/src/lib/components/jobs/writingJob.ts
new file mode 100644
index 0000000000..d1c32ba826
--- /dev/null
+++ b/frontend/src/lib/components/jobs/writingJob.ts
@@ -0,0 +1,12 @@
+import { sendUserToast } from '$lib/toast'
+import { queuedWithoutWorkerMessage } from './missingWorker'
+
+/**
+ * Poll options for a job that writes (row edits, DDL, arbitrary SQL). Such a job
+ * is never abandoned (see `sideEffecting` in `pollJobResult`), so this is what
+ * explains the wait when it sits on a tag no worker serves.
+ */
+export const writingJobOptions = {
+	sideEffecting: true,
+	onNoWorkerForTag: (tag: string) => sendUserToast(queuedWithoutWorkerMessage(tag), true)
+}
diff --git a/frontend/src/lib/components/mcp/McpScopeSelector.svelte b/frontend/src/lib/components/mcp/McpScopeSelector.svelte
index 3ff1ab3d95..a240b09db7 100644
--- a/frontend/src/lib/components/mcp/McpScopeSelector.svelte
+++ b/frontend/src/lib/components/mcp/McpScopeSelector.svelte
@@ -8,6 +8,13 @@
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
 	import { FlowService, FolderService, IntegrationService, ScriptService } from '$lib/gen'
 	import { mcpEndpointTools } from '$lib/mcpEndpointTools'
+	import {
+		endpointPathPolicy,
+		isEndpointExposed,
+		matchesAnyPattern,
+		parseMcpScopeState,
+		pruneEndpointSelection
+	} from '$lib/components/mcp/endpointScopePolicy'
 	import InfoIcon from 'lucide-svelte/icons/info'
 	import { SvelteMap } from 'svelte/reactivity'
 
@@ -32,12 +39,16 @@
 		readOnly ? mcpEndpointTools.filter((e) => e.method === 'GET') : mcpEndpointTools
 	)
 
-	// When read-only flips on, prune already-selected non-GET endpoints so the
-	// scope string doesn't keep references to tools the server will reject.
+	// Endpoints the "API Endpoints" list actually governs. The run-by-path tools
+	// are gated by the script/flow selection instead, so listing them here would
+	// offer a checkbox the server ignores; they get their own section.
+	const selectableEndpointTools = $derived(
+		visibleEndpointTools.filter((e) => endpointPathPolicy(e.name)?.kind !== 'runByPath')
+	)
+
 	$effect(() => {
-		if (!readOnly || selectedEndpoints.length === 0) return
-		const allowed = new Set(visibleEndpointTools.map((e) => e.name))
-		const filtered = selectedEndpoints.filter((n) => allowed.has(n))
+		if (selectedEndpoints.length === 0) return
+		const filtered = pruneEndpointSelection(selectedEndpoints, readOnly)
 		if (filtered.length !== selectedEndpoints.length) {
 			selectedEndpoints = filtered
 		}
@@ -169,8 +180,10 @@
 		}
 	}
 
-	// Compute scope string from selections
-	$effect(() => {
+	// Compute scope string from selections. Derived rather than assigned straight
+	// to `scope` so the exposure previews below can read it in the same pass as
+	// the selection that changed it.
+	const computedScope = $derived.by(() => {
 		let scopeParts: string[] = []
 
 		if (selectedMode === 'custom') {
@@ -206,7 +219,11 @@
 			scopeParts.push(`mcp:hub:${newMcpApps.join(',')}`)
 		}
 
-		scope = scopeParts.join(' ')
+		return scopeParts.join(' ')
+	})
+
+	$effect(() => {
+		scope = computedScope
 	})
 
 	// Clear pattern inputs when not in custom scope
@@ -444,21 +461,6 @@
 	let exposedScriptCount = $state<number | undefined>(undefined)
 	let exposedFlowCount = $state<number | undefined>(undefined)
 
-	// Mirror the backend's is_resource_allowed: `*`, an exact path, or an `x/*`
-	// subtree (matching the folder itself or anything beneath it).
-	function matchesAnyPattern(path: string, patterns: string[]): boolean {
-		for (const p of patterns) {
-			if (p === '*' || p === path) return true
-			if (p.endsWith('/*')) {
-				const prefix = p.slice(0, -2)
-				if (path === prefix || (path.startsWith(prefix) && path[prefix.length] === '/')) {
-					return true
-				}
-			}
-		}
-		return false
-	}
-
 	// Custom-mode counts are computed synchronously from the already-loaded
 	// allScripts/allFlows plus the current selections/patterns — no extra fetch.
 	$effect(() => {
@@ -485,6 +487,39 @@
 		return `This scope matches ${parts.join(' and ')}. Only the ${MCP_TOOL_FETCH_LIMIT} most recent of each type are exposed as MCP tools; the rest are omitted. Narrow the scope to avoid overloading the assistant's context.`
 	})
 
+	// Parsed from the emitted scope string rather than from the selections, so the
+	// previews below answer "what will the server expose for this token" with the
+	// same input the server gets.
+	const scopeState = $derived(
+		parseMcpScopeState(computedScope.split(/\s+/).filter((s) => s.length > 0))
+	)
+
+	const exposedEndpointTools = $derived(
+		visibleEndpointTools.filter((e) => isEndpointExposed(scopeState, e.name))
+	)
+
+	const runByPathTools = $derived(
+		visibleEndpointTools.flatMap((e) => {
+			const policy = endpointPathPolicy(e.name)
+			return policy?.kind === 'runByPath'
+				? [
+						{
+							name: e.name,
+							resource: policy.resource,
+							exposed: isEndpointExposed(scopeState, e.name)
+						}
+					]
+				: []
+		})
+	)
+
+	// Endpoints the user picked that the server will still withhold: the ones
+	// that cannot be confined to a path (run-preview, delete-by-hash) once the
+	// token is limited to specific script paths.
+	const withheldEndpoints = $derived(
+		selectedEndpoints.filter((name) => !isEndpointExposed(scopeState, name))
+	)
+
 	function selectAllScripts() {
 		selectedScripts = [...allScripts]
 	}
@@ -498,7 +533,7 @@
 		selectedFlows = []
 	}
 	function selectAllEndpoints() {
-		selectedEndpoints = [...visibleEndpointTools.map((e) => e.name)]
+		selectedEndpoints = [...selectableEndpointTools.map((e) => e.name)]
 	}
 	function clearAllEndpoints() {
 		selectedEndpoints = []
@@ -623,12 +658,47 @@
 				<div class="flex flex-col gap-2 mt-2">
 					{@render sectionHeader('API Endpoints', selectAllEndpoints, clearAllEndpoints)}
 					<MultiSelect
-						items={safeSelectItems(visibleEndpointTools.map((e) => e.name))}
+						items={safeSelectItems(selectableEndpointTools.map((e) => e.name))}
 						placeholder="Select endpoints"
 						bind:value={selectedEndpoints}
 					/>
 				</div>
 
+				{#if withheldEndpoints.length > 0}
+					<Alert type="warning" size="xs" title="Some selected endpoints will not be exposed">
+						<span class="text-xs">
+							Endpoints that cannot be limited to specific script paths are withheld from a token
+							restricted to a script selection: {withheldEndpoints.join(', ')}. Widening the script
+							wildcard pattern to <code>*</code> exposes them, and keeps the run tools below available.
+						</span>
+					</Alert>
+				{/if}
+
+				{#if runByPathTools.length > 0}
+					<div class="flex flex-col gap-2 mt-2">
+						<span class="block text-xs font-semibold">Run tools</span>
+						<p class="text-xs text-tertiary">
+							Running a script or flow by path is granted by the Scripts and Flows selections above,
+							not by the endpoint list, so a token can never run something outside its scope.
+						</p>
+						<div class="flex flex-col gap-1">
+							{#each runByPathTools as tool (tool.name)}
+								<div class="flex items-center gap-2">
+									<Badge rounded small color={tool.exposed ? 'green' : 'gray'}>{tool.name}</Badge>
+									<span class="text-xs text-tertiary">
+										{#if tool.exposed}
+											exposed
+										{:else}
+											not exposed — select at least one {tool.resource} above, or add a {tool.resource}
+											wildcard pattern
+										{/if}
+									</span>
+								</div>
+							{/each}
+						</div>
+					</div>
+				{/if}
+
 				<div class="text-xs text-primary mt-2">
 					Selected: {selectedScripts.length} scripts, {selectedFlows.length} flows, {selectedEndpoints.length}
 					endpoints
@@ -716,7 +786,7 @@
 
 				<span class="block text-xs mt-2">API endpoint tools that will be available via MCP</span>
 				<div class="flex flex-wrap gap-1">
-					{#each visibleEndpointTools as endpoint (endpoint.name)}
+					{#each exposedEndpointTools as endpoint (endpoint.name)}
 						<Popover notClickable>
 							{#snippet text()}
 								<div class="flex flex-col gap-1">
diff --git a/frontend/src/lib/components/mcp/endpointScopePolicy.test.ts b/frontend/src/lib/components/mcp/endpointScopePolicy.test.ts
new file mode 100644
index 0000000000..e224279f4c
--- /dev/null
+++ b/frontend/src/lib/components/mcp/endpointScopePolicy.test.ts
@@ -0,0 +1,55 @@
+import { describe, expect, it } from 'vitest'
+import {
+	isEndpointExposed,
+	parseMcpScopeState,
+	pruneEndpointSelection
+} from './endpointScopePolicy'
+
+const state = (...scopes: string[]) => parseMcpScopeState(scopes)
+
+describe('isEndpointExposed', () => {
+	it('gates run-by-path tools on the script/flow scope, not the endpoint scope', () => {
+		// Selecting the endpoint without any script path exposes nothing...
+		const endpointsOnly = state('mcp:endpoints:runScriptByPath,listScripts')
+		expect(isEndpointExposed(endpointsOnly, 'runScriptByPath')).toBe(false)
+		expect(isEndpointExposed(endpointsOnly, 'listScripts')).toBe(true)
+
+		// ...while a script path exposes it without any endpoint scope.
+		expect(isEndpointExposed(state('mcp:scripts:f/team/*'), 'runScriptByPath')).toBe(true)
+		expect(isEndpointExposed(state('mcp:scripts:f/team/*'), 'runFlowByPath')).toBe(false)
+
+		// Favorites reach their runnables through per-item tools only.
+		expect(isEndpointExposed(state('mcp:favorites'), 'runScriptByPath')).toBe(false)
+		expect(isEndpointExposed(state('mcp:all'), 'runScriptByPath')).toBe(true)
+	})
+
+	it('withholds unconfinable tools from path-confined tokens', () => {
+		const confined = state('mcp:scripts:f/team/*', 'mcp:endpoints:*')
+		expect(isEndpointExposed(confined, 'runScriptPreviewAndWaitResult')).toBe(false)
+		expect(isEndpointExposed(confined, 'getScriptByPath')).toBe(true)
+
+		// A `*` script pattern is not a confinement.
+		expect(
+			isEndpointExposed(state('mcp:scripts:*', 'mcp:endpoints:*'), 'runScriptPreviewAndWaitResult')
+		).toBe(true)
+	})
+})
+
+describe('pruneEndpointSelection', () => {
+	it('keeps a `*` endpoint scope, which would otherwise revoke every endpoint tool', () => {
+		expect(pruneEndpointSelection(['*'], false)).toEqual(['*'])
+		expect(pruneEndpointSelection(['*'], true)).toEqual(['*'])
+	})
+
+	it('drops only names the endpoint scope cannot honor', () => {
+		expect(pruneEndpointSelection(['runScriptByPath', 'listScripts'], false)).toEqual([
+			'listScripts'
+		])
+		// Non-GET endpoints go only when the token is read-only.
+		expect(pruneEndpointSelection(['createScript', 'listScripts'], false)).toEqual([
+			'createScript',
+			'listScripts'
+		])
+		expect(pruneEndpointSelection(['createScript', 'listScripts'], true)).toEqual(['listScripts'])
+	})
+})
diff --git a/frontend/src/lib/components/mcp/endpointScopePolicy.ts b/frontend/src/lib/components/mcp/endpointScopePolicy.ts
new file mode 100644
index 0000000000..3c571a30d5
--- /dev/null
+++ b/frontend/src/lib/components/mcp/endpointScopePolicy.ts
@@ -0,0 +1,163 @@
+/**
+ * Mirrors `endpoint_path_policy` / `endpoint_tool_in_scope` in
+ * backend/windmill-mcp/src/server/runner.rs. Two endpoint tools are not governed
+ * by the `mcp:endpoints:` scope at all, and two more are hidden from tokens
+ * confined to specific script paths — without mirroring that here, the scope
+ * picker advertises tools the server will never list.
+ */
+
+import { mcpEndpointTools } from '$lib/mcpEndpointTools'
+
+export type McpResourceKind = 'script' | 'flow'
+
+export type EndpointPathPolicy =
+	/** Runs the script/flow named by the `path` argument. Listed when the token
+	 *  grants at least one path of that kind; the endpoint scope is ignored. */
+	| { kind: 'runByPath'; resource: McpResourceKind }
+	/** Reads/writes a script/flow named by a path argument, itself confined to
+	 *  the token's path patterns. Listed by the endpoint scope. */
+	| { kind: 'pathArgs'; resource: McpResourceKind }
+	/** Takes no checkable path (delete-by-hash) or runs arbitrary code
+	 *  (preview); hidden from tokens confined to specific paths. */
+	| { kind: 'unconfinable'; resource: McpResourceKind }
+
+export function endpointPathPolicy(name: string): EndpointPathPolicy | undefined {
+	switch (name) {
+		case 'runScriptByPath':
+			return { kind: 'runByPath', resource: 'script' }
+		case 'runFlowByPath':
+			return { kind: 'runByPath', resource: 'flow' }
+		case 'getScriptByPath':
+		case 'deleteScriptByPath':
+		case 'createScript':
+			return { kind: 'pathArgs', resource: 'script' }
+		case 'getFlowByPath':
+		case 'deleteFlowByPath':
+		case 'createFlow':
+		case 'updateFlow':
+			return { kind: 'pathArgs', resource: 'flow' }
+		case 'deleteScriptByHash':
+		case 'runScriptPreviewAndWaitResult':
+			return { kind: 'unconfinable', resource: 'script' }
+		default:
+			return undefined
+	}
+}
+
+/** The parsed shape of an MCP token's scopes, as `McpScopeConfig` on the backend. */
+export type McpScopeState = {
+	/** Legacy `mcp:all` — grants every path and endpoint. */
+	all: boolean
+	/** Legacy `mcp:favorites` — reaches favorites through per-item tools only. */
+	favorites: boolean
+	scripts: string[]
+	flows: string[]
+	endpoints: string[]
+}
+
+function parseResourceList(resources: string): string[] {
+	return resources
+		.split(',')
+		.map((s) => s.trim())
+		.filter((s) => s.length > 0)
+}
+
+/** Mirrors `parse_mcp_scopes` so the picker can preview exactly what the server
+ *  will make of the scope string it is about to emit. `mcp:hub:` is deliberately
+ *  ignored: hub apps select which hub scripts become tools and never affect
+ *  endpoint-tool exposure. */
+export function parseMcpScopeState(scopes: string[]): McpScopeState {
+	const state: McpScopeState = {
+		all: false,
+		favorites: false,
+		scripts: [],
+		flows: [],
+		endpoints: []
+	}
+	for (const scope of scopes) {
+		if (scope === 'mcp:all') {
+			state.all = true
+			state.scripts.push('*')
+			state.flows.push('*')
+			state.endpoints.push('*')
+		} else if (scope === 'mcp:favorites') {
+			state.favorites = true
+		} else if (scope.startsWith('mcp:all:')) {
+			const folder = scope.slice('mcp:all:'.length)
+			state.scripts.push(folder)
+			state.flows.push(folder)
+			state.endpoints.push('*')
+		} else if (scope.startsWith('mcp:scripts:')) {
+			state.scripts.push(...parseResourceList(scope.slice('mcp:scripts:'.length)))
+		} else if (scope.startsWith('mcp:flows:')) {
+			state.flows.push(...parseResourceList(scope.slice('mcp:flows:'.length)))
+		} else if (scope.startsWith('mcp:endpoints:')) {
+			state.endpoints.push(...parseResourceList(scope.slice('mcp:endpoints:'.length)))
+		}
+	}
+	return state
+}
+
+function patterns(state: McpScopeState, resource: McpResourceKind): string[] {
+	return resource === 'script' ? state.scripts : state.flows
+}
+
+/** Whether the token grants access to any concrete path of this kind. */
+function hasAnyResource(state: McpScopeState, resource: McpResourceKind): boolean {
+	return state.all || patterns(state, resource).length > 0
+}
+
+/** Whether the token restricts this kind to specific paths. A `*` pattern grants
+ *  every path, so it is not a confinement. */
+function isPathConfined(state: McpScopeState, resource: McpResourceKind): boolean {
+	if (state.all) return false
+	const list = patterns(state, resource)
+	return list.length > 0 && !list.includes('*')
+}
+
+function matchesPattern(name: string, pattern: string): boolean {
+	if (pattern === name) return true
+	if (!pattern.endsWith('/*')) return false
+	const prefix = pattern.slice(0, -2)
+	if (!name.startsWith(prefix)) return false
+	return name.length === prefix.length || name[prefix.length] === '/'
+}
+
+/** Mirrors `is_resource_allowed`: whether a path (or endpoint name) is granted by
+ *  any of these patterns, where a pattern is `*`, an exact path, or `<prefix>/*`. */
+export function matchesAnyPattern(path: string, patterns: string[]): boolean {
+	if (patterns.length === 0) return false
+	if (patterns.includes('*')) return true
+	return patterns.some((pattern) => matchesPattern(path, pattern))
+}
+
+const nonGetEndpoints = new Set(
+	mcpEndpointTools.filter((e) => e.method !== 'GET').map((e) => e.name)
+)
+
+/** Strip from an `mcp:endpoints:` selection only the names that scope cannot
+ *  honor: run-by-path tools, which `isEndpointExposed` gates on the script/flow
+ *  scope instead, and — for a read-only token — the non-GET endpoints the server
+ *  refuses. Every other entry is preserved, notably a `*` wildcard, which is a
+ *  valid endpoint scope that dropping would silently revoke every endpoint tool. */
+export function pruneEndpointSelection(selected: string[], readOnly: boolean): string[] {
+	return selected.filter(
+		(name) =>
+			endpointPathPolicy(name)?.kind !== 'runByPath' && !(readOnly && nonGetEndpoints.has(name))
+	)
+}
+
+/** Whether the server will list this endpoint tool for a token with these scopes. */
+export function isEndpointExposed(state: McpScopeState, name: string): boolean {
+	const granular = !state.all && !state.favorites
+	const endpointAllowed = !granular || matchesAnyPattern(name, state.endpoints)
+	const policy = endpointPathPolicy(name)
+	switch (policy?.kind) {
+		case 'runByPath':
+			return hasAnyResource(state, policy.resource)
+		case 'unconfinable':
+			return endpointAllowed && !isPathConfined(state, policy.resource)
+		default:
+			return endpointAllowed
+	}
+}
diff --git a/frontend/src/lib/components/meltComponents/Menu.svelte b/frontend/src/lib/components/meltComponents/Menu.svelte
index a7a4463706..8cd72786a5 100644
--- a/frontend/src/lib/components/meltComponents/Menu.svelte
+++ b/frontend/src/lib/components/meltComponents/Menu.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
 	import { untrack } from 'svelte'
+	import { overlayPortalTarget } from '$lib/components/common/overlayHost.svelte'
 	import { createBubbler } from 'svelte/legacy'
 
 	const bubble = createBubbler()
@@ -54,8 +55,12 @@
 		children
 	}: Props = $props()
 
+	// Overlays belong to the enclosing pane when there is one — see overlayHost.
+	const hostPortal = overlayPortalTarget('body')
+
 	// Use the passed createMenu function
 	const menu = untrack(() => createMenu)({
+		portal: untrack(() => hostPortal()),
 		positioning: {
 			placement: untrack(() => placement),
 			fitViewport: true,
@@ -76,9 +81,14 @@
 	const {
 		elements: { trigger, menu: menuElement, item },
 		builders,
-		states
+		states,
+		options: { portal: portalOption }
 	} = menu
 
+	$effect(() => {
+		$portalOption = hostPortal()
+	})
+
 	const sync = createSync(states)
 	watch(
 		() => open,
diff --git a/frontend/src/lib/components/meltComponents/Popover.svelte b/frontend/src/lib/components/meltComponents/Popover.svelte
index 884dc35c5e..f850e53f6c 100644
--- a/frontend/src/lib/components/meltComponents/Popover.svelte
+++ b/frontend/src/lib/components/meltComponents/Popover.svelte
@@ -17,6 +17,7 @@
 	import { debounce, pointerDownOutside } from '$lib/utils'
 	import { twMerge } from 'tailwind-merge'
 	import { createEventDispatcher, untrack } from 'svelte'
+	import { getOverlayHost, overlayPortalTarget } from '$lib/components/common/overlayHost.svelte'
 	import { Button } from '$lib/components/common'
 	import DocLink from '$lib/components/apps/editor/settingsPanel/DocLink.svelte'
 	import type { FloatingConfig } from '@melt-ui/svelte/internal/actions/floating'
@@ -89,7 +90,7 @@
 		closeOnOutsideClick = true,
 		contentClasses = '',
 		contentStyle = '',
-		portal = 'body',
+		portal = undefined,
 		closeOnOtherPopoverOpen = false,
 		allowFullScreen = false,
 		extraProps = {},
@@ -110,8 +111,16 @@
 		content
 	}: Props = $props()
 
-	// Dynamic portal: use 'body' when fullscreen, otherwise use the provided portal
-	let dynamicPortal = $derived(fullScreen ? 'body' : portal)
+	// Fullscreen abandons the trigger-relative positioning for a container of its own:
+	// the host pane when this popover is enclosed in one (so it covers that pane, like a
+	// drawer), else the document.
+	const overlayHost = getOverlayHost()
+	const hostPortal = overlayPortalTarget('body')
+	const fullScreenHost = $derived(fullScreen ? overlayHost?.el() : undefined)
+	// `null` is melt's "render in place" and must survive; only an absent prop defers to the host.
+	let dynamicPortal = $derived(
+		fullScreen ? (fullScreenHost ?? 'body') : portal === undefined ? hostPortal() : portal
+	)
 
 	const {
 		elements: { trigger: _trigger, content: _content, arrow, close: closeElement, overlay },
@@ -251,7 +260,8 @@
 </button>
 
 {#if fullScreen && isOpen && !disablePopup}
-	<div use:melt={$overlay} class="fixed inset-0 z-10 bg-black/50"></div>
+	<div use:melt={$overlay} class="{fullScreenHost ? 'absolute' : 'fixed'} inset-0 z-10 bg-black/50"
+	></div>
 {/if}
 
 {#if isOpen && !disablePopup}
@@ -268,14 +278,20 @@
 		class={twMerge(
 			'relative dark:border rounded-md bg-surface-tertiary shadow-lg',
 			fullScreen
-				? `fixed !top-1/2 !left-1/2 !-translate-x-1/2 !-translate-y-1/2 !resize-none`
+				? `${fullScreenHost ? 'absolute' : 'fixed'} !top-1/2 !left-1/2 !-translate-x-1/2 !-translate-y-1/2 !resize-none`
 				: 'w-fit',
-			contentClasses,
-			`z-[5001]`
+			// Last so `contentClasses` can raise it: a popover inside a ConfirmationModal has to
+			// clear that modal's own z-index, which sits above this layer.
+			`z-[5001]`,
+			contentClasses
 		)}
 		data-popover
 		{...extraProps}
-		style={fullScreen ? `width: 90vw; max-width: 800px; height: 90vh;` : contentStyle}
+		style={fullScreen
+			? `width: ${fullScreenHost ? '90%' : '90vw'}; max-width: 800px; height: ${
+					fullScreenHost ? '90%' : '90vh'
+				};`
+			: contentStyle}
 	>
 		{#if displayArrow}
 			<div use:melt={$arrow}></div>
diff --git a/frontend/src/lib/components/meltComponents/Tooltip.svelte b/frontend/src/lib/components/meltComponents/Tooltip.svelte
index 68dd81226c..119badb379 100644
--- a/frontend/src/lib/components/meltComponents/Tooltip.svelte
+++ b/frontend/src/lib/components/meltComponents/Tooltip.svelte
@@ -5,6 +5,7 @@
 	import { zIndexes } from '$lib/zIndexes'
 
 	import { createTooltip, melt } from '@melt-ui/svelte'
+	import { overlayPortalTarget } from '$lib/components/common/overlayHost.svelte'
 	import { fade } from 'svelte/transition'
 	import TooltipInner from '../TooltipInner.svelte'
 
@@ -36,7 +37,7 @@
 		disablePopup = false,
 		openDelay = 300,
 		closeDelay = 0,
-		portal = 'body',
+		portal = undefined,
 		customBgClass = undefined,
 		style = '',
 		class: className = '',
@@ -45,9 +46,15 @@
 		text
 	}: Props = $props()
 
+	// Overlays belong to the enclosing pane when there is one — see overlayHost.
+	// `null` is melt's "render in place" and must survive; only an absent prop defers to the host.
+	const hostPortal = overlayPortalTarget('body')
+	const effectivePortal = () => (portal === undefined ? hostPortal() : portal)
+
 	const {
 		elements: { trigger, content },
-		states: { open }
+		states: { open },
+		options: { portal: portalOption }
 	} = createTooltip({
 		positioning: {
 			placement: untrack(() => placement)
@@ -55,7 +62,11 @@
 		openDelay: untrack(() => openDelay),
 		closeDelay: untrack(() => closeDelay),
 		group: true,
-		portal: untrack(() => portal)
+		portal: untrack(() => effectivePortal())
+	})
+
+	$effect(() => {
+		$portalOption = effectivePortal()
 	})
 
 	// Cursor anchoring: floating-ui positions against `reference.getBoundingClientRect()`.
diff --git a/frontend/src/lib/components/modulesTest.svelte.ts b/frontend/src/lib/components/modulesTest.svelte.ts
index 49ae9592c7..f3818e3175 100644
--- a/frontend/src/lib/components/modulesTest.svelte.ts
+++ b/frontend/src/lib/components/modulesTest.svelte.ts
@@ -25,10 +25,22 @@ export class ModulesTestStates {
 export function jobToGraphModuleState(testState: ModuleTestState): GraphModuleState | undefined {
 	if (testState.hiddenInGraph) {
 		return undefined
-	} else if (testState.loading) {
+	}
+	// Testing one step runs it as a single-module flow preview, so an agent's calls land on that
+	// preview's own status. They arrive while it is still running, which is when they are worth
+	// showing, so they have to be read before the loading short-circuit.
+	const agentModule = testState.testJob?.['flow_status']?.modules?.[0]
+	const agentActions = agentModule?.agent_actions
+		? {
+				agent_actions: agentModule.agent_actions,
+				agent_actions_success: agentModule.agent_actions_success
+			}
+		: undefined
+	if (testState.loading) {
 		return {
 			type: 'InProgress',
-			args: {}
+			args: {},
+			...agentActions
 		}
 	} else if (testState.testJob) {
 		return {
@@ -44,7 +56,8 @@ export function jobToGraphModuleState(testState: ModuleTestState): GraphModuleSt
 			duration_ms: testState.testJob['duration_ms'],
 			started_at: testState.testJob.started_at
 				? new Date(testState.testJob.started_at).getTime()
-				: undefined
+				: undefined,
+			...agentActions
 		}
 	}
 }
diff --git a/frontend/src/lib/components/prop_picker.ts b/frontend/src/lib/components/prop_picker.ts
index ced6a5e890..729d60409c 100644
--- a/frontend/src/lib/components/prop_picker.ts
+++ b/frontend/src/lib/components/prop_picker.ts
@@ -9,4 +9,7 @@ export type FlowPropPickerConfig = {
 export type PropPickerContext = {
 	flowPropPickerConfig: Writable<FlowPropPickerConfig | undefined>
 	pickablePropertiesFiltered: Writable<PickableProperties | undefined>
+	/** True when the panel is a modal, which covers the graph. Connecting there could never
+	 *  be completed by clicking a step node, so the graph stays out of it. */
+	inModalPanel?: () => boolean
 }
diff --git a/frontend/src/lib/components/raw_apps/RawAppDataTableDrawer.svelte b/frontend/src/lib/components/raw_apps/RawAppDataTableDrawer.svelte
index 6a6a2a646f..5f0488638d 100644
--- a/frontend/src/lib/components/raw_apps/RawAppDataTableDrawer.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppDataTableDrawer.svelte
@@ -13,6 +13,8 @@
 	import type { DbInput } from '../dbTypes'
 	import type { SelectedTable } from '../DBManager.svelte'
 	import { getRawAppOperatingWorkspace } from './rawAppWorkspace'
+	import { useDbManagerTag } from '../dbManagerTag.svelte'
+	import DbWorkerTagButton from '../DbWorkerTagButton.svelte'
 
 	const getOpWs = getRawAppOperatingWorkspace()
 	let opWs = $derived(getOpWs?.() ?? $workspaceStore)
@@ -148,6 +150,13 @@
 
 	// Can add: has tables selected
 	const canAdd = $derived(selectedDatatable && selectedTables.length > 0)
+
+	// Shares the drawer-set override with the Database Manager: same data table,
+	// same worker group needed to reach it.
+	const workerTag = useDbManagerTag(
+		() => opWs,
+		() => dbInput
+	)
 </script>
 
 <svelte:window bind:innerWidth={windowWidth} />
@@ -171,6 +180,7 @@
 					bind:this={dbManagerContent}
 					input={dbInput}
 					workspace={opWs}
+					bind:workerTag={() => workerTag.tag, (v) => (workerTag.tag = v)}
 					bind:hasReplResult
 					bind:selectedSchemaKey
 					bind:selectedTableKey
@@ -218,6 +228,14 @@
 				{/if}
 			</Button>
 
+			{#if dbInput && opWs}
+				<DbWorkerTagButton
+					bind:tag={() => workerTag.tag, (v) => (workerTag.tag = v)}
+					input={dbInput}
+					workspace={opWs}
+				/>
+			{/if}
+
 			<Button
 				loading={dbManagerContent?.isLoading() ?? false}
 				on:click={() => dbManagerContent?.refresh()}
diff --git a/frontend/src/lib/components/raw_apps/RawAppEditor.svelte b/frontend/src/lib/components/raw_apps/RawAppEditor.svelte
index 31e99dbe89..9d49f7b7ea 100644
--- a/frontend/src/lib/components/raw_apps/RawAppEditor.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppEditor.svelte
@@ -7,7 +7,7 @@
 	import RawAppYamlEditor, { type RawAppYamlUpdate } from './RawAppYamlEditor.svelte'
 	import type Drawer from '../common/drawer/Drawer.svelte'
 	import Alert from '../common/alert/Alert.svelte'
-	import { type Policy, WorkspaceService } from '$lib/gen'
+	import { AppService, type Policy, WorkspaceService } from '$lib/gen'
 	import DiffDrawer from '../DiffDrawer.svelte'
 	import { deepEqual } from 'fast-equals'
 
@@ -54,9 +54,12 @@
 	} from 'lucide-svelte'
 	import DraggableTabs, { type TabItem } from '$lib/components/common/tabs/DraggableTabs.svelte'
 	import { runScriptAndPollResult } from '../jobs/utils'
+	import { writingJobOptions } from '../jobs/writingJob'
 	import { RawAppHistoryManager } from './RawAppHistoryManager.svelte'
 	import { sendUserToast } from '$lib/utils'
 	import { UserDraftDbSyncer } from '$lib/userDraftDbSyncer.svelte'
+	import { UserDraft } from '$lib/userDraft.svelte'
+	import { setOpenInSessionHandoff } from '$lib/components/sessions/openInSessionContext'
 	import {
 		buildDataTableWhitelist,
 		parseDataTableRef,
@@ -207,6 +210,40 @@
 	// drawers, DB selector) so their lookups target the app's workspace too.
 	setRawAppOperatingWorkspace(() => opWorkspace)
 
+	// The path autosaves land on, which is what the session preview loads the app by.
+	const draftStoragePath = $derived(autosavePath ?? liveEditorDraftStoragePath)
+
+	// Materialize a brand-new app's draft before the session preview loads it by
+	// path — an untouched new app never autosaved, so forcePersist is the only
+	// thing that creates the row. Gated to never-deployed: forcePersist skips the
+	// discardIf baseline, safe only when there is none.
+	async function persistDraftForSession(): Promise<void> {
+		if (!opWorkspace || draftStoragePath === undefined) return
+		await UserDraftDbSyncer.flush({
+			workspace: opWorkspace,
+			itemKind: 'raw_app',
+			path: draftStoragePath
+		})
+		if (newApp) {
+			await UserDraft.forcePersist('raw_app', draftStoragePath, { workspace: opWorkspace })
+		}
+	}
+
+	const sessionOpen = $derived(
+		path
+			? {
+					target: { kind: 'raw_app' as const, path },
+					workspaceId: opWorkspace ?? undefined,
+					beforeOpen: persistDraftForSession
+				}
+			: undefined
+	)
+
+	// Reaches the AI entry point in an inline script's toolbar, which sits too deep
+	// in the sidebar to be handed a prop. A raw app has no addressable sub-editor,
+	// so the preview just opens the app.
+	setOpenInSessionHandoff({ source: () => sessionOpen })
+
 	// Convert to object format for child components
 	let dataTableRefsObjects = $derived(data.tables.map(parseDataTableRef))
 	let dataTableWhitelist = $derived(buildDataTableWhitelist(dataTableRefsObjects))
@@ -299,6 +336,7 @@
 	historyManager.manualSnapshot(files ?? {}, runnables, summary, data)
 
 	let iframe: HTMLIFrameElement | undefined = $state(undefined)
+	const PREVIEW_SHELL_URL = '/ui_builder/app-preview.html'
 	let previewIframe: HTMLIFrameElement | undefined = $state(undefined)
 	let previewIframeLoaded = $state(false)
 	let lastBuild: { css: string; js: string } | undefined = undefined
@@ -306,6 +344,10 @@
 	// inline pane. Kept live-synced: every build is replayed into it until the
 	// user closes it. Not reactive — it's a window handle, not UI state.
 	let externalPreviewWindow: Window | null = null
+	// Mirrors `previewIframeLoaded` for the detached window: its reload is only
+	// initiated, never awaited, so a build posted meanwhile would run in the
+	// retiring document and again in its replacement.
+	let externalPreviewReady = $state(false)
 	let inspectorEnabled = $state(false)
 	let bundlerType: 'esbuild' | 'rolldown' = $state('esbuild')
 
@@ -1020,14 +1062,17 @@
 				}
 
 				try {
-					const result = await runScriptAndPollResult({
-						workspace: opWorkspace,
-						requestBody: {
-							language: 'postgresql',
-							content: sql,
-							args: { database: `datatable://${datatableName}` }
-						}
-					})
+					const result = await runScriptAndPollResult(
+						{
+							workspace: opWorkspace,
+							requestBody: {
+								language: 'postgresql',
+								content: sql,
+								args: { database: `datatable://${datatableName}` }
+							}
+						},
+						writingJobOptions
+					)
 
 					// If newTable was specified and the query succeeded, add it to data.tables
 					if (newTable) {
@@ -1104,6 +1149,7 @@
 			e.source === externalPreviewWindow &&
 			e.origin === window.location.origin
 		) {
+			externalPreviewReady = true
 			feedExternalPreview()
 			return
 		}
@@ -1274,6 +1320,7 @@
 	function postToExternalPreview(msg: Record<string, unknown>) {
 		if (!externalPreviewWindow || externalPreviewWindow.closed) {
 			externalPreviewWindow = null
+			externalPreviewReady = false
 			return
 		}
 		// Restrict to our own origin: the detached window loads same-origin
@@ -1282,9 +1329,105 @@
 		externalPreviewWindow.postMessage(msg, window.location.origin)
 	}
 
+	// `app-preview.html` evaluates the js we post, so prefixing the env is what a
+	// bundled `windmill-client` needs — it reads `window.process.env` at module
+	// load. Gated and scoped exactly like a deployed app — sandbox off or no
+	// scopes means no env at all — so preview hits the same 403s, and the same
+	// misconfiguration, as the deployed bundle.
+
+	// Stated on every payload, tokenless included: the preview shell reuses one
+	// window across builds, so omitting it would leave an old token in place.
+	// Deleting rather than blanking matches a deployed app with no scopes.
+	const NO_SDK_ENV_JS = 'try { delete window.process } catch (_) {}\n'
+	let previewSdkEnvJs = $state(NO_SDK_ENV_JS)
+	// Identifies the request whose answer is still wanted. Toggling scopes starts a
+	// new mint while an older one is in flight, and an out-of-order answer would
+	// otherwise hand the preview the wrong scope set — or restore a token after all
+	// scopes were removed.
+	let previewSdkKey: string | undefined = undefined
+	// Holds the build back between dropping a credential and settling its
+	// replacement, so the app mounts once — with the final credential — instead of
+	// once tokenless and again tokenful, running mount-time side effects twice.
+	let previewSdkPending = $state(false)
+
+	/** Discard the running app. The shell resets the DOM but keeps the JavaScript
+	 * realm, so only a reload drops the old bundle's timers, listeners and the
+	 * token its client captured at module load. */
+	function restartPreviewRealm() {
+		if (!lastBuild) return // nothing running yet
+		previewIframeLoaded = false
+		if (previewIframe) previewIframe.src = PREVIEW_SHELL_URL
+		if (externalPreviewWindow && !externalPreviewWindow.closed) {
+			externalPreviewReady = false
+			// User app code can navigate this window elsewhere, which makes its
+			// location cross-origin and unreachable — that document holds no token.
+			try {
+				externalPreviewWindow.location.replace(PREVIEW_SHELL_URL)
+			} catch (_) {}
+		}
+	}
+
+	/** Settle the credential and let the app start: the reloaded shells replay the
+	 * build themselves (the iframe from its `load` handler, the detached window
+	 * from `appPreviewReady`), so this only covers a shell already back up. */
+	function applyPreviewSdkEnv(js: string) {
+		previewSdkEnvJs = js
+		previewSdkPending = false
+		if (lastBuild) feedPreviewIframe(lastBuild)
+		syncExternalPreview()
+	}
+
+	$effect(() => {
+		// Frontend SDK access is sandbox-only, so isolation off gets no credential
+		// here either, however the policy's scope list reads.
+		const scopes = policy?.sandbox === true ? (policy?.frontend_sdk_scopes ?? []) : []
+		const ws = opWorkspace
+		const key = `${ws ?? ''}|${scopes.join(',')}`
+		if (key === previewSdkKey) return
+		previewSdkKey = key
+		// Drop the old credential before asking for its replacement, never after:
+		// a mint is asynchronous, and until it answers the running preview — and
+		// any build fed meanwhile — would keep scopes the policy just removed, or
+		// a token for the workspace we just left.
+		const willMint = scopes.length > 0 && !!ws
+		previewSdkPending = willMint
+		previewSdkEnvJs = NO_SDK_ENV_JS
+		restartPreviewRealm()
+		if (willMint) mintPreviewSdkToken(scopes, ws, key)
+	})
+
+	async function mintPreviewSdkToken(scopes: string[], ws: string, key: string) {
+		try {
+			const token = await AppService.mintPreviewSdkToken({
+				workspace: ws,
+				requestBody: { path, scopes }
+			})
+			if (key !== previewSdkKey) return
+			applyPreviewSdkEnv(
+				`window.process = { env: ${JSON.stringify({
+					WM_RAW_APP: 'true',
+					WM_TOKEN: token,
+					BASE_URL: window.location.origin,
+					WM_WORKSPACE: ws
+				}).replace(/</g, '\\u003c')} };\n`
+			)
+		} catch (e) {
+			// Already tokenless — the effect cleared the env before calling us — so
+			// this only releases the build. The key stays set, so a failed mint is not
+			// retried until the scopes or workspace actually change.
+			console.warn('Could not mint a preview SDK token', e)
+			if (key === previewSdkKey) applyPreviewSdkEnv(NO_SDK_ENV_JS)
+		}
+	}
+
 	function syncExternalPreview() {
+		if (previewSdkPending || !externalPreviewReady) return
 		if (lastBuild) {
-			postToExternalPreview({ type: 'preview', css: lastBuild.css, js: lastBuild.js })
+			postToExternalPreview({
+				type: 'preview',
+				css: lastBuild.css,
+				js: previewSdkEnvJs + lastBuild.js
+			})
 		}
 	}
 
@@ -1292,11 +1435,17 @@
 	// overlays first: a fresh render supersedes the old crash or blank, and
 	// app-preview.html re-posts if the new render fails the same way.
 	function feedPreviewIframe(build: { css: string; js: string }) {
+		// Between dropping a credential and settling its replacement the shell stays
+		// blank; whichever settles last — the mint or the shell's own `load` — starts
+		// the app. Same for a shell still reloading: its `load` handler replays.
+		if (previewSdkPending || !previewIframeLoaded) return
 		runtimeError = undefined
 		emptyRender = false
+		// Same-origin app-preview.html, and the payload now carries a token — address
+		// it to our origin rather than '*', as the detached preview already does.
 		previewIframe?.contentWindow?.postMessage(
-			{ type: 'preview', css: build.css, js: build.js },
-			'*'
+			{ type: 'preview', css: build.css, js: previewSdkEnvJs + build.js },
+			window.location.origin
 		)
 	}
 
@@ -1326,22 +1475,23 @@
 		}
 		// Scope the window name per app path so two open editors don't fight over
 		// (or take over / close) one shared OS-level preview window.
-		const win = window.open(
-			'/ui_builder/app-preview.html',
-			`windmillRawAppPreview:${encodeURIComponent(path)}`
-		)
+		const win = window.open(PREVIEW_SHELL_URL, `windmillRawAppPreview:${encodeURIComponent(path)}`)
 		if (!win) {
 			sendUserToast('Could not open the preview window (popup blocked?)', true)
 			return
 		}
 		externalPreviewWindow = win
+		externalPreviewReady = false
 		// Initial feed: fires once when the freshly opened tab loads. This is the
 		// only feed path against an app-preview.html that predates the
 		// `appPreviewReady` handshake, so the window isn't blank on first open
 		// regardless of the pinned UI Builder artifact. A manual refresh is
 		// covered separately by the handshake in `listener` (this listener is
 		// bound to the now-stale document and won't fire again).
-		win.addEventListener('load', () => feedExternalPreview())
+		win.addEventListener('load', () => {
+			externalPreviewReady = true
+			feedExternalPreview()
+		})
 	}
 
 	let getBundleResolve: (({ css, js }: { css: string; js: string }) => void) | undefined = undefined
@@ -2087,6 +2237,7 @@
 		{newPath}
 		{labels}
 		appPath={path}
+		{sessionOpen}
 		{liveEditorDraftStoragePath}
 		{autosaveWorkspace}
 		{autosavePath}
@@ -2361,7 +2512,7 @@
 								<iframe
 									bind:this={previewIframe}
 									title="App preview"
-									src="/ui_builder/app-preview.html"
+									src={PREVIEW_SHELL_URL}
 									class="w-full flex-1 block"
 								></iframe>
 								{#if buildError}
diff --git a/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte b/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte
index 31a98554e0..58329fac6c 100644
--- a/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte
@@ -9,8 +9,9 @@
 
 	import { AppService, type Policy } from '$lib/gen'
 	import { UserDraft } from '$lib/userDraft.svelte'
-	import { UserDraftDbSyncer } from '$lib/userDraftDbSyncer.svelte'
-	import OpenInSessionButton from '$lib/components/sessions/OpenInSessionButton.svelte'
+	import OpenInSessionButton, {
+		type OpenInSessionSource
+	} from '$lib/components/sessions/OpenInSessionButton.svelte'
 	import { discardDraftAfterDeploy } from '$lib/userDraftToast'
 	import { enterpriseLicense, userStore, userWorkspaces, workspaceStore } from '$lib/stores'
 	import {
@@ -71,7 +72,7 @@
 	import { AIBtnClasses } from '../copilot/chat/AIButtonStyle'
 	import { stripRawAppDiffNoise } from './utils'
 	import type { RawAppData } from './dataTableRefUtils'
-	import { buildForkEditUrl, editInForkAllowed, editInForkLabel } from '$lib/utils/editInFork'
+	import { editInForkAllowed, editInForkLabel, openEditInFork } from '$lib/utils/editInFork'
 	import { isCloudHosted } from '$lib/cloud'
 
 	// async function hash(message) {
@@ -113,6 +114,9 @@
 		/** Initial labels for the app, threaded from the loaded app data. */
 		labels?: string[]
 		appPath: string
+		/** "Open in AI session" hand-off, owned by the editor (it persists the
+		 * draft the session preview loads). Undefined until the app has a path. */
+		sessionOpen?: OpenInSessionSource
 		runnables: Record<string, Runnable>
 		files: Record<string, string> | undefined
 		/** Data configuration including tables and creation policy */
@@ -178,6 +182,7 @@
 		newPath = '',
 		labels: initialLabels = undefined,
 		appPath,
+		sessionOpen,
 		runnables,
 		data,
 		files,
@@ -216,22 +221,6 @@
 	const opWorkspace = $derived(autosaveWorkspace ?? $workspaceStore)
 	const indicatorPath = $derived(autosavePath ?? liveEditorDraftStoragePath)
 
-	// Materialize a brand-new app's draft before the session preview loads it by
-	// path — an untouched new app never autosaved, so forcePersist is the only
-	// thing that creates the row (`appPath === indicatorPath` in the full-page
-	// editor). Gated to never-deployed: forcePersist skips the discardIf baseline.
-	async function persistDraftForSession(): Promise<void> {
-		if (!opWorkspace || indicatorPath === undefined) return
-		await UserDraftDbSyncer.flush({
-			workspace: opWorkspace,
-			itemKind: 'raw_app',
-			path: indicatorPath
-		})
-		if (newApp) {
-			await UserDraft.forcePersist('raw_app', indicatorPath, { workspace: opWorkspace })
-		}
-	}
-
 	$effect(() => {
 		const typed = newEditedPath
 		const baseline = savedApp?.path ?? ''
@@ -870,17 +859,7 @@
 			</Button>
 		</div>
 		<AppExportButton bind:this={appExport} />
-		<OpenInSessionButton
-			source={appPath
-				? {
-						target: { kind: 'raw_app', path: appPath },
-						workspaceId: opWorkspace ?? undefined,
-						// Persist the draft (and materialize a brand-new one) so the session
-						// preview opens the app exactly as it is in the editor right now.
-						beforeOpen: persistDraftForSession
-					}
-				: undefined}
-		>
+		<OpenInSessionButton source={sessionOpen}>
 			{#snippet fallback()}
 				<Button
 					unifiedSize={headerBtnSize}
@@ -913,7 +892,7 @@
 									{
 										label: editInForkLabel(opWorkspace, $userWorkspaces),
 										onClick: () => {
-											window.open(buildForkEditUrl('raw_app', appPath))
+											openEditInFork('raw_app', appPath, opWorkspace)
 										}
 									}
 								]
diff --git a/frontend/src/lib/components/raw_apps/RawAppPreview.svelte b/frontend/src/lib/components/raw_apps/RawAppPreview.svelte
index d9ec6c5e5d..125612336f 100644
--- a/frontend/src/lib/components/raw_apps/RawAppPreview.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppPreview.svelte
@@ -4,6 +4,12 @@
 	import type { Runnable } from './rawAppPolicy'
 	import { getContext, onMount, untrack } from 'svelte'
 	import { unsandboxedRawAppHtml } from './utils'
+	import { randomSecret } from '$lib/utils/uuid'
+
+	// Per-mount secret proving a `windmill:ready` came from the document we loaded.
+	// It is the only thing authenticating that document — a port proves nothing,
+	// since any sender can transfer one — so it must not be guessable.
+	const handshakeNonce = randomSecret()
 
 	interface Props {
 		workspace: string
@@ -36,6 +42,11 @@
 	// same-origin with full access (the default); otherwise the opaque-origin sandbox.
 	const unsandboxedCtx = getContext<{ value: boolean }>('IS_APP_UNSANDBOXED')
 	let unsandboxed = $derived(unsandboxedCtx?.value ?? false)
+
+	// Viewer-scoped frontend SDK token (PublicAppFrame mints it after the viewer
+	// consents). Sandbox-only, so it reaches the bundle through the handshake
+	// below — the unsandboxed wrapper never carries a credential.
+	const sdkTokenCtx = getContext<{ value: string | undefined }>('RAW_APP_SDK_TOKEN')
 	// Unsandboxed (the default) must match the pre-isolation viewer exactly: NO
 	// sandbox attribute (a same-origin blob with full session — an attribute would
 	// only break leftover features like unsandboxed popups for OAuth flows, while
@@ -52,10 +63,11 @@
 	// - DEFAULT (isolated): a real API URL serving a sandboxed, opaque-origin
 	//   document (`CSP: sandbox` response header + the iframe sandbox attribute),
 	//   so a malicious bundle can never reach the authenticated Windmill origin
-	//   (no cookie, no window.parent, no token). Root-relative so it resolves
-	//   against the real host even when this component itself runs inside an opaque
-	//   viewer (where `location.origin` is "null"). Context is handed over via
-	//   postMessage — never baked into the document, never a credential.
+	//   (no cookie, no window.parent). Root-relative so it resolves against the
+	//   real host even when this component itself runs inside an opaque viewer
+	//   (where `location.origin` is "null"). Context — and, when the viewer
+	//   approved SDK scopes, the viewer-scoped token — is handed over via
+	//   postMessage, never baked into the document.
 	// - UNSANDBOXED (the default — publisher did not opt into isolation): a
 	//   client-built blob: wrapper (same-origin with the SPA) loaded with `allow-same-origin`,
 	//   so relative `fetch('/api/...')` and the session cookie work. The backend
@@ -86,9 +98,11 @@
 		// — the wrapper would otherwise be blocked outright, URL flag or not.
 		const coep =
 			new URLSearchParams(window.location.search).has('wm_coep') || window.crossOriginIsolated
-				? '?wm_coep=1'
+				? 'wm_coep=1&'
 				: ''
-		return `/api/w/${workspace}/apps_u/get_data/v/${secret}.html${coep}`
+		// wm_hs: the handshake nonce, readable only by the document we load here —
+		// see `respondCtx` for what it gates.
+		return `/api/w/${workspace}/apps_u/get_data/v/${secret}.html?${coep}wm_hs=${handshakeNonce}`
 	})
 
 	// Revoke blob: URLs (unsandboxed path) when they change or on unmount.
@@ -122,6 +136,11 @@
 	const framed = typeof window !== 'undefined' && window.parent !== window && !storageAccessible()
 	let bundleStorage: Record<string, string> | undefined = undefined
 	let pendingReady = false
+	// The `windmill:ready` we could not answer yet (storage still loading). Holding
+	// the port is what makes the deferred reply safe: it stays bound to the document
+	// that sent it even if the frame is navigated while we wait.
+	let pendingNonce: string | undefined = undefined
+	let pendingPort: MessagePort | undefined = undefined
 
 	function readDirect(): Record<string, string> {
 		try {
@@ -141,18 +160,28 @@
 		} catch (_) {}
 	}
 
-	function respondCtx() {
-		iframe?.contentWindow?.postMessage(
-			{
-				type: 'windmill:ctx',
-				// Same shape as the unsandboxed wrapper: always the object, so
-				// `window.ctx.workspace` works for anonymous viewers too.
-				ctx: { ctx: user, workspace },
-				initialHash,
-				storage: { local: bundleStorage ?? {}, session: {} }
-			},
-			'*'
-		)
+	/** The nonce authenticates the asker: it lives in our URL, which a document
+	 * navigated into the frame can't read. Replying on the port that document
+	 * transferred then keeps the answer from landing in whatever document is
+	 * active by the time we reply. Both are needed. */
+	function respondCtx(nonceEcho?: string, port?: MessagePort) {
+		// No port means the sender is not a wrapper we served — every one of ours
+		// transfers one. Answering anyway would hand the viewer's identity to it.
+		if (!port) return
+		const sdkToken = nonceEcho === handshakeNonce ? sdkTokenCtx?.value : undefined
+		const payload = {
+			type: 'windmill:ctx',
+			// Same shape as the unsandboxed wrapper: always the object, so
+			// `window.ctx.workspace` works for anonymous viewers too.
+			ctx: { ctx: user, workspace },
+			initialHash,
+			storage: { local: bundleStorage ?? {}, session: {} },
+			// The wrapper turns this into `window.process.env` before it injects the
+			// bundle, which is what a bundled `windmill-client` reads at module load.
+			// `baseUrl` comes from here because the bundle's own origin is opaque.
+			...(sdkToken ? { sdk: { token: sdkToken, baseUrl: window.location.origin, workspace } } : {})
+		}
+		port.postMessage(payload)
 	}
 
 	onMount(() => {
@@ -171,7 +200,7 @@
 					bundleStorage = {}
 					if (pendingReady) {
 						pendingReady = false
-						respondCtx()
+						respondCtx(pendingNonce, pendingPort)
 					}
 				}
 			}, 750)
@@ -187,7 +216,7 @@
 				bundleStorage = data.data || {}
 				if (pendingReady) {
 					pendingReady = false
-					respondCtx()
+					respondCtx(pendingNonce, pendingPort)
 				}
 				return
 			}
@@ -195,13 +224,17 @@
 			if (event.source !== iframe?.contentWindow) return
 			if (data?.type === 'windmill:ready') {
 				// Hand the bundle its context + shared storage before it evaluates.
+				const nonceEcho = typeof data.nonce === 'string' ? data.nonce : undefined
+				const port = event.ports?.[0]
 				if (!framed) {
 					bundleStorage = readDirect()
-					respondCtx()
+					respondCtx(nonceEcho, port)
 				} else if (bundleStorage !== undefined) {
-					respondCtx()
+					respondCtx(nonceEcho, port)
 				} else {
 					pendingReady = true
+					pendingNonce = nonceEcho
+					pendingPort = port
 				}
 			} else if (data?.type === 'wm_ls_op') {
 				// The bundle mutated localStorage — apply it to the shared store.
diff --git a/frontend/src/lib/components/raw_apps/RawAppSdkConsent.svelte b/frontend/src/lib/components/raw_apps/RawAppSdkConsent.svelte
new file mode 100644
index 0000000000..1f28cd02c0
--- /dev/null
+++ b/frontend/src/lib/components/raw_apps/RawAppSdkConsent.svelte
@@ -0,0 +1,52 @@
+<script lang="ts">
+	import { Button } from '$lib/components/common'
+	import Toggle from '$lib/components/Toggle.svelte'
+	import { ShieldCheck } from 'lucide-svelte'
+	import { sdkScopeDescription, sdkScopeLabel } from './sdkScopes'
+
+	let {
+		scopes,
+		onContinue,
+		onDecline
+	}: {
+		/** Scopes the app policy declares for its frontend SDK token. */
+		scopes: string[]
+		/** Fired when the viewer accepts; `dontAskAgain` persists the consent for
+		 * this app path so the prompt is skipped until the declared scopes grow. */
+		onContinue: (dontAskAgain: boolean) => void
+		/** Fired when the viewer declines: the app still renders, its frontend code
+		 * just gets no token (SDK calls fail). */
+		onDecline: () => void
+	} = $props()
+
+	let dontAskAgain = $state(false)
+</script>
+
+<div class="px-4 mt-20 max-w-xl mx-auto">
+	<div class="border rounded-md p-6 bg-surface shadow-sm flex flex-col gap-4">
+		<div class="flex items-center gap-2">
+			<ShieldCheck size={20} class="text-primary" />
+			<div class="text-lg font-semibold">This app requires the following permissions</div>
+		</div>
+		<p class="text-sm text-secondary">
+			The app's code will be able to call the Windmill API on your behalf, restricted to:
+		</p>
+		<ul class="flex flex-col gap-2">
+			{#each scopes as scope (scope)}
+				<li class="text-sm">
+					<span class="font-medium">{sdkScopeLabel(scope)}</span>
+					{#if sdkScopeDescription(scope)}
+						<span class="text-tertiary"> — {sdkScopeDescription(scope)}</span>
+					{/if}
+				</li>
+			{/each}
+		</ul>
+		<div class="flex items-center justify-between gap-4 pt-2">
+			<Toggle bind:checked={dontAskAgain} size="xs" options={{ right: 'Do not ask again' }} />
+			<div class="flex items-center gap-2">
+				<Button variant="default" onclick={onDecline}>Open without granting</Button>
+				<Button variant="accent" onclick={() => onContinue(dontAskAgain)}>Continue</Button>
+			</div>
+		</div>
+	</div>
+</div>
diff --git a/frontend/src/lib/components/raw_apps/RawAppTemplatePicker.svelte b/frontend/src/lib/components/raw_apps/RawAppTemplatePicker.svelte
index e37892516b..efcae2af6a 100644
--- a/frontend/src/lib/components/raw_apps/RawAppTemplatePicker.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppTemplatePicker.svelte
@@ -1,7 +1,8 @@
 <script lang="ts">
-	import { Sparkles, Plus, List, Ban, ExternalLinkIcon } from 'lucide-svelte'
+	import { Sparkles, Plus, List, Ban, ExternalLinkIcon, Loader2 } from 'lucide-svelte'
 	import type { Policy } from '$lib/gen'
-	import { userStore, workspaceStore } from '$lib/stores'
+	import { superadmin, userStore, workspaceStore } from '$lib/stores'
+	import { base } from '$lib/base'
 	import { sendUserToast } from '$lib/toast'
 	import { getRawAppOperatingWorkspace } from './rawAppWorkspace'
 	import Modal from '$lib/components/common/modal/Modal.svelte'
@@ -13,7 +14,8 @@
 	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
 	import { Alert } from '$lib/components/common'
 	import { AIBtnClasses } from '$lib/components/copilot/chat/AIButtonStyle'
-	import { copilotInfo } from '$lib/aiStore'
+	import { copilotInfo, copilotWorkspace } from '$lib/aiStore'
+	import { loadCopilot } from '$lib/components/copilot/loadCopilot'
 	import { react18Template, react19Template, svelte5Template } from './templates'
 	import type { Runnable } from './rawAppPolicy'
 	import { type DataTableRef, type RawAppData, formatDataTableRef } from './dataTableRefUtils'
@@ -117,7 +119,19 @@
 	)
 
 	const hasNoDatatables = $derived(availableDatatables?.length === 0)
-	const isAiEnabled = $derived($copilotInfo.enabled)
+
+	// copilotInfo is a global that stays empty until some ancestor's fetch lands, so
+	// `enabled` alone cannot tell "no providers" from "not loaded yet" and the modal
+	// would announce AI as unconfigured while it is merely unknown. Gate on the
+	// config describing opWs, and load it here so the claim owns its own evidence.
+	const aiConfigLoaded = $derived(!!opWs && $copilotWorkspace === opWs)
+	const isAiEnabled = $derived(aiConfigLoaded && $copilotInfo.enabled)
+
+	$effect(() => {
+		if (open && opWs && !aiConfigLoaded) {
+			loadCopilot(opWs)
+		}
+	})
 
 	async function start(withPrompt: boolean) {
 		const template = templates[selectedTemplateIndex]
@@ -334,17 +348,39 @@
 					<span class="text-xs font-normal text-tertiary">(optional)</span>
 				</h2>
 
-				{#if !isAiEnabled}
-					<Alert type="info" title="AI is not configured for this workspace.">
+				{#if !aiConfigLoaded}
+					<div class="flex items-center gap-2 text-xs text-tertiary">
+						<Loader2 size={14} class="animate-spin" />
+						Loading AI settings...
+					</div>
+				{:else if !isAiEnabled}
+					<Alert type="info" title="AI is not configured.">
 						You can still create an app manually but using AI is highly recommended.
 						<br />
 						{#if $userStore?.is_admin}
 							Configure AI in
 							<a
-								href="/workspace_settings?tab=ai"
+								href="{base}/workspace_settings?tab=ai"
 								target="_blank"
 								class="inline-flex items-center gap-1 font-semibold"
 								>workspace settings <ExternalLinkIcon size={16} />
+							</a>
+							{#if $superadmin}
+								or
+								<a
+									href="{base}/?workspace=admins#superadmin-settings"
+									target="_blank"
+									class="inline-flex items-center gap-1 font-semibold"
+									>instance settings <ExternalLinkIcon size={16} />
+								</a>
+							{/if} to enable this feature.
+						{:else if $superadmin}
+							Configure AI in
+							<a
+								href="{base}/?workspace=admins#superadmin-settings"
+								target="_blank"
+								class="inline-flex items-center gap-1 font-semibold"
+								>instance settings <ExternalLinkIcon size={16} />
 							</a> to enable this feature.
 						{:else}
 							Ask your workspace admin to configure AI in workspace settings to enable this feature.
diff --git a/frontend/src/lib/components/raw_apps/RawAppYamlEditor.svelte b/frontend/src/lib/components/raw_apps/RawAppYamlEditor.svelte
index 59b0885989..4ac143976b 100644
--- a/frontend/src/lib/components/raw_apps/RawAppYamlEditor.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppYamlEditor.svelte
@@ -25,14 +25,7 @@
 		onApply: (update: RawAppYamlUpdate) => void
 	}
 
-	let {
-		drawer = $bindable(),
-		summary,
-		files,
-		runnables,
-		data,
-		onApply
-	}: Props = $props()
+	let { drawer = $bindable(), summary, files, runnables, data, onApply }: Props = $props()
 
 	let code = $state('')
 	let initialCode = $state('')
@@ -106,6 +99,7 @@
 					minHeight={editorHeight}
 					bind:code
 					lang="yaml"
+					leadingChangeSync
 				/>
 			</div>
 		{/await}
diff --git a/frontend/src/lib/components/raw_apps/sdkScopes.test.ts b/frontend/src/lib/components/raw_apps/sdkScopes.test.ts
new file mode 100644
index 0000000000..68aba9c545
--- /dev/null
+++ b/frontend/src/lib/components/raw_apps/sdkScopes.test.ts
@@ -0,0 +1,27 @@
+import { beforeEach, describe, expect, it } from 'vitest'
+
+import { hasStoredSdkConsent, storeSdkConsent } from './sdkScopes'
+
+describe('stored frontend SDK consent', () => {
+	beforeEach(() => localStorage.clear())
+
+	it('only covers scopes the viewer actually approved', () => {
+		storeSdkConsent('a@w.dev', 'ws', 'u/a/app', ['users:read'])
+		expect(hasStoredSdkConsent('a@w.dev', 'ws', 'u/a/app', ['users:read'])).toBe(true)
+		// The app added a scope after the viewer consented: it must ask again
+		// rather than silently minting a broader token.
+		expect(hasStoredSdkConsent('a@w.dev', 'ws', 'u/a/app', ['users:read', 'jobs:run'])).toBe(false)
+	})
+
+	it('does not leak one viewer or app to another', () => {
+		storeSdkConsent('a@w.dev', 'ws', 'u/a/app', ['users:read'])
+		expect(hasStoredSdkConsent('b@w.dev', 'ws', 'u/a/app', ['users:read'])).toBe(false)
+		expect(hasStoredSdkConsent('a@w.dev', 'ws', 'u/a/other', ['users:read'])).toBe(false)
+		expect(hasStoredSdkConsent('a@w.dev', 'other', 'u/a/app', ['users:read'])).toBe(false)
+	})
+
+	it('treats unreadable storage as no consent', () => {
+		localStorage.setItem('wm_sdk_consent:a@w.dev:ws:u/a/app', 'not json')
+		expect(hasStoredSdkConsent('a@w.dev', 'ws', 'u/a/app', ['users:read'])).toBe(false)
+	})
+})
diff --git a/frontend/src/lib/components/raw_apps/sdkScopes.ts b/frontend/src/lib/components/raw_apps/sdkScopes.ts
new file mode 100644
index 0000000000..f0ece00c3e
--- /dev/null
+++ b/frontend/src/lib/components/raw_apps/sdkScopes.ts
@@ -0,0 +1,76 @@
+// Frontend-SDK permissions for raw apps: the curated scopes an app author may
+// declare in `policy.frontend_sdk_scopes` (mirrors FRONTEND_SDK_ALLOWED_SCOPES
+// in the backend `apps.rs` — both lists must stay in sync), plus the viewer-side
+// consent persistence for the permission banner.
+
+export const FRONTEND_SDK_SCOPES: { value: string; label: string; description: string }[] = [
+	{
+		value: 'jobs:run',
+		label: 'Run scripts and flows',
+		description: 'Execute any script or flow the viewer can run, and read jobs'
+	},
+	{
+		value: 'jobs:read',
+		label: 'Read jobs and results',
+		description: 'Read jobs and their results, and list the runs the viewer can see'
+	},
+	{
+		value: 'users:read',
+		label: 'Read your identity',
+		description: 'Call whoami (Read the viewer username, email, groups, is_super_admin...)'
+	},
+	{
+		value: 'resources:read',
+		label: 'Read resources',
+		description: 'Read resource values the viewer can access, including credentials'
+	},
+	{
+		value: 'variables:read',
+		label: 'Read variables',
+		description: 'Read variable values the viewer can access'
+	}
+]
+
+export function sdkScopeLabel(scope: string): string {
+	return FRONTEND_SDK_SCOPES.find((s) => s.value === scope)?.label ?? scope
+}
+
+export function sdkScopeDescription(scope: string): string | undefined {
+	return FRONTEND_SDK_SCOPES.find((s) => s.value === scope)?.description
+}
+
+// Keyed by viewer as well as app: this localStorage lives on the shared embedder
+// origin, so without the viewer one person's "do not ask again" would silently
+// suppress the prompt for the next person to use the same browser profile.
+function sdkConsentKey(viewer: string, workspace: string, path: string): string {
+	return `wm_sdk_consent:${viewer}:${workspace}:${path}`
+}
+
+/** True when a previously stored "do not ask again" consent covers every
+ * declared scope. A later deploy that adds scopes re-triggers the prompt. */
+export function hasStoredSdkConsent(
+	viewer: string,
+	workspace: string,
+	path: string,
+	scopes: string[]
+): boolean {
+	try {
+		const stored = JSON.parse(
+			localStorage.getItem(sdkConsentKey(viewer, workspace, path)) ?? 'null'
+		)
+		return Array.isArray(stored) && scopes.every((s) => stored.includes(s))
+	} catch (_) {
+		return false
+	}
+}
+
+export function storeSdkConsent(
+	viewer: string,
+	workspace: string,
+	path: string,
+	scopes: string[]
+): void {
+	try {
+		localStorage.setItem(sdkConsentKey(viewer, workspace, path), JSON.stringify(scopes))
+	} catch (_) { }
+}
diff --git a/frontend/src/lib/components/raw_apps/templates.ts b/frontend/src/lib/components/raw_apps/templates.ts
index 22fa773f85..ba630f0720 100644
--- a/frontend/src/lib/components/raw_apps/templates.ts
+++ b/frontend/src/lib/components/raw_apps/templates.ts
@@ -98,14 +98,13 @@ const indexCss = `.myclass {
 }`
 
 export const react19Template = {
-	'/index.tsx': reactIndex,
-	'/App.tsx': appTsx,
-	'/index.css': indexCss,
-	'/package.json': `{
+  '/index.tsx': reactIndex,
+  '/App.tsx': appTsx,
+  '/index.css': indexCss,
+  '/package.json': `{
     "dependencies": {
         "react": "19.0.0",
-        "react-dom": "19.0.0",
-        "windmill-client": "^1"
+        "react-dom": "19.0.0"
     },
     "devDependencies": {
         "@types/react-dom": "^19.0.0",
@@ -115,10 +114,10 @@ export const react19Template = {
 }
 
 export const react18Template = {
-	'/index.tsx': reactIndex,
-	'/App.tsx': appTsx,
-	'/index.css': indexCss,
-	'/package.json': `{
+  '/index.tsx': reactIndex,
+  '/App.tsx': appTsx,
+  '/index.css': indexCss,
+  '/package.json': `{
     "dependencies": {
         "react": "18.3.1",
         "react-dom": "18.3.1"
@@ -131,22 +130,21 @@ export const react18Template = {
 }
 
 export const svelte5Template = {
-	'/index.ts': indexSvelte,
-	'/App.svelte': appSvelte,
-	'/index.css': indexCss,
-	'/package.json': `{
+  '/index.ts': indexSvelte,
+  '/App.svelte': appSvelte,
+  '/index.css': indexCss,
+  '/package.json': `{
     "dependencies": {
-        "svelte": "^5.56.8",
-        "windmill-client": "^1"
+        "svelte": "^5.56.8"
     }
 }`
 }
 
 export const vueTemplate = {
-	'/index.ts': indexVue,
-	'/App.vue': appVue,
-	'/index.css': indexCss,
-	'/package.json': `{
+  '/index.ts': indexVue,
+  '/App.vue': appVue,
+  '/index.css': indexCss,
+  '/package.json': `{
     "dependencies": {
         "core-js": "3.26.1",
         "vue": "3.5.13"
@@ -155,10 +153,10 @@ export const vueTemplate = {
 }
 
 export const FRAMEWORK_TEMPLATES = {
-	react19: react19Template,
-	react18: react18Template,
-	svelte5: svelte5Template,
-	vue: vueTemplate
+  react19: react19Template,
+  react18: react18Template,
+  svelte5: svelte5Template,
+  vue: vueTemplate
 }
 
 export type FrameworkKey = keyof typeof FRAMEWORK_TEMPLATES
@@ -168,27 +166,27 @@ export const STARTER_RUNNABLE_KEY = 'a'
 // Matches the starter runnable that the apps_raw/add page seeds, so the
 // React/Svelte demo button (`backend.a({ x: 42 })`) works on first render.
 export const STARTER_RUNNABLE = {
-	name: 'a',
-	fields: {},
-	type: 'inline',
-	inlineScript: {
-		content:
-			'// import * as wmill from "windmill-client"\n\nexport async function main(x: string) {\n  return x\n}\n',
-		language: 'bun',
-		schema: {
-			$schema: 'https://json-schema.org/draft/2020-12/schema',
-			properties: {
-				x: {
-					default: null,
-					description: '',
-					originalType: 'string',
-					type: 'string'
-				}
-			},
-			required: ['x'],
-			type: 'object'
-		}
-	}
+  name: 'a',
+  fields: {},
+  type: 'inline',
+  inlineScript: {
+    content:
+      '// import * as wmill from "windmill-client"\n\nexport async function main(x: string) {\n  return x\n}\n',
+    language: 'bun',
+    schema: {
+      $schema: 'https://json-schema.org/draft/2020-12/schema',
+      properties: {
+        x: {
+          default: null,
+          description: '',
+          originalType: 'string',
+          type: 'string'
+        }
+      },
+      required: ['x'],
+      type: 'object'
+    }
+  }
 }
 
 export const appVueRouter = `
diff --git a/frontend/src/lib/components/raw_apps/utils.ts b/frontend/src/lib/components/raw_apps/utils.ts
index 12dc7d87d4..45e32a23cf 100644
--- a/frontend/src/lib/components/raw_apps/utils.ts
+++ b/frontend/src/lib/components/raw_apps/utils.ts
@@ -172,7 +172,7 @@ export function unsandboxedRawAppHtml(
 	<title>App</title>
 	<link rel="stylesheet" href="${baseUrl}/api/w/${workspace}/apps_u/get_data/v/${secret}.css" />
 	<script>
-		window.ctx = ${ctx ? JSON.stringify(ctx) : 'undefined'};
+		window.ctx = ${ctx ? JSON.stringify(ctx).replace(/</g, '\\u003c') : 'undefined'};
 		(function () {
 			// Keep the parent URL hash in sync for shareable URLs.
 			function notifyParent() {
diff --git a/frontend/src/lib/components/recording/FlowRecordingReplay.svelte b/frontend/src/lib/components/recording/FlowRecordingReplay.svelte
index 3d677d8f54..8b802a57f8 100644
--- a/frontend/src/lib/components/recording/FlowRecordingReplay.svelte
+++ b/frontend/src/lib/components/recording/FlowRecordingReplay.svelte
@@ -6,7 +6,8 @@
 	import FlowGraphViewer from '$lib/components/FlowGraphViewer.svelte'
 	import FlowProgressBar from '$lib/components/flows/FlowProgressBar.svelte'
 	import FlowExecutionStatus from '$lib/components/runs/FlowExecutionStatus.svelte'
-	import { setActiveReplay } from './flowRecording.svelte'
+	import { setActiveReplay } from './replay.svelte'
+	import { synthesizeFlowReplay } from './replayStream'
 	import type { FlowRecording } from './types'
 	import { sendUserToast } from '$lib/toast'
 	import { Button } from '$lib/components/common'
@@ -47,138 +48,35 @@
 	export function stop() {
 		setActiveReplay(undefined)
 		job = undefined
-		initRecording()
-	}
-
-	function findRootJobId(data: FlowRecording): string | undefined {
-		for (const [id, recorded] of Object.entries(data.jobs)) {
-			const j = recorded.initial_job
-			if ((j.job_kind === 'flow' || j.job_kind === 'flowpreview') && !j.parent_job) {
-				return id
-			}
-		}
-		for (const [id, recorded] of Object.entries(data.jobs)) {
-			if (!recorded.initial_job.parent_job) return id
-		}
-		return Object.keys(data.jobs)[0]
-	}
-
-	/**
-	 * Offset all absolute timestamps in the recording so they are relative to "now".
-	 * TimelineCompute uses Date.now() for in-progress bars, so we need recorded
-	 * started_at/created_at values to be near the current time.
-	 */
-	function rebaseTimestamps(data: FlowRecording, rootId: string): FlowRecording {
-		const rootJob = data.jobs[rootId]?.initial_job
-		const anchor = rootJob?.started_at ?? rootJob?.created_at
-		if (!anchor) return data
-		const earliest = new Date(anchor).getTime()
-		if (isNaN(earliest)) return data
-
-		const offset = Date.now() - earliest
-
-		function offsetDate(d: string | number | undefined): string | undefined {
-			if (!d) return d as undefined
-			const t = new Date(d).getTime()
-			if (isNaN(t)) return d as string
-			return new Date(t + offset).toISOString()
-		}
-
-		function offsetJobTimestamps(j: any) {
-			if (j.started_at) j.started_at = offsetDate(j.started_at)
-			if (j.created_at) j.created_at = offsetDate(j.created_at)
-			if (j.completed_at) j.completed_at = offsetDate(j.completed_at)
-		}
-
-		function offsetFlowStatus(fs: any) {
-			if (!fs?.modules) return
-			for (const mod of fs.modules) {
-				const durations = mod.flow_jobs_duration
-				if (durations?.started_at) {
-					durations.started_at = durations.started_at.map((d: string) => offsetDate(d) ?? d)
-				}
-			}
-		}
-
-		for (const recorded of Object.values(data.jobs)) {
-			offsetJobTimestamps(recorded.initial_job)
-			if (recorded.initial_job?.flow_status) offsetFlowStatus(recorded.initial_job.flow_status)
-			for (const event of recorded.events) {
-				if (event.data?.job) {
-					offsetJobTimestamps(event.data.job)
-					if (event.data.job.flow_status) offsetFlowStatus(event.data.job.flow_status)
-				}
-				if (event.data?.flow_status) offsetFlowStatus(event.data.flow_status)
-			}
-		}
-		return data
-	}
-
-	function buildInitialJob(data: FlowRecording, jobId: string): Job {
-		const initialJob = JSON.parse(JSON.stringify(data.jobs[jobId].initial_job))
-		if (data.flow?.value) {
-			initialJob.raw_flow = JSON.parse(JSON.stringify(data.flow.value))
-		}
-		return initialJob
+		replayState = 'loaded'
 	}
 
 	function initRecording() {
-		const flowJobId = findRootJobId(recording)
-		if (!flowJobId) {
+		const flowJobId = recording.root_job_id
+		if (!flowJobId || !recording.jobs?.[flowJobId]) {
 			sendUserToast('Recording has no jobs', true)
 			return
 		}
 		rootJobId = flowJobId
-		rootInitialJob = buildInitialJob(recording, flowJobId)
 		replayState = 'loaded'
 	}
 
 	// Initialize on mount
 	initRecording()
 
-	/**
-	 * Ensure the root flow's completed event fires after all sub-job events.
-	 * During recording, addCompletedJob runs after the flow completes, so sub-job
-	 * completed events can have a later `t` than the root's completed event.
-	 */
-	function fixEventOrdering(data: FlowRecording, rootId: string) {
-		const rootEvents = data.jobs[rootId]?.events
-		if (!rootEvents?.length) return
-
-		// Find the latest event.t across all sub-jobs
-		let maxSubJobT = 0
-		for (const [id, recorded] of Object.entries(data.jobs)) {
-			if (id === rootId) continue
-			for (const event of recorded.events) {
-				if (event.t > maxSubJobT) maxSubJobT = event.t
-			}
-		}
-
-		// Push the root's completed event to fire after all sub-job events
-		let completedIdx = -1
-		for (let i = rootEvents.length - 1; i >= 0; i--) {
-			if (rootEvents[i].data.completed) {
-				completedIdx = i
-				break
-			}
-		}
-		if (completedIdx >= 0 && rootEvents[completedIdx].t < maxSubJobT) {
-			rootEvents[completedIdx].t = maxSubJobT + 50
-		}
-	}
-
 	export function startReplay() {
 		if (!rootJobId) return
 		try {
-			// JSON round-trip to unwrap reactive proxies and strip non-cloneable properties
-			const snapshot = JSON.parse(JSON.stringify(recording)) as FlowRecording
-			// A malformed recording (upload / `?src=` fetch) can throw while walking
-			// its jobs' flow_status here — an event-handler throw a Svelte boundary
-			// can't catch, so it's guarded rather than left to break the page.
-			fixEventOrdering(snapshot, rootJobId)
-			rebaseTimestamps(snapshot, rootJobId)
-			setActiveReplay(snapshot)
-			rootInitialJob = buildInitialJob(snapshot, rootJobId)
+			// A malformed recording (upload / `?src=` fetch) can throw while its
+			// jobs' flow_status is walked here — an event-handler throw a Svelte
+			// boundary can't catch, so it's guarded rather than left to break the page.
+			const replay = synthesizeFlowReplay(recording.jobs, rootJobId)
+			setActiveReplay(replay)
+			const initialJob = JSON.parse(JSON.stringify(replay.jobs[rootJobId].initial_job))
+			if (recording.flow?.value) {
+				initialJob.raw_flow = JSON.parse(JSON.stringify(recording.flow.value))
+			}
+			rootInitialJob = initialJob
 			job = undefined
 			replayState = 'playing'
 			selectedTab = 'ui'
@@ -255,7 +153,6 @@
 						{#if job}
 							<FlowExecutionStatus
 								{job}
-								workspaceId={$workspaceStore}
 								isOwner={false}
 								innerModules={job?.flow_status?.modules}
 								suspendStatus={{ val: {} }}
diff --git a/frontend/src/lib/components/recording/PipelineRecordingReplay.svelte b/frontend/src/lib/components/recording/PipelineRecordingReplay.svelte
index 49b3fbfbd4..890740e2c1 100644
--- a/frontend/src/lib/components/recording/PipelineRecordingReplay.svelte
+++ b/frontend/src/lib/components/recording/PipelineRecordingReplay.svelte
@@ -1,6 +1,7 @@
 <script lang="ts">
 	import type { Job } from '$lib/gen'
-	import { setActiveReplay } from './flowRecording.svelte'
+	import { setActiveReplay } from './replay.svelte'
+	import { synthesizeSingleJobReplay } from './replayStream'
 	import type { PipelineRecording, RecordedJob, RecordedNodeState } from './types'
 	import AssetGraphCanvas from '$lib/components/assets/AssetGraph/AssetGraphCanvas.svelte'
 	import type { AssetGraphSelection } from '$lib/components/assets/AssetGraph/types'
@@ -148,29 +149,6 @@
 		timeouts = []
 	}
 
-	/** Offset a recorded job's absolute timestamps to "now" so duration/elapsed
-	 * displays compute correctly during replay. */
-	function rebaseJobTimestamps(rec: RecordedJob) {
-		const anchor = rec.initial_job?.started_at ?? rec.initial_job?.created_at
-		if (!anchor) return
-		const earliest = new Date(anchor).getTime()
-		if (isNaN(earliest)) return
-		const offset = Date.now() - earliest
-		const offsetDate = (d: string | undefined): string | undefined => {
-			if (!d) return d
-			const t = new Date(d).getTime()
-			return isNaN(t) ? d : new Date(t + offset).toISOString()
-		}
-		const fix = (j: any) => {
-			if (!j) return
-			if (j.started_at) j.started_at = offsetDate(j.started_at)
-			if (j.created_at) j.created_at = offsetDate(j.created_at)
-			if (j.completed_at) j.completed_at = offsetDate(j.completed_at)
-		}
-		fix(rec.initial_job)
-		for (const e of rec.events) fix((e.data as any)?.job)
-	}
-
 	// The recorded job id for the selected runnable, if it ran.
 	let selectedJobId = $derived.by(() => {
 		if (selection?.kind !== 'runnable') return undefined
@@ -227,19 +205,21 @@
 
 	async function openNodeDetail(jobId: string) {
 		job = undefined
-		const rec = recording.jobs[jobId]
-		if (!rec) return
-		const cloned = JSON.parse(JSON.stringify(rec)) as RecordedJob
+		const recorded = recording.jobs[jobId]
+		if (!recorded) return
 		// Only a node that is still running in the animation replays its stream
-		// live; a node the graph already shows as finished reveals its logs and
-		// result at once (collapse every event to t=0) rather than re-playing the
-		// whole execution as if it were computing now. Recorded `t` is relative to
-		// the whole-pipeline start, so rebase to the moment of open for the live case.
+		// live (logs pacing out over the job's real duration); a node the graph
+		// already shows as finished reveals its logs and result at once.
 		const streamLive = selectedStatus === 'running'
-		const base = cloned.events[0]?.t ?? 0
-		for (const e of cloned.events) e.t = streamLive ? Math.max(0, e.t - base) : 0
-		rebaseJobTimestamps(cloned)
-		setActiveReplay({ jobs: { [jobId]: cloned } })
+		let stream: RecordedJob
+		try {
+			stream = synthesizeSingleJobReplay(recorded, { collapse: !streamLive })
+		} catch {
+			// A malformed recorded job (recordings are caller-controlled) must not
+			// take down the player from this event handler — show it as-is instead.
+			stream = { initial_job: recorded, events: [] }
+		}
+		setActiveReplay({ jobs: { [jobId]: stream } })
 		await tick()
 		jobLoader?.watchJob(jobId)
 	}
diff --git a/frontend/src/lib/components/recording/RecordingPlayer.svelte b/frontend/src/lib/components/recording/RecordingPlayer.svelte
index b542743f77..dae17029e5 100644
--- a/frontend/src/lib/components/recording/RecordingPlayer.svelte
+++ b/frontend/src/lib/components/recording/RecordingPlayer.svelte
@@ -8,7 +8,7 @@
 	import ScriptRecordingReplay from './ScriptRecordingReplay.svelte'
 	import PipelineRecordingReplay from './PipelineRecordingReplay.svelte'
 	import RawAppRecordingReplay from './RawAppRecordingReplay.svelte'
-	import { setActiveReplay } from './flowRecording.svelte'
+	import { setActiveReplay } from './replay.svelte'
 	import type { LoadedRecording } from './rawAppRecordingLoad'
 	import { Button } from '$lib/components/common'
 	import { TriangleAlert, Upload } from 'lucide-svelte'
diff --git a/frontend/src/lib/components/recording/ScriptRecordingReplay.svelte b/frontend/src/lib/components/recording/ScriptRecordingReplay.svelte
index 0327044b3b..2fa67d17a0 100644
--- a/frontend/src/lib/components/recording/ScriptRecordingReplay.svelte
+++ b/frontend/src/lib/components/recording/ScriptRecordingReplay.svelte
@@ -1,7 +1,7 @@
 <script lang="ts">
 	import type { Job, Script } from '$lib/gen'
-	import { setActiveReplay } from './flowRecording.svelte'
-	import { createScriptRecording } from './scriptRecording.svelte'
+	import { setActiveReplay } from './replay.svelte'
+	import { synthesizeSingleJobReplay } from './replayStream'
 	import type { ScriptRecording } from './types'
 	import { sendUserToast } from '$lib/toast'
 	import { Button, Tab, TabContent } from '$lib/components/common'
@@ -45,8 +45,6 @@
 	let jobLoader: JobLoader | undefined = $state(undefined)
 	let done = $derived((job as any)?.type === 'CompletedJob')
 
-	let scriptRecordingStore = createScriptRecording()
-
 	let schema = $derived(recording.schema)
 
 	if (selectedTab === undefined) {
@@ -64,40 +62,8 @@
 		replayState = 'loaded'
 	}
 
-	/**
-	 * Rebase absolute timestamps so they are relative to "now".
-	 * JobLoader replay uses Date.now() for delay computation.
-	 */
-	function rebaseTimestamps(data: ScriptRecording): ScriptRecording {
-		const anchor = data.job?.initial_job?.started_at ?? data.job?.initial_job?.created_at
-		if (!anchor) return data
-		const earliest = new Date(anchor).getTime()
-		if (isNaN(earliest)) return data
-
-		const offset = Date.now() - earliest
-
-		function offsetDate(d: string | number | undefined): string | undefined {
-			if (!d) return d as undefined
-			const t = new Date(d).getTime()
-			if (isNaN(t)) return d as string
-			return new Date(t + offset).toISOString()
-		}
-
-		function offsetJobTimestamps(j: any) {
-			if (j.started_at) j.started_at = offsetDate(j.started_at)
-			if (j.created_at) j.created_at = offsetDate(j.created_at)
-			if (j.completed_at) j.completed_at = offsetDate(j.completed_at)
-		}
-
-		offsetJobTimestamps(data.job.initial_job)
-		for (const event of data.job.events) {
-			if (event.data?.job) offsetJobTimestamps(event.data.job)
-		}
-		return data
-	}
-
 	function initRecording() {
-		const id = recording.job?.initial_job?.id
+		const id = recording.job?.id
 		if (!id) {
 			sendUserToast('Recording has no job data', true)
 			return
@@ -109,10 +75,18 @@
 	initRecording()
 
 	export async function startReplay() {
-		const snapshot = JSON.parse(JSON.stringify(recording)) as ScriptRecording
-		rebaseTimestamps(snapshot)
-		const replayData = scriptRecordingStore.toReplayData(snapshot)
-		setActiveReplay(replayData)
+		if (!jobId) return
+		try {
+			// A malformed recording (upload / `?src=` fetch) can throw while the
+			// job is walked here — an event-handler throw a Svelte boundary can't
+			// catch, so it's guarded rather than left to break the page.
+			const stream = synthesizeSingleJobReplay(recording.job)
+			setActiveReplay({ jobs: { [jobId]: stream } })
+		} catch {
+			setActiveReplay(undefined)
+			sendUserToast('This recording could not be replayed — it may be malformed', true)
+			return
+		}
 		job = undefined
 		replayState = 'playing'
 		selectedTab = 'result'
@@ -129,7 +103,7 @@
 
 <HighlightTheme />
 
-{#if !recording?.job?.initial_job?.id}
+{#if !recording?.job?.id}
 	<div class="flex flex-col items-center justify-center min-h-[60vh]">
 		<div class="border rounded-lg p-8 bg-surface-tertiary max-w-md w-full text-center">
 			<p class="text-xs text-secondary">
diff --git a/frontend/src/lib/components/recording/flowRecording.svelte.ts b/frontend/src/lib/components/recording/flowRecording.svelte.ts
deleted file mode 100644
index bf7d705a3f..0000000000
--- a/frontend/src/lib/components/recording/flowRecording.svelte.ts
+++ /dev/null
@@ -1,211 +0,0 @@
-import type { Job, OpenFlow } from '$lib/gen'
-import type { ActiveRecording, ActiveReplayData, FlowRecording, RecordedJob } from './types'
-
-const UUID_RE = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi
-
-export function truncateUuids(json: string): string {
-	const map = new Map<string, string>()
-	let counter = 0
-	return json.replace(UUID_RE, (uuid) => {
-		const key = uuid.toLowerCase()
-		let short = map.get(key)
-		if (!short) {
-			short = counter === 0 ? key.slice(-8) : key.slice(-8) + '_' + counter
-			counter++
-			map.set(key, short)
-		}
-		return short
-	})
-}
-
-// Module-level active instances (bypasses context/portal issues)
-let activeRecording: ActiveRecording | undefined = undefined
-let activeReplay: ActiveReplayData | undefined = $state<ActiveReplayData | undefined>(undefined)
-let replayStartTime: number = 0
-
-export function getActiveRecording() {
-	return activeRecording
-}
-export function setActiveRecording(r: ActiveRecording | undefined) {
-	activeRecording = r
-}
-export function getActiveReplay() {
-	return activeReplay
-}
-export function setActiveReplay(r: ActiveReplayData | undefined) {
-	activeReplay = r
-	replayStartTime = r ? Date.now() : 0
-}
-export function getReplayStartTime() {
-	return replayStartTime
-}
-
-export function createFlowRecording() {
-	let active = $state(false)
-	let startTime = 0
-	let flowPath = ''
-	let jobs: Record<string, RecordedJob> = {}
-	let flow: OpenFlow | undefined = undefined
-	let watchedSubJobs = new Set<string>()
-	let subJobSources: EventSource[] = []
-
-	return {
-		get active() {
-			return active
-		},
-		start(path: string) {
-			subJobSources.forEach((es) => es.close())
-			subJobSources = []
-			watchedSubJobs.clear()
-			active = true
-			startTime = Date.now()
-			flowPath = path
-			jobs = {}
-			flow = undefined
-		},
-		setFlow(f: OpenFlow) {
-			// JSON round-trip to strip non-serializable properties (event handlers, etc.)
-			flow = JSON.parse(JSON.stringify(f)) as OpenFlow
-		},
-		recordInitialJob(jobId: string, job: Job) {
-			if (!active) return
-			// $state.snapshot unwraps Svelte 5 reactive proxies (structuredClone fails on them)
-			jobs[jobId] = {
-				initial_job: $state.snapshot(job) as Job,
-				events: []
-			}
-		},
-		recordEvent(jobId: string, data: Record<string, any>) {
-			if (!active) return
-			if (!jobs[jobId]) {
-				jobs[jobId] = {
-					initial_job: (data as any).job
-						? ($state.snapshot((data as any).job) as Job)
-						: ({} as Job),
-					events: []
-				}
-			}
-			jobs[jobId].events.push({
-				t: Date.now() - startTime,
-				data: $state.snapshot(data) as Record<string, any>
-			})
-		},
-		stop(): FlowRecording {
-			active = false
-			subJobSources.forEach((es) => es.close())
-			subJobSources = []
-			const recording: FlowRecording = {
-				version: 1,
-				recorded_at: new Date().toISOString(),
-				flow_path: flowPath,
-				total_duration_ms: Date.now() - startTime,
-				jobs,
-				flow
-			}
-			return recording
-		},
-		/** Add a completed sub-job to the recording (called after stop for sub-jobs fetched post-completion) */
-		addCompletedJob(jobId: string, completedJob: Job) {
-			const snapshotJob = $state.snapshot(completedJob) as Job
-			if (!jobs[jobId]) {
-				jobs[jobId] = {
-					initial_job: snapshotJob,
-					events: []
-				}
-			} else if (!jobs[jobId].initial_job?.id) {
-				// Replace placeholder initial_job created by recordEvent
-				jobs[jobId].initial_job = snapshotJob
-			}
-			// Only add synthetic completed event if SSE didn't already capture one
-			const hasCompleted = jobs[jobId].events.some((e) => e.data.completed)
-			if (!hasCompleted) {
-				jobs[jobId].events.push({
-					t: Date.now() - startTime,
-					data: { completed: true, job: snapshotJob }
-				})
-			}
-		},
-		/** Watch a sub-job's SSE stream during recording to capture incremental log events */
-		watchSubJob(jobId: string, workspace: string) {
-			if (!active || watchedSubJobs.has(jobId)) return
-			watchedSubJobs.add(jobId)
-
-			let subJobLogOffset = 0
-
-			const params = new URLSearchParams({
-				log_offset: '0',
-				running: 'true',
-				fast: 'true'
-			})
-			const url = `/api/w/${workspace}/jobs_u/getupdate_sse/${jobId}?${params}`
-			const es = new EventSource(url)
-			subJobSources.push(es)
-
-			es.onmessage = (event) => {
-				try {
-					const data = JSON.parse(event.data)
-					if (data.type === 'ping' || data.type === 'timeout') return
-					if (data.type === 'error' || data.type === 'not_found') {
-						es.close()
-						return
-					}
-					if (!active) {
-						es.close()
-						return
-					}
-
-					// Deduplicate log data: SSE may resend full log dumps on reconnect.
-					// Drop log data if the offset hasn't advanced past what we already recorded.
-					if (data.new_logs != null && data.log_offset != null) {
-						if (subJobLogOffset > 0 && data.log_offset <= subJobLogOffset) {
-							delete data.new_logs
-							delete data.log_offset
-						} else {
-							subJobLogOffset = data.log_offset
-						}
-					} else if (data.log_offset != null && data.log_offset > subJobLogOffset) {
-						subJobLogOffset = data.log_offset
-					}
-
-					// Record initial job from the first event that carries job data
-					if (!jobs[jobId] && data.job) {
-						jobs[jobId] = {
-							initial_job: data.job as Job,
-							events: []
-						}
-					} else if (!jobs[jobId]) {
-						jobs[jobId] = {
-							initial_job: {} as Job,
-							events: []
-						}
-					}
-					jobs[jobId].events.push({
-						t: Date.now() - startTime,
-						data
-					})
-					if (data.completed) {
-						es.close()
-					}
-				} catch {
-					// Ignore parse errors
-				}
-			}
-			es.onerror = () => {
-				es.close()
-			}
-		},
-		download(recording: FlowRecording) {
-			const blob = new Blob([truncateUuids(JSON.stringify(recording, null, 2))], {
-				type: 'application/json'
-			})
-			const url = URL.createObjectURL(blob)
-			const a = document.createElement('a')
-			a.href = url
-			a.download = `flow-recording-${recording.flow_path.replace(/\//g, '-')}-${Date.now()}.json`
-			a.click()
-			URL.revokeObjectURL(url)
-		}
-	}
-}
-
-export type FlowRecordingStore = ReturnType<typeof createFlowRecording>
diff --git a/frontend/src/lib/components/recording/offlineReplay.svelte.ts b/frontend/src/lib/components/recording/offlineReplay.svelte.ts
index 4c03cfda3d..f36a2b44e0 100644
--- a/frontend/src/lib/components/recording/offlineReplay.svelte.ts
+++ b/frontend/src/lib/components/recording/offlineReplay.svelte.ts
@@ -14,7 +14,7 @@
  *    are JobLoader's (short-circuited by `getActiveReplay`) and the recorder's.
  */
 import { OpenAPI } from '$lib/gen'
-import { getActiveReplay } from './flowRecording.svelte'
+import { getActiveReplay } from './replay.svelte'
 
 let offline = $state(false)
 
diff --git a/frontend/src/lib/components/recording/pipelineRecording.svelte.ts b/frontend/src/lib/components/recording/pipelineRecording.svelte.ts
index 557a3636ec..52c28ee76f 100644
--- a/frontend/src/lib/components/recording/pipelineRecording.svelte.ts
+++ b/frontend/src/lib/components/recording/pipelineRecording.svelte.ts
@@ -1,35 +1,32 @@
-import { JobService, ScriptService, type Job } from '$lib/gen'
+import { ScriptService, type Job } from '$lib/gen'
 import type { AssetGraphResponse } from '$lib/components/assets/AssetGraph/types'
 import { runBoundedCascade } from '$lib/components/assets/AssetGraph/cascadeRun'
 import type {
 	CascadeNodeState,
 	CascadeRunResult
 } from '$lib/components/assets/AssetGraph/cascadeOrchestrator'
-import { truncateUuids } from './flowRecording.svelte'
+import { downloadRecordingJson, fetchJobWithFullLogs } from './runRecording'
 import { capturePipelineAssetSample } from './pipelineAssetSample'
 import type {
 	PipelineAssetSample,
 	PipelineRecordedCode,
 	PipelineRecording,
 	PipelineTimelineFrame,
-	RecordedJob,
 	RecordedNodeState
 } from './types'
 
 /**
- * Recorder for a data-pipeline cascade run. Unlike the flow/script recorders
- * there is no single root job streaming sub-jobs over SSE — a pipeline run is a
- * cascade of independent script jobs launched client-side and polled to
- * completion. So this store captures two things:
+ * Recorder for a data-pipeline cascade run. A pipeline run is a cascade of
+ * independent script jobs launched client-side, so unlike the flow/script
+ * recordings there is no root job whose status ties the run together — the
+ * cascade orchestrator's own status snapshots are that record. The store
+ * captures:
  *
- *  1. the resolved asset graph (rendered read-only by the player), and
+ *  1. the resolved asset graph (rendered read-only by the player),
  *  2. a timeline of per-node status snapshots (from the cascade orchestrator's
- *     `onUpdate`), each node mapped to its job id.
- *
- * For each launched node it opens the job's own SSE stream (`watchJob`) to
- * capture incremental logs/result, storing them in the shared `RecordedJob`
- * shape so the player can replay each node's details through the same
- * `JobLoader` replay path the flow/script players use.
+ *     `onUpdate`), each node mapped to its job id, and
+ *  3. each node's completed job, fetched after the run (`finalize`); the
+ *     player synthesizes its replay stream from it.
  */
 export function createPipelineRecording(): PipelineRecordingStore {
 	let active = $state(false)
@@ -37,24 +34,15 @@ export function createPipelineRecording(): PipelineRecordingStore {
 	let folder = ''
 	let graph: AssetGraphResponse | undefined = undefined
 	let timeline: PipelineTimelineFrame[] = []
-	let jobs: Record<string, RecordedJob> = {}
+	let jobs: Record<string, Job> = {}
 	let assetSamples: Record<string, PipelineAssetSample> = {}
 	let codes: Record<string, PipelineRecordedCode> = {}
-	let watchedJobs = new Set<string>()
-	let jobSources: EventSource[] = []
-
-	function closeSources() {
-		jobSources.forEach((es) => es.close())
-		jobSources = []
-		watchedJobs.clear()
-	}
 
 	return {
 		get active() {
 			return active
 		},
 		start(f: string, g: AssetGraphResponse) {
-			closeSources()
 			active = true
 			startTime = Date.now()
 			folder = f
@@ -75,85 +63,10 @@ export function createPipelineRecording(): PipelineRecordingStore {
 			}
 			timeline.push({ t: Date.now() - startTime, statuses: snapshot })
 		},
-		/** Watch a launched node's SSE stream to capture its incremental
-		 * logs/result. Mirrors flowRecording.watchSubJob's log-offset dedup. */
-		watchJob(jobId: string, workspace: string) {
-			if (!active || watchedJobs.has(jobId)) return
-			watchedJobs.add(jobId)
-
-			let logOffset = 0
-			const params = new URLSearchParams({
-				log_offset: '0',
-				running: 'true',
-				fast: 'true'
-			})
-			const url = `/api/w/${workspace}/jobs_u/getupdate_sse/${jobId}?${params}`
-			const es = new EventSource(url)
-			jobSources.push(es)
-
-			es.onmessage = (event) => {
-				try {
-					const data = JSON.parse(event.data)
-					if (data.type === 'ping' || data.type === 'timeout') return
-					if (data.type === 'error' || data.type === 'not_found') {
-						es.close()
-						return
-					}
-					if (!active) {
-						es.close()
-						return
-					}
-
-					// Deduplicate log data: SSE may resend full log dumps on reconnect.
-					if (data.new_logs != null && data.log_offset != null) {
-						if (logOffset > 0 && data.log_offset <= logOffset) {
-							delete data.new_logs
-							delete data.log_offset
-						} else {
-							logOffset = data.log_offset
-						}
-					} else if (data.log_offset != null && data.log_offset > logOffset) {
-						logOffset = data.log_offset
-					}
-
-					if (!jobs[jobId]) {
-						jobs[jobId] = {
-							initial_job: data.job ? (data.job as Job) : ({ id: jobId } as Job),
-							events: []
-						}
-					}
-					jobs[jobId].events.push({
-						t: Date.now() - startTime,
-						data
-					})
-					if (data.completed) {
-						es.close()
-					}
-				} catch {
-					// Ignore parse errors
-				}
-			}
-			es.onerror = () => {
-				es.close()
-			}
-		},
-		/** Fill in a node's completed job (fallback for anything the SSE stream
-		 * missed — e.g. a job that finished before its stream was opened).
-		 * Callable after stop() so late-fetched completed jobs still attach. */
-		addCompletedJob(jobId: string, completedJob: Job) {
-			const snapshotJob = $state.snapshot(completedJob) as Job
-			if (!jobs[jobId]) {
-				jobs[jobId] = { initial_job: snapshotJob, events: [] }
-			} else if (!jobs[jobId].initial_job?.id) {
-				jobs[jobId].initial_job = snapshotJob
-			}
-			const hasCompleted = jobs[jobId].events.some((e) => e.data.completed)
-			if (!hasCompleted) {
-				jobs[jobId].events.push({
-					t: Date.now() - startTime,
-					data: { completed: true, job: snapshotJob }
-				})
-			}
+		/** Attach a node's completed job. Callable after stop() so the
+		 * post-run fetches still attach to the returned recording. */
+		setJob(jobId: string, completedJob: Job) {
+			jobs[jobId] = $state.snapshot(completedJob) as Job
 		},
 		/** Attach a captured asset data-sample (called during finalize, after
 		 * the run, for each ducklake/datatable asset). Keyed by `${kind}:${path}`.
@@ -170,9 +83,8 @@ export function createPipelineRecording(): PipelineRecordingStore {
 		},
 		stop(): PipelineRecording {
 			active = false
-			closeSources()
 			return {
-				version: 1,
+				version: 2,
 				type: 'pipeline',
 				recorded_at: new Date().toISOString(),
 				folder,
@@ -185,15 +97,10 @@ export function createPipelineRecording(): PipelineRecordingStore {
 			}
 		},
 		download(recording: PipelineRecording) {
-			const blob = new Blob([truncateUuids(JSON.stringify(recording, null, 2))], {
-				type: 'application/json'
-			})
-			const url = URL.createObjectURL(blob)
-			const a = document.createElement('a')
-			a.href = url
-			a.download = `pipeline-recording-${(recording.folder || 'untitled').replace(/\//g, '-')}-${Date.now()}.json`
-			a.click()
-			URL.revokeObjectURL(url)
+			downloadRecordingJson(
+				recording,
+				`pipeline-recording-${(recording.folder || 'untitled').replace(/\//g, '-')}`
+			)
 		}
 	}
 }
@@ -202,8 +109,7 @@ export type PipelineRecordingStore = {
 	readonly active: boolean
 	start(folder: string, graph: AssetGraphResponse): void
 	recordStatuses(statuses: Map<string, RecordedNodeState>): void
-	watchJob(jobId: string, workspace: string): void
-	addCompletedJob(jobId: string, completedJob: Job): void
+	setJob(jobId: string, completedJob: Job): void
 	recordAssetSample(sample: PipelineAssetSample): void
 	recordCode(path: string, code: PipelineRecordedCode): void
 	stop(): PipelineRecording
@@ -212,6 +118,8 @@ export type PipelineRecordingStore = {
 
 // Max asset samples in flight during finalize — each is several preview jobs.
 const ASSET_SAMPLE_CONCURRENCY = 4
+// Max node-job fetches in flight during finalize (two requests each).
+const JOB_FETCH_CONCURRENCY = 20
 
 /** Run `fn` over `items` at most `limit` at a time (sequential batches). */
 async function forEachWithConcurrency<T>(
@@ -225,13 +133,12 @@ async function forEachWithConcurrency<T>(
 }
 
 /**
- * Stop the recorder and enrich the recording with data the live SSE streams
- * can't guarantee: each node's completed job (a fast job may finish before its
- * stream opens), a data-sample per ducklake/datatable asset (offline table
- * preview), and each step's source (by the exact hash that ran). Every fetch is
- * best-effort — a step we can't resolve just replays with less detail. Shared by
- * the pipeline editor's recorder and deploy-to-hub so both produce identical
- * recordings.
+ * Stop the recorder and attach everything the run left behind: each node's
+ * completed job (with its logs and result), a data-sample per
+ * ducklake/datatable asset (offline table preview), and each step's source (by
+ * the exact hash that ran). Every fetch is best-effort — a step we can't
+ * resolve just replays with less detail. Shared by the pipeline editor's
+ * recorder and deploy-to-hub so both produce identical recordings.
  */
 export async function finalizePipelineRecording(
 	store: PipelineRecordingStore,
@@ -246,17 +153,15 @@ export async function finalizePipelineRecording(
 			if (st.jobId) jobIds.add(st.jobId)
 		}
 	}
-	await Promise.all(
-		[...jobIds].map(async (jobId) => {
-			if (rec.jobs[jobId]?.events.some((e) => e.data.completed)) return
-			try {
-				const j = await JobService.getJob({ workspace: ws, id: jobId })
-				store.addCompletedJob(jobId, j)
-			} catch {
-				// best-effort — a job we can't fetch just replays from its stream
-			}
-		})
-	)
+	// Each fetch is two requests, and a wide pipeline has a node per script —
+	// bound the fan-out like the asset sampling below.
+	await forEachWithConcurrency([...jobIds], JOB_FETCH_CONCURRENCY, async (jobId) => {
+		try {
+			store.setJob(jobId, await fetchJobWithFullLogs(ws, jobId))
+		} catch {
+			// best-effort — a job we can't fetch just isn't inspectable in the player
+		}
+	})
 	// Each asset sample runs a metadata scan + a SELECT + a COUNT preview job, so a
 	// wide pipeline could fan out hundreds of jobs at once. Bound the concurrency
 	// to keep the recorder from saturating the worker pool.
@@ -268,24 +173,23 @@ export async function finalizePipelineRecording(
 		store.recordAssetSample(sample)
 	})
 	const codeByPath = new Map<string, string>()
-	for (const r of Object.values(rec.jobs)) {
-		const j = r.events.find((e) => e.data.completed)?.data.job as
-			| { job_kind?: string; script_path?: string; script_hash?: string }
-			| undefined
+	for (const j of Object.values(rec.jobs) as {
+		job_kind?: string
+		script_path?: string
+		script_hash?: string
+	}[]) {
 		if (j?.job_kind === 'script' && j.script_path && j.script_hash) {
 			codeByPath.set(j.script_path, j.script_hash)
 		}
 	}
-	await Promise.all(
-		[...codeByPath].map(async ([path, hash]) => {
-			try {
-				const s = await ScriptService.getScriptByHash({ workspace: ws, hash })
-				store.recordCode(path, { content: s.content, language: s.language })
-			} catch {
-				// best-effort — a step we can't fetch just has no code in the player
-			}
-		})
-	)
+	await forEachWithConcurrency([...codeByPath], JOB_FETCH_CONCURRENCY, async ([path, hash]) => {
+		try {
+			const s = await ScriptService.getScriptByHash({ workspace: ws, hash })
+			store.recordCode(path, { content: s.content, language: s.language })
+		} catch {
+			// best-effort — a step we can't fetch just has no code in the player
+		}
+	})
 	return rec
 }
 
@@ -312,12 +216,7 @@ export async function capturePipelineRecording(opts: {
 		result = await runBoundedCascade({
 			graph: opts.graph,
 			scripts: opts.scriptPaths,
-			launch: async (path) => {
-				const jobId = await opts.launch(path)
-				// No-op unless the store is active; captures the node's stream.
-				store.watchJob(jobId, opts.workspace)
-				return jobId
-			},
+			launch: opts.launch,
 			waitTerminal: opts.waitTerminal,
 			onUpdate: (statuses) => {
 				store.recordStatuses(statuses)
@@ -325,8 +224,6 @@ export async function capturePipelineRecording(opts: {
 			}
 		})
 	} catch (e) {
-		// The cascade threw before finalize could `stop()` the store: close the
-		// per-node SSE streams `watchJob` opened so they don't dangle.
 		store.stop()
 		throw e
 	}
diff --git a/frontend/src/lib/components/recording/rawAppRecordingLoad.test.ts b/frontend/src/lib/components/recording/rawAppRecordingLoad.test.ts
index ace12db711..a02c3744c9 100644
--- a/frontend/src/lib/components/recording/rawAppRecordingLoad.test.ts
+++ b/frontend/src/lib/components/recording/rawAppRecordingLoad.test.ts
@@ -7,7 +7,6 @@
 import { describe, expect, it } from 'vitest'
 import {
 	MAX_COMPONENT_FANOUT,
-	MAX_EVENTS_PER_JOB,
 	MAX_FLOW_MODULES,
 	MAX_RECORDED_JOBS,
 	MAX_MAP_ROWS,
@@ -74,15 +73,37 @@ describe('isAppRecording', () => {
 	})
 })
 
-const job = (events = 1) => ({
-	initial_job: { id: 'j' },
-	events: Array.from({ length: events }, (_, t) => ({ t, data: { completed: true } }))
+// A recorded job is a completed job as the API returns it.
+const job = (extra: Record<string, unknown> = {}) => ({
+	id: 'j',
+	type: 'CompletedJob',
+	...extra
 })
 
 const header = { recorded_at: '2026-07-25T00:00:00.000Z', total_duration_ms: 1000 }
 
+const flowRec = (extra: Record<string, unknown> = {}) => ({
+	version: 2,
+	flow_path: 'f',
+	...header,
+	root_job_id: 'j',
+	jobs: { j: job() },
+	...extra
+})
+
+const scriptRec = (extra: Record<string, unknown> = {}) => ({
+	version: 2,
+	type: 'script',
+	script_path: 's',
+	...header,
+	code: 'echo hi',
+	language: 'bash',
+	job: job(),
+	...extra
+})
+
 const pipeline = (extra: Record<string, unknown> = {}) => ({
-	version: 1,
+	version: 2,
 	type: 'pipeline',
 	folder: 'orders',
 	...header,
@@ -100,21 +121,9 @@ const rejected = (data: unknown) => parseRecording(data).ok === false
 
 describe('parseRecording', () => {
 	it('routes each kind to its player, defaulting a type-less payload to flow', () => {
-		expect(kindOf({ version: 1, flow_path: 'f', ...header, jobs: { j: job() } })).toBe('flow')
-		expect(
-			kindOf({ version: 1, type: 'flow', flow_path: 'f', ...header, jobs: { j: job() } })
-		).toBe('flow')
-		expect(
-			kindOf({
-				version: 1,
-				type: 'script',
-				script_path: 's',
-				...header,
-				code: 'echo hi',
-				language: 'bash',
-				job: job()
-			})
-		).toBe('script')
+		expect(kindOf(flowRec())).toBe('flow')
+		expect(kindOf(flowRec({ type: 'flow' }))).toBe('flow')
+		expect(kindOf(scriptRec())).toBe('script')
 		expect(kindOf(pipeline())).toBe('pipeline')
 		expect(
 			kindOf({
@@ -129,35 +138,78 @@ describe('parseRecording', () => {
 		).toBe('app')
 	})
 
+	it('upgrades v1 job recordings in place, refusing only what cannot be salvaged', () => {
+		// v1 stored live event streams; published recordings (the hub) collapse to
+		// the completed job each stream carried and keep replaying.
+		const v1Stream = (j: Record<string, unknown>, logChunks: string[] = []) => ({
+			initial_job: { id: j.id },
+			events: [
+				...logChunks.map((c, i) => ({ t: i, data: { new_logs: c, log_offset: i + 1 } })),
+				{ t: 5, data: { completed: true, job: j } }
+			]
+		})
+		const v1Flow = {
+			version: 1,
+			flow_path: 'f',
+			...header,
+			jobs: {
+				root: v1Stream(job({ id: 'root', job_kind: 'flowpreview' })),
+				// The backfilled completed job carried no logs — only the stream did.
+				sub: v1Stream(job({ id: 'sub', parent_job: 'root' }), ['line 1\n', 'line 2\n'])
+			}
+		}
+		const flow = parseRecording(v1Flow)
+		expect(flow.ok && flow.loaded.kind).toBe('flow')
+		expect(flow.ok && (flow.loaded.recording as any).root_job_id).toBe('root')
+		expect(flow.ok && (flow.loaded.recording as any).jobs.sub.logs).toBe('line 1\nline 2\n')
+		const v1Script = {
+			version: 1,
+			type: 'script',
+			script_path: 's',
+			...header,
+			code: 'x',
+			language: 'bash',
+			job: v1Stream(job())
+		}
+		expect(kindOf(v1Script)).toBe('script')
+		// A v1 file whose streams carry no completed job has nothing to replay from.
+		const v1Empty = parseRecording({ version: 1, flow_path: 'f', ...header, jobs: {} })
+		expect(v1Empty.ok ? '' : v1Empty.error).toMatch(/older version/)
+		const future = parseRecording(flowRec({ version: 3 }))
+		expect(future.ok ? '' : future.error).toMatch(/newer version/)
+		// App recordings never changed format and stay at version 1.
+		const futureApp = parseRecording({ ...valid(), version: 2 })
+		expect(futureApp.ok ? '' : futureApp.error).toMatch(/newer version/)
+	})
+
 	it('rejects payloads a player would choke on rather than falling through to flow', () => {
 		// A `?src=` origin is arbitrary: a claimed kind must be validated as that
 		// kind, never silently reinterpreted.
-		expect(rejected({ version: 1, type: 'script', code: 'x', language: 'bash' })).toBe(true)
-		expect(rejected({ version: 1, type: 'pipeline', timeline: [], jobs: {} })).toBe(true)
-		expect(rejected({ version: 1, type: 'somethingelse', jobs: {} })).toBe(true)
-		expect(rejected({ version: 2, jobs: {} })).toBe(true)
+		expect(rejected({ version: 2, type: 'script', code: 'x', language: 'bash' })).toBe(true)
+		expect(rejected({ version: 2, type: 'pipeline', timeline: [], jobs: {} })).toBe(true)
+		expect(rejected({ version: 2, type: 'somethingelse', jobs: {} })).toBe(true)
 		expect(rejected(null)).toBe(true)
-		expect(rejected([{ version: 1 }])).toBe(true)
+		expect(rejected([{ version: 2 }])).toBe(true)
 		// Header fields are required by the types and rendered by every player.
-		expect(rejected({ version: 1, jobs: { j: job() } })).toBe(true)
-		expect(rejected({ version: 1, flow_path: 'f', recorded_at: 'x', jobs: { j: job() } })).toBe(
-			true
-		)
-		// JobLoader replays each event in a timer, where a throw escapes every
-		// boundary, so a non-object event has to be caught at load.
+		expect(rejected({ version: 2, root_job_id: 'j', jobs: { j: job() } })).toBe(true)
 		expect(
 			rejected({
-				version: 1,
+				version: 2,
 				flow_path: 'f',
-				...header,
-				jobs: { j: { initial_job: {}, events: ['nope'] } }
+				recorded_at: 'x',
+				root_job_id: 'j',
+				jobs: { j: job() }
 			})
 		).toBe(true)
+		// The replay is keyed and anchored by job ids, so a job without one — or a
+		// root id naming no recorded job — has nothing to attach to.
+		expect(rejected(flowRec({ jobs: { j: { type: 'CompletedJob' } } }))).toBe(true)
+		expect(rejected(flowRec({ root_job_id: 'missing' }))).toBe(true)
 		// Cardinality, not just shape: each job mounts a JobLoader.
 		const tooManyJobs = Object.fromEntries(
-			Array.from({ length: MAX_RECORDED_JOBS + 1 }, (_, i) => [`j${i}`, job(0)])
+			Array.from({ length: MAX_RECORDED_JOBS + 1 }, (_, i) => [`j${i}`, job({ id: `j${i}` })])
 		)
-		expect(rejected({ version: 1, flow_path: 'f', ...header, jobs: tooManyJobs })).toBe(true)
+		expect(rejected(flowRec({ jobs: { j: job(), ...tooManyJobs } }))).toBe(true)
 	})
 
 	it('holds every recorded value to one structural render budget', () => {
@@ -167,87 +219,48 @@ describe('parseRecording', () => {
 		const wide = (n: number) => Array.from({ length: n }, () => 0)
 		const overBudget = MAX_VALUE_NODES + 1
 
-		const flowJob = (initial: unknown, eventData?: unknown) => ({
-			version: 1,
-			flow_path: 'f',
-			...header,
-			jobs: {
-				j: {
-					initial_job: initial,
-					events: eventData ? [{ t: 0, data: eventData }] : []
-				}
-			}
-		})
+		const flowJob = (jobExtra: Record<string, unknown>) => flowRec({ jobs: { j: job(jobExtra) } })
 		// args (a JobArgs row per key) and flow_status.modules (a subtree per entry).
-		expect(rejected(flowJob({ id: 'j', args: { a: wide(overBudget) } }))).toBe(true)
-		expect(rejected(flowJob({ id: 'j', flow_status: { modules: wide(overBudget) } }))).toBe(true)
-		// Same via an event rather than the initial job.
-		expect(rejected(flowJob({ id: 'j' }, { flow_status: { modules: wide(overBudget) } }))).toBe(
-			true
-		)
+		expect(rejected(flowJob({ args: { a: wide(overBudget) } }))).toBe(true)
+		expect(rejected(flowJob({ flow_status: { modules: wide(overBudget) } }))).toBe(true)
 		// render_all fans out into nested DisplayResults, and the renderer recurses —
 		// so a nested budget, not the top-level array's length.
 		const nested = Array.from({ length: 400 }, () => ({ render_all: wide(400) }))
-		expect(
-			rejected(
-				flowJob({ id: 'j' }, { completed: true, job: { id: 'j', result: { render_all: nested } } })
-			)
-		).toBe(true)
+		expect(rejected(flowJob({ result: { render_all: nested } }))).toBe(true)
 		// data_tests is a sibling key whose renderer also fans out per entry; nobody
 		// had to name it for the budget to cover it.
-		expect(
-			rejected(
-				flowJob(
-					{ id: 'j' },
-					{ completed: true, job: { id: 'j', result: { data_tests: wide(overBudget) } } }
-				)
-			)
-		).toBe(true)
+		expect(rejected(flowJob({ result: { data_tests: wide(overBudget) } }))).toBe(true)
 		// Depth is its own hazard: a renderer recursing over this blows the stack long
 		// before the node count would.
 		let deep: unknown = 0
 		for (let i = 0; i < MAX_VALUE_DEPTH + 2; i++) deep = { nest: deep }
-		expect(rejected(flowJob({ id: 'j', args: { a: deep } }))).toBe(true)
+		expect(rejected(flowJob({ args: { a: deep } }))).toBe(true)
 
-		expect(kindOf(flowJob({ id: 'j', args: { a: 1, b: 'two' } }))).toBe('flow')
+		expect(kindOf(flowJob({ args: { a: 1, b: 'two' } }))).toBe('flow')
 	})
 
 	it('bounds what a script and a flow render immediately', () => {
 		const wide = (n: number) => Array.from({ length: n }, () => 0)
-		const script = (extra: Record<string, unknown>) => ({
-			version: 1,
-			type: 'script',
-			script_path: 's',
-			...header,
-			code: 'x',
-			language: 'bash',
-			job: job(),
-			...extra
-		})
 		// SchemaForm recurses into nested properties, so the cap cannot be top-level.
 		expect(
 			rejected(
-				script({
+				scriptRec({
 					schema: { properties: { outer: { properties: { inner: wide(MAX_VALUE_NODES + 1) } } } }
 				})
 			)
 		).toBe(true)
-		expect(kindOf(script({ args: { a: 1 } }))).toBe('script')
+		expect(kindOf(scriptRec({ args: { a: 1 } }))).toBe('script')
 		// `args` and `schema.properties` arrive as the root of the walk on this kind.
 		const wideMap = Object.fromEntries(
 			Array.from({ length: MAX_MAP_ROWS + 1 }, (_, i) => [`a${i}`, 1])
 		)
-		expect(rejected(script({ args: wideMap }))).toBe(true)
-		expect(rejected(script({ args: Array.from({ length: MAX_MAP_ROWS + 1 }, () => 0) }))).toBe(true)
-		expect(rejected(script({ schema: { properties: wideMap } }))).toBe(true)
+		expect(rejected(scriptRec({ args: wideMap }))).toBe(true)
+		expect(rejected(scriptRec({ args: Array.from({ length: MAX_MAP_ROWS + 1 }, () => 0) }))).toBe(
+			true
+		)
+		expect(rejected(scriptRec({ schema: { properties: wideMap } }))).toBe(true)
 
-		const flowWith = (value: unknown) => ({
-			version: 1,
-			flow_path: 'f',
-			...header,
-			jobs: { j: job() },
-			flow: { value }
-		})
+		const flowWith = (value: unknown) => flowRec({ flow: { value } })
 		const modules = (n: number) =>
 			Array.from({ length: n }, (_, i) => ({ id: `m${i}`, value: { type: 'identity' } }))
 		expect(rejected(flowWith({ modules: modules(MAX_FLOW_MODULES + 1) }))).toBe(true)
@@ -313,17 +326,7 @@ describe('parseRecording', () => {
 
 	it('bounds the three things that cost differently: structure, text, components', () => {
 		const wide = (n: number) => Array.from({ length: n }, () => 0)
-		const flowJob = (result: unknown) => ({
-			version: 1,
-			flow_path: 'f',
-			...header,
-			jobs: {
-				j: {
-					initial_job: { id: 'j' },
-					events: [{ t: 0, data: { completed: true, job: { id: 'j', result } } }]
-				}
-			}
-		})
+		const flowJob = (result: unknown) => flowRec({ jobs: { j: job({ result }) } })
 
 		// Fan-out is cumulative across the value, not per array: nesting sidesteps a
 		// per-array cap while mounting a component per leaf.
@@ -382,33 +385,27 @@ describe('parseRecording', () => {
 		const properties = Object.fromEntries(
 			Array.from({ length: MAX_VALUE_NODES }, (_, i) => [`p${i}`, { type: 'string' }])
 		)
-		const res = parseRecording({
-			version: 1,
-			flow_path: 'f',
-			...header,
-			jobs: { j: job() },
-			flow: { schema: { properties }, value: { modules: [] } }
-		})
+		const res = parseRecording(
+			flowRec({ flow: { schema: { properties }, value: { modules: [] } } })
+		)
 		expect(res.ok).toBe(false)
 		// A module's inline `content` is the flow kind's equivalent of a script's
 		// `code`, and text is not structure.
 		expect(
-			rejected({
-				version: 1,
-				flow_path: 'f',
-				...header,
-				jobs: { j: job() },
-				flow: {
-					value: {
-						modules: [
-							{
-								id: 'a',
-								value: { type: 'rawscript', content: 'x'.repeat(MAX_VALUE_STRING_CHARS + 1) }
-							}
-						]
+			rejected(
+				flowRec({
+					flow: {
+						value: {
+							modules: [
+								{
+									id: 'a',
+									value: { type: 'rawscript', content: 'x'.repeat(MAX_VALUE_STRING_CHARS + 1) }
+								}
+							]
+						}
 					}
-				}
-			})
+				})
+			)
 		).toBe(true)
 	})
 
@@ -437,17 +434,7 @@ describe('parseRecording', () => {
 		// Metadata strings land in a header, a highlighter class or an error panel, and
 		// were only `typeof === 'string'`.
 		const long = 'x'.repeat(5000)
-		expect(
-			rejected({
-				version: 1,
-				type: 'script',
-				script_path: 's',
-				...header,
-				code: 'x',
-				language: long,
-				job: job()
-			})
-		).toBe(true)
+		expect(rejected(scriptRec({ language: long }))).toBe(true)
 		expect(rejected(pipeline({ codes: { 'f/a/b': { content: 'x', language: long } } }))).toBe(true)
 		expect(
 			rejected(
@@ -465,37 +452,13 @@ describe('parseRecording', () => {
 				})
 			)
 		).toBe(true)
-
-		// One job's events all become timers in a single pass.
-		expect(
-			rejected({
-				version: 1,
-				flow_path: 'f',
-				...header,
-				jobs: {
-					j: {
-						initial_job: { id: 'j' },
-						events: Array.from({ length: MAX_EVENTS_PER_JOB + 1 }, () => ({
-							t: 0,
-							data: { progress: 1 }
-						}))
-					}
-				}
-			})
-		).toBe(true)
 	})
 
 	it('refuses a huge recording before it looks at what any field means', () => {
 		// The backstop needs no key name, so a field no validator mentions is still
 		// bounded.
 		const filler = Array.from({ length: 5000 }, () => Array.from({ length: 500 }, () => 0))
-		const res = parseRecording({
-			version: 1,
-			flow_path: 'f',
-			...header,
-			jobs: { j: job() },
-			some_future_field: filler
-		})
+		const res = parseRecording(flowRec({ some_future_field: filler }))
 		expect(res.ok).toBe(false)
 		expect(res.ok ? '' : res.error).toMatch(new RegExp(`more than ${MAX_RECORDING_NODES} values`))
 
@@ -503,9 +466,7 @@ describe('parseRecording', () => {
 		// silently uncounted — a backstop that gives up is not a backstop.
 		let buried: unknown = filler
 		for (let i = 0; i < MAX_VALUE_DEPTH + 2; i++) buried = { nest: buried }
-		expect(rejected({ version: 1, flow_path: 'f', ...header, jobs: { j: job() }, buried })).toBe(
-			true
-		)
+		expect(rejected(flowRec({ buried }))).toBe(true)
 	})
 
 	it('bounds an errored asset sample, which still renders its own fields', () => {
@@ -545,36 +506,23 @@ describe('parseRecording', () => {
 		// A wide for-loop flow records a job per iteration, so a real capture can trip
 		// this — it must not read as "your recorder wrote a broken file".
 		const tooManyJobs = Object.fromEntries(
-			Array.from({ length: MAX_RECORDED_JOBS + 1 }, (_, i) => [`j${i}`, job(0)])
+			Array.from({ length: MAX_RECORDED_JOBS + 1 }, (_, i) => [`j${i}`, job({ id: `j${i}` })])
 		)
-		const res = parseRecording({ version: 1, flow_path: 'f', ...header, jobs: tooManyJobs })
+		const res = parseRecording(flowRec({ jobs: { j: job(), ...tooManyJobs } }))
 		expect(res.ok ? '' : res.error).toMatch(/holds \d+ jobs/)
-		const corrupt = parseRecording({ version: 1, flow_path: 'f', ...header, jobs: 'nope' })
+		const corrupt = parseRecording(flowRec({ jobs: 'nope' }))
 		expect(corrupt.ok ? '' : corrupt.error).toBe('Invalid flow recording format.')
 		// The render budget is the cap a real capture is most likely to trip, so it
 		// names the value and what about it was too big.
-		const fat = parseRecording({
-			version: 1,
-			flow_path: 'f',
-			...header,
-			jobs: {
-				j: {
-					initial_job: { id: 'j' },
-					events: [
-						{
-							t: 0,
-							data: {
-								completed: true,
-								job: {
-									id: 'j',
-									result: { render_all: Array.from({ length: MAX_COMPONENT_FANOUT + 1 }, () => 0) }
-								}
-							}
-						}
-					]
+		const fat = parseRecording(
+			flowRec({
+				jobs: {
+					j: job({
+						result: { render_all: Array.from({ length: MAX_COMPONENT_FANOUT + 1 }, () => 0) }
+					})
 				}
-			}
-		})
+			})
+		)
 		expect(fat.ok ? '' : fat.error).toMatch(/a recorded job carries more than \d+ `render_all`/)
 	})
 
diff --git a/frontend/src/lib/components/recording/rawAppRecordingLoad.ts b/frontend/src/lib/components/recording/rawAppRecordingLoad.ts
index 9da039760c..b52cbd4ccb 100644
--- a/frontend/src/lib/components/recording/rawAppRecordingLoad.ts
+++ b/frontend/src/lib/components/recording/rawAppRecordingLoad.ts
@@ -8,13 +8,8 @@
  * `package.json`'s `./components/recording/rawAppRecordingLoad` export, which the hub
  * imports, so renaming it means changing the hub in the same breath.
  */
-import type {
-	FlowRecording,
-	PipelineRecording,
-	RawAppRecording,
-	RecordedJob,
-	ScriptRecording
-} from './types'
+import type { Job } from '$lib/gen'
+import type { FlowRecording, PipelineRecording, RawAppRecording, ScriptRecording } from './types'
 import {
 	MAX_RECORDED_STEPS,
 	MAX_STEP_TEXT_CHARS,
@@ -32,16 +27,12 @@ export const MAX_RECORDING_BYTES = 100 * 1024 * 1024
  * later is unbounded until someone names it; this one needs no field, which is what
  * makes the set closed. Far above any real capture, far below what a tab survives. */
 export const MAX_RECORDING_NODES = 2_000_000
-/* Caps on the job-stream recordings (flow/script/pipeline). Each recorded job
- * mounts a JobLoader and each of its events costs a `setTimeout` created up front,
- * so the counts — not just the byte size — decide whether the tab survives. */
+/* Cap on the job-based recordings (flow/script/pipeline): each recorded job
+ * mounts a JobLoader whose synthesized replay stream costs `setTimeout`s created
+ * up front (the per-job event count is capped by the synthesis itself, in
+ * `replayStream.ts`), so the job count — not just the byte size — decides
+ * whether the tab survives. */
 export const MAX_RECORDED_JOBS = 2000
-/** `JobLoader.watchJob` schedules every event of a job in one pass, so this is a
- * count of timers created at once; events at `t: 0` all fire in the same frame, each
- * one a reactive update. Generous against reality (a long streaming job records on
- * the order of thousands) and survivable when they all land together. */
-export const MAX_EVENTS_PER_JOB = 5000
-export const MAX_RECORDED_JOB_EVENTS = 20_000
 /** The backstop: structure one recorded value may expand into, where a value is
  * what a component renders eagerly. Deliberately generous — it is not the precise
  * bound but the one that catches keys nobody has named; anything mounting a
@@ -74,7 +65,7 @@ export const MAX_MAP_ROWS = 2000
 /** `PipelineRecordingReplay.startReplay` schedules every frame in one pass, so this
  * counts timers created at once — frames at `t: 0` all land in the same tick, and
  * each reassigns the whole per-node status map and rebuilds the derived id/state maps
- * over its entire key set. Same bound as {@link MAX_EVENTS_PER_JOB}, same reason. */
+ * over its entire key set. */
 export const MAX_TIMELINE_FRAMES = 5000
 export const MAX_FRAME_STATUSES = 5000
 /** Graph elements each become a rendered canvas node or edge. */
@@ -277,33 +268,19 @@ function countRecordingNodes(v: unknown, budget = { n: MAX_RECORDING_NODES + 1 }
  * sample); the *number* of such values is bounded separately. */
 const withinRenderBudget = (v: unknown) => describeValueOverflow(v) === undefined
 
-/** JobLoader replays each `event.data` in a `setTimeout`, where a throw escapes
- * every Svelte boundary, so a malformed event must be refused at load. Each job
- * state is also held to the render budget, which covers everything hanging off it
- * at any depth. */
-function isRecordedJob(j: unknown): j is RecordedJob {
-	return (
-		isObject(j) &&
-		isObject(j.initial_job) &&
-		withinRenderBudget(j.initial_job) &&
-		isBoundedArray(j.events, MAX_EVENTS_PER_JOB) &&
-		j.events.every((e) => isObject(e) && isObject(e.data) && withinRenderBudget(e.data))
-	)
+/** A recorded completed job. The synthesized replay walks its timestamps and
+ * flow status and renders everything hanging off it (args, result, logs), so it
+ * is held to the render budget at any depth; `id` keys it into the replay. */
+function isRecordedJob(j: unknown): j is Job {
+	return isObject(j) && isShortText(j.id, true) && withinRenderBudget(j)
 }
 
-/** The `jobs` map every job-stream recording carries, bounded on both the number
- * of streams and the total number of events across them. */
-function isJobsMap(v: unknown): v is Record<string, RecordedJob> {
+/** The `jobs` map the flow and pipeline recordings carry. */
+function isJobsMap(v: unknown): v is Record<string, Job> {
 	if (!isObject(v)) return false
 	const jobs = Object.values(v)
 	if (jobs.length > MAX_RECORDED_JOBS) return false
-	let events = 0
-	for (const j of jobs) {
-		if (!isRecordedJob(j)) return false
-		events += j.events.length
-		if (events > MAX_RECORDED_JOB_EVENTS) return false
-	}
-	return true
+	return jobs.every(isRecordedJob)
 }
 
 /** The header every recording renders: a title, a `recorded_at` each player parses
@@ -349,7 +326,7 @@ function countFlowModules(modules: unknown, budget: number): number {
 
 /** True when `data` is a well-formed script recording. */
 export function isScriptRecording(data: unknown): data is ScriptRecording {
-	if (!isObject(data) || data.version !== 1 || data.type !== 'script') return false
+	if (!isObject(data) || data.version !== 2 || data.type !== 'script') return false
 	// `code` is highlighted in one pass and `language` selects the grammar.
 	return (
 		hasValidHeader(data, 'script_path') &&
@@ -368,7 +345,7 @@ export function isScriptRecording(data: unknown): data is ScriptRecording {
 
 /** True when `data` is a well-formed pipeline recording. */
 export function isPipelineRecording(data: unknown): data is PipelineRecording {
-	if (!isObject(data) || data.version !== 1 || data.type !== 'pipeline') return false
+	if (!isObject(data) || data.version !== 2 || data.type !== 'pipeline') return false
 	const g = data.graph
 	const validGraph =
 		isObject(g) &&
@@ -427,9 +404,11 @@ export function isPipelineRecording(data: unknown): data is PipelineRecording {
 /** True when `data` is a well-formed flow recording. `type` is absent on
  * recordings taken before the discriminator existed. */
 export function isFlowRecording(data: unknown): data is FlowRecording {
-	if (!isObject(data) || data.version !== 1) return false
+	if (!isObject(data) || data.version !== 2) return false
 	if (data.type !== undefined && data.type !== 'flow') return false
 	if (!hasValidHeader(data, 'flow_path') || !isJobsMap(data.jobs)) return false
+	// The player anchors the whole replay on the root job, so it must exist.
+	if (typeof data.root_job_id !== 'string' || !isObject(data.jobs[data.root_job_id])) return false
 	if (data.flow === undefined) return true
 	// The player hands the whole `flow` to FlowViewer, so `schema` renders (Input
 	// Schema tab, Input node) just like `value` does — budget one level up.
@@ -459,13 +438,6 @@ function describeOverflow(data: Record<string, unknown>): string | undefined {
 	if (jobs.length > MAX_RECORDED_JOBS) {
 		return `This recording holds ${jobs.length} jobs, more than the ${MAX_RECORDED_JOBS} this player can replay.`
 	}
-	const events = jobs.reduce(
-		(sum: number, j) => sum + (isObject(j) && Array.isArray(j.events) ? j.events.length : 0),
-		0
-	)
-	if (events > MAX_RECORDED_JOB_EVENTS) {
-		return `This recording holds ${events} job events, more than the ${MAX_RECORDED_JOB_EVENTS} this player can replay.`
-	}
 	if (Array.isArray(data.timeline) && data.timeline.length > MAX_TIMELINE_FRAMES) {
 		return `This recording holds ${data.timeline.length} timeline frames, more than the ${MAX_TIMELINE_FRAMES} this player can animate.`
 	}
@@ -475,6 +447,7 @@ function describeOverflow(data: Record<string, unknown>): string | undefined {
 	const samples = isObject(data.assetSamples) ? Object.values(data.assetSamples) : []
 	for (const [label, value] of [
 		['a recorded job', jobs.find((j) => !withinRenderBudget(j))],
+		['the recorded job', withinRenderBudget(data.job) ? undefined : data.job],
 		['this flow definition', withinRenderBudget(data.flow) ? undefined : data.flow],
 		["this script's inputs", withinRenderBudget(data.schema) ? undefined : data.schema],
 		['a recorded asset sample', samples.find((s) => !withinRenderBudget(s))]
@@ -498,24 +471,104 @@ function describeOverflow(data: Record<string, unknown>): string | undefined {
 	return undefined
 }
 
+/** A v1 stream's incremental logs may be longer than what its completed job
+ * carried (sub-jobs were often backfilled without logs), but the upgraded job
+ * is one rendered value, so the reassembly is held under the text budget. */
+const MAX_UPGRADED_LOG_CHARS = 2 * 1024 * 1024
+
+/** v1 flow/script/pipeline recordings stored captured live event streams; each
+ * stream carried the completed job in its final `completed` event, so they
+ * upgrade to the v2 run-based shape by collapsing every stream to that job —
+ * with the stream's incremental `new_logs` chunks reassembled, since the
+ * completed job was often fetched without them. Recordings already published
+ * (the hub) keep replaying this way. Returns undefined when no completed job
+ * can be extracted. */
+function upgradeV1JobRecording(data: Record<string, unknown>): Record<string, unknown> | undefined {
+	const completedJobOf = (stream: unknown): Record<string, unknown> | undefined => {
+		if (!isObject(stream)) return undefined
+		let job = isObject(stream.initial_job) ? stream.initial_job : undefined
+		let streamedLogs = ''
+		for (const e of Array.isArray(stream.events) ? stream.events : []) {
+			if (!isObject(e) || !isObject(e.data)) continue
+			if (typeof e.data.new_logs === 'string') streamedLogs += e.data.new_logs
+			if (e.data.completed && isObject(e.data.job)) {
+				job = e.data.job as Record<string, unknown>
+			}
+		}
+		if (!job || typeof job.id !== 'string') return undefined
+		const jobLogs = typeof job.logs === 'string' ? job.logs : ''
+		if (streamedLogs.length > jobLogs.length) {
+			job = {
+				...job,
+				logs:
+					streamedLogs.length > MAX_UPGRADED_LOG_CHARS
+						? '[logs truncated for recording]\n…' + streamedLogs.slice(-MAX_UPGRADED_LOG_CHARS)
+						: streamedLogs
+			}
+		}
+		return job
+	}
+	const type = data.type === undefined ? 'flow' : data.type
+	if (type === 'script') {
+		const job = completedJobOf(data.job)
+		return job ? { ...data, version: 2, job } : undefined
+	}
+	if (type !== 'flow' && type !== 'pipeline') return undefined
+	if (!isObject(data.jobs)) return undefined
+	const jobs: Record<string, Record<string, unknown>> = {}
+	for (const stream of Object.values(data.jobs)) {
+		const job = completedJobOf(stream)
+		if (job) jobs[job.id as string] = job
+	}
+	if (type === 'pipeline') return { ...data, version: 2, jobs }
+	// A flow additionally needs its root: the parentless flow job, mirroring how
+	// the v1 player located it.
+	const all = Object.values(jobs)
+	const rootJob =
+		all.find((j) => (j.job_kind === 'flow' || j.job_kind === 'flowpreview') && !j.parent_job) ??
+		all.find((j) => !j.parent_job) ??
+		all[0]
+	if (!rootJob) return undefined
+	return { ...data, version: 2, type: 'flow', root_job_id: rootJob.id, jobs }
+}
+
 /** Classify a parsed recording and validate it against the player that would
  * mount it. The `type` discriminator picks the validator, so a malformed payload
  * reports the kind it claimed to be instead of falling through to `flow`. */
 export function parseRecording(
-	data: unknown
+	input: unknown
 ): { ok: true; loaded: LoadedRecording } | { ok: false; error: string } {
-	if (!isObject(data) || data.version !== 1) {
+	if (!isObject(input) || typeof input.version !== 'number') {
 		return { ok: false, error: 'This file is not a Windmill recording.' }
 	}
 	// Before anything looks at what the fields mean: no recording, whatever it holds,
 	// may carry more structure than a tab can render. This is what makes the bound
 	// exhaustive rather than a list of the fields someone remembered.
-	if (countRecordingNodes(data) > MAX_RECORDING_NODES) {
+	if (countRecordingNodes(input) > MAX_RECORDING_NODES) {
 		return {
 			ok: false,
 			error: `This recording carries more than ${MAX_RECORDING_NODES} values, more than this player can render.`
 		}
 	}
+	let data = input
+	// App recordings never changed format and stay at version 1.
+	const expectedVersion = data.type === 'app' ? 1 : 2
+	if (data.version === 1 && expectedVersion === 2) {
+		const upgraded = upgradeV1JobRecording(data)
+		if (!upgraded) {
+			return {
+				ok: false,
+				error:
+					'This recording was made by an older version of Windmill and can no longer be replayed — re-record it.'
+			}
+		}
+		data = upgraded
+	} else if (data.version !== expectedVersion) {
+		return {
+			ok: false,
+			error: 'This recording needs a newer version of Windmill to replay.'
+		}
+	}
 	const type = data.type === undefined ? 'flow' : data.type
 	const invalid = (kind: string) => ({
 		ok: false as const,
diff --git a/frontend/src/lib/components/recording/replay.svelte.ts b/frontend/src/lib/components/recording/replay.svelte.ts
new file mode 100644
index 0000000000..f2b0fc1d68
--- /dev/null
+++ b/frontend/src/lib/components/recording/replay.svelte.ts
@@ -0,0 +1,21 @@
+import type { ActiveReplayData } from './types'
+
+// Module-level so every JobLoader in the tree sees the same replay, wherever it
+// mounts (portals/drawers included).
+let activeReplay: ActiveReplayData | undefined = $state<ActiveReplayData | undefined>(undefined)
+let replayStartTime: number = 0
+
+export function getActiveReplay() {
+	return activeReplay
+}
+
+export function setActiveReplay(r: ActiveReplayData | undefined) {
+	activeReplay = r
+	replayStartTime = r ? Date.now() : 0
+}
+
+/** The wall-clock moment the current replay started; event `t` values are
+ * scheduled relative to it so late-discovered sub-jobs stay in sync. */
+export function getReplayStartTime() {
+	return replayStartTime
+}
diff --git a/frontend/src/lib/components/recording/replayStream.test.ts b/frontend/src/lib/components/recording/replayStream.test.ts
new file mode 100644
index 0000000000..50faaf9921
--- /dev/null
+++ b/frontend/src/lib/components/recording/replayStream.test.ts
@@ -0,0 +1,300 @@
+/**
+ * The synthesis is what makes a run-based recording replayable: these pin the
+ * contract JobLoader's replay path and FlowStatusViewer depend on — event
+ * ordering, log reassembly, module status transitions and timestamp rebasing.
+ */
+import { describe, expect, it } from 'vitest'
+import type { Job } from '$lib/gen'
+import { synthesizeFlowReplay, synthesizeSingleJobReplay } from './replayStream'
+
+const T0 = new Date('2026-08-01T10:00:00.000Z').getTime()
+const iso = (offsetMs: number) => new Date(T0 + offsetMs).toISOString()
+
+const scriptJob = (extra: Record<string, unknown> = {}): Job =>
+	({
+		id: 'sub1',
+		type: 'CompletedJob',
+		success: true,
+		created_at: iso(0),
+		started_at: iso(100),
+		duration_ms: 2000,
+		logs: 'line1\nline2\nline3\n',
+		result: { ok: true },
+		...extra
+	}) as any
+
+describe('synthesizeSingleJobReplay', () => {
+	it('streams from a queued initial job to the completed one, logs in between', () => {
+		const nowMs = 5_000_000
+		const stream = synthesizeSingleJobReplay(scriptJob(), { nowMs })
+
+		expect(stream.initial_job.type).toBe('QueuedJob')
+		expect((stream.initial_job as any).logs).toBe('')
+		expect((stream.initial_job as any).result).toBeUndefined()
+		expect((stream.initial_job as any).success).toBeUndefined()
+
+		const events = stream.events
+		expect(events[0].data).toEqual({ running: true })
+		const completed = events[events.length - 1]
+		expect(completed.data.completed).toBe(true)
+		expect(completed.t).toBe(2000)
+		expect(completed.data.job.result).toEqual({ ok: true })
+
+		// Log chunks sit strictly inside the run window, in order, and reassemble
+		// to the original logs; offsets increase so JobLoader appends.
+		const logEvents = events.filter((e) => e.data.new_logs)
+		expect(logEvents.length).toBeGreaterThan(0)
+		for (const e of logEvents) {
+			expect(e.t).toBeGreaterThan(0)
+			expect(e.t).toBeLessThan(2000)
+		}
+		expect(logEvents.map((e) => e.data.new_logs).join('')).toBe('line1\nline2\nline3\n')
+		const offsets = logEvents.map((e) => e.data.log_offset)
+		expect([...offsets].sort((a, b) => a - b)).toEqual(offsets)
+		expect(offsets[0]).toBeGreaterThan(0)
+
+		// Absolute timestamps are rebased onto the replay clock ("now").
+		expect(new Date(stream.initial_job.started_at!).getTime()).toBe(nowMs)
+		expect(new Date(completed.data.job.started_at).getTime()).toBe(nowMs)
+	})
+
+	it('collapse reveals the completed job at t=0', () => {
+		const stream = synthesizeSingleJobReplay(scriptJob(), { collapse: true, nowMs: 1 })
+		expect(stream.events).toHaveLength(1)
+		expect(stream.events[0]).toMatchObject({ t: 0, data: { completed: true } })
+		expect((stream.initial_job as any).result).toEqual({ ok: true })
+	})
+
+	it('survives hostile timestamps without throwing or scheduling into the far future', () => {
+		const stream = synthesizeSingleJobReplay(
+			scriptJob({ started_at: 'not-a-date', created_at: undefined, duration_ms: 1e18 }),
+			{ nowMs: 1 }
+		)
+		for (const e of stream.events) {
+			expect(Number.isFinite(e.t)).toBe(true)
+			expect(e.t).toBeLessThanOrEqual(6 * 60 * 60 * 1000)
+		}
+	})
+})
+
+describe('synthesizeFlowReplay', () => {
+	const rootJob = (): Job =>
+		({
+			id: 'root',
+			type: 'CompletedJob',
+			job_kind: 'flowpreview',
+			success: true,
+			created_at: iso(0),
+			started_at: iso(0),
+			duration_ms: 6000,
+			flow_status: {
+				step: 2,
+				modules: [
+					{ id: 'a', type: 'Success', job: 'sub1' },
+					{ id: 'b', type: 'Success', job: 'sub2' }
+				]
+			}
+		}) as any
+
+	const jobs = (): Record<string, Job> => ({
+		root: rootJob(),
+		sub1: scriptJob(),
+		sub2: scriptJob({
+			id: 'sub2',
+			started_at: iso(3000),
+			duration_ms: 2500,
+			logs: 'later\n'
+		})
+	})
+
+	it('flips module statuses at the sub-jobs’ recorded start/end times', () => {
+		const replay = synthesizeFlowReplay(jobs(), 'root', 9_000_000)
+		const root = replay.jobs['root']
+
+		// Before anything ran, both modules wait.
+		const initialModules = (root.initial_job as any).flow_status.modules
+		expect(initialModules.map((m: any) => m.type)).toEqual([
+			'WaitingForPriorSteps',
+			'WaitingForPriorSteps'
+		])
+		// A waiting module must not leak its job id — that is what triggers
+		// sub-job discovery in the viewer.
+		expect(initialModules[0].job).toBeUndefined()
+
+		const statusAt = (t: number) => {
+			const snapshots = root.events.filter((e) => e.data.flow_status && e.t <= t)
+			return snapshots[snapshots.length - 1]?.data.flow_status.modules.map((m: any) => m.type)
+		}
+		// sub1 runs 100→2100, sub2 runs 3000→5500.
+		expect(statusAt(150)).toEqual(['InProgress', 'WaitingForPriorSteps'])
+		expect(statusAt(2200)).toEqual(['Success', 'WaitingForPriorSteps'])
+		expect(statusAt(3100)).toEqual(['Success', 'InProgress'])
+
+		// The root completes only after every sub-job event has landed.
+		const rootCompleted = root.events.find((e) => e.data.completed)!
+		const maxSubT = Math.max(
+			...['sub1', 'sub2'].flatMap((id) => replay.jobs[id].events.map((e) => e.t))
+		)
+		expect(rootCompleted.t).toBeGreaterThan(maxSubT)
+
+		// Sub streams are anchored on the root clock, not their own.
+		expect(replay.jobs['sub2'].events[0]).toMatchObject({ t: 3000, data: { running: true } })
+	})
+
+	it('never mutates the input jobs, so a second Play replays identically', () => {
+		const input = {
+			root: {
+				...rootJob(),
+				flow_status: {
+					step: 1,
+					modules: [
+						{
+							id: 'loop',
+							type: 'Success',
+							flow_jobs: ['it1'],
+							flow_jobs_duration: { started_at: [iso(100)], duration_ms: [1500] }
+						}
+					]
+				}
+			} as any,
+			it1: scriptJob({ id: 'it1', started_at: iso(100), duration_ms: 1500 })
+		}
+		const before = JSON.stringify(input)
+		const first = synthesizeFlowReplay(input, 'root', 9_000_000)
+		// The input survives synthesis untouched — snapshots taken at/after a
+		// module's end must not alias (and later rebase) its original objects.
+		expect(JSON.stringify(input)).toBe(before)
+
+		// A snapshot after the loop ended still shows it completed, with its
+		// recorded (now rebased) iteration timing intact.
+		const snapshots = first.jobs['root'].events.filter((e) => e.data.flow_status)
+		const after = snapshots[snapshots.length - 1].data.flow_status.modules[0]
+		expect(after.type).toBe('Success')
+		expect(new Date(after.flow_jobs_duration.started_at[0]).getTime()).toBe(9_000_000 + 100)
+
+		const second = synthesizeFlowReplay(input, 'root', 9_000_000)
+		expect(JSON.stringify(second)).toBe(JSON.stringify(first))
+	})
+
+	it('bounds the aggregate synthesized events across a many-job replay', () => {
+		const jobsMap: Record<string, Job> = { root: rootJob() }
+		// 200 sub-jobs, each with logs that would individually chunk into 300
+		// ticks — unbudgeted that is 60k log events.
+		for (let i = 0; i < 200; i++) {
+			jobsMap[`s${i}`] = scriptJob({
+				id: `s${i}`,
+				started_at: iso(100),
+				duration_ms: 300_000,
+				logs: Array.from({ length: 1000 }, (_, l) => `line ${l}`).join('\n')
+			})
+		}
+		const replay = synthesizeFlowReplay(jobsMap, 'root', 9_000_000)
+		const total = Object.values(replay.jobs).reduce((sum, s) => sum + s.events.length, 0)
+		// 20k budgeted events plus the per-job running/completed pair and the
+		// budget-exempt single log chunk each job is always allowed.
+		expect(total).toBeLessThanOrEqual(20_000 + 3 * Object.keys(jobsMap).length)
+		// Logs still fully replay even where the budget pinched to one chunk.
+		for (const [id, stream] of Object.entries(replay.jobs)) {
+			const logs = stream.events
+				.filter((e) => e.data.new_logs)
+				.map((e) => e.data.new_logs)
+				.join('')
+			expect(logs).toBe((jobsMap[id] as any).logs ?? '')
+		}
+	})
+
+	it('keeps a module without recorded timing hidden until the flow completes', () => {
+		const jobsMap: Record<string, Job> = {
+			root: rootJob(),
+			sub1: scriptJob()
+			// sub2 (module b's job) deliberately not recorded
+		}
+		const replay = synthesizeFlowReplay(jobsMap, 'root', 9_000_000)
+		const root = replay.jobs['root']
+		const states = [
+			(root.initial_job as any).flow_status,
+			...root.events.filter((e) => e.data.flow_status).map((e) => e.data.flow_status)
+		]
+		for (const fs of states) {
+			// Never reveals its final state — or its job id, which would trigger
+			// sub-job discovery for a job the recording doesn't hold.
+			expect(fs.modules[1]).toEqual({ id: 'b', type: 'WaitingForPriorSteps' })
+		}
+		const completed = root.events.find((e) => e.data.completed)!
+		expect(completed.data.job.flow_status.modules[1].type).toBe('Success')
+	})
+
+	it('completes a nested sub-flow only after its own children', () => {
+		// Nested flow and its child share the exact same end instant — the tie the
+		// per-stream synthesis cannot break on its own.
+		const nested = {
+			id: 'nested',
+			type: 'CompletedJob',
+			job_kind: 'flow',
+			parent_job: 'root',
+			started_at: iso(100),
+			duration_ms: 2000,
+			flow_status: { step: 1, modules: [{ id: 'inner', type: 'Success', job: 'leaf' }] }
+		} as any
+		const leaf = scriptJob({ id: 'leaf', started_at: iso(100), duration_ms: 2000 })
+		const outerRoot = {
+			...rootJob(),
+			flow_status: { step: 1, modules: [{ id: 'n', type: 'Success', job: 'nested' }] }
+		} as any
+		const replay = synthesizeFlowReplay({ root: outerRoot, nested, leaf }, 'root', 9_000_000)
+		const completedT = (id: string) => replay.jobs[id].events.find((e) => e.data.completed)!.t
+		const leafMax = replay.jobs['leaf'].events.reduce((m, e) => Math.max(m, e.t), 0)
+		expect(completedT('nested')).toBeGreaterThan(leafMax)
+		expect(completedT('root')).toBeGreaterThan(completedT('nested'))
+	})
+
+	it('survives malformed flow_status shapes without throwing', () => {
+		const malformed = scriptJob({
+			flow_status: {
+				step: 'x',
+				modules: {},
+				failure_module: { flow_jobs_duration: { started_at: 'nope' } }
+			}
+		})
+		expect(() => synthesizeSingleJobReplay(malformed, { nowMs: 1 })).not.toThrow()
+		expect(() => synthesizeSingleJobReplay(malformed, { nowMs: 1, collapse: true })).not.toThrow()
+		expect(() => synthesizeFlowReplay({ root: malformed }, 'root', 9_000_000)).not.toThrow()
+	})
+
+	it('trims a loop’s iterations to those started at each snapshot', () => {
+		const loopRoot = {
+			...rootJob(),
+			flow_status: {
+				step: 1,
+				modules: [
+					{
+						id: 'loop',
+						type: 'Success',
+						flow_jobs: ['it1', 'it2'],
+						flow_jobs_success: [true, true],
+						iterator: { index: 1, itered_len: 2 },
+						flow_jobs_duration: {
+							started_at: [iso(100), iso(2000)],
+							duration_ms: [1500, 1500]
+						}
+					}
+				]
+			}
+		} as any
+		const replay = synthesizeFlowReplay(
+			{
+				root: loopRoot,
+				it1: scriptJob({ id: 'it1', started_at: iso(100), duration_ms: 1500 }),
+				it2: scriptJob({ id: 'it2', started_at: iso(2000), duration_ms: 1500 })
+			},
+			'root',
+			9_000_000
+		)
+		const snapshots = replay.jobs['root'].events.filter((e) => e.data.flow_status)
+		const during = snapshots.find((e) => e.t >= 100 && e.t < 2000)!
+		const mod = during.data.flow_status.modules[0]
+		expect(mod.type).toBe('InProgress')
+		expect(mod.flow_jobs).toEqual(['it1'])
+		expect(mod.iterator.index).toBe(0)
+	})
+})
diff --git a/frontend/src/lib/components/recording/replayStream.ts b/frontend/src/lib/components/recording/replayStream.ts
new file mode 100644
index 0000000000..72c8911877
--- /dev/null
+++ b/frontend/src/lib/components/recording/replayStream.ts
@@ -0,0 +1,471 @@
+/**
+ * Synthesizes JobLoader replay streams from a run's completed jobs.
+ *
+ * A recording stores only what the run factually was: each completed job with
+ * its timestamps, logs and result. At play time this module turns those into
+ * the event streams a live run would have produced — logs distributed evenly
+ * across each job's execution window, a flow's per-module statuses flipping at
+ * the moments its sub-jobs started and finished — so the players and every
+ * component under them (FlowStatusViewer, LogViewer, …) behave exactly as they
+ * do while watching a real job.
+ *
+ * All `t` values are on the recording clock: zero = the root job's start.
+ * Absolute timestamps inside the emitted jobs are rebased to "now" because
+ * components like TimelineCompute measure elapsed time against `Date.now()`.
+ *
+ * Two hard rules, because recordings are caller-controlled (uploaded files,
+ * `?src=` URLs on the public replay page) and this runs before any timer fires:
+ *  - the input jobs are never mutated — every emitted job/status is a clone, so
+ *    replaying twice from the same recording animates identically;
+ *  - synthesis is budgeted across the whole replay (event count and cloned
+ *    structure), so a file well inside the load-time render budgets still
+ *    cannot make this loop materialize an unbounded amount of work.
+ */
+import type { FlowStatus, FlowStatusModule, Job } from '$lib/gen'
+import type { ActiveReplayData, RecordedEvent, RecordedJob } from './types'
+
+/** Target pacing of synthesized log chunks. */
+const LOG_TICK_MS = 200
+/** Cap on log events per job — each becomes a `setTimeout` scheduled up front. */
+const MAX_LOG_TICKS = 300
+/** Cap on flow-status snapshots per flow job, same reason. */
+const MAX_STATUS_SNAPSHOTS = 500
+/** Recorded timestamps are caller-controlled, so no event may schedule beyond
+ * this horizon. */
+const MAX_REPLAY_MS = 6 * 60 * 60 * 1000
+/** Aggregate cap on synthesized events across every job of one replay — the
+ * per-job caps alone would let a 2000-job recording materialize ~1.6M timer
+ * events. Matches the total the v1 format enforced on stored events. */
+const MAX_TOTAL_REPLAY_EVENTS = 20_000
+/** Aggregate cap on the structure snapshots may clone: each flow-status
+ * snapshot is a deep clone of the job's status, so a status near the per-value
+ * render budget (~100k nodes) must get few snapshots, not 500. */
+const MAX_TOTAL_SNAPSHOT_NODES = 500_000
+
+/** Shared across every stream of one replay; see the caps above. */
+type SynthesisBudget = { events: number; snapshotNodes: number }
+
+function newBudget(): SynthesisBudget {
+	return { events: MAX_TOTAL_REPLAY_EVENTS, snapshotNodes: MAX_TOTAL_SNAPSHOT_NODES }
+}
+
+const asArray = <T>(v: unknown): T[] => (Array.isArray(v) ? (v as T[]) : [])
+
+function parseMs(d: unknown): number | undefined {
+	if (typeof d !== 'string' && typeof d !== 'number') return undefined
+	const t = new Date(d).getTime()
+	return Number.isFinite(t) ? t : undefined
+}
+
+const clampT = (t: number) => Math.min(Math.max(Number.isFinite(t) ? t : 0, 0), MAX_REPLAY_MS)
+
+function jobStartMs(job: Job | undefined): number | undefined {
+	return parseMs(job?.started_at) ?? parseMs(job?.created_at)
+}
+
+function jobDurationMs(job: Job): number {
+	const d = (job as any).duration_ms
+	return typeof d === 'number' && Number.isFinite(d) && d > 0 ? Math.min(d, MAX_REPLAY_MS) : 0
+}
+
+function offsetDate(d: string | undefined, offset: number): string | undefined {
+	if (!d) return d
+	const t = new Date(d).getTime()
+	return isNaN(t) ? d : new Date(t + offset).toISOString()
+}
+
+/** Mutates `fs` — only ever call on a clone this module created. */
+function rebaseFlowStatus(fs: any, offset: number) {
+	if (!fs) return
+	const mods = [...asArray<any>(fs.modules), fs.failure_module, fs.preprocessor_module]
+	for (const mod of mods) {
+		const durations = mod?.flow_jobs_duration
+		if (Array.isArray(durations?.started_at)) {
+			durations.started_at = durations.started_at.map((d: string) => offsetDate(d, offset) ?? d)
+		}
+	}
+}
+
+/** Shift a job's absolute timestamps by `offset` ms so elapsed-time displays
+ * anchored on `Date.now()` read correctly during replay. Mutates `job` — only
+ * ever call on a clone this module created. */
+function rebaseJob(job: any, offset: number) {
+	for (const k of ['started_at', 'created_at', 'completed_at', 'scheduled_for']) {
+		if (job[k]) job[k] = offsetDate(job[k], offset)
+	}
+	rebaseFlowStatus(job.flow_status, offset)
+}
+
+const clone = <T>(v: T): T => JSON.parse(JSON.stringify(v))
+
+/** Rough structure size of a value, for the snapshot budget. Iterative so a
+ * hostile depth can't blow the stack; bails once far past the budget. */
+function roughNodeCount(v: unknown): number {
+	let n = 0
+	const stack: unknown[] = [v]
+	while (stack.length > 0) {
+		const x = stack.pop()
+		if (Array.isArray(x)) {
+			n += x.length
+			for (const i of x) stack.push(i)
+		} else if (x !== null && typeof x === 'object') {
+			const keys = Object.keys(x)
+			n += keys.length
+			for (const k of keys) stack.push((x as any)[k])
+		}
+		if (n > 2 * MAX_TOTAL_SNAPSHOT_NODES) return n
+	}
+	return n
+}
+
+/** A module's execution window on the recording clock, from its recorded
+ * per-iteration durations, its iteration jobs, or its single job. Undefined
+ * when the recording carries no timing for it (the module then reveals its
+ * final state only when its own job's — or the flow's — completion lands). */
+function moduleSpan(
+	mod: FlowStatusModule,
+	jobsById: Record<string, Job>,
+	anchorMs: number
+): { start: number; end: number; iterStarts: number[] } | undefined {
+	const starts: number[] = []
+	const ends: number[] = []
+	const fjd: any = mod.flow_jobs_duration
+	const fjdStarts = asArray<unknown>(fjd?.started_at)
+	if (fjdStarts.length > 0) {
+		fjdStarts.forEach((s, i) => {
+			const st = parseMs(s)
+			if (st === undefined) return
+			const d = Array.isArray(fjd?.duration_ms) ? fjd.duration_ms[i] : undefined
+			starts.push(st - anchorMs)
+			ends.push(st - anchorMs + (typeof d === 'number' && Number.isFinite(d) && d > 0 ? d : 0))
+		})
+	} else if (Array.isArray(mod.flow_jobs) && mod.flow_jobs.length > 0) {
+		for (const jid of mod.flow_jobs) {
+			const j = typeof jid === 'string' ? jobsById[jid] : undefined
+			const st = jobStartMs(j)
+			if (j === undefined || st === undefined) continue
+			starts.push(st - anchorMs)
+			ends.push(st - anchorMs + jobDurationMs(j))
+		}
+	} else if (typeof mod.job === 'string' && jobsById[mod.job]) {
+		const j = jobsById[mod.job]
+		const st = jobStartMs(j)
+		if (st !== undefined) {
+			starts.push(st - anchorMs)
+			ends.push(st - anchorMs + jobDurationMs(j))
+		}
+	}
+	if (starts.length === 0) return undefined
+	const iterStarts = [...starts].sort((a, b) => a - b).map(clampT)
+	return { start: clampT(Math.min(...starts)), end: clampT(Math.max(...ends)), iterStarts }
+}
+
+/** The module as it looked at time `T`: its final state once its window has
+ * passed, a bare waiting marker before it, and in between an in-progress
+ * variant with loop iterations trimmed to those already started. `orig` is
+ * read-only timing input; the returned module is always freshly owned (built
+ * from `cloned`, a clone of `orig`) so later rebasing can't touch the input. */
+function moduleStateAt(
+	T: number,
+	orig: FlowStatusModule,
+	cloned: FlowStatusModule | undefined,
+	jobsById: Record<string, Job>,
+	anchorMs: number
+): FlowStatusModule {
+	const span = moduleSpan(orig, jobsById, anchorMs)
+	// No timing info (sub-job not recorded): keep the module hidden — its final
+	// state arrives with the flow job's own completed event. Revealing it early
+	// would also leak its `job` id, triggering sub-job discovery in the viewer.
+	if (!span || T < span.start) {
+		return { id: orig.id, type: 'WaitingForPriorSteps' }
+	}
+	const m: any = cloned ?? clone(orig)
+	if (T >= span.end) return m
+	const started = span.iterStarts.filter((s) => s <= T).length
+	m.type = 'InProgress'
+	if (Array.isArray(m.flow_jobs)) {
+		m.flow_jobs = m.flow_jobs.slice(0, started)
+		if (Array.isArray(m.flow_jobs_success)) {
+			m.flow_jobs_success = m.flow_jobs_success.slice(0, started)
+		}
+		const fjd = m.flow_jobs_duration
+		if (fjd) {
+			if (Array.isArray(fjd.started_at)) fjd.started_at = fjd.started_at.slice(0, started)
+			if (Array.isArray(fjd.duration_ms)) fjd.duration_ms = fjd.duration_ms.slice(0, started)
+		}
+		if (m.iterator !== null && typeof m.iterator === 'object') {
+			m.iterator.index = Math.max(0, started - 1)
+		}
+	}
+	return m
+}
+
+/** The whole flow status as it looked at time `T`, derived from the completed
+ * status plus the sub-jobs' timings. Always a fresh deep structure. */
+function flowStatusAt(
+	T: number,
+	final: FlowStatus,
+	jobsById: Record<string, Job>,
+	anchorMs: number
+): FlowStatus {
+	const fs: any = clone(final)
+	const origModules = asArray<FlowStatusModule>(final.modules)
+	const clonedModules = asArray<FlowStatusModule>(fs.modules)
+	fs.modules = origModules.map((mod, i) =>
+		moduleStateAt(T, mod, clonedModules[i], jobsById, anchorMs)
+	)
+	let step = 0
+	for (const mod of origModules) {
+		const span = moduleSpan(mod, jobsById, anchorMs)
+		if (span && T >= span.end) step++
+		else break
+	}
+	fs.step = step
+	if (final.failure_module) {
+		fs.failure_module = moduleStateAt(
+			T,
+			final.failure_module,
+			fs.failure_module,
+			jobsById,
+			anchorMs
+		)
+	}
+	if (final.preprocessor_module) {
+		fs.preprocessor_module = moduleStateAt(
+			T,
+			final.preprocessor_module,
+			fs.preprocessor_module,
+			jobsById,
+			anchorMs
+		)
+	}
+	return fs
+}
+
+/** The times at which some module's shown state changes — each one gets a
+ * flow-status snapshot event, thinned evenly to `max`. */
+function statusBoundaries(
+	final: FlowStatus,
+	jobsById: Record<string, Job>,
+	anchorMs: number,
+	max: number
+): number[] {
+	if (max <= 0) return []
+	const ts = new Set<number>()
+	const mods = [
+		...asArray<FlowStatusModule>(final.modules),
+		final.failure_module,
+		final.preprocessor_module
+	]
+	for (const mod of mods) {
+		if (!mod) continue
+		const span = moduleSpan(mod, jobsById, anchorMs)
+		if (!span) continue
+		ts.add(span.start)
+		ts.add(span.end)
+		for (const s of span.iterStarts) ts.add(s)
+	}
+	let sorted = [...ts].sort((a, b) => a - b)
+	if (sorted.length > max) {
+		const stride = sorted.length / max
+		sorted = Array.from({ length: max }, (_, i) => sorted[Math.floor(i * stride)])
+	}
+	return sorted
+}
+
+/** Split `logs` into up to `maxTicks` chunks that concatenate back to the
+ * original, cut on line boundaries where possible. */
+function chunkLogs(logs: string, maxTicks: number): string[] {
+	const lines = logs.match(/[^\n]*\n|[^\n]+$/g) ?? []
+	const k = Math.min(maxTicks, lines.length)
+	if (k <= 1) return logs.length > 0 ? [logs] : []
+	const chunks: string[] = []
+	let from = 0
+	for (let i = 0; i < k; i++) {
+		const to = Math.round(((i + 1) * lines.length) / k)
+		chunks.push(lines.slice(from, to).join(''))
+		from = to
+	}
+	return chunks.filter((c) => c.length > 0)
+}
+
+export type SynthesisOptions = {
+	/** Recorded wall-clock ms that maps to t=0 on the replay clock. */
+	anchorMs: number
+	/** Wall-clock ms that t=0 plays at (usually `Date.now()` when Play is hit). */
+	nowMs: number
+	/** All the run's jobs, so a flow job's module timings can be resolved. */
+	jobsById?: Record<string, Job>
+	/** Reveal everything at t=0 instead of streaming — for a job the viewer
+	 * opens after it already finished. */
+	collapse?: boolean
+	/** Shared across a multi-job replay so the aggregate caps hold; a fresh
+	 * budget is used when absent (single-job replays). */
+	budget?: SynthesisBudget
+}
+
+/** Turn one completed job into the stream of updates a live watch of it would
+ * have produced. Never mutates `job`. */
+export function synthesizeJobStream(job: Job, opts: SynthesisOptions): RecordedJob {
+	const { anchorMs, nowMs, jobsById = {}, collapse } = opts
+	const budget = opts.budget ?? newBudget()
+	const offset = nowMs - anchorMs
+
+	const completed: any = clone(job)
+	rebaseJob(completed, offset)
+
+	if (collapse) {
+		return {
+			initial_job: completed as Job,
+			events: [{ t: 0, data: { completed: true, job: completed } }]
+		}
+	}
+
+	const startT = clampT((jobStartMs(job) ?? anchorMs) - anchorMs)
+	const durMs = jobDurationMs(job)
+	const endT = clampT(startT + durMs)
+
+	const initial: any = clone(completed)
+	initial.type = 'QueuedJob'
+	initial.running = false
+	initial.logs = ''
+	for (const k of ['success', 'result', 'result_stream', 'duration_ms', 'completed_at']) {
+		delete initial[k]
+	}
+	if (job.flow_status) {
+		initial.flow_status = flowStatusAt(startT, job.flow_status as FlowStatus, jobsById, anchorMs)
+		rebaseFlowStatus(initial.flow_status, offset)
+	}
+
+	const events: RecordedEvent[] = [{ t: startT, data: { running: true } }]
+
+	if (job.flow_status) {
+		const statusCost = Math.max(1, roughNodeCount(job.flow_status))
+		const allowed = Math.min(
+			MAX_STATUS_SNAPSHOTS,
+			Math.floor(budget.snapshotNodes / statusCost),
+			budget.events
+		)
+		for (const t of statusBoundaries(job.flow_status as FlowStatus, jobsById, anchorMs, allowed)) {
+			if (t <= startT || t >= endT) continue
+			const fs = flowStatusAt(t, job.flow_status as FlowStatus, jobsById, anchorMs)
+			rebaseFlowStatus(fs, offset)
+			events.push({ t, data: { running: true, flow_status: fs } })
+			budget.events--
+			budget.snapshotNodes -= statusCost
+		}
+	}
+
+	const logs = typeof (job as any).logs === 'string' ? ((job as any).logs as string) : ''
+	if (logs.length > 0 && durMs > 0) {
+		// At least one chunk even with the budget spent, so logs still appear —
+		// a single event per job is bounded by the job count.
+		const maxTicks = Math.max(
+			1,
+			Math.min(MAX_LOG_TICKS, Math.ceil(durMs / LOG_TICK_MS), budget.events)
+		)
+		const chunks = chunkLogs(logs, maxTicks)
+		budget.events -= chunks.length
+		let logOffset = 0
+		chunks.forEach((chunk, i) => {
+			logOffset += chunk.length
+			// Strictly inside (startT, endT) so the last lines land just before
+			// the completion event rather than racing it.
+			const t = clampT(startT + (durMs * (i + 1)) / (chunks.length + 1))
+			events.push({ t, data: { new_logs: chunk, log_offset: logOffset } })
+		})
+	}
+
+	events.push({ t: endT, data: { completed: true, job: completed } })
+	events.sort((a, b) => a.t - b.t)
+	return { initial_job: initial as Job, events }
+}
+
+/** Replay stream for one standalone job (script run, pipeline node), anchored
+ * on its own start so its events play from the moment the replay begins. */
+export function synthesizeSingleJobReplay(
+	job: Job,
+	opts?: { collapse?: boolean; nowMs?: number }
+): RecordedJob {
+	return synthesizeJobStream(job, {
+		anchorMs: jobStartMs(job) ?? 0,
+		nowMs: opts?.nowMs ?? Date.now(),
+		collapse: opts?.collapse
+	})
+}
+
+/** The sub-job ids a flow job's status references directly. */
+function directSubIds(job: Job | undefined): string[] {
+	const fs: any = job?.flow_status
+	if (!fs) return []
+	const ids: string[] = []
+	for (const mod of [...asArray<any>(fs.modules), fs.failure_module, fs.preprocessor_module]) {
+		if (!mod || typeof mod !== 'object') continue
+		if (typeof mod.job === 'string') ids.push(mod.job)
+		for (const j of asArray<unknown>(mod.flow_jobs)) {
+			if (typeof j === 'string') ids.push(j)
+		}
+	}
+	return ids
+}
+
+/** Build the full replay for a recorded flow run: one stream per job, all on
+ * the same clock (zero = root start), with every flow job's completion pushed
+ * past its descendants' events — recorded durations can tie to the millisecond,
+ * and a parent that "finishes" before its children breaks the animation. */
+export function synthesizeFlowReplay(
+	jobs: Record<string, Job>,
+	rootJobId: string,
+	nowMs: number = Date.now()
+): ActiveReplayData {
+	const root = jobs[rootJobId]
+	const anchorMs =
+		jobStartMs(root) ??
+		Object.values(jobs)
+			.map(jobStartMs)
+			.filter((t): t is number => t !== undefined)
+			.sort((a, b) => a - b)[0] ??
+		0
+	const budget = newBudget()
+	const streams: Record<string, RecordedJob> = {}
+	// Root first so the graph-driving status snapshots get first claim on the
+	// budget before sub-job log ticks consume it.
+	const ids = [rootJobId, ...Object.keys(jobs).filter((id) => id !== rootJobId)]
+	for (const id of ids) {
+		if (!jobs[id]) continue
+		streams[id] = synthesizeJobStream(jobs[id], { anchorMs, nowMs, jobsById: jobs, budget })
+	}
+	// Bottom-up: bump each flow job's completed event past its descendants',
+	// then the root's past everything (orphaned streams included).
+	const visited = new Set<string>()
+	const finalizeCompletion = (id: string): number => {
+		const stream = streams[id]
+		if (!stream) return 0
+		const maxOwnT = () => stream.events.reduce((m, e) => Math.max(m, e.t), 0)
+		if (visited.has(id)) return maxOwnT()
+		visited.add(id)
+		let childMax = 0
+		for (const sub of directSubIds(jobs[id])) {
+			if (sub !== id) childMax = Math.max(childMax, finalizeCompletion(sub))
+		}
+		const completedEvent = stream.events.find((e) => e.data.completed)
+		if (completedEvent && childMax > 0 && completedEvent.t <= childMax) {
+			completedEvent.t = clampT(childMax + 50)
+			stream.events.sort((a, b) => a.t - b.t)
+		}
+		return maxOwnT()
+	}
+	finalizeCompletion(rootJobId)
+	let maxT = 0
+	for (const [id, stream] of Object.entries(streams)) {
+		if (id === rootJobId) continue
+		for (const e of stream.events) maxT = Math.max(maxT, e.t)
+	}
+	const rootEvents = streams[rootJobId]?.events
+	const completedEvent = rootEvents?.find((e) => e.data.completed)
+	if (completedEvent && completedEvent.t <= maxT) {
+		completedEvent.t = clampT(maxT + 50)
+		rootEvents!.sort((a, b) => a.t - b.t)
+	}
+	return { jobs: streams }
+}
diff --git a/frontend/src/lib/components/recording/runRecording.ts b/frontend/src/lib/components/recording/runRecording.ts
new file mode 100644
index 0000000000..6ffdfba97a
--- /dev/null
+++ b/frontend/src/lib/components/recording/runRecording.ts
@@ -0,0 +1,175 @@
+/**
+ * Builds recordings from completed runs. A recording is a pure function of a
+ * finished job: the root job plus every sub-job (nested flows included),
+ * fetched from the API with their logs and results. Nothing is captured while
+ * the run is live — replay streams are synthesized from the jobs' timestamps
+ * at play time (see `replayStream.ts`).
+ */
+import { JobService, type Job, type OpenFlow } from '$lib/gen'
+import type { FlowRecording, ScriptRecording } from './types'
+
+const UUID_RE = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi
+
+/** Shorten every UUID in the serialized recording to a stable 8-char form, so
+ * downloaded files don't leak full job ids and stay diff-friendly. The same
+ * UUID always maps to the same short form, keeping job references consistent. */
+export function truncateUuids(json: string): string {
+	const map = new Map<string, string>()
+	let counter = 0
+	return json.replace(UUID_RE, (uuid) => {
+		const key = uuid.toLowerCase()
+		let short = map.get(key)
+		if (!short) {
+			short = counter === 0 ? key.slice(-8) : key.slice(-8) + '_' + counter
+			counter++
+			map.set(key, short)
+		}
+		return short
+	})
+}
+
+/** Serialize `recording` and hand it to the browser as a JSON download. */
+export function downloadRecordingJson(recording: unknown, filenamePrefix: string) {
+	const blob = new Blob([truncateUuids(JSON.stringify(recording, null, 2))], {
+		type: 'application/json'
+	})
+	const url = URL.createObjectURL(blob)
+	const a = document.createElement('a')
+	a.href = url
+	a.download = `${filenamePrefix}-${Date.now()}.json`
+	a.click()
+	URL.revokeObjectURL(url)
+}
+
+/** The sub-job ids a flow job's status references directly (one level). */
+function directSubJobIds(flowStatus: Job['flow_status']): string[] {
+	if (!flowStatus) return []
+	const ids: string[] = []
+	for (const mod of flowStatus.modules ?? []) {
+		if (mod.job) ids.push(mod.job)
+		if (mod.flow_jobs) ids.push(...mod.flow_jobs)
+	}
+	if (flowStatus.failure_module?.job) ids.push(flowStatus.failure_module.job)
+	if (flowStatus.preprocessor_module?.job) ids.push(flowStatus.preprocessor_module.job)
+	return ids
+}
+
+/** Recording size backstop: a pathological run (huge loops) stops collecting
+ * here rather than fetching thousands of jobs. */
+const MAX_RECORDING_FETCH_JOBS = 1000
+/** Concurrent job fetches while collecting a run. */
+const FETCH_CONCURRENCY = 20
+
+/** Cap on one job's recorded logs — the replay loader refuses any value past
+ * ~8MB of text, so an unbounded capture would record fine and then never play. */
+const MAX_RECORDED_LOG_CHARS = 2 * 1024 * 1024
+
+/** Fetch a job with its complete logs: `getJob` returns only the tail of the
+ * log column (and only the residual chunk once logs are offloaded to object
+ * storage), so the full text has to come from the logs endpoint. Best-effort —
+ * on failure the job keeps whatever `getJob` returned. */
+export async function fetchJobWithFullLogs(workspace: string, id: string): Promise<Job> {
+	const [job, logs] = await Promise.all([
+		JobService.getJob({ workspace, id }),
+		JobService.getJobLogs({ workspace, id }).catch(() => undefined)
+	])
+	if (typeof logs === 'string' && logs.length >= ((job as any).logs?.length ?? 0)) {
+		;(job as any).logs =
+			logs.length > MAX_RECORDED_LOG_CHARS
+				? '[logs truncated for recording]\n…' + logs.slice(-MAX_RECORDED_LOG_CHARS)
+				: logs
+	}
+	return job
+}
+
+/** Fetch `rootJobId` and, recursively, every sub-job its flow status
+ * references. Fetch failures are tolerated — a job that can't be fetched
+ * simply replays with less detail. */
+async function fetchRunJobs(workspace: string, rootJobId: string): Promise<Record<string, Job>> {
+	const jobs: Record<string, Job> = {}
+	let frontier = [rootJobId]
+	while (frontier.length > 0 && Object.keys(jobs).length < MAX_RECORDING_FETCH_JOBS) {
+		frontier = [...new Set(frontier)]
+			.filter((id) => !jobs[id])
+			.slice(0, MAX_RECORDING_FETCH_JOBS - Object.keys(jobs).length)
+		// Bounded fan-out: each job costs two requests, and a wide loop's
+		// frontier would otherwise put hundreds in flight at once.
+		const fetched: (Job | undefined)[] = []
+		for (let i = 0; i < frontier.length; i += FETCH_CONCURRENCY) {
+			fetched.push(
+				...(await Promise.all(
+					frontier.slice(i, i + FETCH_CONCURRENCY).map(async (id) => {
+						try {
+							return await fetchJobWithFullLogs(workspace, id)
+						} catch (e) {
+							console.warn('[recording] failed to fetch job', id, e)
+							return undefined
+						}
+					})
+				))
+			)
+		}
+		const next: string[] = []
+		for (const job of fetched) {
+			if (!job) continue
+			jobs[job.id] = job
+			next.push(...directSubJobIds(job.flow_status))
+		}
+		frontier = next
+	}
+	return jobs
+}
+
+/** Build a flow recording from a completed run. */
+export async function buildFlowRecording(
+	workspace: string,
+	rootJobId: string,
+	flowPath: string,
+	flow?: OpenFlow
+): Promise<FlowRecording> {
+	const jobs = await fetchRunJobs(workspace, rootJobId)
+	const root = jobs[rootJobId]
+	if (!root) {
+		throw new Error('Could not fetch the run this recording is based on')
+	}
+	return {
+		version: 2,
+		type: 'flow',
+		recorded_at: new Date().toISOString(),
+		flow_path: flowPath,
+		total_duration_ms: (root as any).duration_ms ?? 0,
+		root_job_id: rootJobId,
+		jobs,
+		// JSON round-trip to strip non-serializable properties (event handlers, …)
+		flow: flow ? (JSON.parse(JSON.stringify(flow)) as OpenFlow) : undefined
+	}
+}
+
+/** Build a script recording from a completed test run. Code/schema are passed
+ * in as they were at run time — a preview job doesn't carry the schema and its
+ * code may since have been edited. `args` defaults to the job's own. */
+export async function buildScriptRecording(
+	workspace: string,
+	jobId: string,
+	meta: {
+		scriptPath: string
+		code: string
+		language: string
+		args?: Record<string, any>
+		schema?: Record<string, any>
+	}
+): Promise<ScriptRecording> {
+	const job = await fetchJobWithFullLogs(workspace, jobId)
+	return {
+		version: 2,
+		type: 'script',
+		recorded_at: new Date().toISOString(),
+		script_path: meta.scriptPath,
+		total_duration_ms: (job as any).duration_ms ?? 0,
+		code: meta.code,
+		language: meta.language,
+		args: JSON.parse(JSON.stringify(meta.args ?? job.args ?? {})),
+		schema: meta.schema ? JSON.parse(JSON.stringify(meta.schema)) : undefined,
+		job
+	}
+}
diff --git a/frontend/src/lib/components/recording/scriptRecording.svelte.ts b/frontend/src/lib/components/recording/scriptRecording.svelte.ts
deleted file mode 100644
index d8f09b6beb..0000000000
--- a/frontend/src/lib/components/recording/scriptRecording.svelte.ts
+++ /dev/null
@@ -1,110 +0,0 @@
-import type { Job } from '$lib/gen'
-import type { ActiveRecording, ActiveReplayData, RecordedJob, ScriptRecording } from './types'
-import { truncateUuids } from './flowRecording.svelte'
-
-export function createScriptRecording(): ScriptRecordingStore {
-	let active = $state(false)
-	let startTime = 0
-	let scriptPath = ''
-	let code = ''
-	let language = ''
-	let scriptArgs: Record<string, any> = {}
-	let scriptSchema: Record<string, any> | undefined = undefined
-	let recordedJob: RecordedJob | undefined = undefined
-
-	return {
-		get active() {
-			return active
-		},
-		start(
-			path: string,
-			scriptCode: string,
-			lang: string,
-			args: Record<string, any>,
-			schema?: Record<string, any>
-		) {
-			active = true
-			startTime = Date.now()
-			scriptPath = path
-			code = scriptCode
-			language = lang
-			scriptArgs = JSON.parse(JSON.stringify(args))
-			scriptSchema = schema ? JSON.parse(JSON.stringify(schema)) : undefined
-			recordedJob = undefined
-		},
-		recordInitialJob(_id: string, job: Job) {
-			if (!active) return
-			recordedJob = {
-				initial_job: $state.snapshot(job) as Job,
-				events: []
-			}
-		},
-		recordEvent(_id: string, data: Record<string, any>) {
-			if (!active) return
-			if (!recordedJob) {
-				recordedJob = {
-					initial_job: (data as any).job
-						? ($state.snapshot((data as any).job) as Job)
-						: ({} as Job),
-					events: []
-				}
-			}
-			recordedJob.events.push({
-				t: Date.now() - startTime,
-				data: $state.snapshot(data) as Record<string, any>
-			})
-		},
-		stop(): ScriptRecording {
-			active = false
-			const recording: ScriptRecording = {
-				version: 1,
-				type: 'script',
-				recorded_at: new Date().toISOString(),
-				script_path: scriptPath,
-				total_duration_ms: Date.now() - startTime,
-				code,
-				language,
-				args: scriptArgs,
-				schema: scriptSchema,
-				job: recordedJob ?? { initial_job: {} as Job, events: [] }
-			}
-			return recording
-		},
-		/** Convert to ActiveReplayData shape for JobLoader replay */
-		toReplayData(recording: ScriptRecording): ActiveReplayData {
-			// Find the job ID from the recorded initial_job
-			const id = recording.job.initial_job?.id
-			if (!id) {
-				return { jobs: {} }
-			}
-			return {
-				jobs: { [id]: recording.job }
-			}
-		},
-		download(recording: ScriptRecording) {
-			const blob = new Blob([truncateUuids(JSON.stringify(recording, null, 2))], {
-				type: 'application/json'
-			})
-			const url = URL.createObjectURL(blob)
-			const a = document.createElement('a')
-			a.href = url
-			a.download = `script-recording-${(recording.script_path || 'untitled').replace(/\//g, '-')}-${Date.now()}.json`
-			a.click()
-			URL.revokeObjectURL(url)
-		}
-	}
-}
-
-export type ScriptRecordingStore = ActiveRecording & {
-	readonly active: boolean
-	start(
-		path: string,
-		code: string,
-		lang: string,
-		args: Record<string, any>,
-		schema?: Record<string, any>
-	): void
-	stop(): ScriptRecording
-	toReplayData(recording: ScriptRecording): ActiveReplayData
-	download(recording: ScriptRecording): void
-}
diff --git a/frontend/src/lib/components/recording/types.ts b/frontend/src/lib/components/recording/types.ts
index 5712d8057e..dd85585768 100644
--- a/frontend/src/lib/components/recording/types.ts
+++ b/frontend/src/lib/components/recording/types.ts
@@ -2,28 +2,38 @@ import type { AssetKind, Job, OpenFlow } from '$lib/gen'
 import type { AssetGraphResponse } from '$lib/components/assets/AssetGraph/types'
 import type { RawAppInteractionKind } from './rawAppSnapshot'
 
+/** One synthesized job-update event fed to JobLoader's replay path. `t` is
+ * milliseconds on the recording clock (zero = root job start). Never stored in
+ * a recording file — streams are synthesized from the completed jobs at play
+ * time (see `replayStream.ts`). */
 export type RecordedEvent = {
 	t: number
 	data: Record<string, any>
 }
 
+/** A job's synthesized replay stream: the job as it looked before running,
+ * plus the events that progressively bring it to its completed state. */
 export type RecordedJob = {
 	initial_job: Job
 	events: RecordedEvent[]
 }
 
 export type FlowRecording = {
-	version: 1
+	version: 2
 	type?: 'flow'
 	recorded_at: string
 	flow_path: string
 	total_duration_ms: number
-	jobs: Record<string, RecordedJob>
+	root_job_id: string
+	/** The run's completed jobs (root + sub-jobs, nested flows included),
+	 * fetched after completion with their logs and results. Replay streams are
+	 * synthesized from their timestamps. */
+	jobs: Record<string, Job>
 	flow?: OpenFlow
 }
 
 export type ScriptRecording = {
-	version: 1
+	version: 2
 	type: 'script'
 	recorded_at: string
 	script_path: string
@@ -32,7 +42,8 @@ export type ScriptRecording = {
 	language: string
 	args: Record<string, any>
 	schema?: Record<string, any>
-	job: RecordedJob
+	/** The completed job, fetched after the run with its logs and result. */
+	job: Job
 }
 
 /** Per-node status inside a recorded cascade frame (mirror of
@@ -71,7 +82,7 @@ export type PipelineAssetSample = {
 }
 
 export type PipelineRecording = {
-	version: 1
+	version: 2
 	type: 'pipeline'
 	recorded_at: string
 	folder: string
@@ -80,9 +91,10 @@ export type PipelineRecording = {
 	graph: AssetGraphResponse
 	/** Ordered cascade status snapshots driving the node animation. */
 	timeline: PipelineTimelineFrame[]
-	/** Per-node job streams (initial job + SSE events), keyed by job id, so the
-	 * player can replay each node's logs/result/args offline via JobLoader. */
-	jobs: Record<string, RecordedJob>
+	/** Each node's completed job, keyed by job id, fetched after the run with
+	 * its logs and result. The player synthesizes a replay stream per node so
+	 * its logs/result replay offline via JobLoader. */
+	jobs: Record<string, Job>
 	/** Per-asset data samples captured after the run, keyed by `${kind}:${path}`,
 	 * so asset nodes are inspectable offline in the player. */
 	assetSamples?: Record<string, PipelineAssetSample>
@@ -131,13 +143,7 @@ export type RawAppRecording = {
 	truncated?: boolean
 }
 
-/** Minimal interface that both flow and script recording stores implement */
-export interface ActiveRecording {
-	recordInitialJob(jobId: string, job: Job): void
-	recordEvent(jobId: string, data: Record<string, any>): void
-}
-
-/** Shape needed by JobLoader replay — a map of job ID to recorded data */
+/** Shape needed by JobLoader replay — a map of job ID to its replay stream */
 export interface ActiveReplayData {
 	jobs: Record<string, RecordedJob>
 }
diff --git a/frontend/src/lib/components/runs/FlowExecutionStatus.svelte b/frontend/src/lib/components/runs/FlowExecutionStatus.svelte
index c97269e42a..67b6520ffb 100644
--- a/frontend/src/lib/components/runs/FlowExecutionStatus.svelte
+++ b/frontend/src/lib/components/runs/FlowExecutionStatus.svelte
@@ -6,13 +6,12 @@
 
 	interface Props {
 		job: Job
-		workspaceId: string | undefined
 		isOwner: boolean
 		innerModules: FlowStatusModule[] | undefined
 		suspendStatus: StateStore<Record<string, { job: Job; nb: number }>>
 	}
 
-	let { job, workspaceId, isOwner, suspendStatus }: Props = $props()
+	let { job, isOwner, suspendStatus }: Props = $props()
 
 	const isWaitingForEvents = $derived(
 		job?.flow_status?.modules?.[job?.flow_status?.step]?.type === 'WaitingForEvents'
@@ -28,7 +27,7 @@
 		transition:slide={{ duration: 150 }}
 	>
 		{#if isWaitingForEvents}
-			<FlowStatusWaitingForEvents {workspaceId} {job} {isOwner} />
+			<FlowStatusWaitingForEvents workspaceId={job.workspace_id} {job} {isOwner} />
 		{:else if isSuspended}
 			<div class="flex gap-2 flex-col" in:fade={{ duration: 150 }}>
 				{#each Object.values(suspendStatus.val) as suspendCount (suspendCount.job.id)}
@@ -36,7 +35,11 @@
 						<div class="text-sm">
 							Flow suspended, waiting for {suspendCount.nb} events
 						</div>
-						<FlowStatusWaitingForEvents job={suspendCount.job} {workspaceId} {isOwner} />
+						<FlowStatusWaitingForEvents
+							job={suspendCount.job}
+							workspaceId={suspendCount.job.workspace_id}
+							{isOwner}
+						/>
 					</div>
 				{/each}
 			</div>
diff --git a/frontend/src/lib/components/runs/JobDetailFieldConfig.ts b/frontend/src/lib/components/runs/JobDetailFieldConfig.ts
index b324fe335e..72845b0820 100644
--- a/frontend/src/lib/components/runs/JobDetailFieldConfig.ts
+++ b/frontend/src/lib/components/runs/JobDetailFieldConfig.ts
@@ -1,5 +1,5 @@
 import type { Job } from '$lib/gen'
-import { triggerIconMap } from '$lib/components/triggers/utils'
+import { triggerDisplayNamesMap, triggerIconMap } from '$lib/components/triggers/utils'
 import { formatMemory } from '$lib/utils'
 import { flowPathToHref } from '$lib/scripts'
 import { Calendar, Bot } from 'lucide-svelte'
@@ -125,14 +125,13 @@ export function getTriggerInfo(job: Job): { type: string; icon: any; detail?: st
 	}
 
 	// Check for trigger type from job trigger_kind if available
-	if ('trigger_kind' in job) {
-		const triggerKind = (job as any).trigger_kind
-		if (triggerKind && triggerIconMap[triggerKind]) {
-			return {
-				type: getTriggerDisplayName(triggerKind),
-				icon: triggerIconMap[triggerKind],
-				detail: triggerKind
-			}
+	const triggerKind = job.trigger_kind
+	if (triggerKind && triggerKind in triggerIconMap) {
+		// No detail: unlike the schedule branch above, the kind carries no path to add,
+		// and repeating it would render as "Webhook: webhook".
+		return {
+			type: triggerDisplayNamesMap[triggerKind],
+			icon: triggerIconMap[triggerKind]
 		}
 	}
 
@@ -154,28 +153,6 @@ export function getTriggerInfo(job: Job): { type: string; icon: any; detail?: st
 	return null
 }
 
-/**
- * Gets human-readable display name for trigger kinds
- */
-function getTriggerDisplayName(triggerKind: string): string {
-	const displayNames: Record<string, string> = {
-		webhook: 'Webhook',
-		http: 'HTTP',
-		websocket: 'WebSocket',
-		postgres: 'PostgreSQL',
-		kafka: 'Kafka',
-		nats: 'NATS',
-		mqtt: 'MQTT',
-		sqs: 'SQS',
-		gcp: 'GCP Pub/Sub',
-		email: 'Email',
-		schedule: 'Schedule',
-		app: 'App',
-		ui: 'UI'
-	}
-	return displayNames[triggerKind] || triggerKind.toUpperCase()
-}
-
 /**
  * Field configurations for all possible fields
  */
@@ -556,6 +533,12 @@ export function getRelevantFields(job: Job): FieldConfig[] {
 				// Always show schedule_path when it exists, regardless of category configuration
 				return job.schedule_path !== null && job.schedule_path !== undefined
 			}
+			if (fieldName === 'trigger_info' && job.trigger_kind) {
+				// A stamped trigger kind is how the run was started, whatever the category — but
+				// only one `getTriggerInfo` can name, or the row renders empty. A schedule is
+				// left out because its own field already says the same thing.
+				return !job.schedule_path && job.trigger_kind in triggerIconMap
+			}
 			return fieldsPresence[fieldName]
 		})
 		.map((fieldName) => fieldConfigs[fieldName])
diff --git a/frontend/src/lib/components/runs/JobRunsPreview.svelte b/frontend/src/lib/components/runs/JobRunsPreview.svelte
index 4e45b18f06..ae61ca2d8e 100644
--- a/frontend/src/lib/components/runs/JobRunsPreview.svelte
+++ b/frontend/src/lib/components/runs/JobRunsPreview.svelte
@@ -173,7 +173,6 @@
 				{#if isFlow}
 					<FlowExecutionStatus
 						{job}
-						workspaceId={job?.workspace_id}
 						{isOwner}
 						innerModules={job?.flow_status?.modules}
 						{suspendStatus}
diff --git a/frontend/src/lib/components/schema/EditableSchemaDrawer.svelte b/frontend/src/lib/components/schema/EditableSchemaDrawer.svelte
index 5062fef802..8ba0bad861 100644
--- a/frontend/src/lib/components/schema/EditableSchemaDrawer.svelte
+++ b/frontend/src/lib/components/schema/EditableSchemaDrawer.svelte
@@ -4,7 +4,6 @@
 	import { GripVertical, Pen, Trash, Plus } from 'lucide-svelte'
 	import EditableSchemaForm from '../EditableSchemaForm.svelte'
 	import { Drawer, DrawerContent } from '../common'
-	import AddProperty from './AddProperty.svelte'
 	import { dragHandle, dragHandleZone } from '@windmill-labs/svelte-dnd-action'
 	import { flip } from 'svelte/animate'
 	import { emptyString, generateRandomString } from '$lib/utils'
@@ -19,7 +18,9 @@
 
 	const dispatch = createEventDispatcher()
 
-	let addPropertyComponent: AddProperty | undefined = $state(undefined)
+	let addPropertyComponent: AddPropertyV2 | undefined = $state(undefined)
+	// The list's instance is absent in `drawerOnly` mode, so the drawer keeps its own.
+	let drawerAddProperty: AddPropertyV2 | undefined = $state(undefined)
 	let schemaFormDrawer: Drawer | undefined = $state(undefined)
 	let editableSchemaForm: EditableSchemaForm | undefined = $state(undefined)
 
@@ -53,14 +54,22 @@
 		jsonView?: boolean
 		hiddenArgs?: string[]
 		onClose?: () => void
+		/** Render only the editing drawer: the caller shows its own view of the schema and
+		 *  opens the drawer through `openDrawer()`. */
+		drawerOnly?: boolean
 	}
 
 	let {
 		schema = $bindable(),
 		jsonView = $bindable(false),
-		hiddenArgs = undefined
+		hiddenArgs = undefined,
+		drawerOnly = false
 	}: Props = $props()
 
+	export function openDrawer() {
+		schemaFormDrawer?.openDrawer()
+	}
+
 	// let schema = $state(structuredClone($state.snapshot(schema)))
 
 	let schemaString: string = $state(JSON.stringify(schema, null, '\t'))
@@ -82,108 +91,7 @@
 	const rnd = generateRandomString()
 </script>
 
-<div class="flex flex-wrap justify-between mb-2 w-full items-center gap-y-2">
-	<AddProperty
-		on:change={() => {
-			if (jsonView) {
-				schemaString = JSON.stringify(schema, null, '\t')
-				editor?.setCode(schemaString)
-			}
-		}}
-		bind:schema
-		bind:this={addPropertyComponent}
-	/>
-
-	<Toggle
-		bind:checked={jsonView}
-		size="xs"
-		options={{
-			right: 'JSON editor',
-			rightTooltip:
-				'Arguments can be edited either using the wizard, or by editing their JSON schema.'
-		}}
-		lightMode
-		on:change={() => {
-			schemaString = JSON.stringify(schema, null, '\t')
-			editor?.setCode(schemaString)
-		}}
-	/>
-</div>
-
-{#if !jsonView}
-	{#key rnd}
-		<div
-			use:dragHandleZone={{
-				items,
-				flipDurationMs,
-				dropTargetStyle: {},
-				type: rnd
-			}}
-			onconsider={handleConsider}
-			onfinalize={handleFinalize}
-			class="gap-1 flex flex-col mt-2"
-		>
-			{#if items?.length > 0}
-				{#each items as item (item.id)}
-					<!-- svelte-ignore a11y_no_noninteractive_tabindex -->
-					<div
-						animate:flip={{ duration: 200 }}
-						class="w-full flex flex-col justify-between border items-center py-1 px-2 rounded-md bg-surface text-sm"
-					>
-						{#if schema.properties?.[item.value]}
-							<div class="flex flex-row justify-between items-center w-full">
-								{`${item.value}${
-									schema.properties?.[item.value]?.title
-										? ` (title: ${schema.properties?.[item.value]?.title})`
-										: ''
-								} `}
-								<!-- svelte-ignore a11y_no_noninteractive_tabindex -->
-								<!-- svelte-ignore a11y_no_static_element_interactions -->
-								<div class="flex flex-row gap-1 item-center h-full justify-center">
-									<Button
-										iconOnly
-										size="xs2"
-										color="light"
-										startIcon={{ icon: Trash }}
-										on:click={() => {
-											addPropertyComponent?.handleDeleteArgument([item.value])
-										}}
-									/>
-									<Button
-										iconOnly
-										size="xs2"
-										color="light"
-										startIcon={{ icon: Pen }}
-										on:click={() => {
-											schemaFormDrawer?.openDrawer()
-
-											tick().then(() => {
-												editableSchemaForm?.openField(item.value)
-											})
-										}}
-									/>
-
-									<div class="flex items-center handle" use:dragHandle>
-										<GripVertical size={16} />
-									</div>
-								</div>
-							</div>
-
-							{#if schema.properties[item.value]?.type === 'object' && !(schema.properties[item.value].oneOf && schema.properties[item.value].oneOf.length >= 2)}
-								<div class="flex flex-col w-full mt-2">
-									<Label label="Nested properties">
-										<EditableSchemaDrawer bind:schema={schema.properties[item.value]} />
-									</Label>
-								</div>
-							{/if}
-						{:else}
-							<div class="text-primary"> Value is undefined </div>
-						{/if}
-					</div>
-				{/each}
-			{/if}
-		</div>
-	{/key}
+{#snippet editorDrawer()}
 	<Drawer bind:this={schemaFormDrawer} size="1200px">
 		{#snippet children()}
 			<DrawerContent title="UI Customisation" on:close={() => schemaFormDrawer?.closeDrawer()}>
@@ -192,11 +100,8 @@
 					bind:this={editableSchemaForm}
 					bind:schema
 					isAppInput
-					on:edit={(e) => {
-						addPropertyComponent?.openDrawer(e.detail)
-					}}
 					on:delete={(e) => {
-						addPropertyComponent?.handleDeleteArgument([e.detail])
+						;(addPropertyComponent ?? drawerAddProperty)?.handleDeleteArgument([e.detail])
 					}}
 					{hiddenArgs}
 					editTab="inputEditor"
@@ -204,6 +109,7 @@
 					{#snippet addProperty()}
 						<AddPropertyV2
 							bind:schema
+							bind:this={drawerAddProperty}
 							onAddNew={(argName) => {
 								editableSchemaForm?.openField(argName)
 							}}
@@ -221,29 +127,147 @@
 			</DrawerContent>
 		{/snippet}
 	</Drawer>
+{/snippet}
+
+{#if drawerOnly}
+	{@render editorDrawer()}
 {:else}
-	<div class="mt-2 bg-surface-tertiary rounded-md border py-2.5">
-		<SimpleEditor
-			bind:this={editor}
-			small
-			fixedOverflowWidgets={false}
+	<div class="flex flex-wrap justify-end mb-2 w-full items-center gap-y-2">
+		<Toggle
+			bind:checked={jsonView}
+			size="2xs"
+			options={{
+				right: 'JSON editor',
+				rightTooltip:
+					'Arguments can be edited either using the wizard, or by editing their JSON schema.'
+			}}
+			lightMode
 			on:change={() => {
-				try {
-					schema = JSON.parse(schemaString)
-					error = ''
-				} catch (err) {
-					error = err.message
-				}
+				schemaString = JSON.stringify(schema, null, '\t')
+				editor?.setCode(schemaString)
 			}}
-			bind:code={schemaString}
-			lang="json"
-			autoHeight
-			automaticLayout
 		/>
 	</div>
-	{#if !emptyString(error)}
-		<div class="text-red-400 text-xs">{error}</div>
+
+	{#if !jsonView}
+		{#key rnd}
+			<div
+				use:dragHandleZone={{
+					items,
+					flipDurationMs,
+					dropTargetStyle: {},
+					type: rnd
+				}}
+				onconsider={handleConsider}
+				onfinalize={handleFinalize}
+				class="gap-1 flex flex-col mt-2"
+			>
+				{#if items?.length > 0}
+					{#each items as item (item.id)}
+						<!-- svelte-ignore a11y_no_noninteractive_tabindex -->
+						<div
+							animate:flip={{ duration: 200 }}
+							class="w-full flex flex-col justify-between border items-center py-1 px-2 rounded-md bg-surface text-sm"
+						>
+							{#if schema.properties?.[item.value]}
+								<div class="flex flex-row justify-between items-center w-full">
+									{`${item.value}${
+										schema.properties?.[item.value]?.title
+											? ` (title: ${schema.properties?.[item.value]?.title})`
+											: ''
+									} `}
+									<!-- svelte-ignore a11y_no_noninteractive_tabindex -->
+									<!-- svelte-ignore a11y_no_static_element_interactions -->
+									<div class="flex flex-row gap-1 item-center h-full justify-center">
+										<Button
+											iconOnly
+											size="xs2"
+											color="light"
+											startIcon={{ icon: Trash }}
+											on:click={() => {
+												addPropertyComponent?.handleDeleteArgument([item.value])
+											}}
+										/>
+										<Button
+											iconOnly
+											size="xs2"
+											color="light"
+											startIcon={{ icon: Pen }}
+											on:click={() => {
+												schemaFormDrawer?.openDrawer()
+
+												tick().then(() => {
+													editableSchemaForm?.openField(item.value)
+												})
+											}}
+										/>
+
+										<div class="flex items-center handle" use:dragHandle>
+											<GripVertical size={16} />
+										</div>
+									</div>
+								</div>
+
+								{#if schema.properties[item.value]?.type === 'object' && !(schema.properties[item.value].oneOf && schema.properties[item.value].oneOf.length >= 2)}
+									<div class="flex flex-col w-full mt-2">
+										<Label label="Nested properties">
+											<EditableSchemaDrawer bind:schema={schema.properties[item.value]} />
+										</Label>
+									</div>
+								{/if}
+							{:else}
+								<div class="text-primary"> Value is undefined </div>
+							{/if}
+						</div>
+					{/each}
+				{/if}
+			</div>
+		{/key}
+
+		<AddPropertyV2
+			bind:schema
+			bind:this={addPropertyComponent}
+			onAddNew={() => {
+				if (jsonView) {
+					schemaString = JSON.stringify(schema, null, '\t')
+					editor?.setCode(schemaString)
+				}
+			}}
+		>
+			{#snippet trigger()}
+				<div
+					class="w-full py-2 mt-1 flex justify-center items-center border border-dashed rounded-md hover:bg-surface-hover"
+				>
+					<Plus size={14} />
+				</div>
+			{/snippet}
+		</AddPropertyV2>
+
+		{@render editorDrawer()}
 	{:else}
-		<div><br /> </div>
+		<div class="mt-2 bg-surface-tertiary rounded-md border py-2.5">
+			<SimpleEditor
+				bind:this={editor}
+				small
+				fixedOverflowWidgets={false}
+				on:change={() => {
+					try {
+						schema = JSON.parse(schemaString)
+						error = ''
+					} catch (err) {
+						error = err.message
+					}
+				}}
+				bind:code={schemaString}
+				lang="json"
+				autoHeight
+				automaticLayout
+			/>
+		</div>
+		{#if !emptyString(error)}
+			<div class="text-red-400 text-xs">{error}</div>
+		{:else}
+			<div><br /> </div>
+		{/if}
 	{/if}
 {/if}
diff --git a/frontend/src/lib/components/scriptModulePath.test.ts b/frontend/src/lib/components/scriptModulePath.test.ts
new file mode 100644
index 0000000000..d90624d10d
--- /dev/null
+++ b/frontend/src/lib/components/scriptModulePath.test.ts
@@ -0,0 +1,57 @@
+import { describe, it, expect } from 'vitest'
+import { canonicalModulePath, findModulePathClash } from './scriptModulePath'
+
+describe('canonicalModulePath', () => {
+	// The pair the duplicate and reserved-name checks exist to catch: both
+	// spellings resolve to the same file in the job directory.
+	it('rewrites a redundant spelling to the file it names', () => {
+		expect(canonicalModulePath('./dbt_project.yml')).toEqual({ path: 'dbt_project.yml' })
+		expect(canonicalModulePath('models//x.sql')).toEqual({ path: 'models/x.sql' })
+		expect(canonicalModulePath('  ./models/./sub//x.sql  ')).toEqual({
+			path: 'models/sub/x.sql'
+		})
+		expect(canonicalModulePath('models/x.sql')).toEqual({ path: 'models/x.sql' })
+	})
+
+	it('refuses a path that leaves the bundle', () => {
+		expect(canonicalModulePath('../x.sql')).toHaveProperty('error')
+		expect(canonicalModulePath('models/../../x.sql')).toHaveProperty('error')
+		expect(canonicalModulePath('/etc/x.sql')).toHaveProperty('error')
+		expect(canonicalModulePath('./')).toHaveProperty('error')
+	})
+
+	// Matches the worker's own rule: `..` is traversal only as a whole segment.
+	it('takes dots inside a name as part of the name', () => {
+		expect(canonicalModulePath('models/weird..name.sql')).toEqual({
+			path: 'models/weird..name.sql'
+		})
+	})
+})
+
+describe('findModulePathClash', () => {
+	// A bundle pushed by the CLI can hold a non-canonical key, so the clash has to
+	// be found from either side, and named the way the tree shows it.
+	it('finds a key that resolves to the same file, however either is spelled', () => {
+		const modules = { './dbt_project.yml': {}, 'models/x.sql': {} }
+		expect(findModulePathClash(modules, 'dbt_project.yml')).toBe('./dbt_project.yml')
+		expect(findModulePathClash(modules, 'models/x.sql')).toBe('models/x.sql')
+		expect(findModulePathClash(modules, 'models/y.sql')).toBeUndefined()
+		expect(findModulePathClash(undefined, 'models/x.sql')).toBeUndefined()
+	})
+
+	// The worker does not trim path components, so an imported `x.sql ` is its
+	// own file and must not stand in the way of adding `x.sql`.
+	it('does not fold a key whose name carries whitespace', () => {
+		expect(findModulePathClash({ 'models/x.sql ': {} }, 'models/x.sql')).toBeUndefined()
+	})
+
+	// A rename must not stop at the module being renamed: with both spellings in
+	// the bundle, that would hide the other one and overwrite its content.
+	it('keeps looking past the key being renamed', () => {
+		const modules = { './models/x.sql': {}, 'models/x.sql': {} }
+		expect(findModulePathClash(modules, 'models/x.sql', './models/x.sql')).toBe('models/x.sql')
+		expect(
+			findModulePathClash({ './models/x.sql': {} }, 'models/x.sql', './models/x.sql')
+		).toBeUndefined()
+	})
+})
diff --git a/frontend/src/lib/components/scriptModulePath.ts b/frontend/src/lib/components/scriptModulePath.ts
new file mode 100644
index 0000000000..63271135c6
--- /dev/null
+++ b/frontend/src/lib/components/scriptModulePath.ts
@@ -0,0 +1,64 @@
+function canonicalize(path: string): { path: string } | { error: string } {
+	if (path.startsWith('/')) {
+		return { error: `File path must be relative, without a leading /` }
+	}
+	const segments = path.split('/').filter((s) => s !== '' && s !== '.')
+	if (segments.includes('..')) {
+		return { error: `File path cannot contain ..` }
+	}
+	if (segments.length === 0) {
+		return { error: `File name cannot be empty` }
+	}
+	return { path: segments.join('/') }
+}
+
+/**
+ * The canonical spelling of a script module's path (the key of the module
+ * bundle), or the reason it cannot be one.
+ *
+ * The worker resolves `.` and `//` away when it materialises the bundle into
+ * the job directory, so `./dbt_project.yml` and `dbt_project.yml` are two keys
+ * for one file on disk; the bundle is a Rust `HashMap`, so which content lands
+ * there is undefined. Canonicalising before the duplicate and reserved-name
+ * checks is what keeps them from being walked past.
+ *
+ * Redundant spellings are rewritten rather than refused: they name the file the
+ * user meant, and the tree shows the canonical form regardless. `..` and
+ * absolute paths name a file OUTSIDE the bundle, which has no canonical form
+ * inside it, so they are refused here — the worker drops them, which would
+ * otherwise show up as a file that was added and then silently never written.
+ *
+ * Surrounding whitespace is dropped because this is what someone typed into a
+ * text box. A key already in a bundle gets no such courtesy — see
+ * `findModulePathClash`.
+ */
+export function canonicalModulePath(path: string): { path: string } | { error: string } {
+	return canonicalize(path.trim())
+}
+
+/**
+ * The existing module key that would land on the same file as `canonicalPath`,
+ * spelled as the bundle holds it (which is what the file tree shows).
+ *
+ * Keys already in the bundle are not canonical either: nothing on the push path
+ * rewrites them, so a project imported with `./dbt_project.yml` in it must still
+ * refuse a second `dbt_project.yml`. They are matched WITHOUT trimming, because
+ * the worker does not trim path components: an imported `x.sql ` is its own file
+ * on disk and must not stand in the way of adding `x.sql`.
+ *
+ * `ignoreKey` is the module being renamed. It has to be skipped inside the
+ * search rather than compared against the result: a bundle can hold BOTH
+ * spellings, and stopping at the renamed one would hide the other and let the
+ * rename overwrite it.
+ */
+export function findModulePathClash(
+	modules: Record<string, unknown> | null | undefined,
+	canonicalPath: string,
+	ignoreKey?: string
+): string | undefined {
+	return Object.keys(modules ?? {}).find((key) => {
+		if (key === ignoreKey) return false
+		const canonical = canonicalize(key)
+		return 'path' in canonical && canonical.path === canonicalPath
+	})
+}
diff --git a/frontend/src/lib/components/sessions/FlowEditorView.svelte b/frontend/src/lib/components/sessions/FlowEditorView.svelte
index 5977c802ec..b7f1adeead 100644
--- a/frontend/src/lib/components/sessions/FlowEditorView.svelte
+++ b/frontend/src/lib/components/sessions/FlowEditorView.svelte
@@ -16,7 +16,8 @@
 		workspaceId,
 		onNavigate,
 		isActiveSession = true,
-		active = true
+		active = true,
+		initialSelectedId
 	}: {
 		runtime: SessionRuntime
 		path: string
@@ -27,11 +28,16 @@
 		isActiveSession?: boolean
 		/** Whether this is the visible preview tab (forwarded as isActiveTab). */
 		active?: boolean
+		/** Step the tab was opened on ("open this step in a session"), from its
+		 * URL's `selected` param. */
+		initialSelectedId?: string
 	} = $props()
 
 	// This tab's own flow cell; each open flow editor binds its own store.
 	const cell = $derived(runtime.flowCell(path))
-	let selectedId = $state('settings-metadata')
+	// Derived, not state: retargeting the tab at another flow swaps the URL, and a
+	// step id from the previous one must not survive into the new flow.
+	const selectedId = $derived(initialSelectedId ?? 'settings-metadata')
 	let diffDrawer: DiffDrawer | undefined = $state()
 
 	// Restore actions for the diff drawer. A `loadFlow`-based handler is a no-op:
diff --git a/frontend/src/lib/components/sessions/OpenInSessionButton.svelte b/frontend/src/lib/components/sessions/OpenInSessionButton.svelte
index 40149640ff..72d319ec9e 100644
--- a/frontend/src/lib/components/sessions/OpenInSessionButton.svelte
+++ b/frontend/src/lib/components/sessions/OpenInSessionButton.svelte
@@ -8,11 +8,14 @@
 		target: SessionTarget
 		workspaceId?: string
 		beforeOpen?: () => void | Promise<void>
+		/** Where inside the item the preview should open (a flow's `selected`
+		 * step). Steers the editor only — tab identity is (kind, path). */
+		previewParams?: Record<string, string>
 	}
 </script>
 
 <script lang="ts">
-	import { getContext, type Snippet } from 'svelte'
+	import { getContext, type ComponentProps, type Snippet } from 'svelte'
 	import { BROWSER } from 'esm-env'
 	import AIButton from '$lib/components/copilot/chat/AIButton.svelte'
 	import { AIBtnClasses } from '$lib/components/copilot/chat/AIButtonStyle'
@@ -22,11 +25,15 @@
 	let {
 		source,
 		btnClasses,
+		btnProps,
 		fallback
 	}: {
 		/** Undefined (e.g. an item without a path yet) renders the fallback. */
 		source?: OpenInSessionSource
 		btnClasses?: string
+		/** Button styling overrides for hosts with their own conventions (an
+		 * editor toolbar). */
+		btnProps?: ComponentProps<typeof AIButton>['btnProps']
 		/** Rendered instead when the user opted out of the sessions beta
 		 * (typically the editor's inline-chat toggle). Never rendered inside
 		 * the session panel. */
@@ -48,7 +55,7 @@
 		opening = true
 		try {
 			await source.beforeOpen?.()
-			await openEditorInSession(source.target, source.workspaceId)
+			await openEditorInSession(source.target, source.workspaceId, source.previewParams)
 		} finally {
 			opening = false
 		}
@@ -56,7 +63,7 @@
 </script>
 
 {#if show}
-	<AIButton togglePanel={open} btnClasses={btnClasses ?? AIBtnClasses('default')} />
+	<AIButton togglePanel={open} btnClasses={btnClasses ?? AIBtnClasses('default')} {btnProps} />
 {:else if !inSessionPanel}
 	{@render fallback?.()}
 {/if}
diff --git a/frontend/src/lib/components/sessions/PreviewTabHost.svelte b/frontend/src/lib/components/sessions/PreviewTabHost.svelte
index 6033b4f1de..2356f161f1 100644
--- a/frontend/src/lib/components/sessions/PreviewTabHost.svelte
+++ b/frontend/src/lib/components/sessions/PreviewTabHost.svelte
@@ -9,16 +9,18 @@
 	} from './sessionState.svelte'
 	import type { SessionRuntime } from './sessionRuntime.svelte'
 	import { Loader2 } from 'lucide-svelte'
-	import { resolvePreviewTab, parsePreviewItemRoute } from './previewRouter'
+	import { resolvePreviewTab, parsePreviewItemRoute, parsePreviewSelectedId } from './previewRouter'
 	import { withMenuHidden } from './sessionMode.svelte'
 	import ArtifactViewer from '../copilot/chat/artifacts/ArtifactViewer.svelte'
 	import { createFrameFocusGuard } from './frameFocusGuard'
+	import { setOverlayHost } from '../common/overlayHost.svelte'
 
 	let {
 		tab,
 		session,
 		runtime,
 		active,
+		collapsed = false,
 		mounted,
 		label,
 		darkMode,
@@ -31,6 +33,11 @@
 		runtime: SessionRuntime | undefined
 		/** Visible tab — only one is at a time; the rest stay mounted but hidden. */
 		active: boolean
+		/** Preview panel is not on screen — collapsed, and not overridden by full screen.
+		 * The panel is never unmounted, so this is the difference between the active tab
+		 * and a tab the user can actually see. Resolved by the page, which owns the
+		 * collapse/full-screen precedence. */
+		collapsed?: boolean
 		/** Preview panel is in full screen — forwarded to editor views so a script
 		 * editor reopens its test pane when there's room. */
 		fullscreen?: boolean
@@ -51,6 +58,10 @@
 	// any editable item (script/flow/raw app) or a pipeline folder mounts its own
 	// live editor.
 	const slot = $derived(resolvePreviewTab(tab.url))
+	// Where inside the editor the tab was opened on ("open this flow step in a
+	// session"). Only the in-process editors need it handed over — an iframe tab
+	// loads the URL whole, params included.
+	const selectedId = $derived(parsePreviewSelectedId(tab.url))
 	const workspaceId = $derived(
 		session ? (getEffectiveWorkspaceId(session) ?? $workspaceStore ?? '') : ''
 	)
@@ -134,10 +145,28 @@
 		active ? 'z-10 opacity-100 pointer-events-auto' : 'z-0 opacity-0 pointer-events-none'
 	)
 
+	// Overlays a tab opens (drawers, modals, popovers) anchor here rather than to the
+	// document, so they stay within this tab and hide with it when another tab takes over.
+	// Every branch that renders content in-realm must bind this — an unbound host makes the
+	// overlay fall back to viewport-`fixed`, spilling it across the whole app.
+	// The stack is per-tab for the same reason: this host stays mounted while hidden, and a
+	// shared stack would let its overlays arbitrate Escape for the tab the user is looking at.
+	let overlayHostEl: HTMLDivElement | undefined = $state()
+	let hostDrawers = $state({ val: [] as string[] })
+	setOverlayHost({
+		el: () => overlayHostEl,
+		drawers: hostDrawers,
+		// The panel is resized rather than unmounted, so the active tab of a panel that
+		// is off screen is as invisible as a background tab.
+		active: () => active && !collapsed
+	})
+
 	let flashing = $state(false)
 	let flashTimer: ReturnType<typeof setTimeout> | undefined
-	// Guard against the effect's non-pulse reruns (tab/runtime changes) firing a flash.
-	let lastPulseNonce = -1
+	// Guard against the effect's non-pulse reruns (tab/runtime changes) firing a
+	// flash. Seeded from the current nonce: a pulse from before this host mounted
+	// is moot, the tab appearing is itself the change the flash would point at.
+	let lastPulseNonce = runtime?.previewTabs.focusPulse.nonce ?? -1
 	$effect(() => {
 		const pulse = runtime?.previewTabs.focusPulse
 		if (!pulse || pulse.nonce === lastPulseNonce) return
@@ -170,7 +199,11 @@
 {/snippet}
 
 {#if slot.kind === 'editor' && mounted && runtime}
-	<div class="absolute inset-0 flex flex-col min-h-0 bg-surface {visibility}" aria-hidden={!active}>
+	<div
+		bind:this={overlayHostEl}
+		class="absolute inset-0 flex flex-col min-h-0 bg-surface {visibility}"
+		aria-hidden={!active}
+	>
 		<!-- Dynamic imports: the live editors pull in the heaviest module graphs in
 		     the app (FlowBuilder, ScriptBuilder/Monaco, the raw-app editor, the
 		     pipeline graph). Loading them only when an editor tab first mounts keeps
@@ -186,6 +219,7 @@
 					{onNavigate}
 					{isActiveSession}
 					{active}
+					initialSelectedId={selectedId}
 				/>
 			{/await}
 		{:else if slot.editorKind === 'script'}
@@ -224,19 +258,16 @@
 		{/if}
 	</div>
 {:else if slot.kind === 'artifact' && mounted}
-	<div class="absolute inset-0 flex flex-col min-h-0 bg-surface {visibility}" aria-hidden={!active}>
-		{#if artifact}
-			<ArtifactViewer {artifact} />
+	<div
+		bind:this={overlayHostEl}
+		class="absolute inset-0 flex flex-col min-h-0 bg-surface {visibility}"
+		aria-hidden={!active}
+	>
+		{#if artifact && runtime}
+			<ArtifactViewer {artifact} store={runtime.manager.artifacts} />
 		{:else if !runtime?.manager.artifacts.loading}
 			<div class="p-4 text-sm text-tertiary">This artifact is no longer available.</div>
 		{/if}
-		<!-- Overlay: the source editor's opaque bg would cover a ring on the container. -->
-		<div
-			class="pointer-events-none absolute inset-0 z-30 ring-2 ring-inset ring-border-accent transition-opacity duration-300 {flashing
-				? 'opacity-100'
-				: 'opacity-0'}"
-			aria-hidden="true"
-		></div>
 	</div>
 {:else if mounted}
 	<iframe
@@ -253,3 +284,14 @@
 		class="absolute inset-0 w-full h-full border-0 bg-surface {visibility}"
 	></iframe>
 {/if}
+
+<!-- Flash ring, a sibling of every tab body rather than a child of one: an
+     editor's own opaque background (or an iframe's document) would paint over a
+     ring drawn inside it. -->
+<div
+	class="pointer-events-none absolute inset-0 z-30 ring-2 ring-inset ring-border-accent transition-opacity duration-300 {flashing &&
+	active
+		? 'opacity-100'
+		: 'opacity-0'}"
+	aria-hidden="true"
+></div>
diff --git a/frontend/src/lib/components/sessions/SessionChangesBar.svelte b/frontend/src/lib/components/sessions/SessionChangesBar.svelte
index 1d2c9d95e0..9c5b5603a4 100644
--- a/frontend/src/lib/components/sessions/SessionChangesBar.svelte
+++ b/frontend/src/lib/components/sessions/SessionChangesBar.svelte
@@ -1,5 +1,12 @@
 <script lang="ts">
-	import { Archive, ExternalLink, GitPullRequestClosed, MoveRight, Trash2 } from 'lucide-svelte'
+	import {
+		Archive,
+		Diff,
+		ExternalLink,
+		GitPullRequestClosed,
+		MoveRight,
+		Trash2
+	} from 'lucide-svelte'
 	import { Button } from '$lib/components/common'
 	import Badge from '$lib/components/common/badge/Badge.svelte'
 	import SessionStatusPopover from './SessionStatusPopover.svelte'
@@ -12,8 +19,11 @@
 	import SessionDiffDrawer from './SessionDiffDrawer.svelte'
 	import { TOKEN_TRIGGER_CLASS } from './SessionStatusToken.svelte'
 	import { useWorkspaceDrafts } from '$lib/workspaceDrafts.svelte'
-	import { badgeCounts, badgeOf, buildDeployItems } from './sessionDeployModel'
+	import { badgeCounts, badgeOf, buildDeployItems, type DeployItem } from './sessionDeployModel'
 	import { useExistingMaskKeys } from './sessionDeployModel.svelte'
+	import { previewTargetForDeployKind } from './sessionPreviewTabs.svelte'
+	import { pipelineFolderFromBundlePath } from '$lib/pipelinePaths'
+	import type { PreviewTarget } from './previewRouter'
 	import JobsSegment from '$lib/components/copilot/chat/JobsSegment.svelte'
 	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
 	import ArtifactsSegment from '$lib/components/copilot/chat/artifacts/ArtifactsSegment.svelte'
@@ -183,6 +193,44 @@
 	)
 	let editsOpen = $state(false)
 
+	// Routed on the storage `path` — the edit route's key, which for a draft-only
+	// item is its `draft_<uuid>` path, not the friendly `displayPath`.
+	function previewTargetFor(item: DeployItem): PreviewTarget | undefined {
+		return previewTargetForDeployKind(item.deployKind, item.path)
+	}
+
+	// The row's primary action is the preview; kinds the panel can't host
+	// (triggers, schedules, resources, variables) fall back to their diff.
+	function openRow(item: DeployItem) {
+		if (previewTargetFor(item)) openInPreview(item)
+		else openDrawer(item.key)
+	}
+
+	// Trailing action; unlike a row pick it isn't routed through the popover's
+	// own close, so it dismisses the popover itself.
+	function openDiff(item: DeployItem) {
+		editsOpen = false
+		openDrawer(item.key)
+	}
+
+	function openInPreview(item: DeployItem) {
+		const owner = runtime?.previewTabs
+		const target = previewTargetFor(item)
+		if (!owner || !target) return
+		owner.open(target)
+	}
+
+	// A pipeline's bundle path (`f/<folder>/data_pipeline`) is an implementation
+	// detail — name the folder, which is what its editor opens. Same call the
+	// compare page makes.
+	function rowLabel(item: DeployItem): string {
+		if (item.deployKind === 'data_pipeline') {
+			const folder = pipelineFolderFromBundlePath(item.path)
+			if (folder) return `f/${folder}`
+		}
+		return item.displayPath
+	}
+
 	// Only draft-vs-deployed drives the color: stale/failed live in the drawer's
 	// deploy model, not here.
 	const editsColorClass = $derived(
@@ -261,8 +309,9 @@
 					title="Edited this session"
 					items={dockItems}
 					itemKey={(item) => item.key}
-					rowTitle={(item) => item.displayPath}
-					onPick={(item) => openDrawer(item.key)}
+					rowTitle={(item) =>
+						previewTargetFor(item) ? `Open ${rowLabel(item)} in preview` : rowLabel(item)}
+					onPick={openRow}
 					triggerClass={`${TOKEN_TRIGGER_CLASS} ${editsColorClass}`}
 					widthClass="w-96"
 					maxHeightClass="max-h-[min(9rem,50vh)]"
@@ -270,7 +319,7 @@
 					{#snippet row(item)}
 						<RowIcon kind={item.deployKind} path={item.path} size={14} />
 						<span class="min-w-0 flex-1 truncate font-mono font-normal text-primary">
-							{item.displayPath}
+							{rowLabel(item)}
 						</span>
 						{#if badgeOf(item) === 'draft'}
 							<Badge small color="indigo">
@@ -280,6 +329,31 @@
 							<Badge small color="green">Deployed</Badge>
 						{/if}
 					{/snippet}
+					{#snippet actions(item)}
+						<Button
+							unifiedSize="xs"
+							variant="subtle"
+							title="Review & deploy"
+							startIcon={{ icon: Diff }}
+							onClick={() => openDiff(item)}
+						>
+							Diff
+						</Button>
+					{/snippet}
+					{#snippet footer()}
+						<button
+							type="button"
+							data-status-row
+							class="flex w-full items-center gap-2 py-1 pl-3 pr-3 text-left font-normal hover:bg-surface-hover focus:bg-surface-hover focus:outline-none"
+							onclick={() => {
+								editsOpen = false
+								openDrawer()
+							}}
+						>
+							<Diff size={14} class="shrink-0 text-tertiary" />
+							<span class="min-w-0 flex-1 truncate text-secondary">Review & deploy all</span>
+						</button>
+					{/snippet}
 				</SessionStatusPopover>
 			{/if}
 		{/if}
diff --git a/frontend/src/lib/components/sessions/SessionEditorTarget.svelte b/frontend/src/lib/components/sessions/SessionEditorTarget.svelte
index 95fd67ef3e..6e23d4e845 100644
--- a/frontend/src/lib/components/sessions/SessionEditorTarget.svelte
+++ b/frontend/src/lib/components/sessions/SessionEditorTarget.svelte
@@ -6,7 +6,7 @@
 	import type { SessionRuntime, SessionTargetKind } from './sessionRuntime.svelte'
 	import { useUserDraftSync, type DraftSyncCodec } from './useUserDraftSync.svelte'
 	import { makeFlowCodec, makeScriptCodec, makeRawAppCodec } from './sessionDraftCodecs'
-	import { draftFriendlyLeaf } from './previewRouter'
+	import { itemDisplayName } from './previewRouter'
 	import SessionItemNotFound from './SessionItemNotFound.svelte'
 
 	let {
@@ -124,17 +124,20 @@
 		codec: () => codec
 	})
 
-	// Stamp the tab's friendly label once this editor's cell knows the item's
-	// typed/auto name. The page can't read the runtime cell reactively (it lives
-	// outside the page's reactive root), but this editor — handed `runtime` as a
-	// prop — can, so it mirrors the name onto the tab model the page does observe.
-	// The label only applies to a never-deployed item still parked at a
-	// `…/draft_<uuid>` storage path; a deployed/real path keeps the plain
-	// location label.
+	// Stamp the tab's friendly label once this editor's cell knows how to name the
+	// item. The page can't read the runtime cell reactively (it lives outside the
+	// page's reactive root), but this editor — handed `runtime` as a prop — can,
+	// so it mirrors the name onto the tab model the page does observe. The item's
+	// summary names it whenever it has one; failing that, a never-deployed item
+	// still parked at a `…/draft_<uuid>` storage path falls back to its typed/auto
+	// name, and anything else to the plain location label.
 	$effect(() => {
-		const v = cell.store.val as { path?: string; draft_path?: string } | undefined
+		// Only once the item has landed: stamping empty-handed off an unloaded cell
+		// would claim the tab from the listing-based name the page shows meanwhile.
+		if (slot.loadedPath !== path) return
+		const v = cell.store.val as { path?: string; draft_path?: string; summary?: string } | undefined
 		const friendly = v?.draft_path ?? v?.path
-		const label = draftFriendlyLeaf(path, friendly)
+		const label = itemDisplayName(path, friendly, v?.summary)
 		// The full staged path rides along whenever it differs from the tab's
 		// route (storage) path — not just when it yielded a label: a DEPLOYED
 		// item with a staged rename is also regrouped under the typed folder by
diff --git a/frontend/src/lib/components/sessions/SessionStatusPopover.svelte b/frontend/src/lib/components/sessions/SessionStatusPopover.svelte
index 05fb841db5..5a260c569c 100644
--- a/frontend/src/lib/components/sessions/SessionStatusPopover.svelte
+++ b/frontend/src/lib/components/sessions/SessionStatusPopover.svelte
@@ -16,6 +16,7 @@
 		rowTitle,
 		row,
 		actions,
+		footer,
 		customTrigger,
 		ariaLabel,
 		triggerClass = TOKEN_TRIGGER_CLASS,
@@ -39,6 +40,9 @@
 		row: Snippet<[T]>
 		/** Trailing per-row action buttons (outside the primary button). */
 		actions?: Snippet<[T]>
+		/** Pinned below the scrolling list; give it `data-status-row` to join the
+		 * arrow-key order as the last stop. */
+		footer?: Snippet
 		/** Replaces the default SessionStatusToken trigger. */
 		customTrigger?: Snippet
 		ariaLabel?: string
@@ -111,34 +115,36 @@
 	{#snippet content()}
 		<div class="flex {widthClass} flex-col text-xs">
 			<div class="px-3 pt-2 pb-0.5 text-2xs text-hint">{title}</div>
-			<!-- svelte-ignore a11y_no_noninteractive_element_interactions (keydown only routes arrows to the row buttons) -->
-			<div
-				role="list"
-				class="{maxHeightClass} overflow-y-auto py-1"
-				bind:this={listRoot}
-				onkeydown={handleListKeydown}
-			>
-				{#each items as item (itemKey(item))}
-					<div
-						class="flex items-center gap-2 py-1 pl-3 pr-2 hover:bg-surface-hover focus-within:bg-surface-hover"
-						role="listitem"
-					>
-						<button
-							type="button"
-							data-status-row
-							class="flex min-w-0 flex-1 items-center gap-2 text-left font-normal focus:outline-none"
-							title={rowTitle?.(item)}
-							onclick={() => pick(item)}
+			<!-- svelte-ignore a11y_no_static_element_interactions (keydown only routes arrows to the row buttons) -->
+			<div class="flex min-h-0 flex-col" bind:this={listRoot} onkeydown={handleListKeydown}>
+				<div role="list" class="{maxHeightClass} overflow-y-auto py-1">
+					{#each items as item (itemKey(item))}
+						<div
+							class="flex items-center gap-2 py-1 pl-3 pr-2 hover:bg-surface-hover focus-within:bg-surface-hover"
+							role="listitem"
 						>
-							{@render row(item)}
-						</button>
-						{#if actions}
-							<div class="flex shrink-0 items-center gap-1.5">
-								{@render actions(item)}
-							</div>
-						{/if}
+							<button
+								type="button"
+								data-status-row
+								class="flex min-w-0 flex-1 items-center gap-2 text-left font-normal focus:outline-none"
+								title={rowTitle?.(item)}
+								onclick={() => pick(item)}
+							>
+								{@render row(item)}
+							</button>
+							{#if actions}
+								<div class="flex shrink-0 items-center gap-1.5">
+									{@render actions(item)}
+								</div>
+							{/if}
+						</div>
+					{/each}
+				</div>
+				{#if footer}
+					<div class="shrink-0 border-t py-1">
+						{@render footer()}
 					</div>
-				{/each}
+				{/if}
 			</div>
 		</div>
 	{/snippet}
diff --git a/frontend/src/lib/components/sessions/SessionWrapper.svelte b/frontend/src/lib/components/sessions/SessionWrapper.svelte
index 68d4a201ab..9472819eea 100644
--- a/frontend/src/lib/components/sessions/SessionWrapper.svelte
+++ b/frontend/src/lib/components/sessions/SessionWrapper.svelte
@@ -13,7 +13,8 @@
 	import { WorkspaceService } from '$lib/gen'
 	import { sendUserToast } from '$lib/toast'
 	import Toggle from '$lib/components/Toggle.svelte'
-	import { copilotInfo, loadCopilot } from '$lib/aiStore'
+	import { copilotInfo } from '$lib/aiStore'
+	import { loadCopilot } from '$lib/components/copilot/loadCopilot'
 	import {
 		Archive,
 		ArchiveRestore,
diff --git a/frontend/src/lib/components/sessions/WorkspaceFamilyPicker.svelte b/frontend/src/lib/components/sessions/WorkspaceFamilyPicker.svelte
index e1480d5097..6c41dd198b 100644
--- a/frontend/src/lib/components/sessions/WorkspaceFamilyPicker.svelte
+++ b/frontend/src/lib/components/sessions/WorkspaceFamilyPicker.svelte
@@ -12,6 +12,7 @@
 	import {
 		findWorkspaceDescendants,
 		findCanonicalDevWorkspace,
+		findDefaultForkBase,
 		findWorkspaceRoot,
 		buildWorkspaceHierarchy
 	} from '$lib/utils/workspaceHierarchy'
@@ -107,6 +108,9 @@
 	const devOfRoot = $derived(
 		root ? findCanonicalDevWorkspace(root.id, forkableWorkspaces) : undefined
 	)
+	// Base a new fork gets by default: the dev workspace when the selection sits in its subtree, the
+	// family root otherwise.
+	const defaultForkBase = $derived(findDefaultForkBase(effectiveId, forkableWorkspaces))
 	const createForkLabel = 'Create new fork…'
 	// Candidate bases ("targets") for a new fork: the root plus every fork/dev in the family, so a fork
 	// can itself be the base — i.e. a fork of a fork. Root first, matching the list order below.
@@ -205,8 +209,8 @@
 	// Bare fork id, without the wm-fork- prefix. Forks have no separate display
 	// name — the id is the name (it also becomes the git branch).
 	let newForkId = $state('')
-	// The base ("target") a new fork will branch from. Defaults to the root; the user can pick any fork
-	// in the family (via the inline target selector) to create a fork of a fork.
+	// The base ("target") a new fork will branch from. Defaults to `defaultForkBase`; the user can pick
+	// any fork in the family (via the inline target selector) to create a fork of a fork.
 	let createForkBaseId = $state<string | undefined>(undefined)
 
 	// Manual keyboard navigation, modelled after SelectDropdown. melt's
@@ -266,8 +270,8 @@
 	}
 
 	function enterCreateMode(initialId?: string, baseId?: string) {
-		// Default the target to the root; the user can switch to any fork in the family (fork of a fork).
-		createForkBaseId = baseId ?? root?.id
+		// The user can switch to any fork in the family (fork of a fork).
+		createForkBaseId = baseId ?? defaultForkBase?.id
 		creatingFork = true
 		newForkId = initialId ?? defaultForkId()
 		// Focus + select is handled by the input's own autofocus (it mounts with
@@ -338,8 +342,8 @@
 		const wasOpen = lastDropdownOpen
 		lastDropdownOpen = dropdownOpen
 		if (dropdownOpen && !wasOpen && pendingFork && !creatingFork && showCreateFork) {
-			// Preserve the base the fork was staged from; without this the re-entry defaults to the root
-			// and silently re-parents a fork that was staged off another fork.
+			// Preserve the base the fork was staged from; without this the re-entry falls back to the
+			// default base and silently re-parents a fork that was staged off another workspace.
 			void enterCreateMode(
 				pendingFork.id.startsWith(WM_FORK_PREFIX)
 					? pendingFork.id.slice(WM_FORK_PREFIX.length)
@@ -475,8 +479,8 @@
 			{#if showCreateFork}
 				<div class="my-1 border-t border-border-light shrink-0"></div>
 				{#if creatingFork}
-					<!-- Small inline form with labels: fork id + base ("target") workspace. The base
-							     defaults to the root; picking a fork there creates a fork of a fork. -->
+					<!-- Small inline form with labels: fork id + base ("target") workspace. Picking a
+							     fork as the base creates a fork of a fork. -->
 					<div class="flex flex-col gap-2 px-2.5 py-2">
 						<div class="flex flex-col gap-0.5">
 							<span class="text-2xs font-normal text-hint">Fork ID</span>
diff --git a/frontend/src/lib/components/sessions/openInSessionContext.ts b/frontend/src/lib/components/sessions/openInSessionContext.ts
new file mode 100644
index 0000000000..27284802cc
--- /dev/null
+++ b/frontend/src/lib/components/sessions/openInSessionContext.ts
@@ -0,0 +1,23 @@
+import { getContext, setContext } from 'svelte'
+import type { OpenInSessionSource } from './OpenInSessionButton.svelte'
+
+// The "Open in AI session" hand-off, published by the component that owns the
+// item being edited (FlowBuilder, RawAppEditor) for AI entry points too deep in
+// the tree to be handed it as a prop — the inline code editor's toolbar sits
+// four levels below the builder, behind a recursive module wrapper.
+
+const KEY = 'OpenInSessionHandoff'
+
+export type OpenInSessionHandoff = {
+	/** The editor's hand-off, opening on `moduleId` when it addresses its parts
+	 * (a flow step). `undefined` while the item has no path to open yet. */
+	source: (opts?: { moduleId?: string }) => OpenInSessionSource | undefined
+}
+
+export function setOpenInSessionHandoff(handoff: OpenInSessionHandoff): void {
+	setContext(KEY, handoff)
+}
+
+export function getOpenInSessionHandoff(): OpenInSessionHandoff | undefined {
+	return getContext<OpenInSessionHandoff | undefined>(KEY)
+}
diff --git a/frontend/src/lib/components/sessions/previewRouter.test.ts b/frontend/src/lib/components/sessions/previewRouter.test.ts
index 8dfcbb52fc..4185078e7c 100644
--- a/frontend/src/lib/components/sessions/previewRouter.test.ts
+++ b/frontend/src/lib/components/sessions/previewRouter.test.ts
@@ -2,9 +2,11 @@ import { describe, it, expect } from 'vitest'
 import {
 	artifactUrl,
 	draftFriendlyLeaf,
+	itemDisplayName,
 	matchReusablePage,
 	parseArtifactRoute,
 	parsePreviewItemRoute,
+	parsePreviewSelectedId,
 	previewLocationLabel,
 	resolvePreviewTab
 } from './previewRouter'
@@ -75,6 +77,24 @@ describe('draftFriendlyLeaf', () => {
 	})
 })
 
+describe('itemDisplayName', () => {
+	it('prefers the summary, including for a draft-parked item that also has a typed name', () => {
+		expect(itemDisplayName('u/admin/my_script', undefined, 'Sync users nightly')).toBe(
+			'Sync users nightly'
+		)
+		expect(
+			itemDisplayName('u/admin/draft_abc123', 'u/admin/valuable_script', 'Sync users nightly')
+		).toBe('Sync users nightly')
+	})
+
+	it('falls through a blank summary to the draft leaf, then to nothing', () => {
+		expect(itemDisplayName('u/admin/draft_abc123', 'u/admin/valuable_script', '   ')).toBe(
+			'valuable_script'
+		)
+		expect(itemDisplayName('u/admin/my_script', undefined, '')).toBeUndefined()
+	})
+})
+
 describe('resolvePreviewTab', () => {
 	it('routes a static page to the iframe fallback', () => {
 		expect(resolvePreviewTab('/runs')).toEqual({ kind: 'iframe' })
@@ -116,6 +136,16 @@ describe('resolvePreviewTab', () => {
 		})
 	})
 
+	it('routes a pipeline url carrying the owner path to the same folder editor', () => {
+		// A hand-written link (or a preview tab persisted from one) can hold
+		// `/pipeline/f%2F<folder>`; it must open the folder, not `f/<folder>`.
+		expect(resolvePreviewTab('/pipeline/f%2Fmy_folder')).toEqual({
+			kind: 'editor',
+			editorKind: 'pipeline',
+			path: 'my_folder'
+		})
+	})
+
 	it('routes the bare pipeline list page to the iframe fallback', () => {
 		expect(resolvePreviewTab('/pipeline')).toEqual({ kind: 'iframe' })
 	})
@@ -128,6 +158,22 @@ describe('resolvePreviewTab', () => {
 	})
 })
 
+describe('parsePreviewSelectedId', () => {
+	it('reads the step a tab was opened on, and stays out of the tab identity', () => {
+		const url = '/flows/edit/f/foo/bar?selected=b'
+		expect(parsePreviewSelectedId(url)).toBe('b')
+		expect(resolvePreviewTab(url)).toEqual({
+			kind: 'editor',
+			editorKind: 'flow',
+			path: 'f/foo/bar'
+		})
+	})
+
+	it('is undefined without the param', () => {
+		expect(parsePreviewSelectedId('/flows/edit/f/foo/bar')).toBeUndefined()
+	})
+})
+
 describe('artifact route', () => {
 	it('round-trips id and name through artifactUrl → parseArtifactRoute, including special chars', () => {
 		for (const [id, name] of [
diff --git a/frontend/src/lib/components/sessions/previewRouter.ts b/frontend/src/lib/components/sessions/previewRouter.ts
index 4fd55861fd..315facc8bb 100644
--- a/frontend/src/lib/components/sessions/previewRouter.ts
+++ b/frontend/src/lib/components/sessions/previewRouter.ts
@@ -13,6 +13,7 @@ import {
 	ScrollText
 } from 'lucide-svelte'
 import type { DrillIcon } from '$lib/components/drillPicker'
+import { normalizePipelineFolder } from '$lib/utils/pipelineFolder'
 import type { WorkspaceItem, WorkspaceItemKind } from '$lib/components/workspacePicker'
 import type { SessionTargetKind } from './sessionRuntime.svelte'
 
@@ -151,6 +152,20 @@ export function draftFriendlyLeaf(
 	return leaf && !leaf.startsWith('draft_') ? leaf : undefined
 }
 
+/** The display name for an item, from what a lister or a live editor cell knows
+ * about it: its summary when set, else the typed/auto name of an item parked at a
+ * `…/draft_<uuid>` storage path. `undefined` when neither applies, leaving the
+ * caller on `previewLocationLabel`. Shared by the live editor's tab stamp and the
+ * sessions page's pre-mount lookup so one tab can't be named two ways depending
+ * on which of them got there first. */
+export function itemDisplayName(
+	storagePath: string,
+	friendlyPath: string | undefined,
+	summary: string | undefined
+): string | undefined {
+	return summary?.trim() || draftFriendlyLeaf(storagePath, friendlyPath)
+}
+
 export type PreviewItemRoute = { kind: WorkspaceItemKind; raw_app: boolean; itemPath: string }
 
 // Parse a preview URL/pathname into the workspace item it edits, or null for a
@@ -167,12 +182,24 @@ export function parsePreviewItemRoute(fullPath: string): PreviewItemRoute | null
 	return { kind: 'app', raw_app: false, itemPath }
 }
 
+// The place inside a previewed flow editor its tab URL asks for (`?selected=`,
+// the same param the full-page flow editor reads). Live editors are mounted in
+// process rather than in an iframe, so the host has to read this off the tab URL
+// and seed the editor with it.
+export function parsePreviewSelectedId(url: string): string | undefined {
+	try {
+		return new URL(url, 'http://_').searchParams.get('selected') || undefined
+	} catch {
+		return undefined
+	}
+}
+
 // A `/pipeline/<folder>` route is the data-pipeline graph editor for that folder
 // (the folder is a single path segment, not a workspace item path). The bare
 // `/pipeline` list page is not an editor. Returns the folder name, or null.
 export function parsePipelineRoute(fullPath: string): string | null {
 	const m = stripBase(fullPath).match(/^\/pipeline\/([^/?#]+)/)
-	return m ? decodeURIComponent(m[1]) : null
+	return m ? normalizePipelineFolder(decodeURIComponent(m[1])) : null
 }
 
 // The id (before the hash) is the artifact's stable routing identity; the name rides in
diff --git a/frontend/src/lib/components/sessions/sessionMode.svelte.ts b/frontend/src/lib/components/sessions/sessionMode.svelte.ts
index 54a27d977a..a4972a9afb 100644
--- a/frontend/src/lib/components/sessions/sessionMode.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionMode.svelte.ts
@@ -16,6 +16,19 @@ export function sessionTargetHref(target: SessionTarget | undefined): string | u
 	return `${base}/${seg}/${target.path}`
 }
 
+// Point a preview tab's URL at a place inside the previewed editor (the flow
+// step to select). The params are not part of the item's identity — every tab
+// resolver strips the query (see previewRouter's stripBase) — so they only ever
+// steer where the editor opens. No-op without params.
+export function withPreviewParams(
+	url: string | undefined,
+	params: Record<string, string> | undefined
+): string | undefined {
+	if (!url || !params) return url
+	const qs = new URLSearchParams(params).toString()
+	return qs ? `${url}${url.includes('?') ? '&' : '?'}${qs}` : url
+}
+
 // Force the global sidebar off in the previewed page (the sessions page already
 // has its own navigation rail) by setting Windmill's `nomenubar` query flag.
 // A session deliberately never switches the global workspaceStore, so the iframe
diff --git a/frontend/src/lib/components/sessions/sessionMode.test.ts b/frontend/src/lib/components/sessions/sessionMode.test.ts
index 0a9dab80eb..9bc67b9a58 100644
--- a/frontend/src/lib/components/sessions/sessionMode.test.ts
+++ b/frontend/src/lib/components/sessions/sessionMode.test.ts
@@ -1,5 +1,10 @@
 import { describe, it, expect } from 'vitest'
-import { sessionTargetHref, withMenuHidden, withWorkspaceParam } from './sessionMode.svelte'
+import {
+	sessionTargetHref,
+	withMenuHidden,
+	withPreviewParams,
+	withWorkspaceParam
+} from './sessionMode.svelte'
 
 describe('sessionTargetHref', () => {
 	it('maps each editor kind to its full-page route', () => {
@@ -14,6 +19,20 @@ describe('sessionTargetHref', () => {
 	})
 })
 
+describe('withPreviewParams', () => {
+	it('points the tab at a step inside the flow it opens', () => {
+		expect(
+			withPreviewParams(sessionTargetHref({ kind: 'flow', path: 'u/me/bar' }), { selected: 'b' })
+		).toBe('/flows/edit/u/me/bar?selected=b')
+	})
+
+	it('is a no-op without params or without a URL', () => {
+		expect(withPreviewParams('/flows/edit/u/me/bar', undefined)).toBe('/flows/edit/u/me/bar')
+		expect(withPreviewParams('/flows/edit/u/me/bar', {})).toBe('/flows/edit/u/me/bar')
+		expect(withPreviewParams(undefined, { selected: 'b' })).toBeUndefined()
+	})
+})
+
 describe('withMenuHidden', () => {
 	it('appends the nomenubar flag', () => {
 		expect(withMenuHidden('/runs')).toBe('/runs?nomenubar=true')
diff --git a/frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts b/frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts
index 82e5743609..42f7d4f321 100644
--- a/frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts
@@ -1,6 +1,7 @@
 import { base } from '$lib/base'
 import { randomUUID } from '$lib/utils/uuid'
 import { editPathFor, type WorkspaceItem } from '$lib/components/workspacePicker'
+import { normalizePipelineFolder } from '$lib/utils/pipelineFolder'
 import {
 	artifactUrl,
 	matchPreviewPage,
@@ -13,6 +14,8 @@ import {
 	type PreviewTarget
 } from './previewRouter'
 import type { SessionPreviewTab, SessionTarget } from './sessionState.svelte'
+import type { Kind } from '$lib/utils_deployable'
+import { pipelineFolderFromBundlePath } from '$lib/pipelinePaths'
 
 // The single live owner of a session's preview tabs. Runs behind a small
 // interface both the sessions page (renderer) and the `open_preview` tool cross,
@@ -58,12 +61,17 @@ function targetUrl(target: PreviewTarget): string {
 // Point a tab at a new destination. Clears `friendlyLabel`/`friendlyPath`
 // (bound to the previous editor's item): a new editor re-stamps them, and
 // navigating to a plain page must drop the stale name so the tab falls back
-// to the location label.
+// to the location label. Only on an actual change of destination, though —
+// nothing re-stamps a tab that stays on the item it already hosts, so wiping
+// there would strand its label at the storage path (`…/draft_<uuid>`).
 function retargetTab(tab: SessionPreviewTab, url: string): void {
+	if (tab.url !== url) {
+		tab.friendlyLabel = undefined
+		tab.friendlyPath = undefined
+		tab.editorNamed = undefined
+	}
 	tab.url = url
 	tab.loc = url
-	tab.friendlyLabel = undefined
-	tab.friendlyPath = undefined
 }
 
 // Strip the query params the sessions preview injects into iframe URLs
@@ -103,7 +111,8 @@ export function previewTargetForSessionTarget(
 	path: string
 ): PreviewTarget | undefined {
 	if (kind === 'pipeline') {
-		return { type: 'page', href: `${base}/pipeline/${encodeURIComponent(path)}`, label: path }
+		const folder = normalizePipelineFolder(path)
+		return { type: 'page', href: `${base}/pipeline/${encodeURIComponent(folder)}`, label: folder }
 	}
 	const item: WorkspaceItem =
 		kind === 'raw_app'
@@ -112,6 +121,28 @@ export function previewTargetForSessionTarget(
 	return { type: 'item', item }
 }
 
+// Adapt a deployable item's layout kind (the session review dock speaks `Kind`,
+// not SessionTarget) to a preview destination: the three live editors, data
+// pipelines, plus legacy drag-and-drop apps, which the panel hosts as an iframe
+// over their edit route. Every other kind maps to undefined — not for lack of any
+// route (a variable or trigger has a list page the panel can host) but because
+// there is no item editor to preview, so their row falls back to the diff. The
+// undefined is also the caller's test for "can this row be previewed?".
+export function previewTargetForDeployKind(kind: Kind, path: string): PreviewTarget | undefined {
+	if (kind === 'app') {
+		return { type: 'item', item: { kind: 'app', raw_app: false, path, summary: '' } }
+	}
+	if (kind === 'script' || kind === 'flow' || kind === 'raw_app') {
+		return previewTargetForSessionTarget(kind, path)
+	}
+	// A pipeline's editor is its folder's graph view, not its bundle path.
+	if (kind === 'data_pipeline') {
+		const folder = pipelineFolderFromBundlePath(path)
+		return folder ? previewTargetForSessionTarget('pipeline', folder) : undefined
+	}
+	return undefined
+}
+
 // Build the initial tab model for a session: its saved tabs, else empty. Default
 // collapse: collapsed only for a session with nothing to preview.
 export function hydratePreviewTabs(session: {
@@ -163,6 +194,13 @@ export class SessionPreviewTabs {
 	// Ephemeral UI signals — not part of the persisted snapshot.
 	#focusPulse = $state({ id: '', nonce: 0 })
 	#reloadPulse = $state({ id: '', nonce: 0 })
+	// Set while a mutation sequence is being judged as a whole (see asOneChange).
+	#pulsing = false
+	// Fullscreen overrides the collapsed layout, so the panel can be on screen
+	// while `#collapsed` still says otherwise. Page-level state (it outlives a
+	// session switch, unlike the persisted per-session flag), pushed in here so
+	// the flash decision reads what the user can actually see.
+	#fullscreen = false
 	readonly #adapter: PreviewTabsAdapter
 	readonly #flushDelay: number
 	#flushHandle: ReturnType<typeof setTimeout> | undefined
@@ -225,10 +263,66 @@ export class SessionPreviewTabs {
 		this.#schedulePersist()
 	}
 
+	// Whether the panel is on screen at all — fullscreen wins over collapsed.
+	setFullscreen(fullscreen: boolean): void {
+		this.#fullscreen = fullscreen
+	}
+
+	// The tab the user is actually looking at, or undefined when nothing is on screen.
+	#displayedTab(): SessionPreviewTab | undefined {
+		if (this.#collapsed && !this.#fullscreen) return undefined
+		return this.#tabs.find((t) => t.id === this.#activeId)
+	}
+
+	// Run a caller's own multi-call sequence (select + navigate + reveal) as a
+	// single change for the flash decision. Judging each call separately would
+	// flash a tab the sequence had just switched to, since the step that made it
+	// visible is not the step that finds nothing left to change. `mutate` must be
+	// synchronous: the verdict is read the moment it returns.
+	asOneChange<T>(mutate: () => T): T {
+		return this.#pulsingIfUnchanged(mutate)
+	}
+
+	// Run a tab mutation, flashing the displayed tab's border when it left the
+	// panel showing exactly what it already showed. Re-opening a destination that
+	// is already on screen is otherwise indistinguishable from a dead click.
+	#pulsingIfUnchanged<T>(mutate: () => T): T {
+		// Already inside a sequence: that outer call owns the decision, and an
+		// inner open()/navigate() must not rule on its own slice of it.
+		if (this.#pulsing) return mutate()
+		this.#pulsing = true
+		try {
+			return this.#pulseIfSameDestination(mutate)
+		} finally {
+			this.#pulsing = false
+		}
+	}
+
+	#pulseIfSameDestination<T>(mutate: () => T): T {
+		const before = this.#displayedTab()
+		const shown = before && { id: before.id, url: before.url, loc: before.loc }
+		const result = mutate()
+		const after = this.#displayedTab()
+		if (
+			shown &&
+			after &&
+			after.id === shown.id &&
+			after.url === shown.url &&
+			after.loc === shown.loc
+		) {
+			this.pulseFocus(after.id)
+		}
+		return result
+	}
+
 	// Open — or focus, if already shown — a tab for a destination, and reveal the
 	// panel. An editable item dedupes against the tab already hosting that same
 	// (kind, path); anything else dedupes on the tab's observed location.
 	open(target: PreviewTarget): { status: 'opened' | 'focused' } {
+		return this.#pulsingIfUnchanged(() => this.#open(target))
+	}
+
+	#open(target: PreviewTarget): { status: 'opened' | 'focused' } {
 		const editorTarget = editorTargetFor(target)
 		// A fresh session starts collapsed, so without this the tab opens behind a
 		// collapsed panel and the user sees nothing change.
@@ -273,8 +367,12 @@ export class SessionPreviewTabs {
 		}
 		// Focus the tab currently *showing* this destination instead of opening a
 		// duplicate. Matched on the observed `loc`, not `url`: a tab that was
-		// opened here but navigated away no longer counts as showing it.
-		const shown = this.#tabs.find((t) => t.loc === url)
+		// opened here but navigated away no longer counts as showing it. Both sides
+		// are canonicalized because a caller may bake `?workspace=` into the href
+		// (the frame re-injects it from the session anyway) while the observed loc
+		// has had it stripped — comparing raw would reopen the page as a duplicate.
+		const canonicalUrl = canonicalizeObservedLoc(url)
+		const shown = this.#tabs.find((t) => canonicalizeObservedLoc(t.loc) === canonicalUrl)
 		if (shown) {
 			this.#activeId = shown.id
 			this.#flush()
@@ -291,6 +389,10 @@ export class SessionPreviewTabs {
 	// Re-point the active tab at a destination (breadcrumb pick / in-editor link /
 	// iframe-posted editor navigation).
 	navigate(target: PreviewTarget): void {
+		this.#pulsingIfUnchanged(() => this.#navigate(target))
+	}
+
+	#navigate(target: PreviewTarget): void {
 		const t = this.#tabs.find((x) => x.id === this.#activeId)
 		if (!t) return
 		const editorTarget = editorTargetFor(target)
@@ -406,17 +508,23 @@ export class SessionPreviewTabs {
 
 	// Stamp the friendly display label (and full friendly path, which scopes the
 	// breadcrumb picker) for the editor tab hosting `target` (the live editor
-	// knows the item's typed/auto name once its cell loads, which the page can't
-	// read reactively from the runtime cell). Matched on the tab's commanded
+	// knows the item's summary / typed name once its cell loads, which the page
+	// can't read reactively from the runtime cell). Matched on the tab's commanded
 	// `url` — the stable per-(kind,path) editor identity. Transient, so no
-	// persist/flush: they're recomputed when the tab remounts.
+	// persist/flush: they're recomputed when the tab remounts. Callers must only
+	// call this once the item has loaded: it also marks the tab as named by its
+	// editor, which stops the page falling back to the workspace listing.
 	setEditorFriendlyLabel(
 		target: SessionTarget,
 		label: string | undefined,
 		friendlyPath?: string
 	): void {
 		const t = this.#tabs.find((x) => isEditorTabFor(x.url, target))
-		if (!t || (t.friendlyLabel === label && t.friendlyPath === friendlyPath)) return
+		if (!t) return
+		// Set before the no-change early return: an item with neither a summary nor
+		// a staged path leaves both fields undefined, and the editor still owns it.
+		t.editorNamed = true
+		if (t.friendlyLabel === label && t.friendlyPath === friendlyPath) return
 		t.friendlyLabel = label
 		t.friendlyPath = friendlyPath
 	}
diff --git a/frontend/src/lib/components/sessions/sessionPreviewTabs.test.ts b/frontend/src/lib/components/sessions/sessionPreviewTabs.test.ts
index a43e31247e..b04f69a90a 100644
--- a/frontend/src/lib/components/sessions/sessionPreviewTabs.test.ts
+++ b/frontend/src/lib/components/sessions/sessionPreviewTabs.test.ts
@@ -3,6 +3,7 @@ import {
 	SessionPreviewTabs,
 	describePreview,
 	hydratePreviewTabs,
+	previewTargetForDeployKind,
 	previewTargetForSessionTarget,
 	selectPreviewTabsToClose,
 	type PreviewTabsAdapter,
@@ -152,6 +153,35 @@ describe('previewTargetForSessionTarget', () => {
 			label: 'my_folder'
 		})
 	})
+	it('maps a pipeline owner path to the same folder target as the bare name', () => {
+		// open_preview is routinely called with `f/<folder>`; keeping the prefix
+		// would scope the editor to the folder "f/<folder>" and make every node
+		// path `f/f/<folder>/…`.
+		expect(previewTargetForSessionTarget('pipeline', 'f/my_folder')).toEqual({
+			type: 'page',
+			href: `${base}/pipeline/my_folder`,
+			label: 'my_folder'
+		})
+	})
+})
+
+describe('previewTargetForDeployKind', () => {
+	it('maps a legacy drag-and-drop app to its non-raw edit route', () => {
+		expect(previewTargetForDeployKind('app', 'u/me/app')).toEqual({
+			type: 'item',
+			item: { kind: 'app', raw_app: false, path: 'u/me/app', summary: '' }
+		})
+	})
+	it('routes a pipeline bundle on its folder, not its storage key', () => {
+		expect(previewTargetForDeployKind('data_pipeline', 'f/crm/data_pipeline')).toEqual(
+			pipelineTarget
+		)
+	})
+	it('has no destination for kinds the preview panel cannot host', () => {
+		expect(previewTargetForDeployKind('schedule', 'u/me/s')).toBeUndefined()
+		expect(previewTargetForDeployKind('http_trigger', 'u/me/t')).toBeUndefined()
+		expect(previewTargetForDeployKind('variable', 'u/me/v')).toBeUndefined()
+	})
 })
 
 describe('SessionPreviewTabs.open', () => {
@@ -370,6 +400,18 @@ describe('SessionPreviewTabs.navigate', () => {
 		o.navigate(pageTarget)
 		expect(o.tabs[0].friendlyLabel).toBeUndefined()
 		expect(o.tabs[0].friendlyPath).toBeUndefined()
+		expect(o.tabs[0].editorNamed).toBeUndefined()
+	})
+
+	it('claims the tab for its editor even when the editor names nothing', () => {
+		const o = owner()
+		o.open(flowTarget)
+		// A deployed item with no summary reports neither a label nor a staged path
+		// — the same values a never-stamped tab already holds. It must still count
+		// as named, or the sessions page keeps falling back to the workspace
+		// listing and resurrects a summary the user just cleared.
+		o.setEditorFriendlyLabel({ kind: 'flow', path: 'u/me/bar' }, undefined, undefined)
+		expect(o.tabs[0].editorNamed).toBe(true)
 	})
 })
 
@@ -659,4 +701,95 @@ describe('SessionPreviewTabs.pulseFocus', () => {
 		o.pulseFocus('tab-b')
 		expect(o.focusPulse).toEqual({ id: 'tab-b', nonce: 3 })
 	})
+
+	it('fires on re-opening whatever the panel already displays, for any tab kind', () => {
+		const o = owner()
+		o.open(rawAppTarget)
+		expect(o.focusPulse.nonce).toBe(0)
+		o.open(rawAppTarget)
+		expect(o.focusPulse).toEqual({ id: o.activeId, nonce: 1 })
+		// A second tab taking over is its own visible change.
+		o.open(pageTarget)
+		expect(o.focusPulse.nonce).toBe(1)
+		o.open(pageTarget)
+		expect(o.focusPulse).toEqual({ id: o.activeId, nonce: 2 })
+		// Re-pointing the displayed tab elsewhere changes what is on screen.
+		o.navigate(scriptTarget)
+		expect(o.focusPulse.nonce).toBe(2)
+		o.navigate(scriptTarget)
+		expect(o.focusPulse.nonce).toBe(3)
+	})
+
+	it('still flashes a collapsed-but-fullscreen panel', () => {
+		const o = owner()
+		o.open(rawAppTarget)
+		o.setCollapsed(true)
+		// Fullscreen carries over from the previous session and overrides collapse,
+		// so the tab is on screen and a re-open of it changes nothing visible.
+		o.setFullscreen(true)
+		o.open(rawAppTarget)
+		expect(o.focusPulse.nonce).toBe(1)
+	})
+
+	it('judges a composed select+navigate as one change', () => {
+		const o = owner()
+		o.open(pageTarget)
+		const runs = o.tabs[0].id
+		o.open(rawAppTarget)
+		expect(o.focusPulse.nonce).toBe(0)
+		// open_page reusing a *background* page tab: the switch is the visible change.
+		o.asOneChange(() => {
+			o.select(runs)
+			o.navigate(pageTarget)
+		})
+		expect(o.focusPulse.nonce).toBe(0)
+		// Same sequence once that tab is already displayed: nothing changes, so flash.
+		o.asOneChange(() => {
+			o.select(runs)
+			o.navigate(pageTarget)
+		})
+		expect(o.focusPulse).toEqual({ id: runs, nonce: 1 })
+	})
+
+	it('keeps the editor-stamped label when re-pointed at the same item', () => {
+		const o = owner()
+		o.open(scriptTarget)
+		o.setEditorFriendlyLabel({ kind: 'script', path: 'u/me/foo' }, 'My script', 'u/me/staged')
+		// Nothing re-stamps a tab that never changed item, so a wipe here would be
+		// permanent — and would make the "nothing changed" flash a lie.
+		o.navigate(scriptTarget)
+		expect(o.tabs[0].friendlyLabel).toBe('My script')
+		expect(o.tabs[0].friendlyPath).toBe('u/me/staged')
+		o.navigate(flowTarget)
+		expect(o.tabs[0].friendlyLabel).toBeUndefined()
+	})
+
+	it('focuses (and flashes) a run tab whose href carries ?workspace=', () => {
+		const o = owner()
+		const run: PreviewTarget = {
+			type: 'page',
+			href: `${base}/run/job-1?workspace=fork`,
+			label: 'Run'
+		}
+		o.open(run)
+		// What the frame reports back has the injected params stripped.
+		o.observeLocation(o.activeId, `${base}/run/job-1?workspace=fork&nomenubar=true`)
+		expect(o.tabs.length).toBe(1)
+		expect(o.open(run).status).toBe('focused')
+		expect(o.tabs.length).toBe(1)
+		expect(o.focusPulse.nonce).toBe(1)
+	})
+
+	it('stays quiet when the re-open is what reveals the tab', () => {
+		const o = owner()
+		o.open(rawAppTarget)
+		o.setCollapsed(true)
+		// Un-collapsing onto the same tab is already visible.
+		o.open(rawAppTarget)
+		expect(o.focusPulse.nonce).toBe(0)
+		// Switching back to a background tab is too.
+		o.open(pageTarget)
+		o.open(rawAppTarget)
+		expect(o.focusPulse.nonce).toBe(0)
+	})
 })
diff --git a/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts b/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
index 83e6aae8dd..aaf0173140 100644
--- a/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
@@ -26,7 +26,8 @@ type SavedFlow = Omit<Flow & UserDraftOverlay, 'draft'> & { draft?: Flow }
 import type { HiddenRunnable } from '$lib/components/apps/types'
 import { type RawAppData, DEFAULT_DATA } from '$lib/components/raw_apps/dataTableRefUtils'
 import { userWorkspaces, workspaceStore } from '$lib/stores'
-import { loadCopilot, copilotWorkspace } from '$lib/aiStore'
+import { copilotWorkspace } from '$lib/aiStore'
+import { loadCopilot } from '$lib/components/copilot/loadCopilot'
 import { emptySchema, type StateStore } from '$lib/utils'
 import {
 	commitSessionWorkspace,
@@ -55,6 +56,7 @@ import {
 	previewLocationLabel,
 	resolvePreviewTab
 } from './previewRouter'
+import { normalizePipelineFolder } from '$lib/utils/pipelineFolder'
 import { logFeatureUsage } from '$lib/utils/featureUsage'
 import { UserDraft } from '$lib/userDraft.svelte'
 import { UserDraftDbSyncer } from '$lib/userDraftDbSyncer.svelte'
@@ -480,14 +482,7 @@ function createRuntime(session: Session): SessionRuntime {
 	}
 
 	manager.openArtifact = (id, name) => {
-		// Capture before open() un-collapses / re-activates: flash only when the tab
-		// was already the displayed one (nothing else visibly changes).
-		const wasDisplayed = !previewTabs.collapsed
-		const prevActive = previewTabs.activeId
-		const { status } = previewTabs.open({ type: 'artifact', id, name })
-		if (status === 'focused' && wasDisplayed && previewTabs.activeId === prevActive) {
-			previewTabs.pulseFocus(previewTabs.activeId)
-		}
+		previewTabs.open({ type: 'artifact', id, name })
 	}
 	manager.closeArtifact = (id) => previewTabs.closeArtifact(id)
 	// Key the store before any configureGlobalMode runs, so a new session's first create shows at once.
@@ -1009,13 +1004,19 @@ setOpenPreviewHandler(async ({ sessionId: callerSessionId, kind, path }) => {
 	// they are live so the model's next turn doesn't race ahead and hit an
 	// "Unknown tool call" error on the first node it tries to build.
 	if (kind === 'pipeline') {
+		const folder = normalizePipelineFolder(path)
 		const ready = await runtime.manager.waitForPipelineHelpers()
 		// A backgrounded session's preview tab does not mount, so its editor never
 		// registers — don't claim success, or the model calls build_pipeline_node
 		// into the void. Tell it the tools aren't available and how to recover.
 		if (!ready) {
-			return `Opened the pipeline preview for "${path}", but its editor tools (build_pipeline_node / edit_pipeline_node) have not registered — this usually means this session is not the one currently displayed. Do NOT call build_pipeline_node yet: ask the user to open/focus this session's pipeline preview, then retry open_preview.`
+			return `Opened the pipeline preview for folder "${folder}", but its editor tools (build_pipeline_node / edit_pipeline_node) have not registered — this usually means this session is not the one currently displayed. Do NOT call build_pipeline_node yet: ask the user to open/focus this session's pipeline preview, then retry open_preview.`
 		}
+		// Spell out the node-path prefix: a node built off the folder name alone (or
+		// off the owner path twice over) is rejected by build_pipeline_node.
+		return `${
+			result.status === 'focused' ? 'Focused the' : 'Opened the'
+		} pipeline editor for folder "${folder}" in the side panel. Its nodes go at paths under \`f/${folder}/\` (e.g. \`f/${folder}/<node_name>\`).`
 	}
 	return result.status === 'focused'
 		? `A preview tab is already showing ${kind} "${path}" — focused it.`
@@ -1046,9 +1047,13 @@ setOpenPagePreviewHandler(({ sessionId: callerSessionId, href, label, newTab })
 			// would silently not re-fire — force a load. Hashless targets need no
 			// reload: focusing the already-correct view is enough.
 			const unchanged = href.includes('#') && (existing.loc || existing.url) === href
-			owner.select(existing.id)
-			owner.navigate({ type: 'page', href, label })
-			owner.setCollapsed(false)
+			// One change, not three: switching to a background tab is already visible,
+			// so the navigate that follows must not read as "nothing happened".
+			owner.asOneChange(() => {
+				owner.select(existing.id)
+				owner.navigate({ type: 'page', href, label })
+				owner.setCollapsed(false)
+			})
 			if (unchanged) {
 				owner.pulseReload(existing.id)
 				return `Re-opened the ${label} preview tab on the requested view.`
diff --git a/frontend/src/lib/components/sessions/sessionState.svelte.ts b/frontend/src/lib/components/sessions/sessionState.svelte.ts
index 26b90abd11..bfd157c1b7 100644
--- a/frontend/src/lib/components/sessions/sessionState.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionState.svelte.ts
@@ -4,6 +4,7 @@ import { createLongHash } from '$lib/editorLangUtils'
 import { random_adj } from '$lib/components/random_positive_adjetive'
 import {
 	enterpriseLicense,
+	superadmin,
 	userStore,
 	userWorkspaces,
 	usersWorkspaceStore,
@@ -135,8 +136,9 @@ export type Session = {
 // last observed location (see the sessions page for the url/loc split).
 // `friendlyLabel` / `friendlyPath` are transient overrides the live editor
 // stamps; not persisted (hydrate rebuilds tabs field-by-field), recomputed on
-// next mount. `friendlyLabel` names a never-deployed item parked at
-// `…/draft_<uuid>` (its typed/auto name). `friendlyPath` is the item's full
+// next mount. `friendlyLabel` is the item's display name — its summary, or the
+// typed/auto name of a never-deployed item parked at
+// `…/draft_<uuid>`. `friendlyPath` is the item's full
 // staged path whenever it differs from the tab's route path — draft-parked OR
 // a deployed item with an undeployed rename — and scopes the breadcrumb
 // picker into the folder the picker tree displays the item under.
@@ -146,6 +148,11 @@ export type SessionPreviewTab = {
 	loc: string
 	friendlyLabel?: string
 	friendlyPath?: string
+	// True once this tab's live editor has loaded its item and reported a name —
+	// or reported that it has none. Until then the sessions page names the tab
+	// from the workspace listing; after, the editor is the only source, else
+	// clearing a summary would fall back to the listing's stale copy of it.
+	editorNamed?: boolean
 }
 
 // Sessions live in one per-user IndexedDB, one record per session in the
@@ -350,6 +357,33 @@ function persistTouched(s: Session): void {
 	void putSession(s)
 }
 
+// Sessions whose record has been removed from IndexedDB. Ids come from createLongHash
+// and are never reused, so an entry can only ever match the record it was recorded for.
+// In-memory by design: a reload re-runs reconciliation, which re-derives the set.
+const deletedSessionIds = new Set<string>()
+
+// Test-only: module state outlives a suite's per-test reset of the stores.
+export function __resetDeletedSessionIdsForTesting(): void {
+	deletedSessionIds.clear()
+}
+
+// The one way to remove a session's record. Tombstones BEFORE awaiting the delete so a
+// putSession racing this transaction cannot commit its write behind it — a direct
+// db.delete elsewhere would silently reopen that window.
+async function deleteSessionRow(db: IDBPDatabase<SessionSchema>, id: string): Promise<void> {
+	deletedSessionIds.add(id)
+	await db.delete('sessions', id)
+}
+
+// The one way to write a session's record, and the other half of the invariant above:
+// every caller reaches its write across an await — putSession on the DB handle, the
+// reconcile and hydrate passes on a getAll() snapshot that an interleaved delete
+// invalidates — so the tombstone has to be consulted here, not only at the entry points.
+async function putSessionRow(db: IDBPDatabase<SessionSchema>, s: Session): Promise<void> {
+	if (deletedSessionIds.has(s.id)) return
+	await db.put('sessions', s)
+}
+
 // Write-behind a single session record. Transient sessions are in-memory only
 // (not yet touched) and are not written to IndexedDB; materializeTransient() /
 // persistTouched() clear the flag first. Awaits DB-open so a write racing
@@ -358,12 +392,17 @@ function persistTouched(s: Session): void {
 export async function putSession(s: Session): Promise<void> {
 	if (!BROWSER) return
 	if (s.transient) return
-	// Never resurrect a session whose workspace is gone — committed (workspace_id)
-	// or pre-send (pending_workspace_id). A live runtime can still write through
-	// here after reconciliation deletes its record (chatId seed, unread watermark),
-	// so guard once the workspace list is loaded.
+	// A record removed because its workspace is gone had its files and artifacts GC'd with
+	// it, so writing it back resurrects an empty husk. Callers reach here holding a
+	// reference captured before the delete — the chat-id seeder awaits mid-loop,
+	// find-then-write callers race the re-hydrate.
+	if (deletedSessionIds.has(s.id)) return
+	// Separately, keep a UI action (e.g. unarchive) from persisting into a workspace that
+	// has gone unavailable but not yet reconciled. `userWorkspaces` answers that only for
+	// a confirmed non-superadmin — hence `=== false`, the store being `undefined` until
+	// the role resolves — since a superadmin reaches workspaces they have no `usr` row in.
 	const boundWs = s.workspace_id ?? s.pending_workspace_id
-	if (boundWs) {
+	if (boundWs && get(superadmin) === false) {
 		const all = get(userWorkspaces)
 		if (all.length > 0 && !all.some((w) => w.id === boundWs)) return
 	}
@@ -371,7 +410,7 @@ export async function putSession(s: Session): Promise<void> {
 	const db = await sessionsDb.whenReady()
 	if (!db) return
 	try {
-		await db.put('sessions', $state.snapshot(s))
+		await putSessionRow(db, $state.snapshot(s))
 	} catch (e) {
 		console.error('Failed to persist session', e)
 	}
@@ -382,7 +421,7 @@ export async function deleteSessionRecord(id: string): Promise<void> {
 	const db = await sessionsDb.whenReady()
 	if (!db) return
 	try {
-		await db.delete('sessions', id)
+		await deleteSessionRow(db, id)
 	} catch (e) {
 		console.error('Failed to delete session record', e)
 	}
@@ -407,7 +446,7 @@ async function hydrateSessions({ dropTransients = false } = {}): Promise<void> {
 	try {
 		const all = await db.getAll('sessions')
 		const changed = all.filter((s) => ensureSessionRootId(s))
-		for (const s of changed) await db.put('sessions', s)
+		for (const s of changed) await putSessionRow(db, s)
 		all.sort((a, b) => b.createdAt - a.createdAt)
 		// In-memory (untouched) drafts are prepended, newest-first as createSession
 		// maintains; persisted sessions follow, sorted by createdAt.
@@ -496,7 +535,7 @@ export async function reconcileSessionsLifecycle(): Promise<void> {
 			if (!ws) continue
 			const { action, patch } = decideSessionLifecycle(s, status[ws])
 			if (action === 'delete') {
-				await db.delete('sessions', s.id)
+				await deleteSessionRow(db, s.id)
 				// GC linked files too, matching deleteSession — a record-only delete
 				// here would orphan the session's attached-file blobs/handles.
 				void deleteItemsForSession(s.id)
@@ -509,7 +548,7 @@ export async function reconcileSessionsLifecycle(): Promise<void> {
 			// Re-root surviving sessions whose family topmost member shifted (an
 			// ancestor was deleted); fall back to backfilling a missing root.
 			if (refreshSessionRootId(s) || ensureSessionRootId(s)) changed = true
-			if (changed) await db.put('sessions', s)
+			if (changed) await putSessionRow(db, s)
 		}
 	} catch (e) {
 		// The connection can go stale mid-loop (user switch reopens the per-user
@@ -570,7 +609,7 @@ export async function archiveSessionsForWorkspace(workspaceId: string): Promise<
 		s.archived = true
 		s.archivedByWorkspace = true
 		ensureSessionRootId(s)
-		await db.put('sessions', s)
+		await putSessionRow(db, s)
 	}
 	for (const s of sessionState.sessions) {
 		if (s.transient || s.workspace_id !== workspaceId || s.archived) continue
@@ -588,7 +627,7 @@ export async function deleteSessionsForWorkspace(workspaceId: string): Promise<v
 		all.filter((s) => s.workspace_id === workspaceId && !s.transient).map((s) => s.id)
 	)
 	for (const id of ids) {
-		await db.delete('sessions', id)
+		await deleteSessionRow(db, id)
 		// GC linked files too (matches deleteSession) so a workspace teardown
 		// doesn't leave the sessions' attached-file blobs/handles orphaned.
 		void deleteItemsForSession(id)
diff --git a/frontend/src/lib/components/sessions/sessionStateIndexedDb.test.ts b/frontend/src/lib/components/sessions/sessionStateIndexedDb.test.ts
index b7d2c853f7..c71fd2fa53 100644
--- a/frontend/src/lib/components/sessions/sessionStateIndexedDb.test.ts
+++ b/frontend/src/lib/components/sessions/sessionStateIndexedDb.test.ts
@@ -36,7 +36,7 @@ vi.mock('$lib/gen', async (orig) => {
 	}
 })
 
-import { userStore, usersWorkspaceStore, type UserExt } from '$lib/stores'
+import { superadmin, userStore, usersWorkspaceStore, type UserExt } from '$lib/stores'
 import { WorkspaceService } from '$lib/gen'
 import {
 	sessionState,
@@ -51,6 +51,7 @@ import {
 	setSessionDraftPrompt,
 	setSessionTabs,
 	reconcileSessionsLifecycle,
+	__resetDeletedSessionIdsForTesting,
 	setSessionArchived,
 	setSessionPreviewSize,
 	type Session
@@ -86,6 +87,12 @@ beforeEach(async () => {
 	localStorage.clear()
 	userStore.set(undefined)
 	usersWorkspaceStore.set(undefined)
+	// Resolved as a plain user: `putSession`'s resurrection guard only trusts the
+	// membership list for a confirmed non-superadmin, so leaving this at its initial
+	// `undefined` would silently disable the guard the tests below exercise.
+	superadmin.set(false)
+	// Tombstones are module state and would otherwise leak across tests reusing an id.
+	__resetDeletedSessionIdsForTesting()
 	await flush()
 	sessionState.sessions = []
 	sessionState.currentSessionId = undefined
@@ -452,6 +459,70 @@ describe('sessionState IndexedDB persistence', () => {
 		expect(rec.archived).toBe(true)
 	})
 
+	it('persists a session bound to a workspace the membership list cannot vouch for', async () => {
+		const user = freshUser()
+		// A loaded list that omits the bound workspace — the shape that trips the
+		// resurrection guard. Neither session below is actually orphaned.
+		usersWorkspaceStore.set({
+			email: user.email,
+			workspaces: [{ id: 'live-ws', name: 'live', disabled: false }] as never
+		})
+		userStore.set(user)
+
+		// The role hasn't resolved yet (layout's globalWhoami is still in flight), so
+		// `userWorkspaces` has not yet grown its synthetic `admins` entry. A touch landing
+		// in this window must not be discarded as orphaned.
+		superadmin.set(undefined)
+		await flush()
+		await putSession(session({ id: 'racing', createdAt: 1, workspace_id: 'admins' }))
+
+		// Resolved superadmin, bound to a workspace they are not a member of: reachable
+		// (the authed extractor lets a superadmin into any workspace), but it enters
+		// `userWorkspaces` only once the async non-member lookup lands.
+		superadmin.set(user.email)
+		await flush()
+		await putSession(session({ id: 'nonmember', createdAt: 2, workspace_id: 'foreign-ws' }))
+
+		const db = await openDB(`windmill-sessions::${user.email}`, 1)
+		const ids = (await db.getAll('sessions' as never)) as Session[]
+		db.close()
+		expect(ids.map((s) => s.id).sort()).toEqual(['nonmember', 'racing'])
+	})
+
+	it('does not let a late write resurrect a session reconciliation deleted', async () => {
+		const user = freshUser()
+		// A superadmin, so the membership check below is inert — the tombstone is the only
+		// thing standing between a late writer and a resurrected record.
+		superadmin.set(user.email)
+		usersWorkspaceStore.set({
+			email: user.email,
+			workspaces: [{ id: 'doomed-ws', name: 'doomed', disabled: false }] as never
+		})
+		userStore.set(user)
+		await flush()
+
+		const doomed = session({ id: 'doomed', createdAt: 1, workspace_id: 'doomed-ws' })
+		await putSession(doomed)
+		await rehydrate(user)
+
+		// The workspace was hard-deleted elsewhere; reconciliation drops the record and
+		// GCs its files and artifacts.
+		vi.mocked(WorkspaceService.getSessionWorkspaceStatus).mockResolvedValueOnce({
+			'doomed-ws': 'deleted'
+		} as never)
+		await reconcileSessionsLifecycle()
+
+		// A caller that captured the session before the delete writes it back — what the
+		// chat-id seeder does when it resumes after awaiting mid-loop.
+		doomed.chatId = 'chat-from-a-stale-reference'
+		await putSession(doomed)
+
+		const db = await openDB(`windmill-sessions::${user.email}`, 1)
+		const rec = await db.get('sessions' as never, 'doomed')
+		db.close()
+		expect(rec).toBeUndefined()
+	})
+
 	it('re-roots a sub-fork session on reconcile when an ancestor was deleted', async () => {
 		const user = freshUser()
 		// Family after a grandparent deletion: the FK's ON DELETE SET NULL nulled
diff --git a/frontend/src/lib/components/sessions/sessionSwitch.svelte.ts b/frontend/src/lib/components/sessions/sessionSwitch.svelte.ts
index 38ca3bf6dd..0eb5179dc2 100644
--- a/frontend/src/lib/components/sessions/sessionSwitch.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionSwitch.svelte.ts
@@ -9,7 +9,7 @@ import {
 	setSessionPendingWorkspace,
 	type SessionTarget
 } from './sessionState.svelte'
-import { sessionTargetHref } from './sessionMode.svelte'
+import { sessionTargetHref, withPreviewParams } from './sessionMode.svelte'
 
 // The session/navigation switch turns the global rail into either the workspace
 // navigation (navigation mode) or the sessions sidebar (session mode). Session
@@ -70,17 +70,19 @@ export async function exitSessionMode(): Promise<void> {
 // so the caller MUST persist any unsaved edits first (e.g. save a draft) for the
 // preview to reflect the live state. `workspaceId` scopes the session to the
 // editor's workspace (instead of createSession's root default) so it opens the
-// same flow/script the user was editing.
+// same flow/script the user was editing. `previewParams` ride on the tab URL to
+// tell the previewed editor where to open (a flow's `selected` step).
 export async function openEditorInSession(
 	target: SessionTarget,
-	workspaceId?: string
+	workspaceId?: string,
+	previewParams?: Record<string, string>
 ): Promise<void> {
 	// Seed the fresh session's preview with a single tab on `target` so it opens
 	// straight onto the editor the caller wants (resetSessionPreviewTabs also
 	// writes through a live runtime if one already exists for this id).
 	const session = createSession()
 	if (workspaceId) setSessionPendingWorkspace(session.id, workspaceId)
-	const url = sessionTargetHref(target)
+	const url = withPreviewParams(sessionTargetHref(target), previewParams)
 	if (url) {
 		// Dynamic import: a static one would drag the runtime's heavy graph
 		// (chat manager → monaco) into this thin navigation seam, breaking its
diff --git a/frontend/src/lib/components/settings/CloudQuotas.svelte b/frontend/src/lib/components/settings/CloudQuotas.svelte
index ec597101ee..02a49d88be 100644
--- a/frontend/src/lib/components/settings/CloudQuotas.svelte
+++ b/frontend/src/lib/components/settings/CloudQuotas.svelte
@@ -9,7 +9,7 @@
 	import { untrack } from 'svelte'
 	import { Trash2 } from 'lucide-svelte'
 
-	type ResourceType = 'scripts' | 'flows' | 'apps'
+	type ResourceType = 'scripts' | 'flows' | 'apps' | 'resources'
 
 	let quotas:
 		| {
@@ -80,6 +80,8 @@
 				return 'This will permanently delete all non-HEAD flow versions. Only the latest version of each flow will be kept. This frees up storage but does not reduce the flow count (quota counts unique flows, not versions).'
 			case 'apps':
 				return 'This will permanently delete all non-HEAD app versions. Only the latest version of each app will be kept. This frees up storage but does not reduce the app count (quota counts unique apps, not versions).'
+			case 'resources':
+				return 'This will permanently delete the value history of every resource. Only the current value of each resource will be kept, so past values can no longer be compared or restored. This frees up storage but does not reduce the resource count (quota counts unique resources, not versions).'
 		}
 	}
 
@@ -88,7 +90,7 @@
 		{ label: 'Flows', key: 'flows', prunable: true },
 		{ label: 'Apps', key: 'apps', prunable: true },
 		{ label: 'Variables', key: 'variables', prunable: false },
-		{ label: 'Resources', key: 'resources', prunable: false },
+		{ label: 'Resources', key: 'resources', prunable: true },
 		{ label: 'Forks', key: 'forks', prunable: false }
 	]
 </script>
diff --git a/frontend/src/lib/components/settings/CreateToken.svelte b/frontend/src/lib/components/settings/CreateToken.svelte
index 14920e96e9..444e245bee 100644
--- a/frontend/src/lib/components/settings/CreateToken.svelte
+++ b/frontend/src/lib/components/settings/CreateToken.svelte
@@ -173,7 +173,9 @@
 </script>
 
 <div>
-	<div class="p-4 rounded-md mb-6 min-w-min bg-surface-tertiary">
+	<!-- Stays bounded by the panel width: a content-driven width (min-w-min) would let a long
+	     scope chip stretch this card and push the rest of the form out of view. -->
+	<div class="p-4 rounded-md mb-6 bg-surface-tertiary">
 		<h3 class="pb-2 font-semibold text-emphasis text-sm">{title}</h3>
 
 		{#if showMcpMode && !mcpOnly}
diff --git a/frontend/src/lib/components/settings/ScopeSelector.svelte b/frontend/src/lib/components/settings/ScopeSelector.svelte
index 91a62e65f7..24c9b99562 100644
--- a/frontend/src/lib/components/settings/ScopeSelector.svelte
+++ b/frontend/src/lib/components/settings/ScopeSelector.svelte
@@ -1,7 +1,7 @@
 <script lang="ts">
 	import { type ScopeDomain, type ScopeDefinition, TokenService } from '$lib/gen'
 	import { sendUserToast } from '$lib/toast'
-	import { ChevronRight, Loader2, X } from 'lucide-svelte'
+	import { ChevronRight, Loader2, Plus, X } from 'lucide-svelte'
 	import Button from '../common/button/Button.svelte'
 	import Popover from '../meltComponents/Popover.svelte'
 	import Tooltip from '../Tooltip.svelte'
@@ -196,28 +196,22 @@
 					)
 			)
 
-			const writeScope = domain.scopes.find((s) => s.value === writeScopeValue)
-			if (writeScope?.requires_resource_path) {
-				selectedScopes = [...selectedScopes, `${writeScopeValue}`]
-			} else {
-				selectedScopes = [...selectedScopes, writeScopeValue]
-			}
+			// A path-restricted scope already counts as selected for this checkbox (see
+			// initializeDomainStates), so ticking it has to carry those paths over: re-adding the bare
+			// scope would silently widen the grant from those paths to the whole domain.
+			const runScopeValues = domain.scopes
+				.filter((scope) => scope.value.includes(':run:'))
+				.map((scope) => scope.value)
 
-			const runScopes = domain.scopes.filter((scope) => scope.value.includes(':run:'))
-			for (const runScope of runScopes) {
-				if (runScope.requires_resource_path) {
-					selectedScopes = [...selectedScopes, `${runScope.value}`]
-				} else {
-					selectedScopes = [...selectedScopes, runScope.value]
-				}
-			}
-
-			for (const scope of domain.scopes) {
-				const scopeState = domainState.scopes[scope.value]
+			for (const scopeValue of [writeScopeValue, ...runScopeValues]) {
+				const scopeState = domainState.scopes[scopeValue]
+				const paths = scopeState?.resourcePaths ?? []
+				selectedScopes = [
+					...selectedScopes,
+					paths.length > 0 ? `${scopeValue}:${paths.join(',')}` : scopeValue
+				]
 				if (scopeState) {
-					if (scope.value === writeScopeValue || runScopes.some((rs) => rs.value === scope.value)) {
-						scopeState.isSelected = true
-					}
+					scopeState.isSelected = true
 				}
 			}
 		} else {
@@ -490,6 +484,34 @@
 	fetchScopeDomains()
 </script>
 
+<!-- The label can be a long comma-joined path list. It must never widen its container, which would
+     push the per-scope path buttons out of the panel, so it either truncates or wraps. Wrap it
+     wherever the reader is auditing the grant: an ellipsis there hides the paths being granted. -->
+{#snippet scopeChip(
+	label: string,
+	removeTitle: string,
+	onRemove: (e: MouseEvent) => void,
+	opts?: { removeDisabled?: boolean; wrapLabel?: boolean }
+)}
+	<span
+		class="inline-flex items-center gap-1 min-w-0 max-w-full px-1.5 py-0.5 text-xs font-medium bg-blue-100 text-blue-800 rounded font-mono"
+	>
+		<span
+			class={opts?.wrapLabel ? 'break-all' : 'truncate'}
+			title={opts?.wrapLabel ? undefined : label}>{label}</span
+		>
+		<button
+			type="button"
+			onclick={onRemove}
+			class="text-blue-600 hover:text-blue-800 flex-shrink-0"
+			title={removeTitle}
+			disabled={opts?.removeDisabled ?? disabled}
+		>
+			<X size={10} />
+		</button>
+	</span>
+{/snippet}
+
 <div class="w-full {className} p-2">
 	{#if loading}
 		<div class="flex items-center justify-center py-12">
@@ -516,22 +538,11 @@
 					>Administrator scope grants full access to all resources.</p
 				>
 			{:else}
-				<div class="flex flex-wrap gap-2">
+				<div class="flex flex-wrap gap-2 max-h-32 overflow-y-auto">
 					{#each selectedScopes.slice(0, 10) as scope}
-						<span
-							class="inline-flex items-center gap-1 px-1.5 py-0.5 text-xs font-medium bg-blue-100 text-blue-800 rounded font-mono"
-						>
-							{scope}
-							<button
-								type="button"
-								onclick={() => removeSelectedScope(scope)}
-								class="text-blue-600 hover:text-blue-800 flex-shrink-0"
-								title="Remove scope"
-								{disabled}
-							>
-								<X size={10} />
-							</button>
-						</span>
+						{@render scopeChip(scope, 'Remove scope', () => removeSelectedScope(scope), {
+							wrapLabel: true
+						})}
 					{/each}
 					{#if selectedScopes.length > 10}
 						<span
@@ -587,6 +598,9 @@
 							</div>
 
 							<div class="flex-1 min-w-0 flex flex-col gap-1">
+								<!-- No height cap here: truncation holds every chip to one row and a domain has a
+								     handful of scopes, so this row cannot run away. Capping it would nest a scroller
+								     inside the domain list, which then swallows wheel events crossing this row. -->
 								<div class="flex items-center gap-x-2 gap-y-1 flex-wrap">
 									<!-- svelte-ignore a11y_no_noninteractive_element_interactions -->
 									<label
@@ -597,23 +611,10 @@
 										{domain.name}
 									</label>
 									{#each selectedScopes as scope}
-										<span
-											class="inline-flex items-center gap-1 px-1.5 py-0.5 text-xs font-medium bg-blue-100 text-blue-800 rounded font-mono"
-										>
-											{scope}
-											<button
-												type="button"
-												onclick={(e) => {
-													e.stopPropagation()
-													removeSelectedScope(scope)
-												}}
-												class="text-blue-600 hover:text-blue-800 flex-shrink-0"
-												title="Remove scope"
-												{disabled}
-											>
-												<X size={10} />
-											</button>
-										</span>
+										{@render scopeChip(scope, 'Remove scope', (e) => {
+											e.stopPropagation()
+											removeSelectedScope(scope)
+										})}
 									{/each}
 								</div>
 								{#if domain.description}
@@ -672,11 +673,19 @@
 														contentClasses="p-3"
 													>
 														{#snippet trigger()}
-															<Button size="xs" disabled={isDisabled} variant="default">
-																Restrict paths
+															<Button
+																size="xs"
+																disabled={isDisabled}
+																variant="default"
+																startIcon={resourcePathArray.length > 0
+																	? { icon: Plus }
+																	: undefined}
+															>
+																{resourcePathArray.length > 0 ? 'Add path' : 'Restrict paths'}
 																<Tooltip light>
-																	Restrict this scope to specific resource paths. If no paths are
-																	specified, the scope gives full access.
+																	Restrict this scope to specific resource paths. With no paths
+																	listed it reaches everything; with paths listed it reaches exactly
+																	those.
 																</Tooltip>
 															</Button>
 														{/snippet}
@@ -724,19 +733,12 @@
 										{#if scope.requires_resource_path && resourcePathArray.length > 0}
 											<div class="flex flex-wrap gap-1 mt-2">
 												{#each resourcePathArray as path}
-													<span
-														class="inline-flex items-center gap-1 px-1.5 py-0.5 text-xs font-medium bg-blue-100 text-blue-800 rounded font-mono"
-													>
-														{path}
-														<button
-															type="button"
-															onclick={() => removeResourcePath(scope.value, path)}
-															class="text-blue-600 hover:text-blue-800 flex-shrink-0"
-															title="Remove path"
-														>
-															<X size={10} />
-														</button>
-													</span>
+													{@render scopeChip(
+														path,
+														'Remove path',
+														() => removeResourcePath(scope.value, path),
+														{ removeDisabled: isDisabled }
+													)}
 												{/each}
 											</div>
 										{/if}
diff --git a/frontend/src/lib/components/sidebar/DeleteForkedWorkspaceModal.svelte b/frontend/src/lib/components/sidebar/DeleteForkedWorkspaceModal.svelte
index 49a0a49da2..ff049ceddb 100644
--- a/frontend/src/lib/components/sidebar/DeleteForkedWorkspaceModal.svelte
+++ b/frontend/src/lib/components/sidebar/DeleteForkedWorkspaceModal.svelte
@@ -26,8 +26,18 @@
 	const forkedDescendants = $derived(
 		$workspaceStore ? findWorkspaceDescendants($workspaceStore, $userWorkspaces ?? []) : []
 	)
-	// Fork/dev workspaces are detected by their parent link, not the `wm-fork-` id prefix.
-	const currentWsIsFork = $derived(workspaceIsFork($workspaceStore, $userWorkspaces ?? []))
+	// Fork/dev workspaces are detected by their parent link, not the `wm-fork-` id prefix — except
+	// that the prefix answers before the workspace list has loaded, which is why the entry must be
+	// present and non-dev rather than merely absent from it. A dev workspace is torn down by
+	// detaching it, never deleted from here, and this guard also holds an already-open modal.
+	const currentWsIsFork = $derived.by(() => {
+		const current = $userWorkspaces?.find((w) => w.id === $workspaceStore)
+		return (
+			!!current &&
+			workspaceIsFork($workspaceStore, $userWorkspaces ?? []) &&
+			!current.is_dev_workspace
+		)
+	})
 
 	async function loadForkedDatatables() {
 		if (!$workspaceStore) return
diff --git a/frontend/src/lib/components/sidebar/SettingsMenu.svelte b/frontend/src/lib/components/sidebar/SettingsMenu.svelte
index 8b5213da24..3322ba66d0 100644
--- a/frontend/src/lib/components/sidebar/SettingsMenu.svelte
+++ b/frontend/src/lib/components/sidebar/SettingsMenu.svelte
@@ -84,8 +84,18 @@
 	const canManageWorkspace = $derived(
 		$userStore?.is_admin || $superadmin || isForkOwner(settingsWs, $userStore?.email)
 	)
-	// Fork/dev workspaces are detected by their parent link, not the `wm-fork-` id prefix.
-	const currentWsIsFork = $derived(workspaceIsFork($workspaceStore, $userWorkspaces ?? []))
+	// Fork/dev workspaces are detected by their parent link, not the `wm-fork-` id prefix. A dev
+	// workspace is excluded: it is a standing environment its whole team works in, torn down by
+	// detaching it in the dev-workspace settings, so offering a one-click delete beside the account
+	// menu puts a destructive action on the wrong surface. Requires the entry to be loaded, not just
+	// absent from the list: `workspaceIsFork` answers from the id prefix alone, so between a cold
+	// load restoring the workspace id and the list arriving, a `wm-fork-` dev workspace would read
+	// as a throwaway and offer its own deletion.
+	const currentWsIsThrowawayFork = $derived(
+		!!currentWs &&
+			workspaceIsFork($workspaceStore, $userWorkspaces ?? []) &&
+			!currentWs.is_dev_workspace
+	)
 
 	let leaveWorkspaceModal = $state(false)
 	let deleteForkModal = $state<DeleteForkedWorkspaceModal>()
@@ -160,7 +170,7 @@
 			: []),
 		// Fork deletion is a global-sidebar action on the active workspace, so keep it
 		// out of the session rail's per-target settings entry (`workspaceSettingsTarget`).
-		...(currentWsIsFork && !workspaceSettingsTarget
+		...(currentWsIsThrowawayFork && !workspaceSettingsTarget
 			? [
 					{
 						displayName: 'Delete forked workspace',
diff --git a/frontend/src/lib/components/sidebar/WorkspaceMenu.svelte b/frontend/src/lib/components/sidebar/WorkspaceMenu.svelte
index 2e57cf88fa..286e044e6b 100644
--- a/frontend/src/lib/components/sidebar/WorkspaceMenu.svelte
+++ b/frontend/src/lib/components/sidebar/WorkspaceMenu.svelte
@@ -9,8 +9,7 @@
 		workspaceUsageStore,
 		workspaceColor,
 		clearWorkspaceFromStorage,
-		globalForkModal,
-		type UserWorkspace
+		globalForkModal
 	} from '$lib/stores'
 	import { Building, Check, ChevronDown, ChevronRight, Plus, Settings } from 'lucide-svelte'
 	import { forkAccentStyle } from '$lib/utils/forkColor'
@@ -30,7 +29,12 @@
 	import { workspaceAIClients } from '../copilot/lib'
 	import { twMerge } from 'tailwind-merge'
 	import type { MenubarBuilders } from '@melt-ui/svelte'
-	import { buildWorkspaceHierarchy, isForkOwner } from '$lib/utils/workspaceHierarchy'
+	import {
+		buildWorkspaceHierarchy,
+		findWorkspaceAncestors,
+		findWorkspaceRoot,
+		isForkOwner
+	} from '$lib/utils/workspaceHierarchy'
 	import { canCreateFork } from '$lib/utils/editInFork'
 	import { getContrastTextColor } from '$lib/utils'
 	import { workspaceRootId } from '$lib/components/sessions/sessionScope.svelte'
@@ -149,21 +153,25 @@
 		e.stopPropagation()
 	}
 
-	function findRoot(id: string | undefined): UserWorkspace | undefined {
-		if (!id || !$userWorkspaces) return undefined
-		let current = $userWorkspaces.find((w) => w.id === id)
-		while (current?.parent_workspace_id) {
-			const parent = $userWorkspaces.find((w) => w.id === current!.parent_workspace_id)
-			if (!parent) break
-			current = parent
-		}
-		return current
-	}
+	// The active workspace's family root — shown in the trigger so a forked active workspace still
+	// surfaces its family name here (the fork itself is shown in the breadcrumb). Resolved exactly
+	// like the scope picker right below, so the two never name different heads for one workspace:
+	// inside a dev workspace's own subtree the head is that dev workspace, not the far root.
+	const currentFamily = $derived(
+		findWorkspaceRoot($workspaceStore ?? undefined, $userWorkspaces ?? [])
+	)
 
-	// The active workspace's family root — shown in the trigger so a forked
-	// active workspace still surfaces its family name here (the fork itself is
-	// shown in the breadcrumb).
-	const currentFamily = $derived(findRoot($workspaceStore ?? undefined))
+	// The row mechanics below — which family to expand, which collapsed row carries the tick — key on
+	// a depth-0 row of the list, which `buildWorkspaceHierarchy` puts at the highest workspace the
+	// caller can see: parentless, or with a parent absent from their list. `findWorkspaceAncestors`
+	// stops at that same visibility boundary, so it lands on the same row. The head displayed above
+	// can sit below it, hence the second resolution.
+	const lineageRoot = $derived.by(() => {
+		const id = $workspaceStore ?? undefined
+		if (!id) return undefined
+		const ancestors = findWorkspaceAncestors(id, $userWorkspaces ?? [])
+		return ancestors.at(-1) ?? $userWorkspaces?.find((w) => w.id === id)
+	})
 
 	// Workspace names carry no uniqueness constraint, and this menu labels every
 	// row by name alone: a prod/staging pair sharing one name renders as two
@@ -183,8 +191,8 @@
 	// on the active fork's own row instead of on its collapsed root.
 	function seedExpandedFamilies() {
 		expandedFamilies.clear()
-		if (currentFamily && currentFamily.id !== $workspaceStore) {
-			expandedFamilies.add(currentFamily.id)
+		if (lineageRoot && lineageRoot.id !== $workspaceStore) {
+			expandedFamilies.add(lineageRoot.id)
 		}
 	}
 
@@ -258,7 +266,7 @@
 						isActive ||
 						(!strictWorkspaceSelect &&
 							depth === 0 &&
-							currentFamily?.id === workspace.id &&
+							lineageRoot?.id === workspace.id &&
 							!expandedFamilies.has(workspace.id))}
 					{@const expandable =
 						!strictWorkspaceSelect && depth === 0 && familiesWithForks.has(workspace.id)}
diff --git a/frontend/src/lib/components/triggers/TriggersEditor.svelte b/frontend/src/lib/components/triggers/TriggersEditor.svelte
index 44f565d086..4b7733ac33 100644
--- a/frontend/src/lib/components/triggers/TriggersEditor.svelte
+++ b/frontend/src/lib/components/triggers/TriggersEditor.svelte
@@ -364,7 +364,7 @@
 			</Alert>
 		</div>
 	{/if}
-	<FlowCard {noEditor} noHeader>
+	<FlowCard {noEditor} title="Triggers">
 		<Splitpanes horizontal>
 			<Pane>
 				<div class="flex flex-row h-full" bind:clientWidth={leftPaneWidth}>
diff --git a/frontend/src/lib/components/triggers/http/RoutesGenerator.svelte b/frontend/src/lib/components/triggers/http/RoutesGenerator.svelte
index 28992cf72c..5c01c84918 100644
--- a/frontend/src/lib/components/triggers/http/RoutesGenerator.svelte
+++ b/frontend/src/lib/components/triggers/http/RoutesGenerator.svelte
@@ -289,7 +289,7 @@
 							{/if}
 							{#if selected === 'OpenAPI' || (selected === 'OpenAPI_File' && !emptyStringTrimmed(openApiFile)) || (selected === 'OpenAPI_URL' && !emptyStringTrimmed(openApiUrl))}
 								{#key forceRerender}
-									<SimpleEditor class="h-96" {lang} bind:code />
+									<SimpleEditor class="h-96" {lang} bind:code leadingChangeSync />
 								{/key}
 							{/if}
 							<Button
diff --git a/frontend/src/lib/components/triggers/native/NativeTriggerEditor.svelte b/frontend/src/lib/components/triggers/native/NativeTriggerEditor.svelte
index 7c14d1c099..66192f184d 100644
--- a/frontend/src/lib/components/triggers/native/NativeTriggerEditor.svelte
+++ b/frontend/src/lib/components/triggers/native/NativeTriggerEditor.svelte
@@ -14,7 +14,7 @@
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
 	import Drawer from '$lib/components/common/drawer/Drawer.svelte'
 	import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
-	import { Loader2, Save } from 'lucide-svelte'
+	import { Loader2, RefreshCw, Save } from 'lucide-svelte'
 	import ScriptPicker from '$lib/components/ScriptPicker.svelte'
 	import Section from '$lib/components/Section.svelte'
 	import Required from '$lib/components/Required.svelte'
@@ -25,6 +25,7 @@
 	import { handleConfigChange, type Trigger } from '$lib/components/triggers/utils'
 	import { deepEqual } from 'fast-equals'
 	import type { Snippet } from 'svelte'
+	import Alert from '$lib/components/common/alert/Alert.svelte'
 
 	interface Props {
 		service: NativeServiceName
@@ -103,6 +104,9 @@
 	let can_write = $state(true)
 	let originalConfig = $state<Record<string, any> | undefined>(undefined)
 	let initialConfig = $state<Record<string, any> | undefined>(undefined)
+	let loadError = $state<string | undefined>(undefined)
+	let externalError = $state<string | undefined>(undefined)
+	let retryEdit = $state<(() => void) | undefined>(undefined)
 
 	export function openNew(
 		nis_flow?: boolean,
@@ -129,6 +133,9 @@
 		originalConfig = undefined
 		initialConfig = undefined
 		summary = ''
+		loadError = undefined
+		externalError = undefined
+		retryEdit = undefined
 	}
 
 	export function openRecreate(nativeTrigger: ExtendedNativeTrigger) {
@@ -153,6 +160,9 @@
 		originalConfig = undefined
 		initialConfig = undefined
 		summary = nativeTrigger.summary ?? ''
+		loadError = undefined
+		externalError = undefined
+		retryEdit = undefined
 	}
 
 	export async function openEdit(
@@ -177,6 +187,15 @@
 		originalConfig = undefined
 		initialConfig = undefined
 		itemKind = nis_flow ? 'flow' : 'script'
+		loadError = undefined
+		externalError = undefined
+		retryEdit = undefined
+		// A failed load must not leave the previously edited trigger's target and config in the
+		// form, where saving would silently repoint this trigger at them.
+		serviceConfig = {}
+		scriptPath = ''
+		initialScriptPath = ''
+		summary = ''
 
 		try {
 			const fullTrigger = await NativeTriggerService.getNativeTrigger({
@@ -191,6 +210,7 @@
 			can_write = canWrite(fullTrigger.script_path, {}, $userStore)
 			summary = fullTrigger.summary ?? ''
 			externalData = fullTrigger.external_data
+			externalError = fullTrigger.external_error ?? undefined
 
 			// Apply default values if provided (for draft triggers)
 			if (defaultValues) {
@@ -198,8 +218,14 @@
 				externalData = { ...externalData, ...defaultValues }
 			}
 		} catch (err: any) {
-			sendUserToast(`Failed to load trigger configuration: ${err}`, true)
+			loadError = err.body ?? err.message ?? String(err)
+			sendUserToast(`Failed to load trigger configuration: ${loadError}`, true)
 			externalData = null
+			// The service form is not rendered in the error state, so nothing else will ever
+			// clear its loading flag or narrow the permission left over from the last trigger.
+			loadingForm = false
+			can_write = false
+			retryEdit = () => openEdit(externalIdOrPath, nis_flow, defaultValues)
 		} finally {
 			clearTimeout(loadingTimeout)
 			loadingConfig = false
@@ -256,7 +282,8 @@
 			loadingConfig ||
 			loadingForm ||
 			!can_write ||
-			!hasChanged
+			!hasChanged ||
+			loadError !== undefined
 	)
 	const saveCfg = $derived.by(getSaveCfg)
 
@@ -388,12 +415,41 @@
 {#snippet content()}
 	{#if loadingConfig && showLoading}
 		<Loader2 class="animate-spin" />
+	{:else if loadError}
+		<Alert
+			type="error"
+			title="Could not load this {serviceInfo?.serviceDisplayName} trigger"
+			descriptionClass="break-words"
+		>
+			<div class="flex flex-col gap-2 items-start">
+				<span>{loadError}</span>
+				<Button
+					size="xs"
+					variant="subtle"
+					startIcon={{ icon: RefreshCw }}
+					on:click={() => retryEdit?.()}
+				>
+					Retry
+				</Button>
+			</div>
+		</Alert>
 	{:else}
 		<div class="flex flex-col gap-4">
 			{#if description}
 				{@render description()}
 			{/if}
 		</div>
+		{#if externalError}
+			<div class="mt-4">
+				<Alert
+					type="warning"
+					title="Could not read this trigger from {serviceInfo?.serviceDisplayName}"
+					descriptionClass="break-words"
+				>
+					{externalError} The configuration below is the one Windmill last saved.
+				</Alert>
+			</div>
+		{/if}
 		<div class="flex flex-col gap-12 mt-6">
 			<Section headless>
 				<div class="flex flex-col gap-6">
diff --git a/frontend/src/lib/components/triggers/native/services/nextcloud/NextcloudTriggerForm.svelte b/frontend/src/lib/components/triggers/native/services/nextcloud/NextcloudTriggerForm.svelte
index cee2980b27..c282797b9b 100644
--- a/frontend/src/lib/components/triggers/native/services/nextcloud/NextcloudTriggerForm.svelte
+++ b/frontend/src/lib/components/triggers/native/services/nextcloud/NextcloudTriggerForm.svelte
@@ -35,6 +35,7 @@
 
 	let availableEvents = $state<NextCloudEventType[]>([])
 	let serviceSchema = $state<any>(null)
+	let eventsError = $state<string | undefined>(undefined)
 
 	async function loadAvailableEvents() {
 		if (!$workspaceStore) {
@@ -43,6 +44,7 @@
 		}
 
 		loading = true
+		eventsError = undefined
 		try {
 			const events = await NativeTriggerService.listNextCloudEvents({
 				workspace: $workspaceStore!
@@ -51,7 +53,8 @@
 			serviceSchema = getNextcloudSchema(events)
 		} catch (err: any) {
 			console.error('Failed to load NextCloud events:', err)
-			sendUserToast(`Failed to load available events: ${err.body || err.message}`, true)
+			eventsError = err.body || err.message || String(err)
+			sendUserToast(`Failed to load available events: ${eventsError}`, true)
 			availableEvents = []
 		} finally {
 			loading = false
@@ -108,9 +111,13 @@
 		</div>
 	{:else if availableEvents.length === 0}
 		<div class="text-red-500 text-xs space-y-2">
-			<div
-				>No events available. Please ensure your workspace has a connected Nextcloud integration.</div
-			>
+			{#if eventsError}
+				<div class="break-words">Could not load the available events: {eventsError}</div>
+			{:else}
+				<div
+					>No events available. Please ensure your workspace has a connected Nextcloud integration.</div
+				>
+			{/if}
 			<div class="flex gap-2">
 				<Button variant="default" on:click={loadAvailableEvents} {disabled}>
 					Retry loading events
diff --git a/frontend/src/lib/components/triggers/nats/NatsTriggersConfigSection.svelte b/frontend/src/lib/components/triggers/nats/NatsTriggersConfigSection.svelte
index 60dd2309de..2c459770d0 100644
--- a/frontend/src/lib/components/triggers/nats/NatsTriggersConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/nats/NatsTriggersConfigSection.svelte
@@ -83,7 +83,7 @@
 				customErrorMessage: 'Invalid consumer name',
 				showExpr: 'fields.use_jetstream',
 				description:
-					'Required is using JetStream. If a consumer with the same name already exists, it will be overwritten. It is also used as the deliver subject.'
+					'Required if using JetStream. If a consumer with the same name already exists, it will be overwritten. It is also used as the deliver subject.'
 			}
 		},
 		required: ['subjects', 'use_jetstream', 'stream_name', 'consumer_name']
diff --git a/frontend/src/lib/components/triggers/utils.ts b/frontend/src/lib/components/triggers/utils.ts
index 6ff2ea3ea0..287bd29e10 100644
--- a/frontend/src/lib/components/triggers/utils.ts
+++ b/frontend/src/lib/components/triggers/utils.ts
@@ -8,7 +8,8 @@ import {
 	Terminal,
 	Timer,
 	Zap,
-	LayoutDashboard
+	LayoutDashboard,
+	MousePointerClick
 } from 'lucide-svelte'
 import KafkaIcon from '$lib/components/icons/KafkaIcon.svelte'
 import NatsIcon from '$lib/components/icons/NatsIcon.svelte'
@@ -101,6 +102,8 @@ export const jobTriggerKinds: JobTriggerKind[] = [
 	'asset',
 	'freshness',
 	'app'
+	// `ui` is deliberately absent: the backend does not stamp it yet, so offering it here
+	// would be a filter that can only ever return nothing.
 ]
 
 export type Trigger = {
@@ -138,13 +141,14 @@ export const triggerIconMap = {
 	nextcloud: NextcloudIcon,
 	google: GoogleIcon,
 	github: GithubIcon,
-	// Job-attribution-only kinds (no trigger CRUD page): the pipeline asset
-	// cascade, the freshness watchdog, and app-component runs. Needed so the Runs
-	// filter and job detail render these trigger kinds instead of a blank label /
-	// no icon.
+	// Job-attribution-only kinds (no trigger CRUD page): the pipeline asset cascade,
+	// the freshness watchdog and app-component runs. Needed so the Runs filter and job
+	// detail render these trigger kinds instead of a blank label / no icon. `ui` is
+	// mapped ahead of the backend stamping it, so the day it does nothing renders blank.
 	asset: Zap,
 	freshness: Timer,
-	app: LayoutDashboard
+	app: LayoutDashboard,
+	ui: MousePointerClick
 }
 
 export const triggerDisplayNamesMap = {
@@ -169,10 +173,11 @@ export const triggerDisplayNamesMap = {
 	github: 'GitHub',
 	asset: 'Asset cascade',
 	freshness: 'Freshness',
-	app: 'App'
-	// `asset` / `freshness` / `app` are job-attribution-only (JobTriggerKind, not
-	// TriggerType) — hence the union in the satisfies below.
-} as const satisfies Record<TriggerType | 'asset' | 'freshness' | 'app', string>
+	app: 'App',
+	ui: 'UI'
+	// `asset` / `freshness` / `app` / `ui` are job-attribution-only (JobTriggerKind,
+	// not TriggerType) — hence the union in the satisfies below.
+} as const satisfies Record<TriggerType | 'asset' | 'freshness' | 'app' | 'ui', string>
 
 /**
  * Converts a TriggerType to a CaptureTriggerKind when a mapping exists
diff --git a/frontend/src/lib/components/vscode.ts b/frontend/src/lib/components/vscode.ts
index f30ffcd780..7ec61be145 100644
--- a/frontend/src/lib/components/vscode.ts
+++ b/frontend/src/lib/components/vscode.ts
@@ -1,6 +1,6 @@
 import '@codingame/monaco-vscode-standalone-typescript-language-features'
 
-import { editor as meditor, Uri as mUri } from 'monaco-editor'
+import { editor as meditor, KeyCode, KeyMod, Uri as mUri } from 'monaco-editor'
 import { getAppliedDarkModeVariant } from '$lib/darkModeVariant'
 
 export let isInitialized = false
@@ -157,6 +157,15 @@ export async function initializeVscode(caller?: string, htmlContainer?: HTMLElem
 			await apiWrapper.start()
 
 			isInitialized = true
+
+			// vscode-api ships VS Code's keybindings, including Ctrl/Cmd+Shift+S
+			// (Save As) which has no meaning here. Left bound, every Monaco
+			// instance swallows the shortcut and the browser/OS one never fires.
+			meditor.addKeybindingRule({
+				keybinding: KeyMod.CtrlCmd | KeyMod.Shift | KeyCode.KeyS,
+				command: null
+			})
+
 			meditor.defineTheme('nord', {
 				base: 'vs-dark',
 				inherit: true,
diff --git a/frontend/src/lib/components/worker_group.ts b/frontend/src/lib/components/worker_group.ts
index d0391b17c2..31d0cee7db 100644
--- a/frontend/src/lib/components/worker_group.ts
+++ b/frontend/src/lib/components/worker_group.ts
@@ -59,7 +59,8 @@ export const defaultTags = [
 	'java',
 	'ruby',
 	'rlang',
-	'duckdb'
+	'duckdb',
+	'dbt'
 	// for related places search: ADD_NEW_LANG
 ]
 /** Strip cache_clear, null/undefined values, empty arrays and empty objects from a worker group config. */
diff --git a/frontend/src/lib/components/workspaceSettings/AISettings.svelte b/frontend/src/lib/components/workspaceSettings/AISettings.svelte
index 48e3fb7f15..60d1cb77a0 100644
--- a/frontend/src/lib/components/workspaceSettings/AISettings.svelte
+++ b/frontend/src/lib/components/workspaceSettings/AISettings.svelte
@@ -57,7 +57,7 @@
 		usesInstanceAiConfig?: boolean
 		instanceAiSummary?: InstanceAISummary
 		customSave?: (config: AIConfig) => Promise<void>
-		onSave?: (info?: GetCopilotSettingsStateResponse) => void | Promise<void>
+		onSave?: (savedConfig: AIConfig, info?: GetCopilotSettingsStateResponse) => void | Promise<void>
 		title?: string
 		description?: string
 		link?: string
@@ -332,7 +332,14 @@
 			sendUserToast('AI settings updated')
 		}
 		storeInitialState()
-		await onSave?.(settingsState)
+		// Hand the parent what was persisted: it owns `initialConfig`, and this component is
+		// destroyed on a settings tab switch, so a stale prop returns as editor state on remount
+		// and is written back by the next save. Clone it, since `providers` aliases our `$state`
+		// and the `lastLoadedConfigKey` guard would then track our own edits; pre-arm that guard
+		// so the prop update does not re-apply the config over what the editor now shows.
+		const savedConfig = clone(config)
+		lastLoadedConfigKey = JSON.stringify(savedConfig)
+		await onSave?.(savedConfig, settingsState)
 	}
 
 	async function onAiProviderChange(provider: AIProvider) {
diff --git a/frontend/src/lib/components/workspaceSettings/CreateWorkspaceInner.svelte b/frontend/src/lib/components/workspaceSettings/CreateWorkspaceInner.svelte
index 23ed37caad..e9e680addd 100644
--- a/frontend/src/lib/components/workspaceSettings/CreateWorkspaceInner.svelte
+++ b/frontend/src/lib/components/workspaceSettings/CreateWorkspaceInner.svelte
@@ -24,7 +24,9 @@
 	import {
 		workspaceIsFork,
 		findWorkspaceRoot,
-		findWorkspaceDescendants
+		findWorkspaceDescendants,
+		findDefaultForkBase,
+		devWorkspacesInChainAbove
 	} from '$lib/utils/workspaceHierarchy'
 	import { useForkableWorkspaces } from '$lib/utils/useForkableWorkspaces.svelte'
 	import {
@@ -32,8 +34,14 @@
 		isRuleUnconditionallyActiveInRulesets
 	} from '$lib/workspaceProtectionRules.svelte'
 	import { resource } from 'runed'
-	import { Badge, Button } from '$lib/components/common'
-	import { devBadgeText } from '$lib/utils/devWorkspaceLabel'
+	import { Button } from '$lib/components/common'
+	import {
+		DEV_WORKSPACE_LABELS,
+		devBadgeText,
+		devLabelKey,
+		type DevWorkspaceLabelKey
+	} from '$lib/utils/devWorkspaceLabel'
+	import DevWorkspaceLabelPicker from '$lib/components/workspaceSettings/DevWorkspaceLabelPicker.svelte'
 	import Toggle from '$lib/components/Toggle.svelte'
 	import Tooltip from '$lib/components/Tooltip.svelte'
 	import { onMount } from 'svelte'
@@ -82,13 +90,24 @@
 		copyMembers = createAsDevWorkspace
 	})
 
-	// A dev workspace can only be created off a root base (backend rejects a dev of a fork). Clear a
-	// stale toggle when the base no longer qualifies so we never submit is_dev_workspace against a fork.
+	// A dev workspace can only be created off a root or dev base (backend rejects a dev of a throwaway
+	// fork). Clear a stale toggle when the base no longer qualifies so we never submit
+	// is_dev_workspace against a fork.
 	$effect(() => {
 		if (!canDesignateDevWorkspace && createAsDevWorkspace) {
 			createAsDevWorkspace = false
 		}
 	})
+	// "Create a new dev workspace" links here with ?dev=true, so the button creates what it names.
+	// Applied once eligibility is confirmed rather than at init, since the effect above would clear a
+	// toggle set while the server check is still in flight.
+	let devRequestedFromUrl = $state(page.url.searchParams.get('dev') === 'true')
+	$effect(() => {
+		if (devRequestedFromUrl && canDesignateDevWorkspace) {
+			devRequestedFromUrl = false
+			createAsDevWorkspace = true
+		}
+	})
 
 	// The base workspace to fork from. A fork's git branch is based on its parent's branch, so picking
 	// a fork here (rather than the root) yields a fork of a fork.
@@ -115,7 +134,9 @@
 			subtitle: w.is_dev_workspace ? 'dev workspace' : w.id === familyRoot?.id ? undefined : 'fork'
 		}))
 	)
-	let defaultBaseWorkspaceId = $derived(familyRoot?.id)
+	let defaultBaseWorkspaceId = $derived(
+		findDefaultForkBase($workspaceStore, forkableWorkspaces)?.id
+	)
 	// Seed the base once the family is known; keep an explicit user choice as long as it stays valid.
 	$effect(() => {
 		if (!isFork) return
@@ -123,34 +144,48 @@
 		baseWorkspaceId = defaultBaseWorkspaceId
 	})
 
-	// Cosmetic display label for the new dev workspace: 'dev' | 'staging'. Purely visual (badge text +
-	// wording); reset when the dev toggle is turned off.
-	let devWorkspaceLabel = $state<'dev' | 'staging'>('dev')
-	$effect(() => {
-		if (!createAsDevWorkspace) devWorkspaceLabel = 'dev'
-	})
-
-	// The dev-workspace option is only offered when forking a root workspace that doesn't already
-	// have one: a workspace gets at most one dev, and dev workspaces don't nest (a dev of a dev).
+	// The dev-workspace option is only offered when forking a workspace that doesn't already have a
+	// dev: a workspace gets at most one. The base may be a root or, less conventionally, another dev
+	// workspace (a dev of a dev) — only a throwaway fork can't host one.
 	let baseWorkspaceEntry = $derived(forkableWorkspaces.find((w) => w.id === baseWorkspaceId))
-	// Require the base workspace to be loaded before treating it as a root: a missing entry must
-	// not read as root (it would offer invalid dev creation while the workspace list is still loading).
+	// Require the base workspace to be loaded before treating it as eligible: a missing entry must not
+	// read as a root (it would offer invalid dev creation while the workspace list is still loading).
 	// `workspaceIsFork` (prefix OR parent) also excludes an orphaned `wm-fork-` workspace, whose parent
 	// FK was set null — it has no parent but is still a fork, so it can't host a dev workspace.
-	let currentIsRoot = $derived(
-		!!baseWorkspaceEntry && !workspaceIsFork(baseWorkspaceId, forkableWorkspaces)
+	let baseCanHostDev = $derived(
+		!!baseWorkspaceEntry &&
+			(!workspaceIsFork(baseWorkspaceId, forkableWorkspaces) ||
+				!!baseWorkspaceEntry.is_dev_workspace)
 	)
 	// Ask the server whether a dev already exists: the caller may not be a member of this prod's dev,
 	// so the client workspace list can't see it and would offer an invalid "create dev" action.
 	const devWorkspaceResource = resource(
-		() => (currentIsRoot ? baseWorkspaceId : undefined),
+		() => (baseCanHostDev ? baseWorkspaceId : undefined),
 		async (ws) => (ws ? await WorkspaceService.getDevWorkspace({ workspace: ws }) : undefined)
 	)
+	// The label names the deploy branch, and the dev workspaces the new one would share a chain with
+	// hold theirs: the picker steers away from those rather than offering a choice the backend rejects.
+	let chainTakenLabels = $derived(
+		new Set(
+			devWorkspacesInChainAbove(baseWorkspaceId, forkableWorkspaces).map((w) =>
+				devLabelKey(w.dev_workspace_label)
+			)
+		)
+	)
+	let availableDevLabels = $derived(DEV_WORKSPACE_LABELS.filter((l) => !chainTakenLabels.has(l)))
 	// Offer dev designation only once the server confirms there's no dev yet (returns null); stay
-	// conservative (no offer) while the check is loading (current is undefined).
-	let canDesignateDevWorkspace = $derived(currentIsRoot && devWorkspaceResource.current === null)
+	// conservative (no offer) while the check is loading (current is undefined). With every label
+	// taken the chain is full and there is nothing left to designate.
+	let canDesignateDevWorkspace = $derived(
+		baseCanHostDev && availableDevLabels.length > 0 && devWorkspaceResource.current === null
+	)
+
+	let devWorkspaceLabel = $state<DevWorkspaceLabelKey>('dev')
+	$effect(() => {
+		if (!createAsDevWorkspace) devWorkspaceLabel = 'dev'
+	})
 	let currentWorkspaceName = $derived(
-		baseWorkspaceEntry?.name ?? baseWorkspaceId ?? 'the root workspace'
+		baseWorkspaceEntry?.name ?? baseWorkspaceId ?? 'the base workspace'
 	)
 
 	// If the root already blocks direct deploy / forking through an existing protection rule, keep the
@@ -443,7 +478,7 @@
 		forkCreationLoading = false
 		sendUserToast(
 			createAsDevWorkspace
-				? `Created ${devWorkspaceLabel === 'staging' ? 'staging' : 'dev'} workspace ${effectiveForkId} for ${baseWorkspaceId}`
+				? `Created ${devWorkspaceLabel} workspace ${effectiveForkId} for ${baseWorkspaceId}`
 				: `Successfully forked workspace ${baseWorkspaceId} as: wm-fork-${id}`
 		)
 
@@ -592,15 +627,15 @@
 			id = name.toLowerCase().replace(/\s/gi, '-')
 		}
 	})
-	// When creating a dev workspace, prefill the fork name with `<root>-dev` / `<root>-stg` (the effect
-	// above slugifies it into the id). Only fill an empty field or one still holding a prior suggestion,
-	// so a user-typed name is never overwritten; flipping Dev<->Staging updates the suffix, and turning
-	// the dev toggle back off clears the suggestion.
+	// When creating a dev workspace, prefill the fork name with `<root>-<badge>` (the effect above
+	// slugifies it into the id). Only fill an empty field or one still holding a prior suggestion, so a
+	// user-typed name is never overwritten; changing the label updates the suffix, and turning the dev
+	// toggle back off clears the suggestion.
 	let lastAutoDevName = $state<string | undefined>(undefined)
 	$effect(() => {
 		const target =
 			createAsDevWorkspace && $workspaceStore
-				? `${$workspaceStore}-${devWorkspaceLabel === 'staging' ? 'stg' : 'dev'}`
+				? `${$workspaceStore}-${devBadgeText(devWorkspaceLabel)}`
 				: ''
 		if (name === '' || name === lastAutoDevName) {
 			name = target
@@ -818,25 +853,18 @@
 					<div class="flex flex-col gap-2 pt-1">
 						<Toggle bind:checked={createAsDevWorkspace} options={{ right: 'Dev workspace' }} />
 						{#if createAsDevWorkspace}
-							<div class="text-2xs text-secondary">
-								Label: <Badge color="indigo" small>{devBadgeText(devWorkspaceLabel)}</Badge>
-								<button
-									type="button"
-									class="text-secondary hover:text-primary hover:underline"
-									onclick={() =>
-										(devWorkspaceLabel = devWorkspaceLabel === 'staging' ? 'dev' : 'staging')}
-								>
-									Change to {devWorkspaceLabel === 'staging' ? 'dev' : 'staging'}
-								</button>
-							</div>
+							<DevWorkspaceLabelPicker
+								bind:value={devWorkspaceLabel}
+								takenLabels={chainTakenLabels}
+							/>
 							<div class="flex flex-col gap-2 rounded-md border bg-surface-secondary p-3">
 								<div class="flex flex-col gap-0.5">
 									<span class="text-xs font-semibold text-emphasis"
 										>Protect {currentWorkspaceName}</span
 									>
 									<span class="text-2xs text-secondary">
-										Adds protection rules to this (root) workspace so changes are made in the new
-										dev workspace and promoted here.
+										Adds protection rules to the base workspace so changes are made in the new dev
+										workspace and promoted there.
 									</span>
 								</div>
 								{#if deployLocked}
@@ -894,10 +922,10 @@
 					</div>
 					<span class="text-xs text-secondary">
 						{#if createAsDevWorkspace}
-							A dev workspace is always based on the root workspace.
+							A dev workspace is paired with the workspace it is based on, which here is {currentWorkspaceName}.
 						{:else}
-							Workspace to fork from. Defaults to the root; pick an existing fork to create a fork
-							of a fork (the new branch is based on the selected workspace's branch).
+							Workspace to fork from: the new branch is based on the selected workspace's branch.
+							Pick an existing fork to create a fork of a fork.
 						{/if}
 					</span>
 					<Select
diff --git a/frontend/src/lib/components/workspaceSettings/DataTableMigrationsButton.svelte b/frontend/src/lib/components/workspaceSettings/DataTableMigrationsButton.svelte
index 307c3eecd7..bb908a433c 100644
--- a/frontend/src/lib/components/workspaceSettings/DataTableMigrationsButton.svelte
+++ b/frontend/src/lib/components/workspaceSettings/DataTableMigrationsButton.svelte
@@ -25,6 +25,7 @@
 	import Tooltip from '../Tooltip.svelte'
 	import Portal from '$lib/components/Portal.svelte'
 	import DropdownV2 from '../DropdownV2.svelte'
+	import MissingWorkerTagAlert from '../jobs/MissingWorkerTagAlert.svelte'
 	import { superadmin, userStore } from '$lib/stores'
 
 	let {
@@ -422,6 +423,7 @@
 				{/if}
 			</div>
 		{:else}
+			<MissingWorkerTagAlert tag="postgresql" subject="Migrations" {workspace} class="mb-2" />
 			{#if loadError}
 				<div class="text-xs text-red-500">
 					Could not read applied status from the data table: {loadError}
diff --git a/frontend/src/lib/components/workspaceSettings/DataTableSettings.svelte b/frontend/src/lib/components/workspaceSettings/DataTableSettings.svelte
index 069ef6093d..254a20fe80 100644
--- a/frontend/src/lib/components/workspaceSettings/DataTableSettings.svelte
+++ b/frontend/src/lib/components/workspaceSettings/DataTableSettings.svelte
@@ -87,6 +87,7 @@
 	import { clone } from '$lib/utils'
 	import SettingsFooter from './SettingsFooter.svelte'
 	import Alert from '../common/alert/Alert.svelte'
+	import MissingWorkerTagAlert from '../jobs/MissingWorkerTagAlert.svelte'
 	import { isCloudHosted } from '$lib/cloud'
 
 	type Props = {
@@ -252,6 +253,8 @@
 	</Alert>
 {/if}
 
+<MissingWorkerTagAlert tag="postgresql" subject="Browsing and querying data tables" class="mb-4" />
+
 <DataTable>
 	<Head>
 		<tr>
diff --git a/frontend/src/lib/components/workspaceSettings/DbtSettings.svelte b/frontend/src/lib/components/workspaceSettings/DbtSettings.svelte
new file mode 100644
index 0000000000..04c4bf7cc0
--- /dev/null
+++ b/frontend/src/lib/components/workspaceSettings/DbtSettings.svelte
@@ -0,0 +1,198 @@
+<script module lang="ts">
+	import type { GetSettingsResponse } from '$lib/gen'
+
+	export type DbtWarehouse = { name: string; resource_path?: string; target?: string }
+	export type DbtSettingsType = { warehouses: DbtWarehouse[] }
+
+	/** The name a project reaches when its descriptor names none. */
+	export const DEFAULT_WAREHOUSE = 'main'
+
+	/**
+	 * The resource types a warehouse may point at: `dbt_profile`, which carries a
+	 * `profiles.yml` block verbatim and so reaches any adapter, plus the connection types
+	 * `render_profile` (backend/windmill-worker/src/dbt_profiles.rs) translates. Anything
+	 * else has no way to become a dbt target at all.
+	 */
+	export const WAREHOUSE_RESOURCE_TYPES = [
+		'dbt_profile',
+		'postgresql',
+		'redshift',
+		'mysql',
+		'snowflake',
+		'snowflake_oauth',
+		'bigquery',
+		'gcp_service_account',
+		'databricks'
+	].join(',')
+
+	export function convertDbtSettingsFromBackend(
+		settings: GetSettingsResponse['dbt_warehouses']
+	): DbtSettingsType {
+		return {
+			warehouses: Object.entries(settings ?? {}).map(([name, rest]) => ({
+				name,
+				resource_path: (rest as DbtWarehouse)?.resource_path,
+				target: (rest as DbtWarehouse)?.target
+			}))
+		}
+	}
+
+	export function convertDbtSettingsToBackend(
+		settings: DbtSettingsType
+	): Record<string, { resource_path: string; target?: string }> {
+		// Null-prototype: the backend accepts any alphanumeric name, `constructor`
+		// and `toString` among them, and on a plain object those are inherited —
+		// `in` would call them duplicates, and assigning `__proto__` would set the
+		// prototype instead of a key.
+		const out: Record<string, { resource_path: string; target?: string }> = Object.create(null)
+		for (const w of settings.warehouses) {
+			const name = w.name?.trim()
+			if (!name) throw 'A warehouse needs a name'
+			if (name in out) throw 'Settings contain duplicate warehouse name: ' + name
+			if (!w.resource_path) throw 'No resource selected for ' + name
+			out[name] = { resource_path: w.resource_path, target: w.target || undefined }
+		}
+		return out
+	}
+</script>
+
+<script lang="ts">
+	import { Plus, Trash } from 'lucide-svelte'
+	import { Button } from '$lib/components/common'
+	import TextInput from '../text_input/TextInput.svelte'
+	import ResourcePicker from '../ResourcePicker.svelte'
+	import DataTable from '../table/DataTable.svelte'
+	import Head from '../table/Head.svelte'
+	import Row from '../table/Row.svelte'
+	import Cell from '../table/Cell.svelte'
+	import SettingsFooter from './SettingsFooter.svelte'
+	import Description from '$lib/components/Description.svelte'
+	import { WorkspaceService } from '$lib/gen'
+	import { workspaceStore } from '$lib/stores'
+	import { sendUserToast } from '$lib/toast'
+	import { clone } from '$lib/utils'
+
+	let {
+		dbtSettings = $bindable(),
+		dbtSavedSettings = $bindable(),
+		onSave: onSaveProp = undefined,
+		onDiscard = undefined
+	}: {
+		dbtSettings: DbtSettingsType
+		dbtSavedSettings: DbtSettingsType
+		onSave?: () => void
+		onDiscard?: () => void
+	} = $props()
+
+	let hasUnsavedChanges = $derived(
+		JSON.stringify(dbtSettings.warehouses) !== JSON.stringify(dbtSavedSettings.warehouses)
+	)
+
+	async function onSave() {
+		try {
+			const dbt_warehouses = convertDbtSettingsToBackend(dbtSettings)
+			await WorkspaceService.editDbtWarehouses({
+				workspace: $workspaceStore!,
+				requestBody: { dbt_warehouses }
+			})
+			dbtSavedSettings = clone(dbtSettings)
+			sendUserToast('dbt warehouses saved successfully')
+			onSaveProp?.()
+		} catch (e) {
+			sendUserToast(e, true)
+			throw e
+		}
+	}
+</script>
+
+<Description link="https://www.windmill.dev/docs/getting_started/scripts_quickstart/dbt">
+	Where dbt projects in this workspace run. A project names a warehouse by name in its descriptor (<span
+		class="font-mono">profile.warehouse</span
+	>) and reaches
+	<span class="font-mono">{DEFAULT_WAREHOUSE}</span> when it names none, so a project carries no
+	connection of its own. The name is also what its tables are keyed on in the asset graph (<span
+		class="font-mono">dbt://{DEFAULT_WAREHOUSE}/schema/table</span
+	>), so two projects on one warehouse share their nodes. Each entry points either at one of
+	Windmill's own connection resources, whose fields are translated into a dbt target, or at a
+	<span class="font-mono">dbt_profile</span> resource, which carries a
+	<span class="font-mono">profiles.yml</span> target as it is and so reaches any adapter dbt has. Configuring
+	one here is what makes it available: anyone who may run a dbt script builds with it and reads its models,
+	without being granted the resource, the same bargain workspace object storage makes.
+</Description>
+
+<DataTable>
+	<Head>
+		<tr>
+			<Cell head first>Name</Cell>
+			<Cell head>Resource</Cell>
+			<Cell head>Target</Cell>
+			<Cell head last />
+		</tr>
+	</Head>
+	<tbody class="divide-y">
+		{#each dbtSettings.warehouses as warehouse, i (i)}
+			<Row>
+				<Cell first>
+					<TextInput
+						bind:value={warehouse.name}
+						inputProps={{ placeholder: DEFAULT_WAREHOUSE }}
+						class="min-w-32"
+					/>
+				</Cell>
+				<Cell>
+					<ResourcePicker
+						class="min-w-48"
+						bind:value={warehouse.resource_path}
+						resourceType={WAREHOUSE_RESOURCE_TYPES}
+						placeholder="warehouse resource"
+					/>
+				</Cell>
+				<Cell>
+					<TextInput
+						bind:value={warehouse.target}
+						inputProps={{ placeholder: 'default' }}
+						class="min-w-24"
+					/>
+				</Cell>
+				<Cell last>
+					<Button
+						size="xs"
+						color="light"
+						variant="border"
+						startIcon={{ icon: Trash }}
+						iconOnly
+						on:click={() => {
+							dbtSettings.warehouses = dbtSettings.warehouses.filter((_, j) => j !== i)
+						}}
+					/>
+				</Cell>
+			</Row>
+		{/each}
+		<Row>
+			<Cell first colspan={4}>
+				<Button
+					size="sm"
+					btnClasses="max-w-fit"
+					variant="default"
+					on:click={() => {
+						dbtSettings.warehouses = [
+							...dbtSettings.warehouses,
+							{ name: dbtSettings.warehouses.length === 0 ? DEFAULT_WAREHOUSE : '' }
+						]
+					}}
+				>
+					<Plus /> New warehouse
+				</Button>
+			</Cell>
+		</Row>
+	</tbody>
+</DataTable>
+
+<SettingsFooter
+	class="mt-6 mb-16"
+	inline
+	{hasUnsavedChanges}
+	{onSave}
+	onDiscard={() => onDiscard?.()}
+	saveLabel="Save dbt warehouses"
+/>
diff --git a/frontend/src/lib/components/workspaceSettings/DeployToHub.svelte b/frontend/src/lib/components/workspaceSettings/DeployToHub.svelte
index cbe0554be8..b372fe2094 100644
--- a/frontend/src/lib/components/workspaceSettings/DeployToHub.svelte
+++ b/frontend/src/lib/components/workspaceSettings/DeployToHub.svelte
@@ -105,18 +105,17 @@
 		// Browser-reported type wins over the extension: a PNG misnamed *.svg
 		// must be treated as PNG or the Hub's content sniff rejects it later.
 		const lower = file.name.toLowerCase()
-		const mime =
-			file.type
-				? file.type === 'image/png'
-					? 'image/png'
-					: file.type === 'image/svg+xml'
-						? 'image/svg+xml'
-						: undefined
-				: lower.endsWith('.png')
-					? 'image/png'
-					: lower.endsWith('.svg')
-						? 'image/svg+xml'
-						: undefined
+		const mime = file.type
+			? file.type === 'image/png'
+				? 'image/png'
+				: file.type === 'image/svg+xml'
+					? 'image/svg+xml'
+					: undefined
+			: lower.endsWith('.png')
+				? 'image/png'
+				: lower.endsWith('.svg')
+					? 'image/svg+xml'
+					: undefined
 		if (!mime) {
 			sendUserToast('Logo must be a PNG or SVG file', true)
 			return
@@ -144,7 +143,6 @@
 		logoDragOver = false
 		await handleLogoFile(e.dataTransfer?.files?.[0])
 	}
-
 </script>
 
 {#if deployHub.session}
@@ -764,6 +762,40 @@
 							schema={s.recordSchema}
 						/>
 					{/if}
+
+					{#if s.pastRuns.length > 0 && s.runState !== 'running'}
+						<div class="flex flex-col gap-1 rounded-md border p-3">
+							<span class="text-xs font-semibold text-primary">Or pick an existing run</span>
+							<span class="text-[11px] text-hint">
+								A recording is built from the completed run, so any recent successful run works.
+							</span>
+							<div class="mt-1 flex flex-col divide-y">
+								{#each s.pastRuns as run}
+									<div class="flex items-center justify-between gap-2 py-1.5">
+										<a
+											href={`/run/${run.id}?workspace=${s.workspace}`}
+											target="_blank"
+											rel="noopener noreferrer"
+											class="inline-flex items-center gap-1 text-xs text-blue-600 dark:text-blue-400 hover:underline"
+										>
+											<ExternalLink size={12} />
+											{run.started_at ? new Date(run.started_at).toLocaleString() : run.id}
+										</a>
+										<div class="flex items-center gap-2">
+											{#if run.duration_ms !== undefined}
+												<span class="text-[11px] text-hint"
+													>{(run.duration_ms / 1000).toFixed(1)}s</span
+												>
+											{/if}
+											<Button size="xs" variant="default" onclick={() => s.useExistingRun(run.id)}>
+												Use this run
+											</Button>
+										</div>
+									</div>
+								{/each}
+							</div>
+						</div>
+					{/if}
 				</div>
 				{#snippet actions()}
 					{#if s.runState === 'success'}
@@ -1133,9 +1165,7 @@
 							</span>
 							<div class="mt-1 flex flex-col items-center gap-2">
 								<div class="w-64 overflow-hidden rounded-2xl border shadow-sm">
-									<div
-										class="flex h-32 items-center justify-center bg-surface-secondary/50 px-4"
-									>
+									<div class="flex h-32 items-center justify-center bg-surface-secondary/50 px-4">
 										<img
 											src={`data:${s.hubLogo.mime};base64,${s.hubLogo.b64}`}
 											alt="Project logo preview"
@@ -1147,7 +1177,9 @@
 											{s.hubName.trim() || 'Project name'}
 										</div>
 										<p class="mt-0.5 line-clamp-2 text-[11px] text-secondary">
-											{s.hubSummary.trim() || s.hubName.trim() || 'Short one-liner shown on the Hub card'}
+											{s.hubSummary.trim() ||
+												s.hubName.trim() ||
+												'Short one-liner shown on the Hub card'}
 										</p>
 									</div>
 								</div>
diff --git a/frontend/src/lib/components/workspaceSettings/DevWorkspaceLabelPicker.svelte b/frontend/src/lib/components/workspaceSettings/DevWorkspaceLabelPicker.svelte
new file mode 100644
index 0000000000..6f8b90d670
--- /dev/null
+++ b/frontend/src/lib/components/workspaceSettings/DevWorkspaceLabelPicker.svelte
@@ -0,0 +1,30 @@
+<script lang="ts">
+	import Select from '$lib/components/select/Select.svelte'
+	import { DEV_WORKSPACE_LABELS, type DevWorkspaceLabelKey } from '$lib/utils/devWorkspaceLabel'
+
+	let {
+		value = $bindable(),
+		takenLabels
+	}: {
+		value: DevWorkspaceLabelKey
+		/** Labels already held by a dev workspace in the resulting chain; the backend rejects a reuse. */
+		takenLabels: Set<string>
+	} = $props()
+
+	// Dev workspaces in a chain share their git-sync repositories, so two carrying the same label
+	// deploy to the same branch. Offer only what is left rather than a choice the backend rejects.
+	let free = $derived(DEV_WORKSPACE_LABELS.filter((l) => !takenLabels.has(l)))
+	// Named, not badge-abbreviated: the label picked here is the branch that gets created, so
+	// offering `stg` for a `staging` branch would name something that does not exist.
+	let items = $derived(free.map((l) => ({ label: l, value: l })))
+	$effect(() => {
+		if (free.length > 0 && !free.includes(value)) value = free[0]
+	})
+</script>
+
+<div class="flex items-center gap-2 text-2xs text-secondary">
+	<span>Label:</span>
+	<div class="w-40">
+		<Select {items} bind:value size="sm" />
+	</div>
+</div>
diff --git a/frontend/src/lib/components/workspaceSettings/GitSyncFilterSettings.svelte b/frontend/src/lib/components/workspaceSettings/GitSyncFilterSettings.svelte
index cbf12c6314..dcbef04a51 100644
--- a/frontend/src/lib/components/workspaceSettings/GitSyncFilterSettings.svelte
+++ b/frontend/src/lib/components/workspaceSettings/GitSyncFilterSettings.svelte
@@ -25,6 +25,7 @@
 		settings: boolean
 		key: boolean
 		workspaceDependencies: boolean
+		dataTableMigrations: boolean
 	}
 
 	let {
@@ -35,7 +36,8 @@
 			'flow',
 			'app',
 			'folder',
-			'workspacedependencies'
+			'workspacedependencies',
+			'datatablemigration'
 		] as GitSyncObjectType[]),
 		exclude_types_override = $bindable([] as GitSyncObjectType[]),
 		isLegacyRepo = false,
@@ -76,7 +78,8 @@
 		triggers: effectiveIncludeTypes.includes('trigger'),
 		settings: effectiveIncludeTypes.includes('settings'),
 		key: effectiveIncludeTypes.includes('key'),
-		workspaceDependencies: effectiveIncludeTypes.includes('workspacedependencies')
+		workspaceDependencies: effectiveIncludeTypes.includes('workspacedependencies'),
+		dataTableMigrations: effectiveIncludeTypes.includes('datatablemigration')
 	})
 
 	// Tab selection for filter kinds
@@ -99,7 +102,8 @@
 			triggers: 'trigger',
 			settings: 'settings',
 			key: 'key',
-			workspaceDependencies: 'workspacedependencies'
+			workspaceDependencies: 'workspacedependencies',
+			dataTableMigrations: 'datatablemigration'
 		}
 
 		if (value) {
@@ -321,6 +325,14 @@
 									options={{ right: 'Workspace dependencies' }}
 								/>
 							</div>
+							<div class="flex items-center gap-2">
+								<Toggle
+									size="xs"
+									checked={typeToggles.dataTableMigrations}
+									on:change={(e) => updateIncludeType('dataTableMigrations', e.detail)}
+									options={{ right: 'Data table migrations' }}
+								/>
+							</div>
 						</div>
 					</div>
 				</div>
diff --git a/frontend/src/lib/components/workspaceSettings/RulesetEditor.svelte b/frontend/src/lib/components/workspaceSettings/RulesetEditor.svelte
index 6a71f63c44..be6a240c19 100644
--- a/frontend/src/lib/components/workspaceSettings/RulesetEditor.svelte
+++ b/frontend/src/lib/components/workspaceSettings/RulesetEditor.svelte
@@ -14,6 +14,7 @@
 	} from '$lib/gen'
 	import { sendUserToast } from '$lib/toast'
 	import { clone } from '$lib/utils'
+	import { DEV_WORKSPACE_LOCK_RULE_NAME } from '$lib/workspaceProtectionRules.svelte'
 	import { untrack } from 'svelte'
 	import { Save, X, Plus } from 'lucide-svelte'
 	import { safeSelectItems } from '$lib/components/select/utils.svelte'
@@ -28,6 +29,9 @@
 
 	// Create mode vs Edit mode
 	const isCreateMode = $derived(!rule)
+	// The dev-workspace feature creates, finds and removes its rule by name, so this one name is
+	// fixed. Its restrictions and bypassers stay editable.
+	const isNameLocked = $derived(rule?.name === DEV_WORKSPACE_LOCK_RULE_NAME)
 
 	// Helper function to check if a rule is in the array
 	const hasRule = (ruleKind: string) => rule?.rules?.includes(ruleKind as any) ?? false
@@ -38,6 +42,7 @@
 	let disableFork = $state(hasRule('DisableWorkspaceForking'))
 	let restrictDeployToDeployers = $state(hasRule('RestrictDeployToDeployers'))
 	let restrictAnonymousAppDeployment = $state(hasRule('RestrictAnonymousAppDeployment'))
+	let restrictPublicRunSharing = $state(hasRule('RestrictPublicRunSharing'))
 	let selectedGroups = $state<string[]>(
 		untrack(() => rule)?.bypass_groups?.map((g) => g.replace('g/', '')) ?? []
 	)
@@ -51,6 +56,7 @@
 	let initialDisableFork = $state(hasRule('DisableWorkspaceForking'))
 	let initialRestrictDeployToDeployers = $state(hasRule('RestrictDeployToDeployers'))
 	let initialRestrictAnonymousAppDeployment = $state(hasRule('RestrictAnonymousAppDeployment'))
+	let initialRestrictPublicRunSharing = $state(hasRule('RestrictPublicRunSharing'))
 	let initialSelectedGroups = $state<string[]>(
 		untrack(() => rule)?.bypass_groups
 			? untrack(() => rule)!.bypass_groups.map((g) => g.replace('g/', ''))
@@ -118,6 +124,7 @@
 					disableFork ||
 					restrictDeployToDeployers ||
 					restrictAnonymousAppDeployment ||
+					restrictPublicRunSharing ||
 					selectedGroups.length > 0 ||
 					selectedUsers.length > 0
 			: name !== initialName ||
@@ -125,6 +132,7 @@
 					disableFork !== initialDisableFork ||
 					restrictDeployToDeployers !== initialRestrictDeployToDeployers ||
 					restrictAnonymousAppDeployment !== initialRestrictAnonymousAppDeployment ||
+					restrictPublicRunSharing !== initialRestrictPublicRunSharing ||
 					JSON.stringify([...selectedGroups].sort()) !==
 						JSON.stringify([...initialSelectedGroups].sort()) ||
 					JSON.stringify([...selectedUsers].sort()) !==
@@ -167,7 +175,8 @@
 							: []),
 						...(restrictAnonymousAppDeployment
 							? ['RestrictAnonymousAppDeployment' as ProtectionRuleKind]
-							: [])
+							: []),
+						...(restrictPublicRunSharing ? ['RestrictPublicRunSharing' as ProtectionRuleKind] : [])
 					],
 					bypass_groups: selectedGroups,
 					bypass_users: selectedUsers
@@ -190,6 +199,7 @@
 				workspace: $workspaceStore,
 				ruleName: initialName,
 				requestBody: {
+					name,
 					rules: [
 						...(disableDirectDeployment ? ['DisableDirectDeployment' as ProtectionRuleKind] : []),
 						...(disableFork ? ['DisableWorkspaceForking' as ProtectionRuleKind] : []),
@@ -198,7 +208,8 @@
 							: []),
 						...(restrictAnonymousAppDeployment
 							? ['RestrictAnonymousAppDeployment' as ProtectionRuleKind]
-							: [])
+							: []),
+						...(restrictPublicRunSharing ? ['RestrictPublicRunSharing' as ProtectionRuleKind] : [])
 					],
 					bypass_groups: selectedGroups,
 					bypass_users: selectedUsers
@@ -213,6 +224,7 @@
 			initialDisableFork = disableFork
 			initialRestrictDeployToDeployers = restrictDeployToDeployers
 			initialRestrictAnonymousAppDeployment = restrictAnonymousAppDeployment
+			initialRestrictPublicRunSharing = restrictPublicRunSharing
 			initialSelectedGroups = clone(selectedGroups)
 			initialSelectedUsers = clone(selectedUsers)
 
@@ -235,10 +247,16 @@
 			bind:value={name}
 			error={nameError}
 			inputProps={{
-				placeholder: 'Enter rule name'
+				placeholder: 'Enter rule name',
+				disabled: isNameLocked
 			}}
 		/>
-		{#if nameError}
+		{#if isNameLocked}
+			<div class="text-xs text-secondary">
+				Managed by the dev workspace pairing, which locates this rule by name. Its restrictions and
+				bypassers below can still be changed.
+			</div>
+		{:else if nameError}
 			<div class="text-xs text-red-600">{nameError}</div>
 		{/if}
 	</Section>
@@ -360,6 +378,20 @@
 					(anonymous execution mode). Apps that are already public can still be redeployed.
 				</div>
 			</div>
+
+			<!-- Restrict public run sharing -->
+			<div class="flex flex-col gap-2">
+				<Toggle
+					bind:checked={restrictPublicRunSharing}
+					options={{
+						right: 'Restrict public run sharing'
+					}}
+				/>
+				<div class="text-xs text-secondary ml-6">
+					Only workspace admins and bypass users can mint a public link to a run (readable without
+					login). The read-only link for workspace members stays available to everyone.
+				</div>
+			</div>
 		</div>
 	</Section>
 
diff --git a/frontend/src/lib/components/workspaceSettings/WorkspaceRulesets.svelte b/frontend/src/lib/components/workspaceSettings/WorkspaceRulesets.svelte
index 3101efed9a..142c2ad29f 100644
--- a/frontend/src/lib/components/workspaceSettings/WorkspaceRulesets.svelte
+++ b/frontend/src/lib/components/workspaceSettings/WorkspaceRulesets.svelte
@@ -11,20 +11,29 @@
 	import { Plus, Pen, Trash } from 'lucide-svelte'
 	import { untrack } from 'svelte'
 	import { WorkspaceService, type ProtectionRuleset } from '$lib/gen'
+	import { DEV_WORKSPACE_LOCK_RULE_NAME } from '$lib/workspaceProtectionRules.svelte'
+	import { page } from '$app/stores'
+	import { goto } from '$app/navigation'
 
 	let rules: ProtectionRuleset[] | undefined = $state<ProtectionRuleset[] | undefined>(undefined)
 	let selectedRule: ProtectionRuleset | undefined = $state(undefined)
 	let ruleDrawer: Drawer | undefined = $state(undefined)
 
+	// A failed load still yields an empty list so the table renders, so the deep link below has to be
+	// told apart from a genuinely absent rule.
+	let loadFailed = $state(false)
+
 	async function loadRules() {
 		if (!$workspaceStore) return
 
 		try {
 			rules = await WorkspaceService.listProtectionRules({ workspace: $workspaceStore })
+			loadFailed = false
 		} catch (error) {
 			console.error('Failed to load protection rules:', error)
 			sendUserToast('Failed to load protection rules', true)
 			rules = []
+			loadFailed = true
 		}
 	}
 
@@ -34,6 +43,28 @@
 		}
 	})
 
+	// `?rule=<name>` deep-links straight into a rule's drawer, so the dev-workspace panel can point at
+	// the ruleset enforcing its locks instead of dropping the reader on the list. The param is consumed
+	// on open: leaving it set would re-open the drawer on every later save or tab switch, since the
+	// sidebar carries the whole query string across tabs.
+	$effect(() => {
+		const name = $page.url.searchParams.get('rule')
+		const loaded = rules
+		if (!name || !loaded) return
+		untrack(() => {
+			const match = loaded.find((r) => r.name === name)
+			if (match) {
+				selectedRule = match
+				ruleDrawer?.openDrawer()
+			} else if (!loadFailed) {
+				sendUserToast(`Protection rule '${name}' not found in this workspace`, true)
+			}
+			const params = new URLSearchParams(window.location.search)
+			params.delete('rule')
+			goto(`?${params.toString()}`, { replaceState: true, noScroll: true, keepFocus: true })
+		})
+	})
+
 	async function deleteRule(name: string) {
 		if (!$workspaceStore) return
 		try {
@@ -145,6 +176,11 @@
 						<Cell first>
 							<div class="flex flex-col">
 								<span class="text-emphasis text-xs font-semibold">{rule.name}</span>
+								{#if rule.name === DEV_WORKSPACE_LOCK_RULE_NAME}
+									<span class="text-2xs text-secondary">
+										Applied by the dev workspace pairing. Detach the dev workspace to remove it.
+									</span>
+								{/if}
 							</div>
 						</Cell>
 						<Cell>
@@ -169,14 +205,20 @@
 											ruleDrawer?.openDrawer()
 										}
 									},
-									{
-										displayName: 'Delete',
-										icon: Trash,
-										type: 'delete',
-										action: async () => {
-											await deleteRule(rule.name)
-										}
-									}
+									// The reserved rule is removed by detaching the dev workspace; the API refuses
+									// to delete it by name, so offering the action here could only ever fail.
+									...(rule.name === DEV_WORKSPACE_LOCK_RULE_NAME
+										? []
+										: [
+												{
+													displayName: 'Delete',
+													icon: Trash,
+													type: 'delete' as const,
+													action: async () => {
+														await deleteRule(rule.name)
+													}
+												}
+											])
 								]}
 							/>
 						</Cell>
diff --git a/frontend/src/lib/components/workspaceSettings/deployToHubSession.svelte.ts b/frontend/src/lib/components/workspaceSettings/deployToHubSession.svelte.ts
index 521989262a..5cc7f0d1d7 100644
--- a/frontend/src/lib/components/workspaceSettings/deployToHubSession.svelte.ts
+++ b/frontend/src/lib/components/workspaceSettings/deployToHubSession.svelte.ts
@@ -50,6 +50,7 @@ import {
 	DATA_ASSET_KINDS
 } from '$lib/components/assets/AssetGraph/cascadeRun'
 import { capturePipelineRecording } from '$lib/components/recording/pipelineRecording.svelte'
+import { buildFlowRecording, buildScriptRecording } from '$lib/components/recording/runRecording'
 import type { PipelineRecording, RawAppRecording } from '$lib/components/recording/types'
 import {
 	TRIGGER_KINDS,
@@ -172,6 +173,9 @@ export class DeployToHubSession {
 	runResult = $state<unknown>(undefined)
 	runError = $state<string | undefined>(undefined)
 	recordings = $state<Record<string, string>>({})
+	// Recent successful runs of the record target: a recording is built from any
+	// completed run, so an existing one can be picked instead of running again.
+	pastRuns = $state<{ id: string; started_at?: string; duration_ms?: number }[]>([])
 
 	// Project-level data-pipeline recording. Unlike script/flow recordings (one
 	// job per item) a pipeline is the whole folder cascade, so it gets a single
@@ -1327,6 +1331,8 @@ export class DeployToHubSession {
 		this.runJobId = undefined
 		this.runResult = undefined
 		this.runError = undefined
+		this.pastRuns = []
+		this.#loadPastRuns(it, tok)
 		try {
 			if (it.kind === 'script') {
 				const s = await ScriptService.getScriptByPath({
@@ -1353,6 +1359,45 @@ export class DeployToHubSession {
 		this.#recordRunTok++
 	}
 
+	/** Recent successful runs of the target, so one can be recorded as-is.
+	 * Best-effort — an empty list just means the drawer only offers a fresh run. */
+	async #loadPastRuns(it: DeployItem, tok: number) {
+		if (it.kind !== 'script' && it.kind !== 'flow') return
+		try {
+			const runs = await JobService.listCompletedJobs({
+				workspace: this.workspace,
+				jobKinds: it.kind === 'script' ? 'script' : 'flow',
+				scriptPathExact: it.path,
+				status: 'success',
+				// Standalone runs only — a script that also runs as a flow step would
+				// otherwise list its child jobs.
+				hasNullParent: true,
+				orderDesc: true,
+				perPage: 5
+			})
+			if (tok !== this.#recordRunTok) return
+			this.pastRuns = runs.map((j) => ({
+				id: j.id,
+				started_at: j.started_at,
+				duration_ms: j.duration_ms
+			}))
+		} catch {
+			// best-effort
+		}
+	}
+
+	/** Adopt an existing successful run as the one to save: recordings are built
+	 * from completed jobs, so it goes through the exact same save path as a
+	 * fresh run. No token bump — there is no poll to cancel (the picker is
+	 * hidden while a run is in flight) and bumping would strand `openRecord`'s
+	 * still-loading schema fetch on "Loading schema…" forever. */
+	useExistingRun = (jobId: string) => {
+		this.runJobId = jobId
+		this.runState = 'success'
+		this.runResult = undefined
+		this.runError = undefined
+	}
+
 	runJob = async () => {
 		const it = this.recordTarget
 		if (!it) return
@@ -1427,69 +1472,71 @@ export class DeployToHubSession {
 
 	async #buildScriptRecording(it: DeployItem, jobId: string) {
 		const workspace = this.workspace
-		const s = await ScriptService.getScriptByPath({ workspace, path: it.path })
-		const job = await JobService.getCompletedJob({ workspace, id: jobId })
-		const initial_job = { ...(job as any), type: 'CompletedJob' }
-		const events = [{ t: 0, data: { completed: true, job: initial_job } }]
-		const duration = (initial_job.duration_ms as number) ?? 0
-		return {
-			version: 1,
-			type: 'script' as const,
-			recorded_at: new Date().toISOString(),
-			script_path: it.path,
-			total_duration_ms: duration,
+		// Pin the code to the version the run executed — the picker can select a
+		// run older than the currently deployed script, and publishing current
+		// code with an old run's logs/result would misrepresent both.
+		const job = (await JobService.getJob({ workspace, id: jobId })) as any
+		let s = job.script_hash
+			? await ScriptService.getScriptByHash({ workspace, hash: job.script_hash }).catch(
+					() => undefined
+				)
+			: undefined
+		if (!s) {
+			s = await ScriptService.getScriptByPath({ workspace, path: it.path })
+			sendUserToast(
+				"The run's script version could not be resolved — the recording pairs it with the current code, which may not match what ran.",
+				true
+			)
+		}
+		return await buildScriptRecording(workspace, jobId, {
+			scriptPath: it.path,
 			code: s.content,
 			language: s.language,
-			args: (job.args ?? {}) as Record<string, any>,
-			schema: s.schema,
-			job: { initial_job, events }
-		}
+			schema: s.schema as Record<string, any> | undefined
+		})
 	}
 
 	async #buildFlowRecording(it: DeployItem, jobId: string) {
 		const workspace = this.workspace
-		const f = await FlowService.getFlowByPath({ workspace, path: it.path })
-		const root = (await JobService.getCompletedJob({ workspace, id: jobId })) as any
-		const jobs: Record<string, { initial_job: any; events: any[] }> = {}
-		const collect = async (j: any) => {
-			const stamped = { ...j, type: 'CompletedJob' }
-			jobs[j.id] = {
-				initial_job: stamped,
-				events: [{ t: 0, data: { completed: true, job: stamped } }]
-			}
-			const modules = (j.flow_status?.modules ?? []).filter(
-				(m: any) => m.job && typeof m.job === 'string'
-			)
-			// Sub-jobs at the same level are independent reads.
-			await Promise.all(
-				modules.map(async (m: any) => {
-					try {
-						const sub = (await JobService.getCompletedJob({ workspace, id: m.job })) as any
-						await collect(sub)
-					} catch {
-						/* sub-job missing — skip */
-					}
-				})
+		// Pin the definition (value, schema) to the version the run executed —
+		// the recorded statuses reference its module ids and the recorded args
+		// its input schema, so the current flow may not match. The job's
+		// script_hash is the flow version id.
+		const root = (await JobService.getJob({ workspace, id: jobId })) as any
+		let flow: { value: unknown; schema?: unknown; summary?: string } | undefined
+		if (root.script_hash) {
+			flow = await FlowService.getFlowVersion({
+				workspace,
+				version: parseInt(root.script_hash, 16)
+			}).catch(() => undefined)
+		}
+		if (!flow && root.raw_flow) {
+			// The API materialized the executed value on the job; the input schema
+			// has to come from the current flow, which may have drifted.
+			const f = await FlowService.getFlowByPath({ workspace, path: it.path })
+			flow = { value: root.raw_flow, schema: f.schema, summary: f.summary }
+			sendUserToast(
+				"The run's flow version could not be resolved — the recording uses the executed graph but the current input schema, which may not match the recorded arguments.",
+				true
 			)
 		}
-		await collect(root)
-		return {
-			version: 1,
-			recorded_at: new Date().toISOString(),
-			flow_path: it.path,
-			total_duration_ms: (root.duration_ms as number) ?? 0,
-			flow: {
-				path: it.path,
-				value: f.value,
-				schema: f.schema ?? { type: 'object', properties: {}, required: [] },
-				summary: f.summary ?? '',
-				archived: false,
-				edited_at: '',
-				edited_by: '',
-				extra_perms: {}
+		if (!flow) {
+			const f = await FlowService.getFlowByPath({ workspace, path: it.path })
+			flow = f
+			sendUserToast(
+				"The run's flow version could not be resolved — the recording pairs it with the current definition, which may not match what ran.",
+				true
+			)
+		}
+		return await buildFlowRecording(workspace, jobId, it.path, {
+			value: flow.value as any,
+			schema: (flow.schema as Record<string, unknown> | undefined) ?? {
+				type: 'object',
+				properties: {},
+				required: []
 			},
-			jobs
-		}
+			summary: flow.summary ?? ''
+		})
 	}
 
 	/** Save a recorded raw-app session as that app's Hub recording. */
diff --git a/frontend/src/lib/components/workspaceSettings/projectInstall.ts b/frontend/src/lib/components/workspaceSettings/projectInstall.ts
index 387dc82ade..abc48a3ad6 100644
--- a/frontend/src/lib/components/workspaceSettings/projectInstall.ts
+++ b/frontend/src/lib/components/workspaceSettings/projectInstall.ts
@@ -23,6 +23,7 @@ import { updateRawAppPolicy } from '$lib/sharedUtils'
 import { apiErrorMessage as errorMessage } from '$lib/utils'
 import type { App } from '$lib/components/apps/types'
 import { runScriptAndPollResult } from '$lib/components/jobs/utils'
+import { writingJobOptions } from '$lib/components/jobs/writingJob'
 import {
 	classifyPath,
 	collectExportVarPaths,
@@ -233,14 +234,17 @@ async function applyOneMigration(
 			only: created.timestamp
 		})
 	} else {
-		await runScriptAndPollResult({
-			workspace,
-			requestBody: {
-				language: 'postgresql',
-				content: m.sql,
-				args: { database: `datatable://${m.datatable_name}` }
-			}
-		})
+		await runScriptAndPollResult(
+			{
+				workspace,
+				requestBody: {
+					language: 'postgresql',
+					content: m.sql,
+					args: { database: `datatable://${m.datatable_name}` }
+				}
+			},
+			writingJobOptions
+		)
 	}
 }
 
diff --git a/frontend/src/lib/deployOrigin.ts b/frontend/src/lib/deployOrigin.ts
new file mode 100644
index 0000000000..97c9ba4b47
--- /dev/null
+++ b/frontend/src/lib/deployOrigin.ts
@@ -0,0 +1,34 @@
+import { OpenAPI } from '$lib/gen'
+
+/** Header that tells the fork tally a write was applied to the workspace rather
+ * than authored in it. Mirrors `DEPLOY_ORIGIN_HEADER` in `windmill-common`. */
+const DEPLOY_ORIGIN_HEADER = 'X-Windmill-Deploy-Origin'
+
+let syncDepth = 0
+
+/**
+ * Run `apply` with every request it makes marked as applied by a sync.
+ *
+ * The mark is per-tab, not per-request: a request the user happens to fire while
+ * the apply is in flight is marked too. That only ever makes the tally more
+ * conservative — a sync-origin write is never taken as evidence that this
+ * workspace dropped an item — so the imprecision costs an offer, never data.
+ */
+export async function asSyncDeploy<T>(apply: () => Promise<T>): Promise<T> {
+	syncDepth++
+	try {
+		return await apply()
+	} finally {
+		syncDepth--
+	}
+}
+
+// Registered once for the session; a no-op outside `asSyncDeploy`.
+OpenAPI.interceptors.request.use((options) => {
+	if (syncDepth > 0) {
+		const headers = new Headers(options.headers)
+		headers.set(DEPLOY_ORIGIN_HEADER, 'sync')
+		options.headers = headers
+	}
+	return options
+})
diff --git a/frontend/src/lib/forLater.ts b/frontend/src/lib/forLater.ts
index 281cbe1e92..c4d7a6dee7 100644
--- a/frontend/src/lib/forLater.ts
+++ b/frontend/src/lib/forLater.ts
@@ -1,7 +1,7 @@
 import { get } from 'svelte/store'
 import { dbClockDrift } from './stores'
 import { JobService } from './gen'
-import { getActiveReplay } from './components/recording/flowRecording.svelte'
+import { getActiveReplay } from './components/recording/replay.svelte'
 import pLimit from 'p-limit'
 
 function subtractSeconds(date: Date, seconds: number): Date {
diff --git a/frontend/src/lib/hubPaths.json b/frontend/src/lib/hubPaths.json
index 3a9874596d..1185d0ef93 100644
--- a/frontend/src/lib/hubPaths.json
+++ b/frontend/src/lib/hubPaths.json
@@ -1,6 +1,6 @@
 {
 	"gitSyncTest": "hub/28184/git-repo-test-read-write-windmill",
-	"gitInitRepo": "hub/28808/git-sync-init-repository-windmill",
+	"gitInitRepo": "hub/28890/git-sync-init-repository-windmill",
 	"slackErrorHandler": "hub/28794/workspace-or-schedule-error-handler-slack",
 	"emailErrorHandler": "hub/19795/workspace-or-error-handler-email",
 	"slackRecoveryHandler": "hub/28791/slack/schedule-recovery-handler-slack",
diff --git a/frontend/src/lib/infer.ts b/frontend/src/lib/infer.ts
index 1e0a36af50..a23bb4af0a 100644
--- a/frontend/src/lib/infer.ts
+++ b/frontend/src/lib/infer.ts
@@ -44,6 +44,14 @@ import initYamlParser, {
 	parse_ansible,
 	parse_ansible_delegate
 } from 'windmill-parser-wasm-yaml'
+// `parse_dbt` is newer than the published `windmill-parser-wasm-yaml`, and a
+// NAMED import of an export a package does not have is a link-time failure —
+// which takes this whole module down, and with it every language's inference.
+// Reached through the namespace instead, so a package predating it degrades to
+// "no schema inferred for dbt" (the deployed script's own, derived server-side
+// by `dbt_arg_schema`, is unaffected).
+import * as yamlParser from 'windmill-parser-wasm-yaml'
+const parse_dbt: ((code: string) => string) | undefined = (yamlParser as any).parse_dbt
 import initCSharpParser, { parse_csharp } from 'windmill-parser-wasm-csharp'
 import initNuParser, { parse_nu } from 'windmill-parser-wasm-nu'
 import initJavaParser, { parse_java } from 'windmill-parser-wasm-java'
@@ -521,6 +529,12 @@ export async function inferArgs(
 			} catch {
 				inferedSchema = parseRSignatureFallback(code)
 			}
+		} else if (language == 'dbt') {
+			// Absent on a parser package predating dbt: the editor keeps whatever
+			// schema it has rather than clearing the run form to nothing.
+			if (!parse_dbt) return null
+			await initWasmYaml()
+			inferedSchema = JSON.parse(parse_dbt(code))
 			// for related places search: ADD_NEW_LANG
 		} else {
 			return null
diff --git a/frontend/src/lib/mcpEndpointTools.ts b/frontend/src/lib/mcpEndpointTools.ts
index 70dabb01f6..b6523fcbd4 100644
--- a/frontend/src/lib/mcpEndpointTools.ts
+++ b/frontend/src/lib/mcpEndpointTools.ts
@@ -709,7 +709,7 @@ export const mcpEndpointTools: EndpointTool[] = [
                 },
                 "language": {
                         "type": "string",
-                        "description": "Possible values: python3, deno, go, bash, powershell, postgresql, mysql, bigquery, snowflake, mssql, oracledb, graphql, nativets, bun, php, rust, ansible, csharp, nu, java, ruby, rlang, duckdb, bunnative"
+                        "description": "Possible values: python3, deno, go, bash, powershell, postgresql, mysql, bigquery, snowflake, mssql, oracledb, graphql, nativets, bun, php, rust, ansible, csharp, nu, java, ruby, rlang, duckdb, bunnative, dbt"
                 },
                 "kind": {
                         "type": "string",
@@ -1081,11 +1081,62 @@ export const mcpEndpointTools: EndpointTool[] = [
         queryFieldRenames: undefined,
         bodyFieldRenames: undefined
     },
+    {
+        name: "listApps",
+        description: "list all apps",
+        instructions: "Lists every app, low-code and full-code alike. `raw_app` tells them apart: true is a full-code app, which getAppByPath then reads and updateApp deploys. An app with no `raw_app` field is low-code — the field is omitted rather than sent as false. A low-code app can only be read here — editing one is a job for its editor in the UI.",
+        path: "/w/{workspace}/apps/list",
+        method: "GET",
+        pathParamsSchema: undefined,
+        queryParamsSchema: {
+        "type": "object",
+        "properties": {
+                "page": {
+                        "type": "integer",
+                        "description": "which page to return (start at 1, default 1)"
+                },
+                "per_page": {
+                        "type": "integer",
+                        "description": "number of items to return for a given page (default 30, max 100)"
+                },
+                "path_start": {
+                        "type": "string",
+                        "description": "mask to filter matching starting path"
+                }
+        },
+        "required": []
+},
+        bodySchema: undefined,
+        queryFieldRenames: undefined,
+        bodyFieldRenames: undefined
+    },
+    {
+        name: "getAppByPath",
+        description: "get app by path",
+        instructions: "Returns the app's whole `value`, which is what updateApp needs: it takes the whole thing, not a patch. A big enough app is truncated by the tool-result limit; sending that back fails the build rather than deploying something partial, so edit those in the app editor or with the CLI. `raw_app` says whether this is a full-code app (its value holds `files`/`runnables`) or a low-code one (a `grid`), and only a full-code app can be deployed through MCP.",
+        path: "/w/{workspace}/apps/get/p/{path}",
+        method: "GET",
+        pathParamsSchema: {
+        "type": "object",
+        "properties": {
+                "path": {
+                        "type": "string"
+                }
+        },
+        "required": [
+                "path"
+        ]
+},
+        queryParamsSchema: undefined,
+        bodySchema: undefined,
+        queryFieldRenames: undefined,
+        bodyFieldRenames: undefined
+    },
     {
         name: "createApp",
-        description: "create app",
-        instructions: "",
-        path: "/w/{workspace}/apps/create",
+        description: "create a raw app from its sources, compiling them on a worker (which runs the app's own dependencies to do so)",
+        instructions: "Creates a raw (full-code) app: `value.files` holds its sources, keyed by path (`/index.tsx`, `/App.tsx`, `/package.json`), and needs an entry point (`/index.tsx`, `/index.ts` or `/index.js`). The sources are compiled on a worker by the same build the editor and the CLI run, so a compile error comes back as the error of this call. Compiling runs the app's own dependencies on a worker, so this tool can execute code there. Low-code apps are legacy and have no MCP tool at all — they are built in their editor.",
+        path: "/w/{workspace}/apps/create_raw_source",
         method: "POST",
         pathParamsSchema: undefined,
         queryParamsSchema: undefined,
@@ -1095,17 +1146,87 @@ export const mcpEndpointTools: EndpointTool[] = [
                 "path": {
                         "type": "string"
                 },
-                "value": {
-                        "type": "object"
-                },
                 "summary": {
                         "type": "string"
                 },
-                "policy": {
-                        "type": "object"
+                "value": {
+                        "type": "object",
+                        "description": "The raw app's value. `files` maps each source path to its content and must contain an entry point; `runnables` and `data` are carried through unchanged.",
+                        "properties": {
+                                "files": {
+                                        "type": "object",
+                                        "additionalProperties": {
+                                                "type": "string"
+                                        }
+                                },
+                                "runnables": {
+                                        "type": "object"
+                                },
+                                "data": {
+                                        "type": "object"
+                                }
+                        },
+                        "required": [
+                                "files"
+                        ]
                 },
-                "deployment_message": {
-                        "type": "string"
+                "policy": {
+                        "type": "object",
+                        "properties": {
+                                "triggerables": {
+                                        "type": "object",
+                                        "additionalProperties": {
+                                                "type": "object"
+                                        }
+                                },
+                                "triggerables_v2": {
+                                        "type": "object",
+                                        "additionalProperties": {
+                                                "type": "object"
+                                        }
+                                },
+                                "s3_inputs": {
+                                        "type": "array",
+                                        "items": {
+                                                "type": "object"
+                                        }
+                                },
+                                "allowed_s3_keys": {
+                                        "type": "array",
+                                        "items": {
+                                                "type": "object",
+                                                "properties": {
+                                                        "s3_path": {
+                                                                "type": "string"
+                                                        },
+                                                        "resource": {
+                                                                "type": "string"
+                                                        }
+                                                }
+                                        }
+                                },
+                                "execution_mode": {
+                                        "type": "string",
+                                        "description": "Possible values: viewer, publisher, anonymous"
+                                },
+                                "on_behalf_of": {
+                                        "type": "string"
+                                },
+                                "on_behalf_of_email": {
+                                        "type": "string"
+                                },
+                                "sandbox": {
+                                        "type": "boolean",
+                                        "description": "Publisher opt-in to app sandbox isolation (alpha). When true the app is isolated from each viewer's Windmill session. When false/absent the app runs same-origin with the viewer's full session (the default, pre-isolation behavior).\n"
+                                },
+                                "frontend_sdk_scopes": {
+                                        "type": "array",
+                                        "items": {
+                                                "type": "string"
+                                        },
+                                        "description": "Raw apps: author-declared scopes for the frontend SDK token. Takes effect only when `sandbox` is also true \u2014 an unsandboxed bundle runs with the viewer's own session, so no token is advertised or minted for it and this list stays inert. On a sandboxed app a non-empty list lets viewers mint (after consenting) a short-lived token carrying their own identity restricted to these scopes, handed to the app bundle so `windmill-client` calls run as the viewer. Must be a subset of the server's curated allowlist (jobs:run, jobs:read, users:read, resources:read, variables:read).\n"
+                                }
+                        }
                 }
         },
         "required": [
@@ -1120,9 +1241,9 @@ export const mcpEndpointTools: EndpointTool[] = [
     },
     {
         name: "updateApp",
-        description: "update app",
-        instructions: "",
-        path: "/w/{workspace}/apps/update/{path}",
+        description: "update a raw app from its sources, compiling them on a worker (which runs the app's own dependencies to do so)",
+        instructions: "Use this to change a raw (full-code) app — an app whose `raw_app` field is true. Send the whole `value` (`files`, `runnables`, `data`), not a patch: read the current one with getAppByPath first and edit it. The sources are compiled on a worker by the same build the editor and the CLI run, so a compile error comes back as the error of this call. Compiling runs the app's own dependencies on a worker, so this tool can execute code there. Low-code apps are legacy and have no MCP tool at all — they are edited in their editor.",
+        path: "/w/{workspace}/apps/update_raw_source/{path}",
         method: "POST",
         pathParamsSchema: {
         "type": "object",
@@ -1143,19 +1264,92 @@ export const mcpEndpointTools: EndpointTool[] = [
                         "type": "string"
                 },
                 "value": {
-                        "type": "object"
+                        "type": "object",
+                        "description": "The raw app's value. `files` maps each source path (e.g. `/index.tsx`, `/App.tsx`, `/package.json`) to its content and must contain an entry point (`/index.tsx`, `/index.ts` or `/index.js`); `runnables` and `data` are carried through unchanged.",
+                        "properties": {
+                                "files": {
+                                        "type": "object",
+                                        "additionalProperties": {
+                                                "type": "string"
+                                        }
+                                },
+                                "runnables": {
+                                        "type": "object"
+                                },
+                                "data": {
+                                        "type": "object"
+                                }
+                        },
+                        "required": [
+                                "files"
+                        ]
                 },
                 "policy": {
-                        "type": "object"
-                },
-                "deployment_message": {
-                        "type": "string"
+                        "type": "object",
+                        "properties": {
+                                "triggerables": {
+                                        "type": "object",
+                                        "additionalProperties": {
+                                                "type": "object"
+                                        }
+                                },
+                                "triggerables_v2": {
+                                        "type": "object",
+                                        "additionalProperties": {
+                                                "type": "object"
+                                        }
+                                },
+                                "s3_inputs": {
+                                        "type": "array",
+                                        "items": {
+                                                "type": "object"
+                                        }
+                                },
+                                "allowed_s3_keys": {
+                                        "type": "array",
+                                        "items": {
+                                                "type": "object",
+                                                "properties": {
+                                                        "s3_path": {
+                                                                "type": "string"
+                                                        },
+                                                        "resource": {
+                                                                "type": "string"
+                                                        }
+                                                }
+                                        }
+                                },
+                                "execution_mode": {
+                                        "type": "string",
+                                        "description": "Possible values: viewer, publisher, anonymous"
+                                },
+                                "on_behalf_of": {
+                                        "type": "string"
+                                },
+                                "on_behalf_of_email": {
+                                        "type": "string"
+                                },
+                                "sandbox": {
+                                        "type": "boolean",
+                                        "description": "Publisher opt-in to app sandbox isolation (alpha). When true the app is isolated from each viewer's Windmill session. When false/absent the app runs same-origin with the viewer's full session (the default, pre-isolation behavior).\n"
+                                },
+                                "frontend_sdk_scopes": {
+                                        "type": "array",
+                                        "items": {
+                                                "type": "string"
+                                        },
+                                        "description": "Raw apps: author-declared scopes for the frontend SDK token. Takes effect only when `sandbox` is also true \u2014 an unsandboxed bundle runs with the viewer's own session, so no token is advertised or minted for it and this list stays inert. On a sandboxed app a non-empty list lets viewers mint (after consenting) a short-lived token carrying their own identity restricted to these scopes, handed to the app bundle so `windmill-client` calls run as the viewer. Must be a subset of the server's curated allowlist (jobs:run, jobs:read, users:read, resources:read, variables:read).\n"
+                                }
+                        }
                 },
                 "path__body": {
                         "type": "string",
                         "description": "(body parameter). Defaults to `path` when omitted; set it only to change the path."
                 }
-        }
+        },
+        "required": [
+                "value"
+        ]
 },
         queryFieldRenames: undefined,
         bodyFieldRenames: {
@@ -1218,7 +1412,7 @@ export const mcpEndpointTools: EndpointTool[] = [
                 },
                 "language": {
                         "type": "string",
-                        "description": "Possible values: python3, deno, go, bash, powershell, postgresql, mysql, bigquery, snowflake, mssql, oracledb, graphql, nativets, bun, php, rust, ansible, csharp, nu, java, ruby, rlang, duckdb, bunnative"
+                        "description": "Possible values: python3, deno, go, bash, powershell, postgresql, mysql, bigquery, snowflake, mssql, oracledb, graphql, nativets, bun, php, rust, ansible, csharp, nu, java, ruby, rlang, duckdb, bunnative, dbt"
                 },
                 "tag": {
                         "type": "string"
@@ -1250,7 +1444,7 @@ export const mcpEndpointTools: EndpointTool[] = [
                                         },
                                         "language": {
                                                 "type": "string",
-                                                "description": "Possible values: python3, deno, go, bash, powershell, postgresql, mysql, bigquery, snowflake, mssql, oracledb, graphql, nativets, bun, php, rust, ansible, csharp, nu, java, ruby, rlang, duckdb, bunnative"
+                                                "description": "Possible values: python3, deno, go, bash, powershell, postgresql, mysql, bigquery, snowflake, mssql, oracledb, graphql, nativets, bun, php, rust, ansible, csharp, nu, java, ruby, rlang, duckdb, bunnative, dbt"
                                         },
                                         "lock": {
                                                 "type": "string",
@@ -1529,6 +1723,10 @@ export const mcpEndpointTools: EndpointTool[] = [
                         "type": "boolean",
                         "description": "is the job skipped"
                 },
+                "resolved": {
+                        "type": "boolean",
+                        "description": "filter on whether a failure has been marked as handled. true keeps only resolved failures, false hides them"
+                },
                 "is_flow_step": {
                         "type": "boolean",
                         "description": "is the job a flow step"
diff --git a/frontend/src/lib/nonMemberWorkspaces.test.ts b/frontend/src/lib/nonMemberWorkspaces.test.ts
new file mode 100644
index 0000000000..027efbf850
--- /dev/null
+++ b/frontend/src/lib/nonMemberWorkspaces.test.ts
@@ -0,0 +1,70 @@
+import { describe, expect, it, beforeEach } from 'vitest'
+import { get } from 'svelte/store'
+import {
+	clearNonMemberWorkspaces,
+	nonMemberWorkspaces,
+	setNonMemberWorkspaces,
+	superadmin,
+	userWorkspaces,
+	usersWorkspaceStore
+} from './stores'
+import type { Workspace } from './gen'
+
+function workspace(id: string, extra: Partial<Workspace> = {}): Workspace {
+	return { id, name: id, owner: 'admin@windmill.dev', ...extra } as Workspace
+}
+
+beforeEach(() => {
+	usersWorkspaceStore.set(undefined)
+	superadmin.set(undefined)
+	nonMemberWorkspaces.set(undefined)
+})
+
+describe('nonMemberWorkspaces', () => {
+	it('merges the resolved workspaces into userWorkspaces with their fork lineage', () => {
+		setNonMemberWorkspaces('dev', [
+			workspace('dev', { parent_workspace_id: 'prod', is_dev_workspace: true }),
+			workspace('prod')
+		])
+		expect(get(userWorkspaces)).toMatchObject([
+			{ id: 'dev', parent_workspace_id: 'prod', is_dev_workspace: true },
+			{ id: 'prod' }
+		])
+	})
+
+	it('never offers an archived workspace, and still marks it resolved', () => {
+		setNonMemberWorkspaces('archived-fork', [workspace('archived-fork', { deleted: true })])
+		expect(get(userWorkspaces)).toEqual([])
+		// Without this the layout re-fetches the archived workspace on every effect pass.
+		expect(get(nonMemberWorkspaces)?.forWorkspace).toBe('archived-fork')
+	})
+
+	it('replaces the previous workspace set rather than accumulating across switches', () => {
+		setNonMemberWorkspaces('fork-a', [workspace('fork-a')])
+		setNonMemberWorkspaces('fork-b', [workspace('fork-b')])
+		expect(get(userWorkspaces).map((w) => w.id)).toEqual(['fork-b'])
+	})
+
+	it('does not duplicate a workspace the user is a member of', () => {
+		usersWorkspaceStore.set({
+			email: 'admin@windmill.dev',
+			workspaces: [{ id: 'dev', name: 'dev', username: 'admin', color: '', disabled: false }]
+		} as any)
+		setNonMemberWorkspaces('dev', [workspace('dev')])
+		expect(get(userWorkspaces).map((w) => w.id)).toEqual(['dev'])
+	})
+
+	// The layout effect that fills this store also reads it, and its member path — every
+	// ordinary user, every pass — clears it. So the empty state must be one Svelte won't
+	// re-notify for: an object value always notifies, however equal, and the effect would
+	// then invalidate itself forever.
+	it('does not notify when clearing an already empty store', () => {
+		let notifications = 0
+		const unsubscribe = userWorkspaces.subscribe(() => notifications++)
+		notifications = 0
+		clearNonMemberWorkspaces()
+		clearNonMemberWorkspaces()
+		expect(notifications).toBe(0)
+		unsubscribe()
+	})
+})
diff --git a/frontend/src/lib/pipelinePaths.ts b/frontend/src/lib/pipelinePaths.ts
new file mode 100644
index 0000000000..534e691479
--- /dev/null
+++ b/frontend/src/lib/pipelinePaths.ts
@@ -0,0 +1,17 @@
+// A folder's data-pipeline drafts all live in ONE bundle stored at
+// `f/<folder>/data_pipeline`, while the editor for it is the folder's pipeline
+// view. Every surface that routes between the two — the drafts compare page,
+// the home list, the session preview panel — needs that layout, so it is stated
+// here once rather than re-parsed per call site.
+export const PIPELINE_DRAFT_KIND = 'data_pipeline' as const
+
+export function pipelineBundlePath(folder: string): string {
+	return `f/${folder}/${PIPELINE_DRAFT_KIND}`
+}
+
+const BUNDLE_PATH_RE = new RegExp(`^f/([^/]+)/${PIPELINE_DRAFT_KIND}$`)
+
+/** The folder a pipeline bundle belongs to, or `undefined` if the path isn't one. */
+export function pipelineFolderFromBundlePath(path: string): string | undefined {
+	return path.match(BUNDLE_PATH_RE)?.[1]
+}
diff --git a/frontend/src/lib/rawAppDeploy.ts b/frontend/src/lib/rawAppDeploy.ts
index b13951c5f8..2a9bea2973 100644
--- a/frontend/src/lib/rawAppDeploy.ts
+++ b/frontend/src/lib/rawAppDeploy.ts
@@ -1,7 +1,8 @@
 /**
- * Deploy a raw app (code-based app) from its server-side draft. Raw apps can't
- * be deployed through the normal AppService.updateApp/createApp path: their
- * source `files` must be bundled to js/css and saved via the raw-app endpoints.
+ * Deploy a raw app (code-based app), from its server-side draft or from an
+ * explicit value. Raw apps can't be deployed through the normal
+ * AppService.updateApp/createApp path: their source `files` must be bundled to
+ * js/css and saved via the raw-app endpoints.
  *
  * This mirrors how the global AI chat deploys raw apps
  * (`copilot/chat/global/core.ts` → deployDraft, case 'app'): read the item with
@@ -17,7 +18,73 @@ import { bundleRawAppDraft } from '$lib/components/copilot/chat/global/rawAppBun
 import type { AppDraftValue } from '$lib/components/copilot/chat/global/workspaceItems'
 import { updateRawAppPolicy } from '$lib/components/raw_apps/rawAppPolicy'
 import { DEFAULT_DATA as DEFAULT_RAW_APP_DATA } from '$lib/components/raw_apps/dataTableRefUtils'
-import { appSourceToDraftValue } from '$lib/components/raw_apps/rawAppDraftValue'
+import {
+	appSourceToDraftValue,
+	normalizeRawAppData
+} from '$lib/components/raw_apps/rawAppDraftValue'
+import { stateSnapshot } from '$lib/svelte5Utils.svelte'
+
+/**
+ * Deploy an explicit raw-app value — one the user edited as JSON, or one
+ * restored from a previous version — onto a deployed app.
+ */
+export async function deployRawAppValue({
+	workspace,
+	path,
+	value,
+	summary,
+	policy: currentPolicy,
+	customPath,
+	deploymentMessage,
+	allowKindChange
+}: {
+	workspace: string
+	path: string
+	value: any
+	summary?: string
+	policy?: Policy
+	customPath?: string | null
+	deploymentMessage?: string
+	/** Let this deploy turn a low-code app into a raw one. Off for every ordinary
+	 * deploy — see the backend's `allow_kind_change`. */
+	allowKindChange?: boolean
+}): Promise<void> {
+	// The value often comes straight out of a `$state` field, and the bundler
+	// runs in an iframe: postMessage refuses to clone a state proxy.
+	const plainValue = (stateSnapshot(value) ?? {}) as Record<string, any>
+	const files = (plainValue.files ?? {}) as Record<string, string>
+	const runnables = plainValue.runnables ?? {}
+	// The value carries the runnables, so the policy's triggerables have to be
+	// recomputed from it or the deployed app can't call what it now contains.
+	const policy = (await updateRawAppPolicy(runnables, currentPolicy)) as Policy
+	if (!policy.execution_mode) {
+		policy.execution_mode = 'publisher'
+	}
+
+	const bundle = await bundleRawAppDraft({ workspace, files })
+
+	const isAdmin = !!(get(userStore)?.is_admin || get(userStore)?.is_super_admin)
+	await AppService.updateAppRaw({
+		workspace,
+		path,
+		formData: {
+			app: {
+				// Through `normalizeRawAppData`, like every other deploy path: an old
+				// version can still carry the pre-`data` datatable shapes.
+				value: { files, runnables, data: normalizeRawAppData(plainValue) },
+				summary: summary ?? '',
+				policy,
+				deployment_message: deploymentMessage,
+				// custom_path changes require admin (see deployRawAppDraft).
+				custom_path: isAdmin ? (customPath ?? '') : undefined,
+				preserve_on_behalf_of: policy.on_behalf_of ? true : undefined,
+				allow_kind_change: allowKindChange || undefined
+			},
+			js: bundle.js,
+			css: bundle.css
+		}
+	})
+}
 
 /**
  * Promote a raw app's draft to deployed. Throws on failure (caller wraps into a
diff --git a/frontend/src/lib/script_helpers.ts b/frontend/src/lib/script_helpers.ts
index 91e310f5c9..178f4474e7 100644
--- a/frontend/src/lib/script_helpers.ts
+++ b/frontend/src/lib/script_helpers.ts
@@ -1345,6 +1345,43 @@ main <- function(
     return(toJSON(result, auto_unbox = TRUE))
 }
 `
+
+// A dbt script is a whole dbt project: the descriptor below is the script's
+// content, and the project's own files live in its module bundle (the
+// `<script>__dbt/` folder the CLI syncs). Field names track dbt's vocabulary.
+const DBT_INIT_CODE = `# dbt-core-1x (default) | dbt-core-2x | fusion
+engine: dbt-core-1x
+profile:
+  # A warehouse configured on this workspace (Settings -> dbt), by name. Omitted
+  # takes 'main'. The NAME is also the warehouse's identity in the asset graph:
+  # every model becomes dbt://<warehouse>/<schema>/<name>, which is what gives
+  # this project its lineage, and lets a native script reading one of those
+  # tables share the node. A dbt run does not trigger such a script.
+  # warehouse: main
+  # target: prod
+  # Alternatively, keep the project's own file. It runs unchanged, but names a
+  # warehouse only to say where its assets belong:
+  # profiles_yml: profiles.yml
+# Passed to dbt verbatim — this is dbt's selector grammar, not Windmill's
+select: []
+exclude: []
+# build (models and tests interleaved) | after_all | none
+test_behavior: build
+vars: {}
+threads: 4
+full_refresh: false
+# Rebuild the nodes a failed build left failed or skipped, in this same job,
+# before reporting failure. dbt confines a failure to its own subtree, so a
+# transient warehouse error costs those nodes rather than the whole project.
+# Not available on agent workers, whose wait could not observe a cancellation.
+# retry_failed_nodes:
+#   attempts: 2
+#   delay_seconds: 30
+# Extra env for the project's own {{ env_var() }} lookups. A $var: value is
+# resolved to that Windmill variable, so secrets stay out of this file.
+# env:
+#   DBT_PASSWORD: $var:u/user/my_warehouse_password
+`
 // for related places search: ADD_NEW_LANG
 export const INITIAL_CODE = {
 	bun: {
@@ -1443,6 +1480,9 @@ export const INITIAL_CODE = {
 	rlang: {
 		script: R_INIT_CODE
 	},
+	dbt: {
+		script: DBT_INIT_CODE
+	},
 	claudesandbox: {
 		script: CLAUDE_SANDBOX_INIT_CODE
 	},
@@ -1610,6 +1650,8 @@ export function initialCode(
 		return INITIAL_CODE.ruby.script
 	} else if (language == 'rlang') {
 		return INITIAL_CODE.rlang.script
+	} else if (language == 'dbt') {
+		return INITIAL_CODE.dbt.script
 		// for related places search: ADD_NEW_LANG
 	} else if (language == 'bun' || language == 'bunnative') {
 		if (subkind === 'claudesandbox') {
diff --git a/frontend/src/lib/scripts.ts b/frontend/src/lib/scripts.ts
index facb4fa3f0..a86ebea43f 100644
--- a/frontend/src/lib/scripts.ts
+++ b/frontend/src/lib/scripts.ts
@@ -63,6 +63,10 @@ export function scriptLangToEditorLang(
 		return 'java'
 	} else if (lang == 'rlang') {
 		return 'r'
+	} else if (lang == 'dbt') {
+		// the script content is the YAML descriptor; the project's own files ride
+		// with it as its module bundle
+		return 'yaml'
 		// for related places search: ADD_NEW_LANG
 	} else if (lang == undefined) {
 		return 'typescript'
@@ -170,9 +174,26 @@ const scriptLanguagesArray: [SupportedLanguage | 'docker' | 'bunnative', string]
 	['java', 'Java'],
 	['duckdb', 'DuckDB'],
 	['ruby', 'Ruby'],
-	['rlang', 'R']
+	['rlang', 'R'],
+	['dbt', 'dbt']
 	// for related places search: ADD_NEW_LANG
 ]
+/**
+ * Languages a MODULE-LESS script cannot be written in.
+ *
+ * A dbt script IS its module bundle — `dbt_project.yml` and the models — and a
+ * flow step's or an app's inline script is a raw body with nowhere to carry
+ * one, so choosing it there produces a job that fails when the worker looks for
+ * the project. A flow reaches dbt the same way it reaches any other script: by
+ * path, to a deployed one.
+ */
+const LANGS_NEEDING_MODULES = ['dbt']
+
+/** `processLangs` for a surface whose scripts have no module bundle. */
+export function processInlineLangs(selected: string | undefined, langs: string[]): string[] {
+	return processLangs(selected, langs).filter((l) => !LANGS_NEEDING_MODULES.includes(l))
+}
+
 export function processLangs(selected: string | undefined, langs: string[]): string[] {
 	if (selected === 'nativets') {
 		return langs
@@ -180,7 +201,18 @@ export function processLangs(selected: string | undefined, langs: string[]): str
 		let ls = langs.filter((lang) => lang !== 'nativets')
 
 		//those languages are newer and may not be in the saved list
-		let nl = ['bunnative', 'rust', 'ansible', 'csharp', 'nu', 'java', 'duckdb', 'ruby', 'rlang']
+		let nl = [
+			'bunnative',
+			'rust',
+			'ansible',
+			'csharp',
+			'nu',
+			'java',
+			'duckdb',
+			'ruby',
+			'rlang',
+			'dbt'
+		]
 		// for related places search: ADD_NEW_LANG
 		nl.forEach((lang) => {
 			if (!ls.includes(lang)) {
diff --git a/frontend/src/lib/storeUtils.ts b/frontend/src/lib/storeUtils.ts
index 93680b24eb..f86861eae9 100644
--- a/frontend/src/lib/storeUtils.ts
+++ b/frontend/src/lib/storeUtils.ts
@@ -4,6 +4,7 @@ import {
 	workspaceStore,
 	userStore,
 	usersWorkspaceStore,
+	nonMemberWorkspaces,
 	superadmin,
 	devopsRole,
 	clearWorkspaceFromStorage
@@ -36,6 +37,7 @@ export function clearStores(): void {
 	userStore.set(undefined)
 	workspaceStore.set(undefined)
 	usersWorkspaceStore.set(undefined)
+	nonMemberWorkspaces.set(undefined)
 	refreshSuperadmin.cancel()
 	superadmin.set(undefined)
 	devopsRole.set(undefined)
diff --git a/frontend/src/lib/stores.ts b/frontend/src/lib/stores.ts
index 72526a3819..0058cc8dd0 100644
--- a/frontend/src/lib/stores.ts
+++ b/frontend/src/lib/stores.ts
@@ -1,5 +1,5 @@
 import { BROWSER } from 'esm-env'
-import { derived, type Readable, writable } from 'svelte/store'
+import { derived, get, type Readable, writable } from 'svelte/store'
 
 import type { IntrospectionQuery } from 'graphql'
 import {
@@ -17,6 +17,11 @@ import { DEFAULT_HUB_BASE_URL } from './hub'
 import type { DbManagerUriState } from './components/dbManagerDrawerModel.svelte'
 
 export interface UserExt {
+	// Workspace this membership was fetched for. `$workspaceStore` flips
+	// synchronously on a switch while the new `whoami` is still in flight, so a
+	// consumer whose behavior depends on the role must compare this against the
+	// active workspace rather than read a role that still describes the previous one.
+	workspace_id: string
 	email: string
 	name?: string
 	username: string
@@ -93,25 +98,70 @@ export const lspTokenStore = writable<string | undefined>(undefined)
 export const hubBaseUrlStore = writable<string>(DEFAULT_HUB_BASE_URL)
 export const wsBaseUrlStore = writable<string | undefined>(undefined)
 export const disableHubStore = writable<boolean>(false)
+// What a superadmin standing in a workspace they are not a member of needs to see it as a
+// fork: the workspace itself and its parent. `listUserWorkspaces` is membership-gated, so
+// `$userWorkspaces` would miss them and every fork lookup would read the workspace as a
+// parentless root. Owned by exactly one workspace (`forWorkspace`) — held past a switch,
+// these would go on presenting themselves as memberships (picker, workspace-family lookups).
+export const nonMemberWorkspaces = writable<
+	{ forWorkspace: string; workspaces: UserWorkspace[] } | undefined
+>(undefined)
+
+/**
+ * Records what was resolved for `forWorkspace`, dropping archived workspaces —
+ * `userWorkspaces` must never offer one. An archived workspace therefore resolves to an
+ * empty set, which still marks it as resolved and stops it being fetched again.
+ */
+export function setNonMemberWorkspaces(forWorkspace: string, workspaces: Workspace[]): void {
+	nonMemberWorkspaces.set({
+		forWorkspace,
+		workspaces: workspaces
+			.filter((w) => !w.deleted)
+			.map((w) => ({
+				id: w.id,
+				name: w.name,
+				// No `usr` row here, hence no per-workspace username — same stand-in as the
+				// synthetic `admins` entry below.
+				username: 'superadmin',
+				color: w.color,
+				parent_workspace_id: w.parent_workspace_id,
+				is_dev_workspace: w.is_dev_workspace,
+				dev_workspace_label: w.dev_workspace_label,
+				disabled: false
+			}))
+	})
+}
+
+export function clearNonMemberWorkspaces(): void {
+	// A Svelte store notifies on every write of an object value, so clearing an already
+	// empty store is not free: the layout effect that fills this one also reads it, and
+	// would re-run itself forever.
+	if (get(nonMemberWorkspaces) != undefined) {
+		nonMemberWorkspaces.set(undefined)
+	}
+}
+
 export const userWorkspaces: Readable<Array<UserWorkspace>> = derived(
-	[usersWorkspaceStore, superadmin],
-	([store, superadmin]) => {
+	[usersWorkspaceStore, superadmin, nonMemberWorkspaces],
+	([store, superadmin, nonMember]) => {
 		const originalWorkspaces = store?.workspaces ?? []
-		if (superadmin) {
-			return [
-				...originalWorkspaces.filter((x) => x.id != 'admins'),
-				{
-					id: 'admins',
-					name: 'Admins',
-					username: 'superadmin',
-					color: undefined,
-					operator_settings: undefined,
-					disabled: false
-				}
-			]
-		} else {
-			return originalWorkspaces
-		}
+		const workspaces = superadmin
+			? [
+					...originalWorkspaces.filter((x) => x.id != 'admins'),
+					{
+						id: 'admins',
+						name: 'Admins',
+						username: 'superadmin',
+						color: undefined,
+						operator_settings: undefined,
+						disabled: false
+					}
+				]
+			: originalWorkspaces
+		const extra = (nonMember?.workspaces ?? []).filter(
+			(w) => !workspaces.some((x) => x.id === w.id)
+		)
+		return extra.length > 0 ? [...workspaces, ...extra] : workspaces
 	}
 )
 
diff --git a/frontend/src/lib/transitions.ts b/frontend/src/lib/transitions.ts
new file mode 100644
index 0000000000..d1d5812951
--- /dev/null
+++ b/frontend/src/lib/transitions.ts
@@ -0,0 +1,44 @@
+import { cubicOut } from 'svelte/easing'
+import type { EasingFunction, TransitionConfig } from 'svelte/transition'
+
+/** `slide`, but re-measuring the content on every frame.
+ *
+ *  `slide` snapshots the height once when the transition starts, so content that settles
+ *  after mount (a Monaco editor sizing itself to its lines) animates towards a stale
+ *  target and snaps to its real height at the end. */
+export function slideDynamic(
+	node: HTMLElement,
+	{
+		delay = 0,
+		duration = 150,
+		easing = cubicOut
+	}: { delay?: number; duration?: number; easing?: EasingFunction } = {}
+): TransitionConfig {
+	const style = getComputedStyle(node)
+	const paddingTop = parseFloat(style.paddingTop)
+	const paddingBottom = parseFloat(style.paddingBottom)
+	const initial = {
+		overflow: node.style.overflow,
+		height: node.style.height,
+		paddingTop: node.style.paddingTop,
+		paddingBottom: node.style.paddingBottom
+	}
+	return {
+		delay,
+		duration,
+		easing,
+		tick: (t: number) => {
+			if (t === 1) {
+				Object.assign(node.style, initial)
+				return
+			}
+			node.style.overflow = 'hidden'
+			// Padding shrinks with the box, or `border-box` would floor the height at it.
+			node.style.paddingTop = `${t * paddingTop}px`
+			node.style.paddingBottom = `${t * paddingBottom}px`
+			// scrollHeight ignores the height clamp but does count the padding just written.
+			const content = node.scrollHeight - t * (paddingTop + paddingBottom)
+			node.style.height = `${t * (content + paddingTop + paddingBottom)}px`
+		}
+	}
+}
diff --git a/frontend/src/lib/user.ts b/frontend/src/lib/user.ts
index aaca893636..cbeb0ccccf 100644
--- a/frontend/src/lib/user.ts
+++ b/frontend/src/lib/user.ts
@@ -4,15 +4,16 @@ import type { UserExt } from './stores.js'
 export async function getUserExt(workspace: string): Promise<UserExt | undefined> {
 	try {
 		const user = await UserService.whoami({ workspace })
-		return mapUserToUserExt(user)
+		return mapUserToUserExt(user, workspace)
 	} catch (error) {
 		return undefined
 	}
 }
 
-function mapUserToUserExt(user: User): UserExt {
+function mapUserToUserExt(user: User, workspace: string): UserExt {
 	const ext: UserExt = {
 		...user,
+		workspace_id: workspace,
 		groups: user.groups!,
 		pgroups: user.groups!.map((x) => `g/${x}`)
 	}
diff --git a/frontend/src/lib/userScopedDb.test.ts b/frontend/src/lib/userScopedDb.test.ts
index f97ec7cc09..2abb2c09d9 100644
--- a/frontend/src/lib/userScopedDb.test.ts
+++ b/frontend/src/lib/userScopedDb.test.ts
@@ -57,6 +57,114 @@ describe('userScopedDb', () => {
 		expect((await dbA2!.getAll('items')).map((x) => x.id)).toEqual(['i1'])
 	})
 
+	it('yields its connection so another tab can upgrade the schema', async () => {
+		userStore.set(asUser('a@x.com'))
+		const held = userScopedDb<TestSchema>('t', { version: 1, upgrade })
+		expect(await held.whenReady()).toBeDefined()
+
+		// Second tab, higher version. Without the blocking handler the open never settles
+		// and this await hangs rather than failing.
+		const upgrading = userScopedDb<TestSchema>('t', { version: 2, upgrade })
+		expect((await upgrading.whenReady())?.version).toBe(2)
+
+		// The tab that yielded is still on the old schema, so its reopen cannot succeed —
+		// it degrades to in-memory like any failed open, rather than hanging or throwing.
+		expect(await held.whenReady()).toBeUndefined()
+	})
+
+	it('gives up on an upgrade an uncooperative connection is blocking', async () => {
+		userStore.set(asUser('a@x.com'))
+		// A tab running a build older than the blocking handler: it holds v1 open and never
+		// hears versionchange, so nothing this side can do will make it let go.
+		const legacy = await openDB<TestSchema>('t::a@x.com', 1, { upgrade })
+		const dbh = userScopedDb<TestSchema>('t', { version: 2, upgrade, openGraceMs: 20 })
+
+		// Bounded, so callers degrade to in-memory instead of awaiting it forever.
+		expect(await dbh.whenReady()).toBeUndefined()
+
+		// Every later call gives up too, rather than reopening behind the parked request.
+		expect(await dbh.whenReady()).toBeUndefined()
+		expect(await dbh.whenReady()).toBeUndefined()
+
+		// Giving up is not permanent: once the blocker goes, the next call gets the DB.
+		legacy.close()
+		await vi.waitFor(async () => expect((await dbh.whenReady())?.version).toBe(2))
+	})
+
+	it('gives up on an open that is queued behind another and so hears nothing', async () => {
+		userStore.set(asUser('a@x.com'))
+		// What a second upgrading opener sees while a first one sits blocked: the browser
+		// processes a database's opens in order, so this request waits its turn without
+		// reaching `blocked` — or any other callback — of its own.
+		let arrive!: (db: IDBPDatabase<TestSchema>) => void
+		const queuedOpen = (() =>
+			new Promise((resolve) => (arrive = resolve as never))) as unknown as typeof openDB
+
+		const dbh = userScopedDb<TestSchema>('t', {
+			version: 2,
+			upgrade,
+			openGraceMs: 20,
+			openDB: queuedOpen
+		})
+
+		expect(await dbh.whenReady()).toBeUndefined()
+
+		// Giving up did not cancel it — nothing can. When its turn comes it is adopted.
+		const real = await openDB<TestSchema>('t::a@x.com', 2, { upgrade })
+		arrive(real)
+		await vi.waitFor(async () => expect(await dbh.whenReady()).toBe(real))
+		real.close()
+	})
+
+	it('keeps degrading, not hanging, across a user switch away and back', async () => {
+		userStore.set(asUser('a@x.com'))
+		const legacy = await openDB<TestSchema>('t::a@x.com', 1, { upgrade })
+		const dbh = userScopedDb<TestSchema>('t', { version: 2, upgrade, openGraceMs: 20 })
+		expect(await dbh.whenReady()).toBeUndefined()
+
+		// B is a different physical database, so it opens normally.
+		userStore.set(asUser('b@y.com'))
+		expect(await dbh.whenReady()).toBeDefined()
+
+		// Back to A, whose open is still parked: reopening here would hang, not degrade.
+		userStore.set(asUser('a@x.com'))
+		expect(await dbh.whenReady()).toBeUndefined()
+
+		legacy.close()
+		await vi.waitFor(async () => expect((await dbh.whenReady())?.version).toBe(2))
+	})
+
+	it('issues one open per database however often callers give up on it', async () => {
+		userStore.set(asUser('a@x.com'))
+		const legacy = await openDB<TestSchema>('t::a@x.com', 1, { upgrade })
+		const opens: string[] = []
+		const countingOpen = ((name: string, version: number, cbs: unknown) => {
+			opens.push(name)
+			return openDB(name as never, version, cbs as never)
+		}) as unknown as typeof openDB
+
+		const dbh = userScopedDb<TestSchema>('t', {
+			version: 2,
+			upgrade,
+			openGraceMs: 20,
+			openDB: countingOpen
+		})
+
+		// Give up, drop the handle, switch away and back — every path that used to start over.
+		expect(await dbh.whenReady()).toBeUndefined()
+		expect(await dbh.whenReady()).toBeUndefined()
+		dbh.close()
+		expect(await dbh.whenReady()).toBeUndefined()
+		userStore.set(asUser('b@y.com'))
+		await dbh.whenReady()
+		userStore.set(asUser('a@x.com'))
+		expect(await dbh.whenReady()).toBeUndefined()
+
+		expect(opens.filter((n) => n === 't::a@x.com')).toHaveLength(1)
+
+		legacy.close()
+	})
+
 	it('runs migrate once per scoped name and claims+deletes the legacy DB', async () => {
 		// Seed a legacy (un-namespaced) DB, mirroring the chat-history pattern.
 		const legacy = await openDB<TestSchema>('t', 1, { upgrade })
diff --git a/frontend/src/lib/userScopedDb.ts b/frontend/src/lib/userScopedDb.ts
index 4b7242f35a..71d80a369f 100644
--- a/frontend/src/lib/userScopedDb.ts
+++ b/frontend/src/lib/userScopedDb.ts
@@ -10,7 +10,9 @@ import { scopedKey } from '$lib/userScopedStorage'
 // and transparently closes + reopens when the email changes, so the handle
 // self-heals on user switch WITHOUT subscribing to onUserChange. That matters
 // because there is one handle per HistoryManager instance (singleton + one per
-// session runtime) — a per-instance subscription would leak callbacks.
+// session runtime) — a per-instance subscription would leak callbacks. The email
+// can change back and forth within one page: logout is a client-side goto() that
+// clears userStore, not a reload.
 
 export interface UserScopedDbMigrateDeps {
 	openDB: typeof idbOpenDB
@@ -27,40 +29,104 @@ export interface UserScopedDbOptions<Schema extends DBSchema> {
 	// Injectable for tests (defaults to the real idb implementations).
 	openDB?: typeof idbOpenDB
 	deleteDB?: typeof idbDeleteDB
+	// How long an open waits to settle before giving up. Injectable for tests, which
+	// cannot afford the real grace period.
+	openGraceMs?: number
 }
 
 export interface UserScopedDb<Schema extends DBSchema> {
-	// Resolves to the open DB for the current user, or undefined when no user is
-	// logged in yet or the open failed (degrade to in-memory; never rejects).
+	// Resolves to the open DB for the current user, or undefined when no user is logged
+	// in yet, the open failed, or another connection is holding up a schema upgrade —
+	// directly, or by sitting ahead of this open in the browser's queue for the database
+	// (degrade to in-memory; never rejects, never hangs).
 	whenReady(): Promise<IDBPDatabase<Schema> | undefined>
 	close(): void
 }
 
+// How long an open waits to settle before the opener gives up and degrades to in-memory.
+// Only a connection that ignores `versionchange`, or an open queued behind one, takes this long.
+const OPEN_GRACE_MS = 5000
+
 export function userScopedDb<Schema extends DBSchema>(
 	baseName: string,
 	opts: UserScopedDbOptions<Schema>
 ): UserScopedDb<Schema> {
 	const openDB = opts.openDB ?? idbOpenDB
 	const deleteDB = opts.deleteDB ?? idbDeleteDB
+	const openGraceMs = opts.openGraceMs ?? OPEN_GRACE_MS
 	const migratedNames = new Set<string>()
 
-	let openName: string | undefined
-	let openPromise: Promise<IDBPDatabase<Schema> | undefined> | undefined
-
-	function closeCurrent() {
-		const prev = openPromise
-		if (prev) void prev.then((db) => db?.close()).catch(() => {})
-		openPromise = undefined
-		openName = undefined
+	/**
+	 * One open request for one scoped database, plus everything learned about it since.
+	 *
+	 * An open cannot be cancelled and the browser processes a database's opens in order, so
+	 * a replacement issued while one is pending waits behind it, never reaching its own
+	 * `blocked` callback. An attempt is therefore replaced only once it has settled; losing
+	 * interest in it is recorded on these fields instead.
+	 */
+	interface Attempt {
+		/**
+		 * The open with the keep-or-discard decision already applied, so a handle we drop is
+		 * reported as undefined rather than handed over and closed behind the caller's back.
+		 */
+		outcome: Promise<IDBPDatabase<Schema> | undefined>
+		/** Set when `outcome` settles. Its presence, not its `db`, is what "settled" means. */
+		settled?: { db: IDBPDatabase<Schema> | undefined }
+		/** Resolves undefined when the open has taken too long to settle. */
+		gaveUp: Promise<undefined>
+		timedOut: boolean
+		/** Handle yielded to another tab's upgrade, or force-closed by the browser. */
+		dead: boolean
+		/** Released before it arrived: close it on arrival rather than hand it out. */
+		unwanted: boolean
 	}
 
-	async function open(name: string): Promise<IDBPDatabase<Schema> | undefined> {
+	const attempts = new Map<string, Attempt>()
+	let currentName: string | undefined
+
+	async function open(
+		name: string,
+		attempt: Attempt,
+		onTooLong: () => void
+	): Promise<IDBPDatabase<Schema> | undefined> {
+		// Armed before the request is issued rather than from `blocked`, because an open
+		// queued behind another one is told nothing at all: it waits its turn in the
+		// browser's per-database queue, and a callback that never fires cannot bound it.
+		let graceTimer: ReturnType<typeof setTimeout> | undefined = setTimeout(onTooLong, openGraceMs)
+		const stopWaiting = () => {
+			if (graceTimer) clearTimeout(graceTimer)
+			graceTimer = undefined
+		}
 		try {
+			let handle: IDBPDatabase<Schema> | undefined
 			const db = await openDB<Schema>(name, opts.version, {
 				upgrade(database) {
+					// The version-change transaction is ours: nothing is queued ahead of this
+					// open any more, and what remains is our own upgrade running.
+					stopWaiting()
 					opts.upgrade(database)
+				},
+				// Another tab is opening this database at a higher version, which our open
+				// connection would block indefinitely. Let go so their upgrade lands; this
+				// attempt is replaced by a fresh open once it has settled.
+				blocking() {
+					handle?.close()
+					attempt.dead = true
+				},
+				blocked(currentVersion, blockedVersion) {
+					console.warn(
+						`userScopedDb(${baseName}): upgrade ${currentVersion}→${blockedVersion} waiting on another connection`
+					)
+				},
+				// The browser force-closed the connection (site data cleared, database
+				// dropped from devtools). Every request on this handle would now throw.
+				terminated() {
+					attempt.dead = true
 				}
 			})
+			handle = db
+			// The handle is in hand; a slow migrate is not a hung open.
+			stopWaiting()
 			if (opts.migrate && !migratedNames.has(name)) {
 				migratedNames.add(name)
 				try {
@@ -74,30 +140,91 @@ export function userScopedDb<Schema extends DBSchema>(
 			}
 			return db
 		} catch (e) {
-			// Failed open (blocked / corrupt / private-browsing): degrade to
-			// in-memory by resolving undefined (callers no-op their writes). The
-			// undefined is cached for this name so we don't hammer the open.
+			// Failed open (corrupt / private-browsing / a newer version already stored):
+			// degrade to in-memory by resolving undefined (callers no-op their writes).
 			console.error(`userScopedDb(${baseName}): could not open database`, e)
 			return undefined
+		} finally {
+			stopWaiting()
 		}
 	}
 
+	function start(name: string): Attempt {
+		let giveUp!: () => void
+		const attempt: Attempt = {
+			// Assigned immediately below; open() needs the attempt to report back onto.
+			outcome: undefined as unknown as Promise<IDBPDatabase<Schema> | undefined>,
+			gaveUp: new Promise<undefined>((resolve) => (giveUp = () => resolve(undefined))),
+			timedOut: false,
+			dead: false,
+			unwanted: false
+		}
+		// The timer is owned by this attempt, so it can only ever time out its own request.
+		attempt.outcome = open(name, attempt, () => {
+			attempt.timedOut = true
+			giveUp()
+		}).then((db) => {
+			// Arrived after we stopped wanting it, or after we yielded the handle: holding it
+			// open would block the next tab's upgrade for no one's benefit, and by now it may
+			// belong to a user who is no longer logged in.
+			const discard = attempt.unwanted || attempt.dead
+			if (discard) {
+				db?.close()
+				attempt.dead = true
+			}
+			attempt.settled = { db: discard ? undefined : db }
+			attempt.timedOut = false
+			return attempt.settled.db
+		})
+		attempts.set(name, attempt)
+		return attempt
+	}
+
+	/** Stop serving `name`; a still-pending attempt is only marked, per the rule on Attempt. */
+	function release(name: string | undefined) {
+		const attempt = name ? attempts.get(name) : undefined
+		if (!attempt) return
+		if (attempt.settled) {
+			const { db } = attempt.settled
+			attempts.delete(name!)
+			// A microtask later, never synchronously: callers hold this handle across several
+			// awaits (hydrate, write-behind), and closing under them turns a routine user
+			// switch into InvalidStateError. close() then waits on what they started.
+			if (db) void Promise.resolve().then(() => db.close())
+			return
+		}
+		attempt.unwanted = true
+	}
+
 	return {
 		whenReady() {
 			const name = scopedKey(baseName)
-			if (!name) {
-				closeCurrent()
-				return Promise.resolve(undefined)
+			if (name !== currentName) {
+				release(currentName)
+				currentName = name
 			}
-			if (name !== openName) {
-				closeCurrent()
-				openName = name
-				openPromise = open(name)
+			if (!name) return Promise.resolve(undefined)
+
+			let attempt = attempts.get(name)
+			// The one place an attempt is replaced, and only once settled — see Attempt.
+			if (attempt?.settled && attempt.dead) {
+				attempts.delete(name)
+				attempt = undefined
 			}
-			return openPromise!
+			attempt ??= start(name)
+			// Wanting it again cancels a release that has not landed yet.
+			attempt.unwanted = false
+
+			if (attempt.settled) return Promise.resolve(attempt.settled.db)
+			// Still in flight. `dead` means the handle is spoken for and `timedOut` that we
+			// stopped waiting — either way, degrade now rather than block the caller; both
+			// resolve themselves when the request finally settles.
+			if (attempt.dead || attempt.timedOut) return Promise.resolve(undefined)
+			return Promise.race([attempt.outcome, attempt.gaveUp])
 		},
 		close() {
-			closeCurrent()
+			release(currentName)
+			currentName = undefined
 		}
 	}
 }
diff --git a/frontend/src/lib/utils/devWorkspaceLabel.ts b/frontend/src/lib/utils/devWorkspaceLabel.ts
index 026ec9a746..e12e490261 100644
--- a/frontend/src/lib/utils/devWorkspaceLabel.ts
+++ b/frontend/src/lib/utils/devWorkspaceLabel.ts
@@ -1,25 +1,54 @@
-// Cosmetic display label for a dev workspace. The paired-fork machinery is unchanged; this only
-// swaps the badge text and identity wording so a team can present the environment as "staging"
-// instead of "dev". A null/unknown stored value renders as "dev" (the default).
+// Environment label of a dev workspace: its badge text, the wording used to name it, and the git
+// branch it deploys to. A null/empty stored value reads as 'dev'.
 
-export type DevWorkspaceLabelKey = 'dev' | 'staging'
+/**
+ * The labels a dev workspace may carry, ordered dev -> prod. Mirrors `DEV_WORKSPACE_LABELS` in the
+ * backend, which is authoritative. Every dev workspace in a chain must carry a distinct one, so the
+ * length of this list is also the deepest promotion chain.
+ */
+export const DEV_WORKSPACE_LABELS = [
+	'dev',
+	'qa',
+	'test',
+	'uat',
+	'staging',
+	'demo',
+	'sandbox',
+	'preprod'
+] as const
 
-/** Resolve the stored `dev_workspace_label` to a known key; anything unset/unknown is 'dev'. */
-export function devLabelKey(label: string | null | undefined): DevWorkspaceLabelKey {
-	return label === 'staging' ? 'staging' : 'dev'
+/** A label the UI may assign. The read side stays `string`: rows predating a list change persist. */
+export type DevWorkspaceLabelKey = (typeof DEV_WORKSPACE_LABELS)[number]
+
+/** Resolve the stored `dev_workspace_label` to its effective value; unset/empty is 'dev'. */
+export function devLabelKey(label: string | null | undefined): string {
+	return label && label !== '' ? label : 'dev'
 }
 
-/** Short badge text: 'dev' or 'stg'. */
+/** Short badge text: 'staging' abbreviates to 'stg', anything else shows verbatim. */
 export function devBadgeText(label: string | null | undefined): string {
-	return devLabelKey(label) === 'staging' ? 'stg' : 'dev'
+	const key = devLabelKey(label)
+	return key === 'staging' ? 'stg' : key
 }
 
 /** Capitalized word for identity wording, e.g. `${devLabelWord(l)} workspace of X`. */
 export function devLabelWord(label: string | null | undefined): string {
-	return devLabelKey(label) === 'staging' ? 'Staging' : 'Dev'
+	const key = devLabelKey(label)
+	return key.charAt(0).toUpperCase() + key.slice(1)
 }
 
 /** Lowercase noun phrase for prose, e.g. "made in its ${devLabelNoun(l)}". */
 export function devLabelNoun(label: string | null | undefined): string {
-	return devLabelKey(label) === 'staging' ? 'staging workspace' : 'dev workspace'
+	return `${devLabelKey(label)} workspace`
+}
+
+/**
+ * How to name a child workspace in prose: its environment noun when it is a dev workspace
+ * ("dev workspace", "staging workspace"), "fork" otherwise. A dev workspace is a standing
+ * environment its whole team works in, so calling it a fork misreads it as throwaway.
+ */
+export function childWorkspaceNoun(
+	workspace: { is_dev_workspace?: boolean; dev_workspace_label?: string | null } | undefined
+): string {
+	return workspace?.is_dev_workspace ? devLabelNoun(workspace.dev_workspace_label) : 'fork'
 }
diff --git a/frontend/src/lib/utils/editInFork.ts b/frontend/src/lib/utils/editInFork.ts
index c446732b7d..4e0344471f 100644
--- a/frontend/src/lib/utils/editInFork.ts
+++ b/frontend/src/lib/utils/editInFork.ts
@@ -9,8 +9,12 @@ import {
 } from '$lib/stores'
 import { findCanonicalDevWorkspace } from '$lib/utils/workspaceHierarchy'
 import { isRuleActive, canUserBypassRuleKind } from '$lib/workspaceProtectionRules.svelte'
+import { goto } from '$lib/navigation'
+import { sendUserToast } from '$lib/toast'
+import { checkItemExists } from '$lib/utils_workspace_deploy'
+import { updateDevWorkspaceModal } from '$lib/utils/editInForkModal.svelte'
 
-type ItemType = 'script' | 'flow' | 'app' | 'raw_app'
+export type ItemType = 'script' | 'flow' | 'app' | 'raw_app'
 
 /**
  * Whether to show the "edit in fork / dev workspace" affordance. Allowed when forking isn't disabled,
@@ -64,26 +68,164 @@ function editPathFor(itemType: ItemType, itemPath: string): string {
 	}
 }
 
-function viewPathFor(itemType: ItemType, itemPath: string): string {
-	switch (itemType) {
-		case 'script':
-			return `${base}/scripts/get/${itemPath}`
-		case 'flow':
-			return `${base}/flows/get/${itemPath}`
-		case 'app':
-			return `${base}/apps/get/${itemPath}`
-		case 'raw_app':
-			return `${base}/apps_raw/get/${itemPath}`
+export function buildForkEditUrl(itemType: ItemType, itemPath: string): string {
+	// When the current ("prod") workspace has a canonical dev workspace, edits are funneled there.
+	const dev = findCanonicalDevWorkspace(get(workspaceStore), get(userWorkspaces))
+	return dev
+		? devWorkspaceEditUrl(itemType, itemPath, dev.id)
+		: forkWorkspaceUrl(itemType, itemPath)
+}
+
+/** Fork-creation flow, coming back to the item's editor once the fork exists. */
+export function forkWorkspaceUrl(itemType: ItemType, itemPath: string): string {
+	return `${base}/user/fork_workspace?rd=${encodeURIComponent(editPathFor(itemType, itemPath))}`
+}
+
+/** The item's editor in the dev workspace — the target `buildForkEditUrl` produces when a dev exists. */
+export function devWorkspaceEditUrl(
+	itemType: ItemType,
+	itemPath: string,
+	devWorkspaceId: string
+): string {
+	// `?workspace=` switches the workspace store (handled in the logged layout), so the editor
+	// opens against the dev workspace rather than whichever one the tab was on.
+	return `${editPathFor(itemType, itemPath)}?workspace=${encodeURIComponent(devWorkspaceId)}`
+}
+
+/**
+ * A dev workspace can be behind its prod, so the URL built at render time dead-ends on a not-found
+ * page for any item prod has and dev doesn't. Resolve the destination at click time instead:
+ * return it when the item is there, else raise the prompt offering to update the dev workspace with
+ * it and return undefined. Shared by the row buttons and the editors' "Edit in <dev>" dropdown
+ * entries.
+ */
+let latestResolve = 0
+
+async function resolveEditInForkTarget(
+	itemType: ItemType,
+	itemPath: string,
+	prod: string,
+	dev: UserWorkspace,
+	openInNewTab = false
+): Promise<string | undefined> {
+	const seq = ++latestResolve
+	const from = { path: window.location.pathname, workspace: get(workspaceStore) }
+	let exists: boolean
+	try {
+		exists = await checkItemExists(itemType, itemPath, dev.id)
+	} catch {
+		// Inconclusive — go anyway and let the editor report whatever is actually wrong.
+		exists = true
+	}
+	// Only act if the user is still where they asked from. A later click supersedes this one, and
+	// navigating or switching workspace abandons it — the modal is layout-global and `goto` is
+	// unconditional, so a late answer would otherwise hijack whatever they moved on to.
+	if (seq !== latestResolve) return undefined
+	if (window.location.pathname !== from.path || get(workspaceStore) !== from.workspace)
+		return undefined
+	if (exists) return devWorkspaceEditUrl(itemType, itemPath, dev.id)
+	updateDevWorkspaceModal.val = {
+		itemType,
+		itemPath,
+		devWorkspaceId: dev.id,
+		devWorkspaceName: dev.name,
+		prodWorkspaceId: prod,
+		openInNewTab
+	}
+	return undefined
+}
+
+function currentDevWorkspace(
+	prodWorkspace?: string
+): { prod: string; dev: UserWorkspace } | undefined {
+	const prod = prodWorkspace ?? get(workspaceStore)
+	const dev = findCanonicalDevWorkspace(prod, get(userWorkspaces))
+	if (!dev || !prod) return undefined
+	return { prod, dev }
+}
+
+/**
+ * Click handler for the "Edit in <dev workspace>" affordance. Menu entries carry no href — the
+ * destination is only known after an async probe — so this navigates itself by default. Link
+ * callers pass `hasHref` so modifier/middle clicks still open the raw href in a new tab, and so the
+ * no-dev-workspace case is left to the anchor rather than being navigated twice.
+ */
+export async function onEditInForkClick(
+	e: Event | undefined,
+	itemType: ItemType,
+	itemPath: string,
+	{ hasHref = false }: { hasHref?: boolean } = {}
+): Promise<void> {
+	const click = e as MouseEvent | undefined
+	if (
+		hasHref &&
+		(click?.ctrlKey || click?.metaKey || click?.shiftKey || click?.altKey || click?.button)
+	)
+		return
+	const target = currentDevWorkspace()
+	if (!target) {
+		// Nothing to probe: the destination is the fork-creation flow, which the anchor already points at.
+		if (!hasHref) await goto(forkWorkspaceUrl(itemType, itemPath))
+		return
+	}
+	e?.preventDefault()
+	const url = await resolveEditInForkTarget(itemType, itemPath, target.prod, target.dev)
+	if (url) await goto(url)
+}
+
+export type ClaimedTab = { show: (url: string) => void; discard: () => void }
+
+/**
+ * Take a tab now, to point somewhere once an async step resolves. Safari refuses `window.open` from
+ * any promise continuation however fast it resolves, so a tab opened after an `await` never appears
+ * there — it has to be claimed inside the click's own transient activation. `discard` releases it
+ * when the answer turns out to be "nowhere to go". Returns undefined if the popup was blocked, which
+ * leaves the caller to decide between a late `window.open` and saying so.
+ */
+export function claimTab(): ClaimedTab | undefined {
+	const tab = window.open('about:blank')
+	if (!tab) return undefined
+	return {
+		show: (url: string) => {
+			tab.location.href = url
+		},
+		discard: () => tab.close()
 	}
 }
 
-export function buildForkEditUrl(itemType: ItemType, itemPath: string): string {
-	// When the current ("prod") workspace has a canonical dev workspace, edits are funneled there:
-	// land on the item's page in the dev workspace (not straight in the editor) so the workspace
-	// switch is legible and the user opens the editor deliberately from there.
-	const dev = findCanonicalDevWorkspace(get(workspaceStore), get(userWorkspaces))
-	if (dev) {
-		return `${viewPathFor(itemType, itemPath)}?workspace=${encodeURIComponent(dev.id)}`
+/**
+ * "Edit in <dev workspace>" from an editor's dropdown, which opens a new tab rather than navigating
+ * away from work in progress. `prodWorkspace` is the workspace the editor is operating on, which in
+ * a session pane is not the one the navigation store holds — pass the same value the surrounding
+ * `editInForkAllowed` / `editInForkLabel` are given, so the action can't resolve against a different
+ * workspace than the label above it names.
+ */
+export async function openEditInFork(
+	itemType: ItemType,
+	itemPath: string,
+	prodWorkspace?: string
+): Promise<void> {
+	const target = currentDevWorkspace(prodWorkspace)
+	if (!target) {
+		// No dev workspace to probe for: the destination is the fork-creation flow.
+		if (!window.open(forkWorkspaceUrl(itemType, itemPath))) {
+			sendUserToast('Allow popups to fork this workspace', true)
+		}
+		return
+	}
+	// Navigating in place would throw away whatever this editor is holding — the whole reason this
+	// entry opens a tab. The cost is a blank tab that flashes and closes when the item turns out to
+	// be missing and the prompt takes over; the prompt then opens its own tab on confirm.
+	const tab = claimTab()
+	const url = await resolveEditInForkTarget(itemType, itemPath, target.prod, target.dev, true)
+	if (!url) {
+		// Superseded, abandoned, or answered by the prompt in the original tab — nothing to show.
+		tab?.discard()
+		return
+	}
+	if (tab) {
+		tab.show(url)
+	} else if (!window.open(url)) {
+		sendUserToast(`Allow popups to open ${itemPath} in ${target.dev.name}`, true)
 	}
-	return `${base}/user/fork_workspace?rd=${encodeURIComponent(editPathFor(itemType, itemPath))}`
 }
diff --git a/frontend/src/lib/utils/editInForkModal.svelte.ts b/frontend/src/lib/utils/editInForkModal.svelte.ts
new file mode 100644
index 0000000000..a331ba23ab
--- /dev/null
+++ b/frontend/src/lib/utils/editInForkModal.svelte.ts
@@ -0,0 +1,28 @@
+import { createState } from '$lib/svelte5Utils.svelte'
+import type { StateStore } from '$lib/utils'
+import type { ItemType } from './editInFork'
+
+/**
+ * An "Edit in <dev workspace>" click that landed on an item the dev workspace
+ * doesn't have yet. Held globally so the confirmation renders once in the logged
+ * layout instead of per item row.
+ */
+export type UpdateDevWorkspaceModalState = {
+	itemType: ItemType
+	itemPath: string
+	devWorkspaceId: string
+	devWorkspaceName: string
+	prodWorkspaceId: string
+	/**
+	 * The click that raised this came from an editor's dropdown, which opens a tab rather than
+	 * navigating away from work in progress. Answering it has to keep that promise: without this
+	 * the "item is present" branch opens a tab while the "item is missing" branch — this prompt —
+	 * would leave the editor the user was told would be preserved.
+	 */
+	openInNewTab?: boolean
+}
+
+export let updateDevWorkspaceModal: StateStore<UpdateDevWorkspaceModalState | undefined> =
+	createState({
+		val: undefined
+	})
diff --git a/frontend/src/lib/utils/pipelineFolder.ts b/frontend/src/lib/utils/pipelineFolder.ts
new file mode 100644
index 0000000000..d77c2bcb91
--- /dev/null
+++ b/frontend/src/lib/utils/pipelineFolder.ts
@@ -0,0 +1,13 @@
+/**
+ * The bare folder name a pipeline is scoped to, from either form a caller may hold
+ * (`analytics` or the owner path `f/analytics`). Every pipeline surface keys on the
+ * NAME and builds `f/<folder>/<node>` paths from it, so a value that still carries
+ * the prefix double-prefixes every path built from it. A folder name cannot contain
+ * `/`, so a leading `f/` is unambiguously the prefix.
+ */
+export function normalizePipelineFolder(folder: string): string {
+	return folder
+		.trim()
+		.replace(/^\/+|\/+$/g, '')
+		.replace(/^f\//, '')
+}
diff --git a/frontend/src/lib/utils/useForkableWorkspaces.svelte.ts b/frontend/src/lib/utils/useForkableWorkspaces.svelte.ts
index 372d3652a6..c2d95423b9 100644
--- a/frontend/src/lib/utils/useForkableWorkspaces.svelte.ts
+++ b/frontend/src/lib/utils/useForkableWorkspaces.svelte.ts
@@ -42,6 +42,10 @@ export function useForkableWorkspaces(args: {
 					username: '',
 					color: w.color ?? undefined,
 					parent_workspace_id: w.parent_workspace_id,
+					// Dev-ness travels with the entry: the fork-base default and the "dev" badge both read
+					// it off the list, and a synthesized entry missing it reads as an ordinary fork.
+					is_dev_workspace: w.is_dev_workspace,
+					dev_workspace_label: w.dev_workspace_label,
 					disabled: false
 				}
 			]
diff --git a/frontend/src/lib/utils/uuid.ts b/frontend/src/lib/utils/uuid.ts
index 4a9f092dac..c1fb1da40f 100644
--- a/frontend/src/lib/utils/uuid.ts
+++ b/frontend/src/lib/utils/uuid.ts
@@ -5,3 +5,13 @@ export function randomUUID() {
 		return v.toString(16)
 	})
 }
+
+/** Unguessable token, for values gating a credential — `randomUUID` above is
+ * `Math.random()`-based and must not be used for those. `getRandomValues` is
+ * NOT secure-context-only (unlike `crypto.randomUUID` and `crypto.subtle`), so
+ * this works over plain HTTP and needs no fallback. */
+export function randomSecret(bytes = 32): string {
+	const buf = new Uint8Array(bytes)
+	crypto.getRandomValues(buf)
+	return Array.from(buf, (b) => b.toString(16).padStart(2, '0')).join('')
+}
diff --git a/frontend/src/lib/utils/workspaceHierarchy.test.ts b/frontend/src/lib/utils/workspaceHierarchy.test.ts
new file mode 100644
index 0000000000..14e063cba8
--- /dev/null
+++ b/frontend/src/lib/utils/workspaceHierarchy.test.ts
@@ -0,0 +1,77 @@
+import { describe, expect, it } from 'vitest'
+
+import {
+	devWorkspacesInChainAbove,
+	findDefaultForkBase,
+	findWorkspaceAncestors,
+	findWorkspaceRoot
+} from './workspaceHierarchy'
+import type { UserWorkspace } from '../stores'
+
+function ws(id: string, parent?: string, extra: Partial<UserWorkspace> = {}): UserWorkspace {
+	return { id, name: id, username: 'u', parent_workspace_id: parent, disabled: false, ...extra }
+}
+
+const root = ws('prod')
+const dev = ws('devws', 'prod', { is_dev_workspace: true })
+const forkOfDev = ws('wm-fork-a', 'devws')
+const forkOfRoot = ws('wm-fork-b', 'prod')
+const family = [root, dev, forkOfDev, forkOfRoot]
+
+describe('findDefaultForkBase', () => {
+	it('bases a fork on the dev workspace from inside its subtree', () => {
+		expect(findDefaultForkBase('devws', family)?.id).toBe('devws')
+		expect(findDefaultForkBase('wm-fork-a', family)?.id).toBe('devws')
+	})
+
+	it('bases a fork on the root outside the dev subtree', () => {
+		expect(findDefaultForkBase('prod', family)?.id).toBe('prod')
+		expect(findDefaultForkBase('wm-fork-b', family)?.id).toBe('prod')
+	})
+
+	it('skips a dev workspace the user is disabled in', () => {
+		const disabledDev = [root, { ...dev, disabled: true }, forkOfDev]
+		expect(findDefaultForkBase('wm-fork-a', disabledDev)?.id).toBe('prod')
+	})
+})
+
+const nestedDev = ws('stgws', 'devws', { is_dev_workspace: true })
+const forkOfNestedDev = ws('wm-fork-c', 'stgws')
+const nestedFamily = [...family, nestedDev, forkOfNestedDev]
+
+describe('findWorkspaceRoot', () => {
+	it('walks to the family root through a single dev workspace', () => {
+		expect(findWorkspaceRoot('devws', family)?.id).toBe('prod')
+		expect(findWorkspaceRoot('wm-fork-a', family)?.id).toBe('prod')
+	})
+
+	it('stops at the parent dev workspace of a dev of a dev', () => {
+		expect(findWorkspaceRoot('stgws', nestedFamily)?.id).toBe('devws')
+		expect(findWorkspaceRoot('wm-fork-c', nestedFamily)?.id).toBe('devws')
+	})
+
+	it('stops at the highest reachable ancestor', () => {
+		expect(findWorkspaceRoot('devws', [dev, forkOfDev])?.id).toBe('devws')
+	})
+})
+
+describe('findWorkspaceAncestors', () => {
+	// The attach-candidate cycle filter depends on this NOT stopping where findWorkspaceRoot does.
+	it('walks past a dev-of-dev boundary to the true root', () => {
+		expect(findWorkspaceAncestors('wm-fork-c', nestedFamily).map((w) => w.id)).toEqual([
+			'stgws',
+			'devws',
+			'prod'
+		])
+	})
+})
+
+describe('devWorkspacesInChainAbove', () => {
+	it('collects the dev workspaces at and above the prod side', () => {
+		expect(devWorkspacesInChainAbove('stgws', nestedFamily).map((w) => w.id)).toEqual([
+			'stgws',
+			'devws'
+		])
+		expect(devWorkspacesInChainAbove('prod', nestedFamily)).toEqual([])
+	})
+})
diff --git a/frontend/src/lib/utils/workspaceHierarchy.ts b/frontend/src/lib/utils/workspaceHierarchy.ts
index 9c817f49e2..86c5eaca9b 100644
--- a/frontend/src/lib/utils/workspaceHierarchy.ts
+++ b/frontend/src/lib/utils/workspaceHierarchy.ts
@@ -108,6 +108,12 @@ export function isRootWorkspace(workspace: UserWorkspace): boolean {
  * Walk up `parent_workspace_id` to the top of a workspace's family. Stops at the first ancestor not
  * present in `allWorkspaces` (e.g. a parent the user can't see) and returns it, so the result is
  * always the highest reachable ancestor. Returns undefined when the id itself isn't in the list.
+ *
+ * A dev workspace nested under another dev workspace (a dev of a dev, supported but not the
+ * recommended shape) ends the walk: it is the prod of everything below it, and presenting the far
+ * root — which such a family may promote to only through an intermediate, and which its members
+ * often can't even reach — as the family head makes every root-scoped affordance (fork base, deploy
+ * target, scope chip) point past the workspace actually being worked in.
  */
 export function findWorkspaceRoot(
 	workspaceId: string | undefined,
@@ -118,11 +124,53 @@ export function findWorkspaceRoot(
 	while (current?.parent_workspace_id) {
 		const parent = allWorkspaces.find((w) => w.id === current!.parent_workspace_id)
 		if (!parent) break
+		const crossedNestedDev = !!current.is_dev_workspace && !!parent.is_dev_workspace
 		current = parent
+		if (crossedNestedDev) break
 	}
 	return current
 }
 
+/**
+ * Every reachable ancestor of a workspace, nearest first. Unlike `findWorkspaceRoot` this never stops
+ * at a dev-of-dev boundary — it answers "is X above me in the real tree?", e.g. to keep an ancestor
+ * out of a dev-workspace attach list, where reparenting it below would close a cycle.
+ */
+export function findWorkspaceAncestors(
+	workspaceId: string | undefined,
+	allWorkspaces: UserWorkspace[]
+): UserWorkspace[] {
+	const ancestors: UserWorkspace[] = []
+	let current = workspaceId ? allWorkspaces.find((w) => w.id === workspaceId) : undefined
+	const seen = new Set<string>(current ? [current.id] : [])
+	while (current?.parent_workspace_id) {
+		const parent = allWorkspaces.find((w) => w.id === current!.parent_workspace_id)
+		if (!parent || seen.has(parent.id)) break
+		seen.add(parent.id)
+		ancestors.push(parent)
+		current = parent
+	}
+	return ancestors
+}
+
+/**
+ * The dev workspaces at or above `workspaceId`. A dev workspace placed under it joins their
+ * promotion chain, so their environment labels are the ones it cannot reuse — dev workspaces in a
+ * chain inherit the same git-sync repositories, and an equal label means one shared deploy branch.
+ * `disabled` is not filtered out, unlike elsewhere: it means the caller has no seat in that
+ * workspace, which does not free the branch it deploys to. Ancestors the caller cannot see end the
+ * walk, so this can under-report; the backend rejects on the full tree either way.
+ */
+export function devWorkspacesInChainAbove(
+	workspaceId: string | undefined,
+	allWorkspaces: UserWorkspace[]
+): UserWorkspace[] {
+	const self = workspaceId ? allWorkspaces.find((w) => w.id === workspaceId) : undefined
+	return [...(self ? [self] : []), ...findWorkspaceAncestors(workspaceId, allWorkspaces)].filter(
+		(w) => w.is_dev_workspace
+	)
+}
+
 /**
  * Whether a workspace (by id) is a fork or dev workspace. Forks and dev workspaces both set
  * `parent_workspace_id` (a dev workspace has no `wm-fork-` id prefix), but a `wm-fork-` workspace can
@@ -168,6 +216,31 @@ export function findCanonicalDevWorkspace(
 	)
 }
 
+/**
+ * The workspace a new fork should branch from by default. Inside a dev workspace's subtree the base is
+ * that dev workspace, not the family root: the dev workspace carries the changes being worked on, and
+ * a prod locked against forking (`lock_prod_forking`) rejects a root-based fork outright. Anywhere
+ * else it is the family root, so an ad-hoc fork branches from prod rather than from whichever
+ * throwaway fork happens to be open. A dev workspace the user is disabled in is skipped — forking from
+ * it would fail — and the walk continues upwards.
+ */
+export function findDefaultForkBase(
+	currentWorkspaceId: string | undefined,
+	allWorkspaces: UserWorkspace[]
+): UserWorkspace | undefined {
+	let current = allWorkspaces.find((w) => w.id === currentWorkspaceId)
+	while (current) {
+		if (current.is_dev_workspace && !current.disabled) return current
+		if (!current.parent_workspace_id) break
+		const parent: UserWorkspace | undefined = allWorkspaces.find(
+			(w) => w.id === current!.parent_workspace_id
+		)
+		if (!parent) break
+		current = parent
+	}
+	return findWorkspaceRoot(currentWorkspaceId, allWorkspaces)
+}
+
 /**
  * Helper function to find all descendants of a workspace
  */
diff --git a/frontend/src/lib/utils_draft_deploy.test.ts b/frontend/src/lib/utils_draft_deploy.test.ts
index bae50691cc..9bed95917b 100644
--- a/frontend/src/lib/utils_draft_deploy.test.ts
+++ b/frontend/src/lib/utils_draft_deploy.test.ts
@@ -1,5 +1,36 @@
-import { describe, it, expect } from 'vitest'
-import { draftBaseIsStale } from './utils_draft_deploy'
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { draftBaseIsStale, deployDraft } from './utils_draft_deploy'
+
+vi.mock('$lib/gen', () => ({
+	ScriptService: { getScriptByPath: vi.fn(), createScript: vi.fn() },
+	FlowService: { getFlowByPath: vi.fn(), createFlow: vi.fn(), updateFlow: vi.fn() },
+	DraftService: { deleteDraft: vi.fn() },
+	AppService: {},
+	VariableService: {},
+	ResourceService: {},
+	ScheduleService: {},
+	HttpTriggerService: {},
+	WebsocketTriggerService: {},
+	PostgresTriggerService: {},
+	KafkaTriggerService: {},
+	NatsTriggerService: {},
+	MqttTriggerService: {},
+	AmqpTriggerService: {},
+	SqsTriggerService: {},
+	GcpTriggerService: {},
+	AzureTriggerService: {},
+	EmailTriggerService: {}
+}))
+vi.mock('$lib/userDraftDbSyncer.svelte', () => ({ UserDraftDbSyncer: { save: vi.fn() } }))
+vi.mock('$lib/workspaceDrafts.svelte', () => ({ invalidateWorkspaceDrafts: vi.fn() }))
+vi.mock('$lib/workspaceComparison', () => ({ invalidateWorkspaceComparison: vi.fn() }))
+vi.mock('$lib/localDraftHints.svelte', () => ({ setLocalDraftHint: vi.fn() }))
+vi.mock('$lib/rawAppDeploy', () => ({ deployRawAppDraft: vi.fn() }))
+vi.mock('$lib/components/raw_apps/utils', () => ({ canonicalRawAppDiffValue: vi.fn() }))
+vi.mock('$lib/appDiffSides', () => ({ classicAppDraftParts: vi.fn() }))
+vi.mock('$lib/utils_deployable', () => ({ TRIGGER_RUNTIME_IGNORE: [] }))
+
+import { ScriptService, FlowService } from '$lib/gen'
 
 // draftBaseIsStale compares a draft's base pointer against the deployed head
 // of the item it was fetched with (`get_draft=true`). Shared by CompareDrafts
@@ -38,3 +69,58 @@ describe('draftBaseIsStale', () => {
 		expect(draftBaseIsStale('script', undefined)).toBe(false)
 	})
 })
+
+// Without preserve_on_behalf_of the backend rewrites on_behalf_of_email to the
+// deploying user, so deploying a draft silently re-points the runnable's
+// identity.
+
+describe('deployDraft preserves on_behalf_of', () => {
+	beforeEach(() => vi.clearAllMocks())
+
+	it('script: forwards the flag when the draft carries an on_behalf_of_email', async () => {
+		vi.mocked(ScriptService.getScriptByPath).mockResolvedValueOnce({
+			hash: 'v1',
+			draft: { path: 'f/admin/send_email', on_behalf_of_email: 'alice@windmill.dev' }
+		} as any)
+
+		expect(await deployDraft('script', 'f/admin/send_email', 'ws')).toEqual({ success: true })
+		expect(ScriptService.createScript).toHaveBeenCalledWith(
+			expect.objectContaining({
+				requestBody: expect.objectContaining({
+					on_behalf_of_email: 'alice@windmill.dev',
+					preserve_on_behalf_of: true
+				})
+			})
+		)
+	})
+
+	it('script: omits the flag when the draft has no on_behalf_of_email', async () => {
+		vi.mocked(ScriptService.getScriptByPath).mockResolvedValueOnce({
+			hash: 'v1',
+			draft: { path: 'f/admin/send_email' }
+		} as any)
+
+		await deployDraft('script', 'f/admin/send_email', 'ws')
+		expect(ScriptService.createScript).toHaveBeenCalledWith(
+			expect.objectContaining({
+				requestBody: expect.objectContaining({ preserve_on_behalf_of: undefined })
+			})
+		)
+	})
+
+	it('flow: forwards the flag when the draft carries an on_behalf_of_email', async () => {
+		vi.mocked(FlowService.getFlowByPath).mockResolvedValueOnce({
+			draft: { path: 'f/admin/notify', value: {}, on_behalf_of_email: 'alice@windmill.dev' }
+		} as any)
+
+		expect(await deployDraft('flow', 'f/admin/notify', 'ws')).toEqual({ success: true })
+		expect(FlowService.updateFlow).toHaveBeenCalledWith(
+			expect.objectContaining({
+				requestBody: expect.objectContaining({
+					on_behalf_of_email: 'alice@windmill.dev',
+					preserve_on_behalf_of: true
+				})
+			})
+		)
+	})
+})
diff --git a/frontend/src/lib/utils_draft_deploy.ts b/frontend/src/lib/utils_draft_deploy.ts
index 87baf2e5c7..b322d6adc4 100644
--- a/frontend/src/lib/utils_draft_deploy.ts
+++ b/frontend/src/lib/utils_draft_deploy.ts
@@ -459,7 +459,10 @@ export async function deployDraft(
 					...rest,
 					path: scriptPath,
 					parent_hash: r.hash,
-					deployment_message: deploymentMessage
+					deployment_message: deploymentMessage,
+					// Deploy the draft's on-behalf-of as-is; the backend resets it to the
+					// deploying user without this flag, gated by can_preserve_on_behalf_of.
+					preserve_on_behalf_of: rest.on_behalf_of_email ? true : undefined
 				}
 			})
 			// Then deploy any draft trigger edits, so they aren't dropped with the draft.
@@ -482,6 +485,10 @@ export async function deployDraft(
 				ws_error_handler_muted: d.ws_error_handler_muted,
 				visible_to_runner_only: d.visible_to_runner_only,
 				on_behalf_of_email: d.on_behalf_of_email,
+				on_behalf_of: d.on_behalf_of,
+				// Same as scripts and apps: the backend resets on_behalf_of_email to the
+				// deploying user without this flag, gated by can_preserve_on_behalf_of.
+				preserve_on_behalf_of: d.on_behalf_of_email ? true : undefined,
 				labels: d.labels,
 				deployment_message: deploymentMessage
 			}
diff --git a/frontend/src/lib/utils_workspace_deploy.test.ts b/frontend/src/lib/utils_workspace_deploy.test.ts
new file mode 100644
index 0000000000..08a877d012
--- /dev/null
+++ b/frontend/src/lib/utils_workspace_deploy.test.ts
@@ -0,0 +1,118 @@
+import { describe, it, expect } from 'vitest'
+import {
+	checkPathWritePermission,
+	diffActionableInDirection,
+	diffCreatesInTarget,
+	diffRemovesInTarget
+} from './utils_workspace_deploy'
+
+/** The row shape the fork comparison returns for an item the parent has and the
+ * fork does not: one write on the fork side, whatever that write was. */
+const parentOnly = { ahead: 1, behind: 0, exists_in_source: true, exists_in_fork: false }
+const forkDeleted = {
+	...parentOnly,
+	fork_last_event_kind: 'delete',
+	fork_last_event_origin: 'authored'
+} as const
+const forkRenamedAway = {
+	...parentOnly,
+	fork_last_event_kind: 'rename_from',
+	fork_last_event_origin: 'authored'
+} as const
+const syncReverted = {
+	...parentOnly,
+	fork_last_event_kind: 'delete',
+	fork_last_event_origin: 'sync'
+} as const
+const forkOnly = { ahead: 1, behind: 0, exists_in_source: false, exists_in_fork: true }
+const bothSides = { ahead: 1, behind: 1, exists_in_source: true, exists_in_fork: true }
+
+describe('deploy direction of a one-sided diff row', () => {
+	it('offers a parent-only item to the fork even with no behind count', () => {
+		expect(diffActionableInDirection(parentOnly, false)).toBe(true)
+		expect(diffCreatesInTarget(parentOnly, false)).toBe(true)
+		expect(diffRemovesInTarget(parentOnly, false)).toBe(false)
+	})
+
+	it('keeps a parent-only row with no recorded event out of a merge into the parent', () => {
+		expect(diffActionableInDirection(parentOnly, true)).toBe(false)
+		// An arbitrary target has no tally behind it and does propagate the removal.
+		expect(diffActionableInDirection(parentOnly, true, true)).toBe(true)
+		expect(diffRemovesInTarget(parentOnly, true)).toBe(true)
+	})
+
+	it('merges a removal the fork can show it made, and never one a sync made', () => {
+		expect(diffActionableInDirection(forkDeleted, true)).toBe(true)
+		expect(diffActionableInDirection(forkRenamedAway, true)).toBe(true)
+		expect(diffActionableInDirection(syncReverted, true)).toBe(false)
+		// Still a removal, so still opt-in rather than bulk-selected.
+		expect(diffRemovesInTarget(forkDeleted, true)).toBe(true)
+		// The update direction keeps offering it back whatever the fork recorded.
+		expect(diffActionableInDirection(syncReverted, false)).toBe(true)
+	})
+
+	it('surfaces a fork deletion the parent also edited in both directions', () => {
+		const conflict = { ...forkDeleted, behind: 1 }
+		expect(diffActionableInDirection(conflict, true)).toBe(true)
+		expect(diffActionableInDirection(conflict, false)).toBe(true)
+	})
+
+	it('does not resurrect a fork-only item into an update of the fork', () => {
+		expect(diffActionableInDirection(forkOnly, false)).toBe(false)
+		expect(diffCreatesInTarget(forkOnly, true)).toBe(true)
+	})
+
+	it('keeps a two-sided row on its counters', () => {
+		expect(diffActionableInDirection(bothSides, true)).toBe(true)
+		expect(diffActionableInDirection({ ...bothSides, behind: 0 }, false)).toBe(false)
+		expect(diffCreatesInTarget(bothSides, true)).toBe(false)
+		expect(diffRemovesInTarget(bothSides, false)).toBe(false)
+	})
+})
+
+describe('per-item write permission in the deploy target', () => {
+	const member = { is_admin: false, username: 'alice', folders: ['shared'] }
+	const never = async () => {
+		throw new Error('folder probe should not run')
+	}
+
+	it('lets a workspace admin write anywhere', async () => {
+		const admin = { is_admin: true, username: 'root', folders: [] }
+		expect(await checkPathWritePermission('dev', 'u/someone/x', admin, never)).toEqual({ ok: true })
+		expect(await checkPathWritePermission('dev', 'f/locked/x', admin, never)).toEqual({ ok: true })
+	})
+
+	it('allows a user their own path and refuses someone else’s', async () => {
+		expect(await checkPathWritePermission('dev', 'u/alice/x', member, never)).toEqual({ ok: true })
+		const refused = await checkPathWritePermission('dev', 'u/bob/x', member, never)
+		expect(refused.ok).toBe(false)
+		expect(refused.reason).toContain('u/bob')
+	})
+
+	it('allows a folder in the write set without probing for it', async () => {
+		expect(await checkPathWritePermission('dev', 'f/shared/x', member, never)).toEqual({ ok: true })
+	})
+
+	it('refuses a folder that exists in the target but is not writable', async () => {
+		const refused = await checkPathWritePermission('dev', 'f/locked/x', member, async () => true)
+		expect(refused.ok).toBe(false)
+		expect(refused.reason).toContain('locked')
+	})
+
+	// The two fail-open paths. Turning either into a refusal would block a deploy the server
+	// would have accepted, so they are asserted rather than left to the `catch` reading as dead.
+	it('allows a folder the target does not have yet, since the deploy creates it', async () => {
+		expect(
+			await checkPathWritePermission('dev', 'f/brand_new/x', member, async () => false)
+		).toEqual({ ok: true })
+	})
+
+	it('allows when the folder probe itself fails', async () => {
+		const probeFailed = async () => {
+			throw new Error('network')
+		}
+		expect(await checkPathWritePermission('dev', 'f/locked/x', member, probeFailed)).toEqual({
+			ok: true
+		})
+	})
+})
diff --git a/frontend/src/lib/utils_workspace_deploy.ts b/frontend/src/lib/utils_workspace_deploy.ts
index 72400bb962..c330a2210b 100644
--- a/frontend/src/lib/utils_workspace_deploy.ts
+++ b/frontend/src/lib/utils_workspace_deploy.ts
@@ -14,10 +14,12 @@ import {
 	ScheduleService,
 	ScriptService,
 	SqsTriggerService,
+	GroupService,
 	UserService,
 	VariableService,
 	WebsocketTriggerService,
-	WorkspaceService
+	WorkspaceService,
+	type User
 } from '$lib/gen'
 import {
 	fetchProtectionRulesForWorkspace,
@@ -167,7 +169,45 @@ function legacyTriggerKind(kind: TriggerDeployKind) {
 	return map[kind]
 }
 
-function makeProvider(): DeployProvider {
+/** An identity in both formats the app policy stores it in. */
+export type AppIdentity = { email: string; permissionedAs: string }
+
+/**
+ * Set when a create-only deploy was refused because the target turned out to already have the
+ * item. Carried on an object rather than matched out of the error text: `deployItem` swallows
+ * every throw into `{ success: false, error }`, so the flag is the only reliable signal.
+ */
+export type DeployConflict = { hit: boolean }
+
+/**
+ * `deployItem` overrides only the email half of the identity, while the body it builds
+ * spreads the *source* item — which carries the source workspace's permissioned_as, valid
+ * nowhere else since usernames are per-workspace. The key is therefore always overwritten:
+ * with the picked user's principal for a custom choice, and cleared otherwise so the
+ * backend derives the target's own from the email it is given. The shared `deployItem`
+ * clears it too, but this app consumes the published package, so the clear has to exist
+ * on both sides until that version ships.
+ */
+function makeProvider(
+	onBehalfOfPrincipal?: string,
+	appIdentity?: AppIdentity,
+	/**
+	 * Refuse the writes the shared `deployItem` reaches for only when the item already exists in
+	 * the target, turning its silent switch to an update into a failure the caller can act on.
+	 * The three below are exactly its `alreadyExists` branches: a flow and an app are replaced
+	 * outright, and a script is given the target's head as `parent_hash`, which is what makes an
+	 * otherwise identical `createScript` an update.
+	 */
+	conflict?: DeployConflict
+): DeployProvider {
+	const withPermissionedAs = <T extends Record<string, any>>(requestBody: T): T => ({
+		...requestBody,
+		on_behalf_of: onBehalfOfPrincipal
+	})
+	const refuseUpdate = (): never => {
+		if (conflict) conflict.hit = true
+		throw new Error('item already exists in the target workspace')
+	}
 	return {
 		existsFlowByPath: (p) => FlowService.existsFlowByPath(p),
 		existsScriptByPath: (p) => ScriptService.existsScriptByPath(p),
@@ -177,17 +217,39 @@ function makeProvider(): DeployProvider {
 		existsResourceType: (p) => ResourceService.existsResourceType(p),
 		existsFolder: (p) => FolderService.existsFolder(p),
 		getFlowByPath: (p) => FlowService.getFlowByPath(p),
-		createFlow: (p) => FlowService.createFlow(p),
-		updateFlow: (p) => FlowService.updateFlow(p),
+		createFlow: (p) =>
+			FlowService.createFlow({ ...p, requestBody: withPermissionedAs(p.requestBody) }),
+		updateFlow: (p) =>
+			conflict
+				? refuseUpdate()
+				: FlowService.updateFlow({ ...p, requestBody: withPermissionedAs(p.requestBody) }),
 		archiveFlowByPath: (p) => FlowService.archiveFlowByPath(p),
 		getScriptByPath: (p) => ScriptService.getScriptByPath(p),
-		createScript: (p) => ScriptService.createScript(p),
+		createScript: (p) =>
+			conflict && p.requestBody.parent_hash
+				? refuseUpdate()
+				: ScriptService.createScript({ ...p, requestBody: withPermissionedAs(p.requestBody) }),
 		archiveScriptByPath: (p) => ScriptService.archiveScriptByPath(p),
-		getAppByPath: (p) => AppService.getAppByPath(p),
+		// An app's identity lives in its policy, and the shared deploy forwards the source policy
+		// untouched — it only turns `onBehalfOf` into `preserve_on_behalf_of: true`. Rewriting the
+		// policy on the way out is therefore the only way a chosen identity reaches the target; the
+		// backend honours it (`should_preserve` requires `policy.on_behalf_of.is_some()`).
+		getAppByPath: async (p) => {
+			const app = await AppService.getAppByPath(p)
+			if (!appIdentity) return app
+			return {
+				...app,
+				policy: {
+					...app.policy,
+					on_behalf_of: appIdentity.permissionedAs,
+					on_behalf_of_email: appIdentity.email
+				}
+			}
+		},
 		createApp: (p) => AppService.createApp(p),
-		updateApp: (p) => AppService.updateApp(p),
+		updateApp: (p) => (conflict ? refuseUpdate() : AppService.updateApp(p)),
 		createAppRaw: (p) => AppService.createAppRaw(p),
-		updateAppRaw: (p) => AppService.updateAppRaw(p),
+		updateAppRaw: (p) => (conflict ? refuseUpdate() : AppService.updateAppRaw(p)),
 		getPublicSecretOfLatestVersionOfApp: (p) => AppService.getPublicSecretOfLatestVersionOfApp(p),
 		getRawAppData: (p) => AppService.getRawAppData(p),
 		deleteApp: (p) => AppService.deleteApp(p),
@@ -267,6 +329,20 @@ export interface DeployItemParams {
 	 * If undefined, the deploying user's identity is used.
 	 */
 	onBehalfOf?: string
+	/**
+	 * Authorization half of `onBehalfOf` (u/username or g/group). Must name the same identity as
+	 * `onBehalfOf`. Set it only when the user picked a specific user; undefined clears the key,
+	 * leaving the backend to derive the target workspace's own principal from `onBehalfOf`. Apps
+	 * additionally need it in the policy, which holds both formats — see `makeProvider`.
+	 */
+	onBehalfOfPrincipal?: string
+	/**
+	 * Fail instead of overwriting when the target turns out to already have the item. The shared
+	 * deploy re-probes and silently switches to an update, so a caller that only means to create —
+	 * one acting on the item being absent — has to say so or it will overwrite whoever got there
+	 * between the two probes. The result then carries `conflict`.
+	 */
+	createOnly?: boolean
 }
 
 /**
@@ -274,8 +350,19 @@ export interface DeployItemParams {
  * `DeployKind` union plus the legacy generic `'trigger'` from `DeployWorkspace.svelte`,
  * which carries its sub-kind in `additionalInformation`.
  */
-export async function deployItem(params: DeployItemParams): Promise<DeployResult> {
-	const { kind, path, workspaceFrom, workspaceTo, additionalInformation, onBehalfOf } = params
+export async function deployItem(
+	params: DeployItemParams
+): Promise<DeployResult & { conflict?: boolean }> {
+	const {
+		kind,
+		path,
+		workspaceFrom,
+		workspaceTo,
+		additionalInformation,
+		onBehalfOf,
+		onBehalfOfPrincipal,
+		createOnly
+	} = params
 
 	if (kind === 'trigger') {
 		// Legacy path: `DeployWorkspace.svelte` doesn't know the per-kind trigger
@@ -313,14 +400,84 @@ export async function deployItem(params: DeployItemParams): Promise<DeployResult
 		}
 	}
 
-	return sharedDeployItem(
-		makeProvider(),
+	const appIdentity =
+		(kind === 'app' || kind === 'raw_app') && onBehalfOf && onBehalfOfPrincipal
+			? { email: onBehalfOf, permissionedAs: onBehalfOfPrincipal }
+			: undefined
+	const conflict: DeployConflict | undefined = createOnly ? { hit: false } : undefined
+	const result = await sharedDeployItem(
+		makeProvider(onBehalfOfPrincipal, appIdentity, conflict),
 		kind as DeployKind,
 		path,
 		workspaceFrom,
 		workspaceTo,
 		onBehalfOf
 	)
+	return conflict?.hit ? { ...result, conflict: true } : result
+}
+
+/**
+ * The two sides of a `workspace_diff` row a deploy direction reads:
+ * `exists_in_source` is the parent (or arbitrary target) side, `exists_in_fork`
+ * the current workspace. `fork_last_event_*` is what the tally recorded for the
+ * fork's last write at this path, absent on a row that predates the recording.
+ */
+type WorkspaceDiffSides = {
+	ahead: number
+	behind: number
+	exists_in_source: boolean
+	exists_in_fork: boolean
+	fork_last_event_kind?: 'write' | 'delete' | 'rename_from'
+	fork_last_event_origin?: 'authored' | 'sync'
+}
+
+/** Deploying this row creates the item in the target, which does not have it. */
+export function diffCreatesInTarget(diff: WorkspaceDiffSides, mergeIntoParent: boolean): boolean {
+	return mergeIntoParent ? diff.exists_in_source === false : diff.exists_in_fork === false
+}
+
+/**
+ * Deploying this row removes the item in the target, the only side that has it.
+ * A removal is always opt-in (never bulk-selected): the row states what deploying
+ * does, and for the merge direction `diffForkDroppedItem` is what justifies
+ * offering it at all.
+ */
+export function diffRemovesInTarget(diff: WorkspaceDiffSides, mergeIntoParent: boolean): boolean {
+	return mergeIntoParent ? diff.exists_in_fork === false : diff.exists_in_source === false
+}
+
+/**
+ * The fork dropped the item on purpose — someone deleted it, or renamed it away.
+ * The counters cannot show this (they count writes on a side without saying what
+ * they were), so only the recorded event does: a sync-origin removal is a git-sync
+ * revert rather than a fork decision, and an unrecorded one is no evidence at all.
+ */
+export function diffForkDroppedItem(diff: WorkspaceDiffSides): boolean {
+	return (
+		diff.fork_last_event_origin === 'authored' &&
+		(diff.fork_last_event_kind === 'delete' || diff.fork_last_event_kind === 'rename_from')
+	)
+}
+
+/**
+ * Rows a deploy in this direction can act on. A merge carries what the fork *has*,
+ * plus what it can show it dropped; an item the fork merely never received is no
+ * fork change. The update direction takes a parent-only row whatever the counters
+ * say. An arbitrary target merges one unconditionally — that one-way sync has no
+ * tally, so target-only does mean "remove".
+ */
+export function diffActionableInDirection(
+	diff: WorkspaceDiffSides,
+	mergeIntoParent: boolean,
+	isArbitraryTarget: boolean = false
+): boolean {
+	if (mergeIntoParent) {
+		if (!isArbitraryTarget && diff.exists_in_fork === false && !diffForkDroppedItem(diff)) {
+			return false
+		}
+		return diff.ahead > 0
+	}
+	return diff.behind > 0 || diffCreatesInTarget(diff, mergeIntoParent)
 }
 
 /**
@@ -393,6 +550,159 @@ export async function getOnBehalfOf(
 	return sharedGetOnBehalfOf(makeProvider(), kind as DeployKind, path, workspace)
 }
 
+/**
+ * `getOnBehalfOf` without its swallow-and-return-undefined. A caller that offers an identity choice
+ * only when the source has one must be able to tell "carries no identity" from "could not read it":
+ * conflating them silently reassigns the deployed item to whoever deployed it.
+ */
+export async function getOnBehalfOfOrThrow(
+	kind: 'script' | 'flow' | 'app' | 'raw_app',
+	path: string,
+	workspace: string
+): Promise<string | undefined> {
+	const provider = makeProvider()
+	if (kind === 'flow') return (await provider.getFlowByPath({ workspace, path })).on_behalf_of_email
+	if (kind === 'script')
+		return (await provider.getScriptByPath({ workspace, path })).on_behalf_of_email
+	return (await provider.getAppByPath({ workspace, path })).policy?.on_behalf_of_email
+}
+
+/**
+ * Every workspace group, not just the first page.
+ *
+ * `listGroupNames` would be the obvious call but unions in instance groups, which folder rules do
+ * not resolve against — a same-named instance group would let an unusable rule through. `listGroups`
+ * reads the workspace's own `group_` rows, which is what the server checks, but it paginates: a
+ * group missed here reads as "no account in the target", which now refuses a folder copy outright.
+ */
+async function workspaceGroupNames(workspace: string): Promise<Set<string>> {
+	const PER_PAGE = 1000
+	const names = new Set<string>()
+	// Stops on a short page; the size check is the backstop for a server that ignores `page`.
+	for (let page = 1; page <= 50; page++) {
+		const batch = await GroupService.listGroups({ workspace, page, perPage: PER_PAGE })
+		const before = names.size
+		batch.forEach((g) => names.add(g.name))
+		if (batch.length < PER_PAGE || names.size === before) break
+	}
+	return names
+}
+
+/**
+ * Resolve a source-workspace principal into the same person or group as the target names them.
+ *
+ * A `u/<username>` is workspace-local: the same username in the target can be a different account,
+ * so copying one verbatim can hand a folder — or an item's execution identity — to a namesake. Email
+ * is the only identifier stable across workspaces, so users go source username -> email -> target
+ * username, and anyone without an account there resolves to undefined for the caller to deal with.
+ */
+async function principalTranslator(workspaceFrom: string, workspaceTo: string) {
+	const [fromUsers, toUsers, targetGroups] = await Promise.all([
+		// `list_users` is unpaginated, unlike the group listing below.
+		UserService.listUsers({ workspace: workspaceFrom }),
+		UserService.listUsers({ workspace: workspaceTo }),
+		workspaceGroupNames(workspaceTo)
+	])
+	const emailOfSourceUsername = new Map(fromUsers.map((u) => [u.username, u.email]))
+	const targetUsernameOfEmail = new Map(toUsers.map((u) => [u.email, u.username]))
+
+	/** The same principal as `workspaceTo` names it, or undefined when it has no account there. */
+	return (principal: string): string | undefined => {
+		if (principal.startsWith('u/')) {
+			const email = emailOfSourceUsername.get(principal.slice(2))
+			const username = email ? targetUsernameOfEmail.get(email) : undefined
+			return username ? `u/${username}` : undefined
+		}
+		if (principal.startsWith('g/')) {
+			return targetGroups.has(principal.slice(2)) ? principal : undefined
+		}
+		// An email is already workspace-independent; it only has to name someone there.
+		return targetUsernameOfEmail.has(principal) ? principal : undefined
+	}
+}
+
+export type CreateFolderResult = DeployResult & {
+	/** Access dropped because its principal has no account in the target, if any. */
+	droppedAccess?: string[]
+}
+
+/**
+ * Copy a folder into `workspaceTo`, creating it and never updating it.
+ *
+ * `deployItem` re-probes and switches to `updateFolder` when the folder turns out to exist, which
+ * would replace its owners and ACL with the source's. For a folder the user asked to deploy that is
+ * the point; for one created on their behalf to give an item somewhere to land it would silently
+ * rewrite the permissions of a folder someone else just created. Losing that race is success here —
+ * the folder exists, which is all the caller needed.
+ *
+ * Every principal is translated into the target's own naming (see `principalTranslator`), and the
+ * two kinds of unresolvable principal are treated differently because they fail differently:
+ *
+ *  - an **owner or ACL entry** with no account in the target is dropped. The folder ends up more
+ *    restrictive than its source, never less, and `create_folder` makes the caller an owner, so
+ *    nobody is locked out of what they just created.
+ *  - an **identity rule** with no account in the target refuses the whole copy. Dropping it would
+ *    leave the folder applying no rule where the source applied one, so an item landing inside runs
+ *    as whoever deployed it — the silent substitution this prompt exists to prevent — and carrying
+ *    it verbatim is worse still: the server validates a rule's shape at folder-create time but its
+ *    principal's existence at item-create time, so the folder would be created and then reject
+ *    every deploy into it, including the retry.
+ *
+ * `default_permissioned_as` and `labels` are carried at all, which the shared folder deploy drops.
+ */
+export async function createFolderIfAbsent(
+	name: string,
+	workspaceFrom: string,
+	workspaceTo: string
+): Promise<CreateFolderResult> {
+	try {
+		const folder = await FolderService.getFolder({ workspace: workspaceFrom, name })
+		const rules = folder.default_permissioned_as ?? []
+		const owners = folder.owners ?? []
+		const acl = Object.entries((folder.extra_perms ?? {}) as Record<string, boolean>)
+		const translate = await principalTranslator(workspaceFrom, workspaceTo)
+
+		const unresolvableRule = rules.map((r) => r.permissioned_as).find((p) => !translate(p))
+		if (unresolvableRule) {
+			return {
+				success: false,
+				error:
+					`f/${name} runs items on behalf of ${unresolvableRule}, which has no account in ` +
+					`the target workspace. Bring the folder across from the compare page first.`
+			}
+		}
+
+		const droppedAccess = [...owners, ...acl.map(([p]) => p)].filter((p) => !translate(p))
+		await FolderService.createFolder({
+			workspace: workspaceTo,
+			requestBody: {
+				name,
+				owners: owners.map(translate).filter((p): p is string => !!p),
+				extra_perms: Object.fromEntries(
+					acl.flatMap(([p, write]) => {
+						const t = translate(p)
+						return t ? [[t, write] as const] : []
+					})
+				),
+				summary: folder.summary ?? undefined,
+				default_permissioned_as: rules.map((r) => ({
+					...r,
+					permissioned_as: translate(r.permissioned_as)!
+				})),
+				labels: folder.labels
+			}
+		})
+		return { success: true, droppedAccess: droppedAccess.length ? droppedAccess : undefined }
+	} catch (e) {
+		// The name conflict a concurrent create produces is not part of the API contract, so ask
+		// again rather than matching its message.
+		try {
+			if (await checkItemExists('folder', `f/${name}`, workspaceTo)) return { success: true }
+		} catch {}
+		return { success: false, error: `${e}` }
+	}
+}
+
 export type DeployPermission = { ok: boolean; reason?: string }
 
 /**
@@ -406,9 +716,13 @@ export type DeployPermission = { ok: boolean; reason?: string }
  * Fails open on any error — the server still enforces on the actual deploy.
  * Shared by the session dock and the compare page so both gate identically.
  */
-export async function checkDeployPermission(workspace: string): Promise<DeployPermission> {
+export async function checkDeployPermission(
+	workspace: string,
+	/** Pre-fetched `whoami` for `workspace`, to save a round trip when the caller already has one. */
+	whoami?: User
+): Promise<DeployPermission> {
 	try {
-		const me = await UserService.whoami({ workspace })
+		const me = whoami ?? (await UserService.whoami({ workspace }))
 		if (me.operator) {
 			return { ok: false, reason: "You're an operator in this workspace — operators can't deploy" }
 		}
@@ -431,3 +745,75 @@ export async function checkDeployPermission(workspace: string): Promise<DeployPe
 		return { ok: true }
 	}
 }
+
+/**
+ * Whether `me` may write at `path` in `workspace` — the per-item half of the deploy gate, which
+ * `checkDeployPermission`'s workspace-level rules don't cover. Advisory only: it exists so the UI
+ * can refuse with a reason instead of letting the write fail, and the server stays the enforcement
+ * point. Same fail-open contract — every uncertain answer is `ok`.
+ *
+ * `me.folders` is the target workspace's *write* set, so a folder absent from it is one this user
+ * can read at most. `folderExists` is injected so the decision can be exercised without a backend.
+ */
+export async function checkPathWritePermission(
+	workspace: string,
+	path: string,
+	me: Pick<User, 'is_admin' | 'username' | 'folders'>,
+	folderExists: (folderPath: string) => Promise<boolean> = (folderPath) =>
+		checkItemExists('folder', folderPath, workspace)
+): Promise<DeployPermission> {
+	if (me.is_admin) return { ok: true }
+	const owner = path.match(/^u\/([^/]+)\//)?.[1]
+	if (owner) {
+		return owner === me.username
+			? { ok: true }
+			: {
+					ok: false,
+					reason: `${path} is owned by u/${owner} — only they or a workspace admin can write there`
+				}
+	}
+	const folder = path.match(/^f\/([^/]+)\//)?.[1]
+	if (!folder || me.folders?.includes(folder)) return { ok: true }
+	try {
+		// A folder the target doesn't have yet is created by the deploy, with the deployer as its
+		// owner — lacking write access to something that doesn't exist isn't a refusal.
+		if (!(await folderExists(`f/${folder}`))) return { ok: true }
+	} catch {
+		// Inconclusive: let the deploy decide rather than refusing on a failed probe.
+		return { ok: true }
+	}
+	return { ok: false, reason: `You don't have write access to folder ${folder}` }
+}
+
+export type DeployTargetAccess = {
+	permission: DeployPermission
+	/** Whether the user may hand the item an identity other than their own. */
+	canPreserveOnBehalfOf: boolean
+	/** The caller as `workspace` knows them — usernames are per-workspace, emails are not. */
+	me?: AppIdentity
+}
+
+/**
+ * What the target workspace says about landing one item in it: the workspace-level gate, write
+ * access to the item's path, and whether another identity may be preserved. Bundled so one `whoami`
+ * answers all of it, and so a refusal is known before the deploy rather than as a 403 on confirm.
+ */
+export async function checkItemDeployAccess(
+	workspace: string,
+	path: string
+): Promise<DeployTargetAccess> {
+	let me: User
+	try {
+		me = await UserService.whoami({ workspace })
+	} catch {
+		return { permission: { ok: true }, canPreserveOnBehalfOf: false }
+	}
+	const workspaceLevel = await checkDeployPermission(workspace, me)
+	return {
+		permission: workspaceLevel.ok
+			? await checkPathWritePermission(workspace, path, me)
+			: workspaceLevel,
+		canPreserveOnBehalfOf: me.is_admin || (me.groups ?? []).includes('wm_deployers'),
+		me: { email: me.email, permissionedAs: `u/${me.username}` }
+	}
+}
diff --git a/frontend/src/lib/workspaceProtectionRules.svelte.ts b/frontend/src/lib/workspaceProtectionRules.svelte.ts
index 9bca16005f..40eeee719b 100644
--- a/frontend/src/lib/workspaceProtectionRules.svelte.ts
+++ b/frontend/src/lib/workspaceProtectionRules.svelte.ts
@@ -6,6 +6,11 @@ import type { UserExt } from './stores'
 // UserExt store value.
 export type RuleBypassUser = Pick<UserExt, 'is_admin' | 'username' | 'groups'>
 
+// Mirrors DEV_WORKSPACE_LOCK_RULE_NAME in windmill-common. The pairing owns this rule by name:
+// attaching a dev workspace creates it, detaching deletes it. The API refuses to create or delete
+// it, so the UI must not offer those two actions on it; its restrictions stay editable.
+export const DEV_WORKSPACE_LOCK_RULE_NAME = 'dev_workspace_lock'
+
 /**
  * Internal reactive state using Svelte 5 $state rune
  */
diff --git a/frontend/src/routes/(root)/(logged)/+layout.svelte b/frontend/src/routes/(root)/(logged)/+layout.svelte
index 9de1123ff9..ecb7b6c39b 100644
--- a/frontend/src/routes/(root)/(logged)/+layout.svelte
+++ b/frontend/src/routes/(root)/(logged)/+layout.svelte
@@ -20,6 +20,7 @@
 	import { SIDEBAR_BG, SIDEBAR_BG_DARK } from '$lib/components/sidebar/sidebarChrome'
 	import CriticalAlertModal from '$lib/components/sidebar/CriticalAlertModal.svelte'
 	import ForkConflictModal from '$lib/components/ForkConflictModal.svelte'
+	import UpdateDevWorkspaceModal from '$lib/components/UpdateDevWorkspaceModal.svelte'
 	import {
 		enterpriseLicense,
 		isPremiumStore,
@@ -29,6 +30,7 @@
 		userStore,
 		workspaceStore,
 		userWorkspaces,
+		usersWorkspaceStore,
 		type UserExt,
 		defaultScripts,
 		hubBaseUrlStore,
@@ -39,7 +41,11 @@
 		whitelabelNameStore,
 		globalDbManagerDrawer,
 		globalForkModal,
-		globalS3FilePickerExplorer
+		globalS3FilePickerExplorer,
+		nonMemberWorkspaces,
+		setNonMemberWorkspaces,
+		clearNonMemberWorkspaces,
+		type UserWorkspace
 	} from '$lib/stores'
 	import CenteredModal from '$lib/components/CenteredModal.svelte'
 	import { afterNavigate, beforeNavigate } from '$app/navigation'
@@ -301,6 +307,13 @@
 				}
 			}
 			const user = await getUserExt(workspace)
+			// Every workspace change starts a fetch without cancelling the one before it,
+			// so a slow response can land after a faster one for the workspace the user
+			// has since moved to. The store must describe the active workspace: letting a
+			// superseded response write would leave every role gate reading the one we left.
+			if ($workspaceStore !== workspace) {
+				return
+			}
 			if (!deepEqual(user, $userStore)) {
 				userStore.set(user)
 			}
@@ -622,8 +635,15 @@
 			timeout = undefined
 		} else if (!u) {
 			timeout = setTimeout(async () => {
-				if (!$userStore && $workspaceStore) {
-					$userStore = await getUserExt($workspaceStore)
+				const ws = $workspaceStore
+				if (!$userStore && ws) {
+					const user = await getUserExt(ws)
+					// Recovers the workspace that was left without a role. A switch
+					// mid-flight has already started the fetch for the new one, so this
+					// answer describes the workspace we left.
+					if ($workspaceStore === ws) {
+						$userStore = user
+					}
 				}
 			}, 5000)
 		}
@@ -702,34 +722,70 @@
 	$effect(() => {
 		const ws = $workspaceStore
 		const list = $userWorkspaces
+		const memberships = $usersWorkspaceStore?.workspaces
+		const resolvedFor = $nonMemberWorkspaces?.forWorkspace
 		const isSuperadmin = $superadmin
-		untrack(() => void recordCurrentForkParent(ws, list, isSuperadmin))
+		untrack(() => void resolveCurrentWorkspace(ws, list, memberships, resolvedFor, isSuperadmin))
 	})
 
-	// A superadmin can open a fork they aren't a member of, including a prefixless
-	// dev workspace. The membership-gated list omits it, so `recordForkParent` can't
-	// see its parent — fetch it directly so the deleted-fork recovery still works.
-	async function recordCurrentForkParent(
+	// A superadmin can open a fork they aren't a member of, including a prefixless dev
+	// workspace, and only `getWorkspaceAsSuperAdmin` will hand back its lineage (see
+	// `nonMemberWorkspaces`). Membership is decided against the raw list, not
+	// `$userWorkspaces`: that one already carries what this resolves, so checking it
+	// would clear and re-fetch the entry on every pass.
+	async function resolveCurrentWorkspace(
 		ws: string | undefined,
 		list: typeof $userWorkspaces,
+		memberships: UserWorkspace[] | undefined,
+		resolvedFor: string | undefined,
 		isSuperadmin: string | false | undefined
 	): Promise<void> {
-		if (!ws) return
-		if (list.some((w) => w.id === ws)) {
-			recordForkParent(ws, list)
+		// Leaving every workspace (deleting the one you were in) has to drop the cache too:
+		// the other two paths below only fire once another workspace is open, and until then
+		// the workspace picker would keep offering the one that just went away.
+		if (!ws) {
+			clearNonMemberWorkspaces()
 			return
 		}
-		if (!isSuperadmin) return
+		if (list.some((w) => w.id === ws)) {
+			recordForkParent(ws, list)
+		}
+		// Absence from a list that hasn't arrived yet says nothing about membership.
+		if (memberships == undefined || resolvedFor === ws) return
+		if (memberships.some((w) => w.id === ws)) {
+			clearNonMemberWorkspaces()
+			return
+		}
+		// This effect re-runs while a fetch is in flight, and no such pass can see the
+		// result yet.
+		if (!isSuperadmin || resolvingWorkspace === ws) return
+		resolvingWorkspace = ws
 		try {
 			const workspace = await WorkspaceService.getWorkspaceAsSuperAdmin({ workspace: ws })
-			if (workspace.parent_workspace_id) {
-				rememberForkParent(ws, workspace.parent_workspace_id)
+			const parentId = workspace.parent_workspace_id
+			// The fork UI names the parent, which a superadmin is just as likely not to be
+			// a member of. One hop only: nothing above the parent is displayed.
+			const parent =
+				parentId && !memberships.some((w) => w.id === parentId)
+					? await WorkspaceService.getWorkspaceAsSuperAdmin({ workspace: parentId })
+					: undefined
+			// A switch during the fetch already resolved (or cleared) the store for the
+			// workspace now open; this answer describes the one we left.
+			if ($workspaceStore !== ws) return
+			setNonMemberWorkspaces(ws, parent ? [workspace, parent] : [workspace])
+			if (parentId) {
+				rememberForkParent(ws, parentId)
 			}
 		} catch {
-			// Best-effort: if we can't resolve the parent, recovery falls back to the
+			// Best-effort: if we can't resolve the workspace, recovery falls back to the
 			// workspace picker rather than the parent redirect.
+		} finally {
+			if (resolvingWorkspace === ws) {
+				resolvingWorkspace = undefined
+			}
 		}
 	}
+	let resolvingWorkspace: string | undefined = undefined
 	$effect(() => {
 		$workspaceStore && untrack(() => onLoad())
 	})
@@ -1334,6 +1390,7 @@
 				{children}
 				noPadding={devOnly || menuHidden}
 				disableAi={globalAiEnabled && !$userStore?.operator ? true : sessionMode}
+				loadAiConfig={!sessionMode}
 				showSessionsBetaBanner={!$userStore?.operator}
 				sidebarWidth={railWidth}
 				transitionClass={sidebarTransitionClass}
@@ -1358,6 +1415,8 @@
 
 <ForkConflictModal />
 
+<UpdateDevWorkspaceModal />
+
 <Modal2
 	title="Forking {$workspaceStore}"
 	target="#content"
diff --git a/frontend/src/routes/(root)/(logged)/assets/+page.svelte b/frontend/src/routes/(root)/(logged)/assets/+page.svelte
index 6967ff3d19..9237f32977 100644
--- a/frontend/src/routes/(root)/(logged)/assets/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/assets/+page.svelte
@@ -7,6 +7,7 @@
 	import Head from '$lib/components/table/Head.svelte'
 	import {
 		AssetService,
+		ScriptService,
 		SettingService,
 		WorkspaceService,
 		type AssetKind,
@@ -26,7 +27,11 @@
 	import AssetsUsageDrawer from '$lib/components/assets/AssetsUsageDrawer.svelte'
 	import AssetGenericIcon from '$lib/components/icons/AssetGenericIcon.svelte'
 	import { Tooltip } from '$lib/components/meltComponents'
-	import { AlertTriangle, Loader2, SettingsIcon, StarIcon } from 'lucide-svelte'
+	import { AlertTriangle, Loader2, SettingsIcon, StarIcon, TableProperties } from 'lucide-svelte'
+	import { previewDbtRows, type DbtPreview } from '$lib/components/dbt/previewRows'
+	import { nodeSelector } from '$lib/components/dbt/parseDbtRun'
+	import Drawer from '$lib/components/common/drawer/Drawer.svelte'
+	import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
 	import { StaleWhileLoading, useInfiniteQuery, useScrollToBottom } from '$lib/svelte5Utils.svelte'
 	import { resource, watch, type ResourceReturn } from 'runed'
 	import RefreshButton from '$lib/components/common/button/RefreshButton.svelte'
@@ -55,7 +60,8 @@
 		'variable',
 		'ducklake',
 		'datatable',
-		'volume'
+		'volume',
+		'dbt'
 	])
 
 	// FilterSearchbar setup
@@ -111,6 +117,113 @@
 	let s3FilePicker: S3FilePicker | undefined = $state()
 	let assetsUsageDropdown: AssetsUsageDrawer | undefined = $state()
 
+	// A `dbt://` asset's rows, previewed through the dbt project that writes it.
+	// The producer is the asset's own WRITE usage — a table nobody writes has no
+	// project to ask, and no `ref()` to resolve the relation with.
+	type AssetRow = { path: string; kind: string; usages: { path: string; kind: string; access_type?: string }[] }
+	function dbtProducerOf(asset: AssetRow): string | undefined {
+		if (asset.kind !== 'dbt') return undefined
+		// A DEFINITE writer. A bare `dbt://…` literal in a native script is stored
+		// with no access type at all, so treating "not read" as "writes" would pick
+		// a Python consumer — and previewing would then RUN that script and its side
+		// effects instead of `dbt show`. Its being a dbt script is checked before
+		// anything is submitted.
+		return asset.usages.find(
+			(u) => u.kind === 'script' && (u.access_type === 'w' || u.access_type === 'rw')
+		)?.path
+	}
+	let previewDrawer: Drawer | undefined = $state()
+	let previewTitle = $state('')
+	let preview = $state<DbtPreview | undefined>(undefined)
+	let previewSeq = 0
+	// A warehouse row can hold JSON, an array or a struct; `String()` renders those
+	// as `[object Object]`, which says less than nothing about the data.
+	function cell(v: unknown): string {
+		if (v == undefined) return ''
+		return typeof v === 'object' ? JSON.stringify(v) : String(v)
+	}
+	async function previewTable(asset: AssetRow) {
+		const ws = $workspaceStore
+		const script = dbtProducerOf(asset)
+		if (!ws || !script) return
+		previewTitle = asset.path.split('/').pop() ?? asset.path
+		preview = { pending: true }
+		previewDrawer?.openDrawer()
+		const seq = ++previewSeq
+		const fail = (error: string) => {
+			if (seq === previewSeq) preview = { error }
+		}
+		try {
+			// A relation outlives the script that wrote it: deleting a dbt script
+			// leaves its `usages` behind, and the raw 404 that follows says nothing
+			// about which script or why.
+			const producer = await ScriptService.getScriptByPath({
+				workspace: ws,
+				path: script
+			}).catch(() => undefined)
+			if (!producer) {
+				return fail(
+					`${script} is recorded as writing this table but no longer exists, so there is ` +
+						`nothing to preview it with.`
+				)
+			}
+			if (producer.language !== 'dbt') {
+				return fail(`${script} writes this table but is not a dbt script, so there is no model to preview.`)
+			}
+			// A project whose descriptor interpolates `{{ }}` needs those values to
+			// run at all, and this page has nowhere to ask for them. Say so instead
+			// of submitting a job that fails inside dbt.
+			const needs = (((producer.schema as any)?.required ?? []) as string[]).filter(
+				(r) => r !== 'command'
+			)
+			if (needs.length > 0) {
+				return fail(
+					`${script} takes run arguments (${needs.join(', ')}), so previewing it needs the ` +
+						`run form — open the script and run \`show\` there.`
+				)
+			}
+			// dbt selects by MODEL name; the asset path ends in the relation's name,
+			// which `alias`/`identifier` may have moved away from it. The graph
+			// carries the provenance, so ask it rather than guessing from the path.
+			//
+			// Pinned to THIS script's version, which is what makes the answer the
+			// right one: provenance keeps a single winner per relation workspace-wide,
+			// so where two projects write one table the unpinned graph may name the
+			// other project's model — and running this script with that selector
+			// previews a model it does not have.
+			const graph = await AssetService.getAssetsGraph({
+				workspace: ws,
+				assetKinds: 'dbt',
+				dbtScriptHash: String(producer.hash)
+			})
+			const uniqueId = graph.assets?.find(
+				(a: any) => a.kind === asset.kind && a.path === asset.path
+			)?.dbt?.unique_id
+			if (!uniqueId) {
+				return fail(
+					`${script} writes this table but its deployed version builds no model for it, ` +
+						`so there is nothing to preview.`
+				)
+			}
+			if (seq !== previewSeq) return
+			const res = await previewDbtRows({
+				workspace: ws,
+				scriptPath: script,
+				// The SAME version the selector came from: a deploy between the
+				// provenance lookup and this submission would otherwise run a newer
+				// project with the older one's model id, previewing a renamed
+				// relation or failing outright for one since removed.
+				scriptHash: producer.hash,
+				model: nodeSelector(uniqueId),
+				stillWanted: () => seq === previewSeq
+			})
+			if (seq === previewSeq && res) preview = res
+		} catch (e) {
+			fail(e instanceof Error ? e.message : String(e))
+		}
+	}
+
+
 	let allS3Storages = resource(
 		() => $workspaceStore,
 		() =>
@@ -386,6 +499,17 @@
 						{#if assetCanBeExplored(asset, asset.metadata) && !$userStore?.operator}
 							<ExploreAssetButton {asset} {s3FilePicker} _resourceMetadata={asset.metadata} />
 						{/if}
+						{#if dbtProducerOf(asset) && !$userStore?.operator}
+							<Button
+								size="xs2"
+								color="light"
+								variant="border"
+								startIcon={{ icon: TableProperties }}
+								on:click={() => previewTable(asset)}
+							>
+								Preview
+							</Button>
+						{/if}
 						{#if asset.kind === 'resource' && asset.metadata === undefined}
 							<Tooltip class={'w-24 flex items-center justify-center'}>
 								<AlertTriangle size={20} class="text-orange-600 dark:text-orange-500" />
@@ -410,3 +534,40 @@
 		</tbody>
 	</DataTable>
 {/snippet}
+
+<Drawer bind:this={previewDrawer} size="800px">
+	<DrawerContent title={`Rows of ${previewTitle}`} on:close={() => previewDrawer?.closeDrawer()}>
+		{#if preview && 'pending' in preview}
+			<div class="flex items-center gap-2 text-xs text-secondary">
+				<Loader2 size={14} class="animate-spin" /> Previewing the first rows…
+			</div>
+		{:else if preview && 'error' in preview}
+			<div class="text-xs text-red-600 dark:text-red-400">{preview.error}</div>
+		{:else if preview && 'rows' in preview}
+			{#if preview.rows.length === 0}
+				<div class="text-xs text-secondary">No rows.</div>
+			{:else}
+				<div class="overflow-auto">
+					<table class="text-xs w-full">
+						<thead>
+							<tr>
+								{#each Object.keys(preview.rows[0]) as col}
+									<th class="text-left px-2 py-1 font-semibold border-b">{col}</th>
+								{/each}
+							</tr>
+						</thead>
+						<tbody>
+							{#each preview.rows as row}
+								<tr>
+									{#each Object.keys(preview.rows[0]) as col}
+										<td class="px-2 py-1 border-b font-mono">{cell(row[col])}</td>
+									{/each}
+								</tr>
+							{/each}
+						</tbody>
+					</table>
+				</div>
+			{/if}
+		{/if}
+	</DrawerContent>
+</Drawer>
diff --git a/frontend/src/routes/(root)/(logged)/flows/get/[...path]/+page.svelte b/frontend/src/routes/(root)/(logged)/flows/get/[...path]/+page.svelte
index fd9483f5d2..93d9c3d905 100644
--- a/frontend/src/routes/(root)/(logged)/flows/get/[...path]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/flows/get/[...path]/+page.svelte
@@ -21,6 +21,7 @@
 	import { isDeployable, ALL_DEPLOYABLE } from '$lib/utils_deployable'
 
 	import DetailPageLayout from '$lib/components/details/DetailPageLayout.svelte'
+	import OnBehalfOfBadge from '$lib/components/details/OnBehalfOfBadge.svelte'
 	import { goto } from '$lib/navigation'
 	import { base } from '$lib/base'
 	import { Badge as HeaderBadge, Alert } from '$lib/components/common'
@@ -76,7 +77,12 @@
 	import { twMerge } from 'tailwind-merge'
 	import CiTestResults from '$lib/components/CiTestResults.svelte'
 	import NoDirectDeployAlert from '$lib/components/NoDirectDeployAlert.svelte'
-	import { buildForkEditUrl, editInForkAllowed, editInForkLabel } from '$lib/utils/editInFork'
+	import {
+		buildForkEditUrl,
+		editInForkAllowed,
+		editInForkLabel,
+		onEditInForkClick
+	} from '$lib/utils/editInFork'
 	import { isCloudHosted } from '$lib/cloud'
 
 	let flow: Flow | undefined = $state()
@@ -315,9 +321,10 @@
 				label: editInForkLabel($workspaceStore, $userWorkspaces),
 				buttonProps: {
 					href: buildForkEditUrl('flow', flow.path),
+					onClick: (e: Event | undefined) => onEditInForkClick(e, 'flow', flow.path, { hasHref: true }),
 					unifiedSize: 'md',
 					variant: !showEditButtons ? 'default' : 'subtle',
-					startIcon: GitFork
+					startIcon: Pen
 				}
 			})
 		}
@@ -600,6 +607,11 @@
 			{#if $workspaceStore && flow}
 				<Star kind="flow" path={flow.path} summary={flow.summary} />
 			{/if}
+			<OnBehalfOfBadge
+				onBehalfOf={flow?.on_behalf_of}
+				onBehalfOfEmail={flow?.on_behalf_of_email}
+				kind="flow"
+			/>
 			{#if flow?.value?.priority != undefined}
 				<div class="hidden md:block">
 					<HeaderBadge color="blue" variant="outlined" size="xs">
diff --git a/frontend/src/routes/(root)/(logged)/forks/compare/+page.svelte b/frontend/src/routes/(root)/(logged)/forks/compare/+page.svelte
index 5f9d86ca21..a21fa36835 100644
--- a/frontend/src/routes/(root)/(logged)/forks/compare/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/forks/compare/+page.svelte
@@ -10,6 +10,7 @@
 		reconcileAfterWorkspaceChange
 	} from '$lib/components/sessions/sessionState.svelte'
 	import { useWorkspaceDrafts } from '$lib/workspaceDrafts.svelte'
+	import { diffActionableInDirection } from '$lib/utils_workspace_deploy'
 	import { page } from '$app/state'
 	import { userWorkspaces, workspaceStore } from '$lib/stores'
 	import { onDestroy, untrack } from 'svelte'
@@ -50,6 +51,10 @@
 	// prefix. Distinct from having a compare target: a root workspace has no parent
 	// yet can still be pointed at an arbitrary one.
 	const isFork = $derived(!!parentWorkspaceId)
+	// A dev workspace is a standing environment, torn down by detaching it in the
+	// dev-workspace settings — never by an archive/delete button sitting next to the
+	// merge it is here to perform.
+	const isDevWorkspace = $derived(!!currentWorkspaceData?.is_dev_workspace)
 	const hasCompareTarget = $derived(!!compareTargetId)
 
 	// Mode is seeded from the URL (?mode=draft|fork). `draft` is valid for any
@@ -65,7 +70,12 @@
 	// Which fork direction to restore when switching back from draft mode. The
 	// merged toggle (CompareModeToggle, rendered inside each card) reports its
 	// selection here; the page only swaps which comparison component is shown.
-	let forkDirection = $state<'deploy_to' | 'update'>('deploy_to')
+	// `?dir=update` opens on the other one, for callers that already know which
+	// direction has something in it (the fork banner's CTA, the "not in the dev
+	// workspace yet" prompt).
+	let forkDirection = $state<'deploy_to' | 'update'>(
+		page.url.searchParams.get('dir') === 'update' ? 'update' : 'deploy_to'
+	)
 
 	// Explicit preselection via `?items=<kind:path,...>` (built by the chat's
 	// open_page tool). Parsed synchronously from the live URL so it can never race
@@ -149,17 +159,21 @@
 	)
 
 	// Per-direction counts for the merged toggle badges. Deployable = items ahead
-	// (fork has changes the parent lacks); updateable = items behind. Computed
-	// here so they show on the toggle in draft mode too (where CompareDrafts has
-	// no comparison data of its own). Typed helpers avoid a $state `never`
-	// inference quirk on `comparison` inside $derived. A conflict (ahead AND
-	// behind) is intentionally counted in both directions — it's actionable either
-	// way.
-	function countDir(c: WorkspaceComparison | undefined, dir: 'ahead' | 'behind'): number {
-		return c?.diffs.filter((d) => d[dir] > 0).length ?? 0
+	// (fork has changes the parent lacks); updateable = items behind, plus what the
+	// parent has and the fork does not. Same predicate as the deploy list, so the
+	// badge never counts rows the list won't show. Computed here so they show on the
+	// toggle in draft mode too (where CompareDrafts has no comparison data of its
+	// own). Typed helpers avoid a $state `never` inference quirk on `comparison`
+	// inside $derived. A conflict (ahead AND behind) is intentionally counted in both
+	// directions — it's actionable either way.
+	function countDir(c: WorkspaceComparison | undefined, mergeIntoParent: boolean): number {
+		return (
+			c?.diffs.filter((d) => diffActionableInDirection(d, mergeIntoParent, isArbitraryTarget))
+				.length ?? 0
+		)
 	}
-	const deployCount = $derived(countDir(comparison, 'ahead'))
-	const updateCount = $derived(countDir(comparison, 'behind'))
+	const deployCount = $derived(countDir(comparison, true))
+	const updateCount = $derived(countDir(comparison, false))
 
 	$effect(() => {
 		if (modeResolved || !currentWorkspaceData) return
@@ -379,10 +393,10 @@
 <CenteredPage>
 	<PageHeader title="Compare & Deploy">
 		<div class="flex flex-row gap-2 items-center">
-			<!-- The merged compare toggle (fork direction + deployed↔draft) now lives
-			     inside each comparison card; only the fork lifecycle actions remain
-			     in the page header. -->
-			{#if isFork}
+			<!-- The merged compare toggle (fork direction + deployed↔draft) lives inside
+			     each comparison card; only the fork lifecycle actions remain in the page
+			     header, and only for a throwaway fork. -->
+			{#if isFork && !isDevWorkspace}
 				<Button
 					variant="default"
 					color="light"
@@ -449,6 +463,7 @@
 				{draftKeys}
 				{chatMask}
 				{chatMaskReady}
+				maskAppliesToUpdate={urlItemsMask !== undefined}
 				onChanged={refreshCounts}
 				onModeSelected={selectMode}
 			/>
diff --git a/frontend/src/routes/(root)/(logged)/pipeline/+page.svelte b/frontend/src/routes/(root)/(logged)/pipeline/+page.svelte
index e15c3abdf7..1515040f18 100644
--- a/frontend/src/routes/(root)/(logged)/pipeline/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/pipeline/+page.svelte
@@ -3,6 +3,7 @@
 	import PipelineFolderList from '$lib/components/assets/AssetGraph/PipelineFolderList.svelte'
 	import PipelineSetupSignpost from '$lib/components/assets/AssetGraph/PipelineSetupSignpost.svelte'
 	import PipelineAlphaAckModal from '$lib/components/assets/AssetGraph/PipelineAlphaAckModal.svelte'
+	import PipelineDbtSignpost from '$lib/components/assets/AssetGraph/PipelineDbtSignpost.svelte'
 	import { BookOpen, NetworkIcon } from 'lucide-svelte'
 	import { onMount } from 'svelte'
 
@@ -79,6 +80,13 @@
 			{/if}
 
 			<PipelineFolderList />
+
+			<!-- Below the pipeline content on purpose: dbt is a separate runtime, not a
+			     way of building a pipeline, and reads as one when it sits in the flow
+			     that defines what a pipeline is. -->
+			{#if !$userStore?.operator}
+				<PipelineDbtSignpost />
+			{/if}
 		</div>
 	</div>
 </div>
diff --git a/frontend/src/routes/(root)/(logged)/pipeline/[folder]/+page.svelte b/frontend/src/routes/(root)/(logged)/pipeline/[folder]/+page.svelte
index 6123c07000..1015818896 100644
--- a/frontend/src/routes/(root)/(logged)/pipeline/[folder]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/pipeline/[folder]/+page.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
 	import { workspaceStore, userStore } from '$lib/stores'
+	import { PIPELINE_DRAFT_KIND, pipelineBundlePath } from '$lib/pipelinePaths'
 	import { base } from '$lib/base'
 	import { page } from '$app/state'
 	import Button from '$lib/components/common/button/Button.svelte'
@@ -36,6 +37,8 @@
 		type ColumnLineageGraph
 	} from '$lib/components/assets/AssetGraph/columnLineageGraph'
 	import { resolveGraph } from '$lib/components/assets/AssetGraph/resolveGraph'
+	import { normalizePipelineFolder } from '$lib/utils/pipelineFolder'
+	import { hideDbtRunnables } from '$lib/components/assets/AssetGraph/hideDbtRunnables'
 	import { buildSchemaContractContext } from '$lib/components/assets/AssetGraph/schemaContracts'
 	import {
 		computeDownstreamClosure,
@@ -123,7 +126,7 @@
 	// layout without adding lineage information.
 	const DATA_KINDS = DATA_ASSET_KINDS
 
-	let folder = $derived(page.params.folder as string)
+	let folder = $derived(normalizePipelineFolder(page.params.folder as string))
 
 	// Externalized editor state (drafts, live overlays, selection), shared with
 	// the in-session pipeline preview via PipelineEditorState. Referenced as
@@ -188,7 +191,8 @@
 		resource: '$res:',
 		ducklake: 'ducklake://',
 		datatable: 'datatable://',
-		volume: 'volume://'
+		volume: 'volume://',
+		dbt: 'dbt://'
 	}
 
 	// Path-input split for the insert menu: a read-only `f/<folder>/` chip
@@ -252,7 +256,7 @@
 
 	// Draft autosave (the data_pipeline DraftService bundle) lives inside
 	// PipelineGraphEditor now; the route just supplies its path to the indicator.
-	let pipelineDraftPath = $derived(`f/${folder}/data_pipeline`)
+	let pipelineDraftPath = $derived(pipelineBundlePath(folder))
 
 	// The live editor overlays (annotations / body assets / content for the open
 	// script) now live in `pe`. The canonical "empty" literals stay here — they
@@ -1412,12 +1416,12 @@
 	// other's storage writes.
 	let cascadeRunningRoot = $state<string | undefined>(undefined)
 
-	// Recorder: when armed, the next cascade run captures the resolved graph, the
-	// per-node status timeline and each node's job stream into a downloadable
-	// recording that the /pipeline_replay player can rerun offline (parity with the
-	// flow/script recorders). Job capture (`watchJob`) and status capture
-	// (`recordStatuses`) no-op unless the store is active, so the cascade run
-	// paths call them unconditionally.
+	// Recorder: when armed, the next cascade run captures the resolved graph and
+	// the per-node status timeline into a downloadable recording that the
+	// /pipeline_replay player can rerun offline (parity with the flow/script
+	// recorders); each node's completed job is fetched when the run finalizes.
+	// Status capture (`recordStatuses`) no-ops unless the store is active, so
+	// the cascade run paths call it unconditionally.
 	let pipelineRecording = createPipelineRecording()
 	let recordingMode = $state(false)
 	let lastPipelineRecording = $state<PipelineRecording | undefined>(undefined)
@@ -1787,8 +1791,6 @@
 				launch: async (path) => {
 					const jobId = await launchCascadeScript(path)
 					activeRunnables.arm(`script:${path}`)
-					// No-op unless a recording is active; captures the node's stream.
-					if ($workspaceStore) pipelineRecording.watchJob(jobId, $workspaceStore)
 					if (firstJobId === undefined) {
 						firstJobId = jobId
 						runsPendingJobId = jobId
@@ -1964,6 +1966,15 @@
 	// running a draft via runScriptPreview creates a `preview`-kind job at
 	// the same path, which the panel's listing query picks up.
 	let selectionProducers = $derived(assetProducers(graphWithDraft, pe.selection))
+	// dbt provenance of the selected relation: the details pane renders the
+	// model's own SQL from it. Looked up on the asset, not the producer — a
+	// relation carries one description whichever script materializes it.
+	let selectionDbt = $derived.by(() => {
+		const sel = pe.selection
+		if (sel?.kind !== 'asset') return undefined
+		return graphWithDraft?.assets?.find((a) => a.kind === sel.asset_kind && a.path === sel.path)
+			?.dbt
+	})
 
 	// Empty graph reused when the trace isn't shown (no ducklake-asset selection,
 	// or a draft is actively edited) so the pane blanks out like the other
@@ -2221,7 +2232,7 @@
 				signal
 			})
 			if (!res.ok) throw new Error(`GET /assets/graph → ${res.status}`)
-			return (await res.json()) as AssetGraphResponse
+			return hideDbtRunnables((await res.json()) as AssetGraphResponse)
 		}
 	)
 
@@ -2488,7 +2499,7 @@
 				{#if $workspaceStore}
 					<AutosaveIndicator
 						workspace={$workspaceStore}
-						itemKind="data_pipeline"
+						itemKind={PIPELINE_DRAFT_KIND}
 						path={pipelineDraftPath}
 						draftOnly
 						loadedFromDraft={pe.loadedFromDbDraft}
@@ -2585,6 +2596,7 @@
 				canRunByPath={openScriptHasDataUpload}
 				onRunByPath={runByPathLegit}
 				{selectionProducers}
+				{selectionDbt}
 				selectionColumnGraph={pe.activeDraft ? EMPTY_COLUMN_GRAPH : columnGraph}
 				{schemaCanEvolve}
 				{selectionForkMaterialization}
diff --git a/frontend/src/routes/(root)/(logged)/resources/+page.svelte b/frontend/src/routes/(root)/(logged)/resources/+page.svelte
index fb3dbacc2c..27fdd286b5 100644
--- a/frontend/src/routes/(root)/(logged)/resources/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/resources/+page.svelte
@@ -1372,7 +1372,11 @@
 
 <SupabaseConnect bind:this={supabaseConnect} on:refresh={loadResources} />
 <AppConnect bind:this={appConnect} on:refresh={loadResources} />
-<ResourceEditorDrawer bind:this={resourceEditor} on:refresh={loadResources} />
+<ResourceEditorDrawer
+	bind:this={resourceEditor}
+	on:refresh={loadResources}
+	onRestored={loadResources}
+/>
 
 <ShareModal
 	bind:this={shareModal}
diff --git a/frontend/src/routes/(root)/(logged)/run/[...run]/+page.svelte b/frontend/src/routes/(root)/(logged)/run/[...run]/+page.svelte
index a77a2f13ad..6894a69549 100644
--- a/frontend/src/routes/(root)/(logged)/run/[...run]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/run/[...run]/+page.svelte
@@ -37,9 +37,10 @@
 		Code2,
 		ClipboardCopy,
 		GitBranch,
-		GitFork,
 		EllipsisVertical,
-		Share2
+		Share2,
+		Globe,
+		Users
 	} from 'lucide-svelte'
 
 	import { isJobResolvable } from '$lib/utils'
@@ -49,6 +50,7 @@
 		rememberRerunOrigin
 	} from '$lib/components/runs/rerunResolution.svelte'
 	import DisplayResult from '$lib/components/DisplayResult.svelte'
+	import DbtRunGraph from '$lib/components/dbt/DbtRunGraph.svelte'
 	import DispatchEventsPanel from '$lib/components/runs/DispatchEventsPanel.svelte'
 	import UpstreamSnapshotsPanel from '$lib/components/runs/UpstreamSnapshotsPanel.svelte'
 	import {
@@ -102,8 +104,17 @@
 	import FlowRestartButton from '$lib/components/FlowRestartButton.svelte'
 	import { useNestedRestartState } from '$lib/components/useNestedRestartState.svelte'
 	import JobOtelTraces from '$lib/components/JobOtelTraces.svelte'
-	import { isRuleActive } from '$lib/workspaceProtectionRules.svelte'
-	import { buildForkEditUrl, editInForkAllowed, editInForkLabel } from '$lib/utils/editInFork'
+	import {
+		canUserBypassRuleKind,
+		isRuleActive,
+		protectionRulesState
+	} from '$lib/workspaceProtectionRules.svelte'
+	import {
+		buildForkEditUrl,
+		editInForkAllowed,
+		editInForkLabel,
+		onEditInForkClick
+	} from '$lib/utils/editInFork'
 	import { isCloudHosted } from '$lib/cloud'
 	let job: (Job & { result?: any; result_stream?: string }) | undefined = $state()
 	let jobUpdateLastFetch: Date | undefined = $state()
@@ -204,6 +215,22 @@
 		}
 	}
 
+	async function sharePublicLink(id: string): Promise<void> {
+		try {
+			const workspace = $workspaceStore!
+			const token = (await JobService.getJobPublicViewToken({ workspace, id })).trim()
+			// The workspace is a path segment here: the public run page is outside the
+			// logged layout and has no workspace store to fall back on.
+			const url = `${window.location.origin}${base}/public_run/${encodeURIComponent(
+				workspace
+			)}/${id}?view_token=${encodeURIComponent(token)}`
+			copyToClipboard(url)
+			sendUserToast('Public link copied to clipboard — anyone with it can view this run')
+		} catch (e) {
+			sendUserToast(`Failed to create public link: ${e}`, true)
+		}
+	}
+
 	async function deleteCompletedJob(id: string): Promise<void> {
 		await JobService.deleteCompletedJob({ workspace: $workspaceStore!, id })
 		getJob()
@@ -429,7 +456,10 @@
 	}
 
 	let runImmediatelyLoading = $state(false)
-	async function runImmediately() {
+	// An override may be a function, because the arguments it merges into are not
+	// known until they are here: a `WINDMILL_TOO_BIG` payload is a placeholder
+	// until fetched, and merging over that one drops what the fetch was for.
+	async function runImmediately(argsOverride?: ScriptArgs | ((args: ScriptArgs) => ScriptArgs)) {
 		runImmediatelyLoading = true
 		try {
 			let args = job?.args as ScriptArgs
@@ -439,6 +469,10 @@
 					id: job?.id!
 				})) as ScriptArgs
 			}
+			args =
+				typeof argsOverride === 'function'
+					? argsOverride(args ?? {})
+					: { ...args, ...(argsOverride ?? {}) }
 
 			const commonArgs = {
 				workspace: $workspaceStore!,
@@ -478,13 +512,65 @@
 			} else {
 				sendUserToast('Cannot run this job immediately', true)
 			}
+		} catch (err) {
+			// A refusal is the interesting case here: the worker rejects a `dbt
+			// retry` whose run is no longer the saved one, and a caller who saw
+			// nothing happen would just click again.
+			sendUserToast(`Could not create job: ${err}`, true)
 		} finally {
 			runImmediatelyLoading = false
 		}
 	}
 
+	// Whether a `dbt retry` submitted from here would resume THIS run: only the
+	// latest failure of a script is kept per principal, so a later run of it — or
+	// one that failed with nothing to rebuild — leaves this page's retry refused.
+	// Both entry points to it, the dropdown item and the graph's banner, ask.
+	let dbtResumable = $state(false)
+	$effect(() => {
+		const ws = $workspaceStore
+		const id = job?.id
+		const failed = job?.language === 'dbt' && job?.type === 'CompletedJob' && !job?.success
+		dbtResumable = false
+		if (!ws || !id || !failed) return
+		JobService.getDbtResumable({ workspace: ws, id })
+			.then((held) => {
+				// The page may have moved on, or the workspace changed, in flight.
+				if (job?.id === id && $workspaceStore === ws) dbtResumable = held === id
+			})
+			.catch(() => {})
+	})
+
+	// The retry goes through `runImmediately` so it carries the run's own arguments
+	// and resolved tag: worker tags, debounce and concurrency keys interpolate from
+	// the submitted arguments at enqueue, while the ones being resumed are restored
+	// later, inside the worker.
+	async function resumeDbtRun() {
+		// Merged INTO the run's own block, not put in its place: those fields are
+		// what a `$args[command.vars.tenant]` tag or concurrency key interpolates
+		// from at enqueue. The worker ignores them for a retry — it rebuilds with
+		// the arguments the failed run had — but the queue has already read them.
+		await runImmediately((args) => ({
+			...args,
+			command: {
+				...((args?.['command'] as Record<string, any> | undefined) ?? {}),
+				label: 'retry',
+				dbt_retry_job: job?.id
+			}
+		}))
+	}
+
 	let showEditButton = $derived(!isRuleActive('DisableDirectDeployment'))
 
+	// Admins always pass the backend gate. Everyone else fails closed while the rulesets
+	// are still loading, so the item is never briefly offered to a restricted user.
+	let canSharePublicly = $derived(
+		!!$userStore?.is_admin ||
+			!!$userStore?.is_super_admin ||
+			(protectionRulesState.rulesets !== undefined &&
+				canUserBypassRuleKind('RestrictPublicRunSharing', $userStore ?? undefined))
+	)
+
 	$effect(() => {
 		job?.id && lastJobId !== job.id && untrack(() => getConcurrencyKey(job))
 	})
@@ -663,15 +749,33 @@
 				{/if}
 			{/if}
 			{#if job}
-				<Button
-					variant="default"
-					unifiedSize="md"
-					startIcon={{ icon: Share2 }}
-					title="Copy a read-only share link to this run for another workspace member"
-					onclick={() => job && shareReadLink(job.id)}
+				<Dropdown
+					customWidth={280}
+					items={[
+						{
+							displayName: 'Copy link for members',
+							icon: Users,
+							tooltip:
+								'Read-only link to this run for another member of this workspace. They must be logged in.',
+							action: () => job && shareReadLink(job.id)
+						},
+						{
+							displayName: 'Copy public link',
+							icon: Globe,
+							disabled: !canSharePublicly,
+							tooltip: canSharePublicly
+								? "Read-only link that anyone on the internet can open, without logging in. It shows a minimal version of this page: this run's inputs, result and logs, and for a flow its graph plus every step's inputs, result, logs and code. The link cannot be revoked."
+								: 'Sharing a run publicly is restricted in this workspace. Ask an admin to share it, or to grant you a bypass on the ruleset.',
+							action: () => job && sharePublicLink(job.id)
+						}
+					]}
 				>
-					Share
-				</Button>
+					{#snippet buttonReplacement()}
+						<Button nonCaptureEvent variant="default" unifiedSize="md" startIcon={{ icon: Share2 }}>
+							Share
+						</Button>
+					{/snippet}
+				</Dropdown>
 			{/if}
 			{@const stem = job?.job_kind === 'script_hub' ? '/scripts' : `/${job?.job_kind}s`}
 			{@const viewHref = `${stem}/get/${isScript ? job?.script_hash : job?.script_path}`}
@@ -794,8 +898,14 @@
 			{#if job?.job_kind === 'script' || job?.job_kind === 'script_hub' || job?.job_kind === 'flow'}
 				<Button
 					on:click|once={async () => {
+						// The form this lands on rebuilds the whole project. When resuming
+						// THIS run is the cheaper thing to do, name it so the form can
+						// offer that in one click rather than leaving the reader to know.
+						const from = dbtResumable ? `?dbt_retry_from=${job?.id}` : ''
 						goto(
-							viewHref + `#${computeSharableHash(job?.args, await getRerunTagOverride(job?.args))}`
+							viewHref +
+								from +
+								`#${computeSharableHash(job?.args, await getRerunTagOverride(job?.args))}`
 						)
 					}}
 					unifiedSize="md"
@@ -803,6 +913,11 @@
 					startIcon={{ icon: RefreshCw }}
 					loading={runImmediatelyLoading}
 					dropdownItems={[
+						// A failed dbt run's cheap next step is resuming its failed and skipped
+						// nodes rather than rebuilding the project, and `dbt_command` is the
+						// only argument that differs. Offered first, and only while the saved
+						// failure is still this run — which is what `dbtResumable` answers.
+						...(dbtResumable ? [{ label: 'dbt retry with same args', onClick: resumeDbtRun }] : []),
 						{
 							label: 'Run immediately with same args',
 							onClick: () => runImmediately()
@@ -830,11 +945,14 @@
 					{#if !showEditButton && !isCloudHosted() && editInForkAllowed($workspaceStore, $userWorkspaces)}
 						<Button
 							href={buildForkEditUrl(isScript ? 'script' : 'flow', job?.script_path ?? '')}
+							onClick={(e) =>
+								onEditInForkClick(e, isScript ? 'script' : 'flow', job?.script_path ?? '', {
+									hasHref: true
+								})}
 							unifiedSize="md"
 							variant="default"
 							size="sm"
-							startIcon={{ icon: GitFork }}
-							>{editInForkLabel($workspaceStore, $userWorkspaces)}</Button
+							startIcon={{ icon: Pen }}>{editInForkLabel($workspaceStore, $userWorkspaces)}</Button
 						>
 					{/if}
 				{/if}
@@ -899,7 +1017,6 @@
 						{job}
 						{isOwner}
 						{suspendStatus}
-						workspaceId={job?.workspace_id}
 						innerModules={job?.flow_status?.modules}
 					/>
 				{/if}
@@ -972,6 +1089,25 @@
 					<JobProgressBar {job} {scriptProgress} class="py-4" hideStepTitle={true} />
 				{/if}
 
+				<!-- The models a dbt run touches, above its result: the run page is
+				     where you land on a running job, and the per-node table below
+				     only exists once the job has produced one. -->
+				{#if job?.language === 'dbt' && job?.script_path}
+					<div class="mr-2 sm:mr-0 mt-12">
+						<h3 class="text-xs font-semibold text-emphasis mb-1">Models</h3>
+						<DbtRunGraph
+							scriptPath={job.script_path}
+							jobId={job.id}
+							running={job.type !== 'CompletedJob'}
+							result={job.type === 'CompletedJob' ? job.result : undefined}
+							scriptHash={job.script_hash}
+							runArgs={job.args}
+							canResume={dbtResumable}
+							onResume={resumeDbtRun}
+						/>
+					</div>
+				{/if}
+
 				<!-- Result Section (moved outside tabs) -->
 				{#if job}
 					<div class="mr-2 sm:mr-0 mt-12 mb-6">
diff --git a/frontend/src/routes/(root)/(logged)/scripts/get/[...hash]/+page.svelte b/frontend/src/routes/(root)/(logged)/scripts/get/[...hash]/+page.svelte
index ff6b41bc1f..04c16c0acb 100644
--- a/frontend/src/routes/(root)/(logged)/scripts/get/[...hash]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/scripts/get/[...hash]/+page.svelte
@@ -40,6 +40,7 @@
 	} from '$lib/components/common'
 	import Skeleton from '$lib/components/common/skeleton/Skeleton.svelte'
 	import RunForm from '$lib/components/RunForm.svelte'
+	import DbtRunGraph from '$lib/components/dbt/DbtRunGraph.svelte'
 	import { goto } from '$lib/navigation'
 	import MoveDrawer from '$lib/components/MoveDrawer.svelte'
 
@@ -49,6 +50,7 @@
 
 	import SavedInputsV2 from '$lib/components/SavedInputsV2.svelte'
 	import DetailPageLayout from '$lib/components/details/DetailPageLayout.svelte'
+	import OnBehalfOfBadge from '$lib/components/details/OnBehalfOfBadge.svelte'
 	import DetailPageHeader from '$lib/components/details/DetailPageHeader.svelte'
 	import {
 		Activity,
@@ -89,7 +91,12 @@
 	import TriggersEditor from '$lib/components/triggers/TriggersEditor.svelte'
 	import { Triggers } from '$lib/components/triggers/triggers.svelte'
 	import { page } from '$app/state'
-	import { buildForkEditUrl, editInForkAllowed, editInForkLabel } from '$lib/utils/editInFork'
+	import {
+		buildForkEditUrl,
+		editInForkAllowed,
+		editInForkLabel,
+		onEditInForkClick
+	} from '$lib/utils/editInFork'
 	import { isCloudHosted } from '$lib/cloud'
 	import { isWorkflowAsCode } from '$lib/components/graph/wacToFlow'
 	import WacDiagram from '$lib/components/graph/WacDiagram.svelte'
@@ -359,6 +366,74 @@
 		}
 	}
 
+	// A dbt retry must name the run it resumes, and a job id is not something to
+	// type from memory: picking `retry` fills the field with the run this caller's
+	// retry would land on. Filled once per script, so clearing it stays cleared.
+	let dbtResumableAsked: string | undefined = $state(undefined)
+	$effect(() => {
+		const ws = $workspaceStore
+		const path = script?.path
+		const command = args?.['command'] as Record<string, any> | undefined
+		if (!ws || !path || script?.language !== 'dbt' || command?.label !== 'retry') return
+		if (command['dbt_retry_job'] || dbtResumableAsked === path) return
+		dbtResumableAsked = path
+		JobService.getDbtResumableForScript({ workspace: ws, path })
+			.then((held) => {
+				// The page may show another script, or another workspace, by now:
+				// filling THIS answer into that form aims its retry at a run of a
+				// script it is not, which only a reload could undo.
+				if ($workspaceStore !== ws || script?.path !== path) return
+				const current = untrack(() => args)
+				const block = current?.['command'] as Record<string, any> | undefined
+				if (!held || !current || block?.label !== 'retry' || block['dbt_retry_job']) return
+				args = { ...current, command: { ...block, dbt_retry_job: held } }
+				if (jsonView) {
+					runForm?.setCode(JSON.stringify(args, null, '\t'))
+				}
+			})
+			.catch(() => {})
+	})
+
+	// Arrived from a failed dbt run's `Run again`, which prefills the arguments it
+	// ran with — a whole-project rebuild. Resuming that run instead is usually
+	// what the reader wants and there is nothing on this form that says so, hence
+	// the offer. Confirmed against the run rather than trusted from the URL: only
+	// the latest failure of a script is resumable, and by the time the form opens
+	// another run may hold it.
+	let dbtRetryFrom: string | undefined = $state(undefined)
+	$effect(() => {
+		const ws = $workspaceStore
+		const from = page.url.searchParams.get('dbt_retry_from') ?? undefined
+		dbtRetryFrom = undefined
+		if (!ws || !from || script?.language !== 'dbt') return
+		JobService.getDbtResumable({ workspace: ws, id: from })
+			.then((held) => {
+				if ($workspaceStore === ws && held === from) dbtRetryFrom = from
+			})
+			.catch(() => {})
+	})
+
+	function useDbtRetry() {
+		const from = dbtRetryFrom
+		if (!from) return
+		// Merged, never replaced: a tag, concurrency key or debounce key may
+		// interpolate `command.vars`, and the QUEUE reads those at enqueue — long
+		// before the worker restores the failed run's own arguments. Dropping them
+		// here routes the retry by a different key than the run it resumes. Same
+		// as the run page's retry.
+		args = {
+			...(args ?? {}),
+			command: {
+				...((args?.['command'] as Record<string, any> | undefined) ?? {}),
+				label: 'retry',
+				dbt_retry_job: from
+			}
+		}
+		if (jsonView) {
+			runForm?.setCode(JSON.stringify(args, null, '\t'))
+		}
+	}
+
 	let moveDrawer: MoveDrawer | undefined = $state()
 	let deploymentDrawer: DeployWorkspaceDrawer | undefined = $state()
 	let persistentScriptDrawer: PersistentScriptDrawer | undefined = $state()
@@ -395,9 +470,10 @@
 				label: editInForkLabel($workspaceStore, $userWorkspaces),
 				buttonProps: {
 					href: buildForkEditUrl('script', script.path),
+					onClick: (e: Event | undefined) => onEditInForkClick(e, 'script', script.path, { hasHref: true }),
 					unifiedSize: 'md',
 					variant: !showEditButtons ? 'default' : 'subtle',
-					startIcon: GitFork
+					startIcon: Pen
 				}
 			})
 		}
@@ -723,6 +799,11 @@
 						></Badge
 					>
 				{/if}
+				<OnBehalfOfBadge
+					onBehalfOf={script?.on_behalf_of}
+					onBehalfOfEmail={script?.on_behalf_of_email}
+					kind="script"
+				/>
 				{#if script?.priority != undefined}
 					<div class="hidden md:block">
 						<Badge color="blue" variant="outlined" size="xs">
@@ -751,11 +832,15 @@
 				<NoDirectDeployAlert onUpdateCanEditStatus={(v) => (showEditButtons = v)} />
 			</div>
 			{#if script}
-				<div class={twMerge('flex flex-col', isWac ? 'h-full divide-y' : '')}>
+				{@const showsDbtGraph = script.language === 'dbt' && !!script.path}
+				<div class={twMerge('flex flex-col', isWac || showsDbtGraph ? 'h-full divide-y' : '')}>
 					<div
 						class={twMerge(
 							'p-8 w-full max-w-3xl overflow-y-auto mx-auto flex flex-col relative',
-							isWac ? 'max-h-1/2' : ''
+							isWac ? 'max-h-1/2' : '',
+							// The graph takes the rest of the pane, as a flow's does, so the form
+							// scrolls within its half instead of pushing the models off-screen.
+							showsDbtGraph ? 'shrink-0 max-h-1/2' : ''
 						)}
 					>
 						{#if script?.path}
@@ -856,6 +941,27 @@
 								</div>
 							{/if}
 
+							<!-- Landed here from a failed dbt run's `Run again`, which prefills a
+							     whole-project rebuild. Resuming that run is one click, and the
+							     form alone never says it is possible. -->
+							{#if dbtRetryFrom && (args?.['command'] as any)?.label !== 'retry'}
+								<div class="mb-2">
+									<Alert type="info" size="xs" title="This rebuilds the whole project">
+										<div class="flex flex-row gap-2 items-center flex-wrap">
+											<span>
+												The run you came from failed part-way. <span class="font-mono"
+													>dbt retry</span
+												>
+												rebuilds only its failed and skipped nodes, with the arguments it ran with.
+											</span>
+											<Button size="xs" variant="border" color="light" on:click={useDbtRetry}>
+												Retry that run instead
+											</Button>
+										</div>
+									</Alert>
+								</div>
+							{/if}
+
 							{#if script?.schema?.prompt_for_ai !== undefined}
 								<AIFormAssistant
 									instructions={script.schema?.prompt_for_ai as string}
@@ -911,7 +1017,16 @@
 							</div>
 						</div>
 					</div>
-					{#if isWac && script.content}
+					{#if showsDbtGraph}
+						<!-- The bottom of the pane, the way a flow's graph takes it: a dbt
+						     script's `content` is a descriptor, so what it BUILDS is the thing
+						     to look at. Pinned to the version on screen and given no job, so
+						     this is the project as THIS deploy declared it; a node opens its
+						     SQL and previews its rows with whatever the form above holds. -->
+						<div class="grow min-h-0">
+							<DbtRunGraph scriptPath={script.path} scriptHash={script.hash} runArgs={args} fill />
+						</div>
+					{:else if isWac && script.content}
 						<div class="grow min-h-0" style="min-height: 400px;">
 							<WacDiagram code={script.content} language={script.language ?? ''} />
 						</div>
diff --git a/frontend/src/routes/(root)/(logged)/sessions/+page.svelte b/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
index 225bbec8ed..1abf9c2d18 100644
--- a/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
@@ -52,6 +52,7 @@
 	import { base } from '$lib/base'
 	import {
 		artifactKey,
+		itemDisplayName,
 		matchPreviewPage,
 		pageKey,
 		parseArtifactRoute,
@@ -60,7 +61,12 @@
 		type PreviewTarget
 	} from '$lib/components/sessions/previewRouter'
 	import { toolReloadEffect, tabsToReload } from '$lib/components/sessions/previewReload'
-	import { leafKeyFor, type WorkspaceItem } from '$lib/components/workspacePicker'
+	import {
+		leafKeyFor,
+		loadKind,
+		type WorkspaceItem,
+		type WorkspaceItemKind
+	} from '$lib/components/workspacePicker'
 	import { splitterPointerCapture } from '$lib/utils/splitterPointerCapture'
 
 	const globalEnabled = isGlobalAiEnabled()
@@ -299,7 +305,11 @@
 	// Adapt the session tab model to DraggableTabs items (labels derived from the
 	// observed location; every tab closable, none pinned).
 	const previewTabItems = $derived<TabItem[]>(
-		(owner?.tabs ?? []).map((t) => ({ id: t.id, label: tabLabelFor(t) }))
+		(owner?.tabs ?? []).map((t) => ({
+			id: t.id,
+			label: tabLabelFor(t, previewWorkspace ?? ''),
+			title: tabTitleFor(t, previewWorkspace ?? '')
+		}))
 	)
 	let newTabOpen = $state(false)
 	// Separate open flag for the empty-state launcher: it can be mounted at the
@@ -308,6 +318,12 @@
 	let emptyStateNewTabOpen = $state(false)
 
 	let fullscreen = $state(false)
+	// Fullscreen is page state, not per-session, so it outlives a session switch —
+	// tell the incoming session's model, whose own collapsed flag it overrides, or
+	// re-opening the item plainly on screen would be judged invisible and not flash.
+	$effect(() => {
+		owner?.setFullscreen(fullscreen)
+	})
 	// Collapse the preview panel to give the chat the full width. Per-session and
 	// owned by the runtime's previewTabs (restored on switch, written back on
 	// toggle) so it survives session switches with the rest of the tab model.
@@ -467,8 +483,7 @@
 	// (or focus, if already shown) the item's preview in the active session's panel —
 	// the visible chat is always the active session, so `owner` is its panel. Read
 	// `owner` lazily inside the handler (not in the effect body) so this registers
-	// once, not on every session switch. A 'focused' open leaves the tab where it is,
-	// so pulse it to make the click visibly land.
+	// once, not on every session switch.
 	$effect(() => {
 		return registerToolDisplayActionHandler('open_item_preview', (action) => {
 			if (action.type !== 'open_item_preview') return
@@ -476,8 +491,7 @@
 			if (!o) return
 			const target = previewTargetForSessionTarget(action.previewKind, action.path)
 			if (!target) return
-			const { status } = o.open(target)
-			if (status === 'focused') o.pulseFocus(o.activeId)
+			o.open(target)
 		})
 	})
 
@@ -547,12 +561,76 @@
 		owner?.navigate(target)
 	}
 
-	// Short tab label. A never-deployed item parked at `…/draft_<uuid>` carries a
-	// `friendlyLabel` its live editor stamped (the page can't read the runtime cell
-	// reactively; the editor mirrors the typed/auto name onto the tab model). Falls
-	// back to the plain location label for deployed items and non-item pages.
-	function tabLabelFor(tab: SessionPreviewTab): string {
-		return tab.friendlyLabel ?? previewLocationLabel(tab.loc)
+	// Names for the active session's item tabs, read from the same workspace
+	// listing the pickers use (module-cached, so an opened picker makes this free).
+	// The mounted editor's stamp is the live source, but it only fires for a tab
+	// the user has visited — without this, restoring a session shows a path leaf on
+	// every unvisited tab, each popping to its real name when first clicked.
+	// Requested keys are tracked outside the state so filling the map can't re-run
+	// the effect that fills it, and a key is released again on failure so a
+	// transient network error doesn't strand every unvisited tab on its path leaf
+	// for the lifetime of the page.
+	const listedItemsRequested = new Set<string>()
+	let listedItems = $state<Record<string, WorkspaceItem[]>>({})
+	const listedKey = (workspace: string, kind: WorkspaceItemKind) => `${workspace}:${kind}`
+	$effect(() => {
+		const ws = previewWorkspace
+		if (!ws) return
+		for (const tab of owner?.tabs ?? []) {
+			const route = parsePreviewItemRoute(tab.loc)
+			if (!route) continue
+			const key = listedKey(ws, route.kind)
+			if (listedItemsRequested.has(key)) continue
+			listedItemsRequested.add(key)
+			void loadKind(ws, route.kind)
+				.then((items) => {
+					listedItems = { ...listedItems, [key]: items }
+				})
+				.catch((e) => {
+					listedItemsRequested.delete(key)
+					console.error(`Failed to load workspace ${route.kind}s`, e)
+				})
+		}
+	})
+
+	// Keyed by the tab's OWN session workspace, never the active one: every warm
+	// session's tabs are labelled here, and two sessions on different forks can
+	// hold the same item path.
+	function listedItemFor(tab: SessionPreviewTab, workspace: string): WorkspaceItem | undefined {
+		// A loaded editor supersedes the listing for good — including when it names
+		// nothing, else clearing a summary would resurrect the listing's copy of it.
+		if (tab.editorNamed) return undefined
+		const route = parsePreviewItemRoute(tab.loc)
+		if (!route) return undefined
+		return listedItems[listedKey(workspace, route.kind)]?.find((i) => i.path === route.itemPath)
+	}
+
+	// Short tab label. An item whose live editor has loaded carries a
+	// `friendlyLabel` that editor stamped — its summary, or the typed/auto name of
+	// an item still parked at `…/draft_<uuid>` (the page can't read the runtime
+	// cell reactively, so the editor mirrors the name onto the tab model). Before
+	// that, the workspace listing names it. Falls back to the plain location label
+	// for summary-less items and non-item pages.
+	function tabLabelFor(tab: SessionPreviewTab, workspace: string): string {
+		const listed = listedItemFor(tab, workspace)
+		return (
+			tab.friendlyLabel ??
+			(listed && itemDisplayName(listed.path, listed.draftPath, listed.summary)) ??
+			previewLocationLabel(tab.loc)
+		)
+	}
+
+	// Hover title for a tab. A summary label is free text the strip truncates, and
+	// it hides the path entirely, so the tooltip carries both. The path shown is
+	// the item's staged one when it has one — a draft's `…/draft_<uuid>` storage
+	// path names nothing to the reader.
+	function tabTitleFor(tab: SessionPreviewTab, workspace: string): string {
+		const label = tabLabelFor(tab, workspace)
+		const path =
+			tab.friendlyPath ??
+			listedItemFor(tab, workspace)?.draftPath ??
+			parsePreviewItemRoute(tab.loc)?.itemPath
+		return path && path !== label ? `${label}\n${path}` : label
 	}
 
 	// A link click inside a live editor (e.g. a subflow reference) re-points the
@@ -890,8 +968,9 @@
 											session={s}
 											runtime={rt}
 											active={s.id === activeSession?.id && tab.id === tabs?.activeId}
+											collapsed={(tabs?.collapsed ?? false) && !fullscreen}
 											mounted={mountedTabKeys.has(tabKey(s.id, tab.id))}
-											label={tabLabelFor(tab)}
+											label={tabLabelFor(tab, s.workspace_id ?? '')}
 											darkMode={isDarkMode.val}
 											{fullscreen}
 											onNavigate={navigateEditorTo}
diff --git a/frontend/src/routes/(root)/(logged)/workers/+page.svelte b/frontend/src/routes/(root)/(logged)/workers/+page.svelte
index c2de0b81d8..f7e0f07a54 100644
--- a/frontend/src/routes/(root)/(logged)/workers/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/workers/+page.svelte
@@ -624,6 +624,7 @@
 			lang="yaml"
 			class="h-full"
 			fixedOverflowWidgets={false}
+			leadingChangeSync
 		/>
 		{#snippet actions()}
 			<Button
@@ -676,6 +677,7 @@
 				lang="yaml"
 				class="h-full"
 				fixedOverflowWidgets={false}
+				leadingChangeSync
 			/>
 		{/if}
 		{#snippet actions()}
diff --git a/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte b/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte
index b93a4baf7a..782da1bb2c 100644
--- a/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte
@@ -65,6 +65,10 @@
 	import Trashbin from '$lib/components/settings/Trashbin.svelte'
 	import { untrack } from 'svelte'
 	import { getHandlerType } from '$lib/components/triggers/utils'
+	import DbtSettings, {
+		convertDbtSettingsFromBackend,
+		type DbtSettingsType
+	} from '$lib/components/workspaceSettings/DbtSettings.svelte'
 	import DucklakeSettings, {
 		convertDucklakeSettingsFromBackend,
 		type DucklakeSettingsType
@@ -251,6 +255,8 @@
 	let dataTableSettings: DataTableSettingsType = $state({ dataTables: [] })
 	let dataTableSettingsComponent: DataTableSettings | undefined = $state(undefined)
 
+	let dbtSettings: DbtSettingsType = $state({ warehouses: [] })
+	let dbtSavedSettings: DbtSettingsType = $state(untrack(() => dbtSettings))
 	let ducklakeSettings: DucklakeSettingsType = $state({ ducklakes: [] })
 	let ducklakeSavedSettings: DucklakeSettingsType = $state(untrack(() => ducklakeSettings))
 
@@ -379,6 +385,7 @@
 			| 'windmill_lfs'
 			| 'volume_storage'
 			| 'ducklake'
+			| 'dbt'
 			| 'git_sync'
 			| 'default_app'
 			| 'native_triggers'
@@ -641,6 +648,8 @@
 		)
 		s3ResourceSavedSettings = clone(s3ResourceSettings)
 		dataTableSettings = convertDataTableSettingsFromBackend(settings.datatable)
+		dbtSettings = convertDbtSettingsFromBackend(settings.dbt_warehouses)
+		dbtSavedSettings = clone(dbtSettings)
 		ducklakeSettings = convertDucklakeSettingsFromBackend(settings.ducklake)
 		ducklakeSavedSettings = clone(ducklakeSettings)
 
@@ -937,6 +946,13 @@
 		s3ResourceSettings.volumeStorage = s3ResourceSavedSettings.volumeStorage
 	}
 
+	function getDbtSettingsInitialAndModifiedValues() {
+		return {
+			savedValue: { dbtSettings: dbtSavedSettings },
+			modifiedValue: { dbtSettings: dbtSettings }
+		}
+	}
+
 	// Function to check if there are unsaved changes in ducklake settings
 	function getDucklakeSettingsInitialAndModifiedValues() {
 		return {
@@ -1079,6 +1095,8 @@
 				return getVolumeStorageInitialAndModifiedValues()
 			case 'ducklake':
 				return getDucklakeSettingsInitialAndModifiedValues()
+			case 'dbt':
+				return getDbtSettingsInitialAndModifiedValues()
 			case 'dev_workspace':
 				return getDeploySettingsInitialAndModifiedValues()
 			case 'webhook':
@@ -1144,6 +1162,9 @@
 			case 'windmill_data_tables':
 				dataTableSettingsComponent?.discard()
 				break
+			case 'dbt':
+				dbtSettings = clone(dbtSavedSettings)
+				break
 			case 'default_app':
 				discardDefaultAppSettingsChanges()
 				break
@@ -1277,6 +1298,12 @@
 					label: 'Ducklake',
 					aiId: 'workspace-settings-ducklake',
 					aiDescription: 'Ducklake workspace settings'
+				},
+				{
+					id: 'dbt',
+					label: 'dbt',
+					aiId: 'workspace-settings-dbt',
+					aiDescription: 'dbt warehouses workspace settings'
 				}
 			]
 		},
@@ -1385,49 +1412,55 @@
 								description="Pair this workspace with a dev workspace: the same code with a different environment. Edits are made in the dev workspace and promoted to prod."
 								link="https://www.windmill.dev/docs/core_concepts/staging_prod"
 							/>
-							<DevWorkspaceSetting />
-							{#if showDeployToTab}
-								<!-- The deploy filters only bite on a workspace that deploys into a
-								     parent; a root workspace promotes nowhere by lineage. -->
-								{#if $enterpriseLicense}
-									<DeployToSetting
-										bind:deployUiSettings
-										hasUnsavedChanges={hasDeploySettingsChanges}
-										parentWorkspaceId={currentWorkspace?.parent_workspace_id ?? undefined}
-										isDevWorkspace={currentWorkspace?.is_dev_workspace ?? false}
-										onSave={() => {
-											initialDeployUiSettings = clone(deployUiSettings)
-										}}
-										onDiscard={discardDeploySettingsChanges}
-									/>
-								{:else}
-									<div class="my-2"
-										><Alert type="warning" title="Enterprise license required"
-											>Deploy to staging/prod from the web UI is only available with an enterprise
-											license</Alert
-										></div
-									>
+							<!-- Positioned by DevWorkspaceSetting, not here — see its `deployTarget` prop. -->
+							{#snippet deployTarget()}
+								{#if showDeployToTab}
+									<!-- The deploy filters only bite on a workspace that deploys into a
+									     parent; a root workspace promotes nowhere by lineage. -->
+									{#if $enterpriseLicense}
+										<DeployToSetting
+											bind:deployUiSettings
+											hasUnsavedChanges={hasDeploySettingsChanges}
+											parentWorkspaceId={currentWorkspace?.parent_workspace_id ?? undefined}
+											isDevWorkspace={currentWorkspace?.is_dev_workspace ?? false}
+											onSave={() => {
+												initialDeployUiSettings = clone(deployUiSettings)
+											}}
+											onDiscard={discardDeploySettingsChanges}
+										/>
+									{:else}
+										<div class="my-2"
+											><Alert type="warning" title="Enterprise license required"
+												>Deploy to staging/prod from the web UI is only available with an enterprise
+												license</Alert
+											></div
+										>
+									{/if}
 								{/if}
-							{/if}
-						<!-- Last, and below the lineage target above: the escape hatch for a
+							{/snippet}
+							<DevWorkspaceSetting {deployTarget} />
+							<!-- Last, and below the lineage target above: the escape hatch for a
 						     destination the lineage cannot express. -->
-						<div class="flex flex-col gap-2 max-w-2xl mt-8 pt-6 border-t">
-							<span class="text-xs font-semibold text-emphasis">Deploy into another workspace</span>
-							<p class="text-sm text-secondary">
-								Promotion normally follows the lineage, from this workspace into its parent. For a
-								one-off migration you can instead point the merge UI at any workspace you administer;
-								it computes a full diff over both workspaces and deploys the items you pick, one way.
-							</p>
-							<div>
-								<Button
-									variant="default"
-									startIcon={{ icon: Target }}
-									onclick={() => goto(`${base}/forks/compare?mode=fork`)}
+							<div class="flex flex-col gap-2 max-w-2xl mt-8 pt-6 border-t">
+								<span class="text-xs font-semibold text-emphasis"
+									>Deploy into another workspace</span
 								>
-									Merge into another workspace
-								</Button>
+								<p class="text-sm text-secondary">
+									Promotion normally follows the lineage, from this workspace into its parent. For a
+									one-off migration you can instead point the merge UI at any workspace you
+									administer; it computes a full diff over both workspaces and deploys the items you
+									pick, one way.
+								</p>
+								<div>
+									<Button
+										variant="default"
+										startIcon={{ icon: Target }}
+										onclick={() => goto(`${base}/forks/compare?mode=fork`)}
+									>
+										Merge into another workspace
+									</Button>
+								</div>
 							</div>
-						</div>
 						{:else if tab == 'rulesets'}
 							<SettingsPageHeader
 								title="Workspace Protection Rulesets"
@@ -2002,7 +2035,8 @@ export async function main(
 								{hasInstanceAiConfig}
 								{usesInstanceAiConfig}
 								{instanceAiSummary}
-								onSave={(copilotSettingsState) => {
+								onSave={(savedConfig, copilotSettingsState) => {
+									aiInitialConfig = savedConfig
 									if (!copilotSettingsState) {
 										return
 									}
@@ -2035,6 +2069,14 @@ export async function main(
 									s3ResourceSettings = clone(s3ResourceSavedSettings)
 								}}
 							/>
+						{:else if tab == 'dbt'}
+							<DbtSettings
+								bind:dbtSettings
+								bind:dbtSavedSettings
+								onDiscard={() => {
+									dbtSettings = clone(dbtSavedSettings)
+								}}
+							/>
 						{:else if tab == 'ducklake'}
 							<DucklakeSettings
 								bind:ducklakeSettings
diff --git a/frontend/src/routes/(root)/+layout.svelte b/frontend/src/routes/(root)/+layout.svelte
index 3db5efcf60..1f7a813eac 100644
--- a/frontend/src/routes/(root)/+layout.svelte
+++ b/frontend/src/routes/(root)/+layout.svelte
@@ -40,10 +40,22 @@
 		"Client got disposed and can't be restarted."
 	]
 
+	// The only load of the workspace list for the whole session, and an empty `$userWorkspaces`
+	// degrades silently rather than erroring — the edit-in-dev affordance, the no-direct-deploy
+	// alert and the fork banner all quietly lose their dev workspace. Retry rather than strand
+	// the tab in that state.
+	const WORKSPACE_LIST_RETRY_DELAYS_MS = [1000, 3000, 8000]
 	async function setUserWorkspaceStore() {
-		const list = await WorkspaceService.listUserWorkspaces()
-		$usersWorkspaceStore = list
-		return list
+		for (let attempt = 0; ; attempt++) {
+			try {
+				$usersWorkspaceStore = await WorkspaceService.listUserWorkspaces()
+				return
+			} catch (e) {
+				if (attempt >= WORKSPACE_LIST_RETRY_DELAYS_MS.length) throw e
+				console.error('could not load workspace list, retrying', e)
+				await new Promise((r) => setTimeout(r, WORKSPACE_LIST_RETRY_DELAYS_MS[attempt]))
+			}
+		}
 	}
 
 	// A fork deleted remotely while the tab was open leaves the client pointing at a
@@ -118,10 +130,18 @@
 				if ($userStore) {
 					console.log(`Welcome back ${$userStore.username} to ${$workspaceStore}`)
 				} else {
-					$userStore = await getUserExt($workspaceStore)
-					if (!$userStore) {
+					const ws = $workspaceStore
+					const user = await getUserExt(ws)
+					// A switch mid-flight means this answers for the workspace we left, and
+					// that switch has already started the fetch answering for the active
+					// one: neither this role nor its failure describes where we are now.
+					if ($workspaceStore !== ws) {
+						return
+					}
+					if (!user) {
 						throw Error('Not logged in')
 					}
+					$userStore = user
 				}
 			} else {
 				if (
@@ -228,7 +248,11 @@
 
 					if (workspace && user) {
 						const newUser = await getUserExt(workspace)
-						if (!deepEqual(newUser, $userStore)) {
+						// Refreshes the workspace that was active when the tick started; a
+						// switch mid-flight makes this answer describe the one we left.
+						if ($workspaceStore !== workspace) {
+							console.debug('workspace changed during user refresh, dropping')
+						} else if (!deepEqual(newUser, $userStore)) {
 							userStore.set(newUser)
 							console.info('refreshed user')
 						} else {
diff --git a/frontend/src/routes/+layout.svelte b/frontend/src/routes/+layout.svelte
index d95b78ccf3..ad64ef9917 100644
--- a/frontend/src/routes/+layout.svelte
+++ b/frontend/src/routes/+layout.svelte
@@ -68,7 +68,7 @@
 <style>
 	.wrap {
 		display: flex;
-		font-family: 'Inter', sans-serif;
+		font-family: 'Inter', 'Noto Color Emoji', sans-serif;
 		width: 100%;
 		height: 100%;
 		justify-content: center;
diff --git a/frontend/src/routes/a/[...path]/+page.svelte b/frontend/src/routes/a/[...path]/+page.svelte
index 3456c6e4f8..fc2da2b619 100644
--- a/frontend/src/routes/a/[...path]/+page.svelte
+++ b/frontend/src/routes/a/[...path]/+page.svelte
@@ -61,7 +61,7 @@
 
 	// Embedder side: validate access (main session cookie or shared JWT) and mint
 	// a scoped embed token for the opaque iframe (WIN-2006).
-	async function fetchEmbedToken(): Promise<{ token?: string }> {
+	async function fetchEmbedToken(opts?: { sdkConsent?: boolean }): Promise<{ token?: string }> {
 		if (parsedCustomPath.jwt) {
 			OpenAPI.TOKEN = 'jwt_ext_' + parsedCustomPath.jwt
 		}
@@ -69,8 +69,9 @@
 		if (typeof OpenAPI.TOKEN === 'string' && OpenAPI.TOKEN) {
 			headers['Authorization'] = `Bearer ${OpenAPI.TOKEN}`
 		}
+		const consent = opts?.sdkConsent ? '?sdk_consent=true' : ''
 		const res = await fetch(
-			`${OpenAPI.BASE}/apps_u/embed_token_by_custom_path/${parsedCustomPath.path}`,
+			`${OpenAPI.BASE}/apps_u/embed_token_by_custom_path/${parsedCustomPath.path}${consent}`,
 			{ headers }
 		)
 		if (!res.ok) {
diff --git a/frontend/src/routes/app_embed/[workspace]/[...path]/+page.svelte b/frontend/src/routes/app_embed/[workspace]/[...path]/+page.svelte
index d0af10b433..ee83869ee8 100644
--- a/frontend/src/routes/app_embed/[workspace]/[...path]/+page.svelte
+++ b/frontend/src/routes/app_embed/[workspace]/[...path]/+page.svelte
@@ -29,12 +29,13 @@
 
 	// Embedder side: the logged-in member's session mints a scoped embed token for
 	// the opaque iframe, isolating the in-workspace app from their full session.
-	async function fetchEmbedToken(): Promise<{ token?: string }> {
+	async function fetchEmbedToken(opts?: { sdkConsent?: boolean }): Promise<{ token?: string }> {
 		const headers: Record<string, string> = {}
 		if (typeof OpenAPI.TOKEN === 'string' && OpenAPI.TOKEN) {
 			headers['Authorization'] = `Bearer ${OpenAPI.TOKEN}`
 		}
-		const res = await fetch(`${OpenAPI.BASE}/w/${workspace}/apps/embed_token/p/${path}`, {
+		const consent = opts?.sdkConsent ? '?sdk_consent=true' : ''
+		const res = await fetch(`${OpenAPI.BASE}/w/${workspace}/apps/embed_token/p/${path}${consent}`, {
 			headers
 		})
 		if (!res.ok) {
diff --git a/frontend/src/routes/flows/dev/+page.svelte b/frontend/src/routes/flows/dev/+page.svelte
index fdb3c512f1..bbd3d0d76e 100644
--- a/frontend/src/routes/flows/dev/+page.svelte
+++ b/frontend/src/routes/flows/dev/+page.svelte
@@ -118,7 +118,8 @@
 		modulesTestStates: new ModulesTestStates(),
 		outputPickerOpenFns: {},
 		preserveOnBehalfOf: writable(false),
-		savedOnBehalfOfEmail: writable<string | undefined>(undefined)
+		savedOnBehalfOfEmail: writable<string | undefined>(undefined),
+		savedOnBehalfOfPermissionedAs: writable<string | undefined>(undefined)
 	})
 	setContext<PropPickerContext>('PropPickerContext', {
 		flowPropPickerConfig: writable<FlowPropPickerConfig | undefined>(undefined),
diff --git a/frontend/src/routes/kitchen_sink/+page.svelte b/frontend/src/routes/kitchen_sink/+page.svelte
index 4285ee0921..8681fb78da 100644
--- a/frontend/src/routes/kitchen_sink/+page.svelte
+++ b/frontend/src/routes/kitchen_sink/+page.svelte
@@ -12,8 +12,8 @@
 
 	let tab = $state('button')
 
-	// Enough tabs to overflow a narrow strip so the shared ScrollableX hover
-	// scrollbar is exercised: drag to reorder, hover to reveal the 4px thumb.
+	// Enough tabs to overflow a narrow strip so the strip's own hover scrollbar is
+	// exercised: drag to reorder, hover to reveal the 4px thumb.
 	let draggableTabs = $state<TabItem[]>(
 		Array.from({ length: 14 }, (_, i) => ({ id: `t${i}`, label: `Preview tab ${i + 1}` }))
 	)
@@ -200,8 +200,8 @@ That's the full round-trip.`
 		</TabContent>
 		<TabContent value="scrollbar" class="p-4">
 			<div class="text-xs text-tertiary mb-3">
-				DraggableTabs (uses the shared <code>ScrollableX</code>, 4px bar): hover to reveal the
-				thumb, drag to reorder.
+				DraggableTabs (draws its own 4px bar on the strip's bottom edge): hover to reveal the thumb,
+				drag to reorder.
 			</div>
 			<div class="border border-border-light rounded-md" style="max-width: 420px;">
 				<DraggableTabs
diff --git a/frontend/src/routes/public/[workspace]/[...secret]/+page.svelte b/frontend/src/routes/public/[workspace]/[...secret]/+page.svelte
index 089b95c97d..1f142590d9 100644
--- a/frontend/src/routes/public/[workspace]/[...secret]/+page.svelte
+++ b/frontend/src/routes/public/[workspace]/[...secret]/+page.svelte
@@ -41,7 +41,7 @@
 
 	// Embedder side: validate access (using the main session cookie or the shared
 	// JWT) and mint a scoped embed token for the opaque iframe (WIN-2006).
-	async function fetchEmbedToken(): Promise<{ token?: string }> {
+	async function fetchEmbedToken(opts?: { sdkConsent?: boolean }): Promise<{ token?: string }> {
 		if (parsedSecret.jwt) {
 			OpenAPI.TOKEN = 'jwt_ext_' + parsedSecret.jwt
 		}
@@ -49,8 +49,9 @@
 		if (typeof OpenAPI.TOKEN === 'string' && OpenAPI.TOKEN) {
 			headers['Authorization'] = `Bearer ${OpenAPI.TOKEN}`
 		}
+		const consent = opts?.sdkConsent ? '?sdk_consent=true' : ''
 		const res = await fetch(
-			`${OpenAPI.BASE}/w/${workspace}/apps_u/embed_token/${parsedSecret.secret}`,
+			`${OpenAPI.BASE}/w/${workspace}/apps_u/embed_token/${parsedSecret.secret}${consent}`,
 			{ headers }
 		)
 		if (!res.ok) {
diff --git a/frontend/src/routes/public_run/[workspace]/[id]/+page.svelte b/frontend/src/routes/public_run/[workspace]/[id]/+page.svelte
new file mode 100644
index 0000000000..71e0f92045
--- /dev/null
+++ b/frontend/src/routes/public_run/[workspace]/[id]/+page.svelte
@@ -0,0 +1,193 @@
+<script lang="ts">
+	import { page } from '$app/state'
+	import { onDestroy, untrack } from 'svelte'
+	import { Globe } from 'lucide-svelte'
+	import type { Job } from '$lib/gen'
+	import { workspaceStore } from '$lib/stores'
+	import { setViewToken } from '$lib/viewToken'
+	import { setLicense } from '$lib/enterpriseUtils'
+	import { applyDarkModeVariant } from '$lib/darkModeVariant'
+	import { displayDate, isNotFlow, truncateRev } from '$lib/utils'
+	import { Alert, Badge, Skeleton } from '$lib/components/common'
+	import DisplayResult from '$lib/components/DisplayResult.svelte'
+	import FlowStatusViewer from '$lib/components/FlowStatusViewer.svelte'
+	import JobArgs from '$lib/components/JobArgs.svelte'
+	import JobLoader from '$lib/components/JobLoader.svelte'
+	import JobStatus from '$lib/components/JobStatus.svelte'
+	import LogViewer from '$lib/components/LogViewer.svelte'
+	import WindmillIcon from '$lib/components/icons/WindmillIcon.svelte'
+
+	// SvelteKit reuses this component across /public_run/* navigations, so every input
+	// derived from the URL has to stay reactive — a captured-once value would leave the
+	// previous run (and its token) live while the address bar shows another link.
+	let workspace = $derived(page.params.workspace ?? '')
+	let jobId = $derived(page.params.id ?? '')
+	let viewToken = $derived(page.url.searchParams.get('view_token') ?? undefined)
+	// Identity of what is on screen. The token is part of it: the same run reached with a
+	// different credential is a different view, and a completed job makes no further
+	// request that would reject a now-invalid one.
+	let viewKey = $derived(`${workspace}|${jobId}|${viewToken ?? ''}`)
+
+	// The public share token is the page's only credential: install it before JobLoader
+	// mounts so every read it fires (job, args, logs, SSE, flow steps) carries it. Set
+	// eagerly at init, then kept in sync for client-side navigation.
+	setViewToken(viewToken)
+	$effect(() => {
+		setViewToken(viewToken)
+	})
+	onDestroy(() => setViewToken(undefined))
+
+	$effect(() => {
+		$workspaceStore = workspace
+	})
+
+	const darkMode =
+		window.localStorage.getItem('dark-mode') ??
+		(window.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light')
+	document.documentElement.classList.toggle('dark', darkMode === 'dark')
+	applyDarkModeVariant()
+
+	setLicense()
+
+	let job: (Job & { result?: any; result_stream?: string }) | undefined = $state()
+	let notfound = $state(false)
+	let loadError: { status?: number; message?: string } | undefined = $state(undefined)
+	let jobLoader: JobLoader | undefined = $state(undefined)
+
+	let isFlow = $derived(job != undefined && !isNotFlow(job?.job_kind))
+
+	// Clear the previous run first: `isFlow` then falls back to false, which remounts the
+	// JobLoader a flow run had unmounted, so the effect below has a loader to watch with.
+	let resetForViewKey: string | undefined = undefined
+	$effect(() => {
+		const key = viewKey
+		untrack(() => {
+			if (resetForViewKey === key) return
+			resetForViewKey = key
+			job = undefined
+			notfound = false
+			loadError = undefined
+		})
+	})
+
+	// `watchJob` writes `job`, so it must not run tracked — reading its own output back
+	// would re-enter this effect on every poll.
+	let watchedViewKey: string | undefined = undefined
+	$effect(() => {
+		const key = viewKey
+		const id = jobId
+		const loader = jobLoader
+		untrack(() => {
+			if (!loader || !id || watchedViewKey === key) return
+			watchedViewKey = key
+			loader.watchJob(id)
+		})
+	})
+</script>
+
+<svelte:head>
+	<title>Run {truncateRev(jobId, 8)} | Windmill</title>
+	<!-- The URL *is* the credential: keep the link out of search indexes, and out of the
+	     Referer header of anything the rendered result or logs may link to. -->
+	<meta name="robots" content="noindex, nofollow" />
+	<meta name="referrer" content="no-referrer" />
+</svelte:head>
+
+<!-- Flow jobs are watched by FlowStatusViewer's own loader, exactly like the run page. -->
+{#if !isFlow}
+	<JobLoader
+		bind:this={jobLoader}
+		bind:job
+		bind:notfound
+		bind:loadError
+		workspaceOverride={workspace}
+	/>
+{/if}
+
+<div class="min-h-screen bg-surface">
+	<div class="border-b bg-surface-secondary">
+		<div class="max-w-7xl mx-auto w-full px-4 py-3 flex items-center gap-3">
+			<WindmillIcon height="20px" width="20px" />
+			<span class="text-sm font-semibold text-primary">Run {truncateRev(jobId, 8)}</span>
+			<Badge color="blue" small>
+				<span class="flex items-center gap-1"><Globe size={12} /> Public read-only view</span>
+			</Badge>
+		</div>
+	</div>
+
+	<div class="max-w-7xl mx-auto w-full px-4 py-6 flex flex-col gap-6">
+		{#if loadError || notfound}
+			<Alert type="error" title="This run is not available">
+				{#if loadError?.status === 403 || loadError?.status === 400}
+					This link is not valid for this run, or public sharing of it was never enabled.
+				{:else}
+					Run {jobId} was not found in {workspace}.
+				{/if}
+			</Alert>
+		{:else if !job}
+			<Skeleton layout={[[3], 1, [8]]} />
+		{:else}
+			<div class="flex flex-col gap-2">
+				<div class="flex flex-wrap items-center gap-2">
+					<JobStatus {job} />
+					{#if job.script_path}
+						<Badge color="gray">{job.script_path}</Badge>
+					{/if}
+					{#if job.language}
+						<Badge color="gray">{job.language}</Badge>
+					{/if}
+				</div>
+				<div class="text-xs text-secondary">
+					Started {job.started_at ? displayDate(job.started_at) : 'not yet'}
+				</div>
+			</div>
+
+			<div>
+				<div class="text-xs text-emphasis font-semibold mb-1">Inputs</div>
+				<JobArgs workspace={job.workspace_id ?? workspace} id={job.id} args={job.args} />
+			</div>
+
+			{#if isFlow}
+				<FlowStatusViewer
+					jobId={job.id}
+					initialJob={job}
+					workspaceId={workspace}
+					onJobsLoaded={({ job: newJob }) => (job = newJob)}
+					onDone={({ job: newJob }) => (job = newJob)}
+				/>
+			{:else}
+				<div>
+					<div class="text-xs text-emphasis font-semibold mb-1">Result</div>
+					<div class="border rounded-md bg-surface-tertiary p-4 overflow-auto max-h-screen">
+						{#if job.result_stream || (job.type == 'CompletedJob' && job.result !== undefined)}
+							<DisplayResult
+								workspaceId={job.workspace_id}
+								result_stream={job.result_stream}
+								jobId={job.id}
+								result={job.result}
+								language={job.language}
+								isTest={false}
+							/>
+						{:else}
+							<div class="text-secondary text-sm">No output is available yet</div>
+						{/if}
+					</div>
+				</div>
+
+				<div>
+					<div class="text-xs text-emphasis font-semibold mb-1">Logs</div>
+					<div class="border rounded-md bg-surface-secondary p-2 overflow-auto min-h-[400px]">
+						<LogViewer
+							jobId={job.id}
+							duration={job?.['duration_ms']}
+							mem={job?.['mem_peak']}
+							isLoading={job?.['running'] == false}
+							content={job?.logs}
+							tag={job?.tag}
+						/>
+					</div>
+				</div>
+			{/if}
+		{/if}
+	</div>
+</div>
diff --git a/frontend/static/fonts/LICENSE-noto-color-emoji.txt b/frontend/static/fonts/LICENSE-noto-color-emoji.txt
new file mode 100644
index 0000000000..79b4113fe3
--- /dev/null
+++ b/frontend/static/fonts/LICENSE-noto-color-emoji.txt
@@ -0,0 +1,93 @@
+Copyright 2022 Google Inc.
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+https://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.
diff --git a/frontend/static/fonts/noto-color-emoji.0.woff2 b/frontend/static/fonts/noto-color-emoji.0.woff2
new file mode 100644
index 0000000000..6bd5c1db95
Binary files /dev/null and b/frontend/static/fonts/noto-color-emoji.0.woff2 differ
diff --git a/frontend/static/fonts/noto-color-emoji.1.woff2 b/frontend/static/fonts/noto-color-emoji.1.woff2
new file mode 100644
index 0000000000..df45509e73
Binary files /dev/null and b/frontend/static/fonts/noto-color-emoji.1.woff2 differ
diff --git a/frontend/static/fonts/noto-color-emoji.2.woff2 b/frontend/static/fonts/noto-color-emoji.2.woff2
new file mode 100644
index 0000000000..dd1c2ae0b5
Binary files /dev/null and b/frontend/static/fonts/noto-color-emoji.2.woff2 differ
diff --git a/frontend/static/fonts/noto-color-emoji.3.woff2 b/frontend/static/fonts/noto-color-emoji.3.woff2
new file mode 100644
index 0000000000..ea25e7ddee
Binary files /dev/null and b/frontend/static/fonts/noto-color-emoji.3.woff2 differ
diff --git a/frontend/static/fonts/noto-color-emoji.4.woff2 b/frontend/static/fonts/noto-color-emoji.4.woff2
new file mode 100644
index 0000000000..2400e69388
Binary files /dev/null and b/frontend/static/fonts/noto-color-emoji.4.woff2 differ
diff --git a/frontend/static/fonts/noto-color-emoji.5.woff2 b/frontend/static/fonts/noto-color-emoji.5.woff2
new file mode 100644
index 0000000000..3b6c74df20
Binary files /dev/null and b/frontend/static/fonts/noto-color-emoji.5.woff2 differ
diff --git a/frontend/static/fonts/noto-color-emoji.6.woff2 b/frontend/static/fonts/noto-color-emoji.6.woff2
new file mode 100644
index 0000000000..319f906718
Binary files /dev/null and b/frontend/static/fonts/noto-color-emoji.6.woff2 differ
diff --git a/frontend/static/fonts/noto-color-emoji.7.woff2 b/frontend/static/fonts/noto-color-emoji.7.woff2
new file mode 100644
index 0000000000..63d9a6d572
Binary files /dev/null and b/frontend/static/fonts/noto-color-emoji.7.woff2 differ
diff --git a/frontend/static/fonts/noto-color-emoji.8.woff2 b/frontend/static/fonts/noto-color-emoji.8.woff2
new file mode 100644
index 0000000000..3a6e9d502f
Binary files /dev/null and b/frontend/static/fonts/noto-color-emoji.8.woff2 differ
diff --git a/frontend/static/fonts/noto-color-emoji.9.woff2 b/frontend/static/fonts/noto-color-emoji.9.woff2
new file mode 100644
index 0000000000..d3d1e10a2f
Binary files /dev/null and b/frontend/static/fonts/noto-color-emoji.9.woff2 differ
diff --git a/frontend/tailwind.config.cjs b/frontend/tailwind.config.cjs
index 6650c44544..a0b1c80d37 100644
--- a/frontend/tailwind.config.cjs
+++ b/frontend/tailwind.config.cjs
@@ -451,7 +451,9 @@ const config = {
 		},
 		fontFamily: {
 			// add double quotes if there is space in font name
-			main: ['Inter', 'sans-serif'],
+			// 'Noto Color Emoji' sits after Inter so it only ever picks up codepoints Inter
+			// lacks. See the @font-face block in src/lib/assets/app.css for why it is bundled.
+			main: ['Inter', '"Noto Color Emoji"', 'sans-serif'],
 			mono: [
 				'ui-monospace',
 				'SFMono-Regular',
diff --git a/frontend/vite.config.js b/frontend/vite.config.js
index aa2e8870d9..732eec8687 100644
--- a/frontend/vite.config.js
+++ b/frontend/vite.config.js
@@ -16,6 +16,63 @@ const uiBuilderStaticPresent = existsSync(
 	fileURLToPath(new URL('static/ui_builder/app-preview.html', import.meta.url))
 )
 
+/**
+ * Fail the build if the emitted chunks import each other in a cycle.
+ *
+ * A chunk's imports all evaluate before its own body, so in a cycle one member runs
+ * while another has initialized nothing: its `const`/`class` exports read as
+ * `undefined` and the app dies on load with "X is not a constructor" behind
+ * SvelteKit's default 500 page. The module graph being acyclic is not enough —
+ * chunk *grouping* alone can create one. See docs/frontend-import-cycles.md.
+ */
+function assertAcyclicChunks() {
+	return {
+		name: 'wm-assert-acyclic-chunks',
+		generateBundle(_options, bundle) {
+			const imports = new Map()
+			for (const [file, chunk] of Object.entries(bundle)) {
+				if (chunk.type === 'chunk') imports.set(file, chunk.imports ?? [])
+			}
+			const state = new Map() // file -> 'visiting' | 'done'
+			const describe = (file) => {
+				const chunk = bundle[file]
+				const ids = chunk.moduleIds ?? Object.keys(chunk.modules ?? {})
+				const own = ids.filter((id) => id.includes('/src/')).map((id) => id.split('/src/')[1])
+				const shown = own.slice(0, 6).join(', ')
+				return `  ${file}\n      ${shown}${own.length > 6 ? `, +${own.length - 6} more` : ''}`
+			}
+			for (const root of imports.keys()) {
+				if (state.get(root)) continue
+				const stack = [[root, 0]]
+				const path = [root]
+				state.set(root, 'visiting')
+				while (stack.length) {
+					const frame = stack[stack.length - 1]
+					const deps = imports.get(frame[0]) ?? []
+					if (frame[1] >= deps.length) {
+						state.set(path.pop(), 'done')
+						stack.pop()
+						continue
+					}
+					const dep = deps[frame[1]++]
+					if (state.get(dep) === 'visiting') {
+						const cycle = path.slice(path.indexOf(dep)).concat(dep)
+						this.error(
+							`Cyclic chunk imports — this ships a runtime crash, see docs/frontend-import-cycles.md:\n` +
+								cycle.map(describe).join('\n   ->\n')
+						)
+					}
+					if (!state.has(dep) && imports.has(dep)) {
+						state.set(dep, 'visiting')
+						path.push(dep)
+						stack.push([dep, 0])
+					}
+				}
+			}
+		}
+	}
+}
+
 const remoteUrl =
 	process.env.REMOTE ??
 	(process.env.BACKEND_PORT
@@ -127,7 +184,12 @@ const config = {
 		}
 	},
 	preview: { port: 3001 },
-	plugins: [sveltekit(), ...(process.env.HTTPS === 'true' ? [mkcert()] : []), plugin],
+	plugins: [
+		sveltekit(),
+		...(process.env.HTTPS === 'true' ? [mkcert()] : []),
+		plugin,
+		assertAcyclicChunks()
+	],
 	define: { __pkg__: version },
 	optimizeDeps: {
 		include: ['highlight.js', 'highlight.js/lib/core', 'monaco-vim'],
@@ -147,6 +209,19 @@ const config = {
 		dedupe: ['vscode', 'monaco-editor']
 	},
 	assetsInclude: ['**/*.wasm'],
+	build: {
+		rollupOptions: {
+			output: {
+				// src/lib/gen is a self-contained generated client and a leaf of the module
+				// graph. Left alone the bundler splits it — index.ts in one chunk, the
+				// 12k-line schemas.gen.ts in another beside app code that imports back —
+				// which makes the *chunk* graph cyclic where the module graph is not, and
+				// modules then evaluate against uninitialized bindings. See
+				// docs/frontend-import-cycles.md.
+				advancedChunks: { groups: [{ name: 'gen', test: /[\\/]src[\\/]lib[\\/]gen[\\/]/ }] }
+			}
+		}
+	},
 	test: {
 		expect: { requireAssertions: true },
 		projects: [
diff --git a/lsp/Pipfile b/lsp/Pipfile
index 24c5b9197c..b6e51b4eba 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,7 +4,7 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.775.2"
+wmill = ">=1.783.0"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index 833d43cb91..dcf0b6498b 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: '3.0.3'
 
 info:
-  version: 1.775.2
+  version: 1.783.0
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
@@ -37,7 +37,10 @@ components:
           description: JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')
         on_behalf_of_email:
           type: string
-          description: The flow will be run with the permissions of the user with this email.
+          description: Address of the account the flow runs on behalf of. Derived from on_behalf_of on read; accepted on write, where it is resolved to the account it names.
+        on_behalf_of:
+          type: string
+          description: 'The flow runs with the permissions of this identity: u/{username}, g/{group}, or a bare email when the username is itself email-shaped. The only stored half of the identity; on_behalf_of_email is derived from it. Omit it when writing and it is resolved from that address instead.'
       required:
         - summary
         - value
@@ -677,6 +680,10 @@ components:
             - ruby
             - rlang
             - duckdb
+            # NOT dbt: a dbt script runs the project carried as its module
+            # bundle, which an inline snippet has none of, and the worker rejects
+            # inline execution — advertising it here would let such a flow
+            # validate and then always fail at runtime.
             # for related places search: ADD_NEW_LANG
         path:
           type: string
@@ -724,6 +731,7 @@ components:
                   - ducklake
                   - datatable
                   - volume
+                  - dbt
               access_type:
                 type: string
                 nullable: true
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index d54c4c5a88..cb45694566 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.775.2'
+    ModuleVersion     = '1.783.0'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index 90b6989676..51794989e4 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.775.2"
+version = "1.783.0"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/python-client/wmill/wmill/client.py b/python-client/wmill/wmill/client.py
index 01589d4ef7..9400dabdc7 100644
--- a/python-client/wmill/wmill/client.py
+++ b/python-client/wmill/wmill/client.py
@@ -1377,8 +1377,14 @@ class Windmill:
     def username_to_email(self, username: str) -> str:
         """
         Get email from workspace username
-        This method is particularly useful for apps that require the email address of the viewer.
-        Indeed, in the viewer context WM_USERNAME is set to the username of the viewer but WM_EMAIL is set to the email of the creator of the app.
+
+        .. deprecated:: Read the contextual variables instead:
+        `os.environ.get("WM_END_USER_EMAIL") or os.environ.get("WM_EMAIL")`.
+        WM_END_USER_EMAIL is the email of whoever triggered the run when it came from an app, so
+        the fallback yields the app viewer inside an app and the executing user everywhere else -
+        without an extra API call, and unlike this method it also resolves viewers who are not
+        workspace members. An app viewed anonymously has no identity to report: the variable is
+        then empty and the fallback yields the app publisher.
         """
         return self.get(f"/w/{self.workspace}/users/username_to_email/{username}").text
 
@@ -2221,8 +2227,14 @@ def run_inline_script_preview(
 def username_to_email(username: str) -> str:
     """
     Get email from workspace username
-    This method is particularly useful for apps that require the email address of the viewer.
-    Indeed, in the viewer context WM_USERNAME is set to the username of the viewer but WM_EMAIL is set to the email of the creator of the app.
+
+    .. deprecated:: Read the contextual variables instead:
+    `os.environ.get("WM_END_USER_EMAIL") or os.environ.get("WM_EMAIL")`.
+    WM_END_USER_EMAIL is the email of whoever triggered the run when it came from an app, so the
+    fallback yields the app viewer inside an app and the executing user everywhere else - without
+    an extra API call, and unlike this function it also resolves viewers who are not workspace
+    members. An app viewed anonymously has no identity to report: the variable is then empty and
+    the fallback yields the app publisher.
     """
     return _client.username_to_email(username)
 
diff --git a/release-please-config.json b/release-please-config.json
new file mode 100644
index 0000000000..9b5c16b7e5
--- /dev/null
+++ b/release-please-config.json
@@ -0,0 +1,10 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "packages": {
+    ".": {
+      "release-type": "simple",
+      "package-name": "windmill",
+      "include-component-in-tag": false
+    }
+  }
+}
diff --git a/scripts/worktree-common.sh b/scripts/worktree-common.sh
index 4ca78338bf..65c396d458 100755
--- a/scripts/worktree-common.sh
+++ b/scripts/worktree-common.sh
@@ -181,8 +181,14 @@ wm_setup_ee_worktree() {
     mkdir -p "$(dirname "$ee_worktree_dir")"
     git -C "$ee_repo" fetch --quiet 2>/dev/null || true
 
-    if git -C "$ee_repo" worktree add "$ee_worktree_dir" "$branch" 2>/dev/null; then
-      echo "Created EE worktree at $ee_worktree_dir (branch: $branch)"
+    # Guard on refs/heads: without it, `worktree add` DWIMs a remote-only branch
+    # into a new local branch here, skipping the explicit --track arm below.
+    if git -C "$ee_repo" show-ref --verify --quiet "refs/heads/$branch" \
+         && git -C "$ee_repo" worktree add "$ee_worktree_dir" "$branch" 2>/dev/null; then
+      echo "Created EE worktree at $ee_worktree_dir (existing local branch: $branch)"
+    elif git -C "$ee_repo" show-ref --verify --quiet "refs/remotes/origin/$branch" \
+         && git -C "$ee_repo" worktree add --track -b "$branch" "$ee_worktree_dir" "origin/$branch" 2>/dev/null; then
+      echo "Created EE worktree at $ee_worktree_dir (tracking origin/$branch)"
     elif git -C "$ee_repo" worktree add -b "$branch" "$ee_worktree_dir" main 2>/dev/null; then
       echo "Created EE worktree at $ee_worktree_dir (new branch: $branch from main)"
     else
diff --git a/system_prompts/auto-generated/cli/cli-commands.md b/system_prompts/auto-generated/cli/cli-commands.md
index 8d04a720db..8029ae48c7 100644
--- a/system_prompts/auto-generated/cli/cli-commands.md
+++ b/system_prompts/auto-generated/cli/cli-commands.md
@@ -32,8 +32,12 @@ app related commands
   - `--host <host:string>` - Host to bind the dev server to
   - `--entry <entry:string>` - Entry point file (default: index.ts for Svelte/Vue, index.tsx otherwise)
   - `--no-open` - Don't automatically open the browser
+  - `--recording` - Frame the app in a shell with a Record button, to capture a replayable session recording of the app under development
 - `app lint [app_folder:string]` - Lint a raw app folder to validate structure and buildability
   - `--fix` - Attempt to fix common issues (not implemented yet)
+- `app bundle [app_folder:string]` - Bundle a raw app folder to js/css without deploying it
+  - `--out <dir:string>` - Directory to write bundle.js and bundle.css into (default: <app_folder>/dist)
+  - `--no-minify` - Skip minification
 - `app new` - create a new raw app from a template
   - `--summary <summary:string>` - App summary (short description). Skips the prompt when provided. Triggers non-interactive mode.
   - `--path <path:string>` - App path (e.g., f/folder/my_app or u/username/my_app). Skips the prompt when provided. Triggers non-interactive mode.
diff --git a/system_prompts/auto-generated/flow.md b/system_prompts/auto-generated/flow.md
index b63d2e8008..d5a62c1248 100644
--- a/system_prompts/auto-generated/flow.md
+++ b/system_prompts/auto-generated/flow.md
@@ -343,4 +343,4 @@ Reference a specific resource using `$res:` prefix:
 
 ## OpenFlow Schema
 
-{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"The flow will be run with the permissions of the user with this email."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"preserve_step_tags":{"type":"boolean","description":"If true and the flow runs on a custom worker tag, steps that declare their own non-empty tag run on it instead of inheriting the flow tag. Steps without their own tag still inherit the flow tag."},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff (delay doubles each time)","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Initial delay in seconds"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note (e.g., \"yellow\", \"#ffff00\")"},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes, 'group' for notes that group other nodes"},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor"}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."},"error_include_result":{"type":"boolean","description":"When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"},"reasoning_effort":{"type":"string","description":"Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default."}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryAuto":{"type":"object","description":"Automatic context management","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","description":"Explicit message history","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Conversation memory configuration","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"Short description of what this tool does (shown to the AI)"},"description":{"type":"string","description":"Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script."},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\nValid values: 'text' (default) - plain text response, 'image' - image generation\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with flow.input syntax."},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\nFormat: Array<{ bucket: string, key: string }> - S3 object references\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\nRange: 0.0 to 2.0 (provider-dependent)\n- 0.0 = deterministic, focused responses\n- 0.7 = balanced (common default)\n- 1.0+ = more creative/random\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\nRange: 1-1000.\n"}},"required":["user_message"]},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default `flow`)"},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"agent":{"type":"string","description":"Path of a reusable `ai_agent` resource (hybrid linking). When set, the agent brain\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\nthat resource; the module's input_transforms then only carry the flow-local inputs\n(user_message/user_attachments).\n"},"tool_inputs":{"type":"object","description":"Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\nshared resource; overlaid onto the tools' input_transforms at runtime \u2014 including when\n`agent` is unset, since a step forked for editing keeps these overrides until it is saved\nback or unlinked.\n","additionalProperties":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}}},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}
\ No newline at end of file
+{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"Address of the account the flow runs on behalf of. Derived from on_behalf_of on read; accepted on write, where it is resolved to the account it names."},"on_behalf_of":{"type":"string","description":"The flow runs with the permissions of this identity: u/{username}, g/{group}, or a bare email when the username is itself email-shaped. The only stored half of the identity; on_behalf_of_email is derived from it. Omit it when writing and it is resolved from that address instead."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"preserve_step_tags":{"type":"boolean","description":"If true and the flow runs on a custom worker tag, steps that declare their own non-empty tag run on it instead of inheriting the flow tag. Steps without their own tag still inherit the flow tag."},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff (delay doubles each time)","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Initial delay in seconds"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note (e.g., \"yellow\", \"#ffff00\")"},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes, 'group' for notes that group other nodes"},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor"}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."},"error_include_result":{"type":"boolean","description":"When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"},"reasoning_effort":{"type":"string","description":"Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default."}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryAuto":{"type":"object","description":"Automatic context management","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","description":"Explicit message history","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Conversation memory configuration","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume","dbt"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"Short description of what this tool does (shown to the AI)"},"description":{"type":"string","description":"Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script."},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\nValid values: 'text' (default) - plain text response, 'image' - image generation\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with flow.input syntax."},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\nFormat: Array<{ bucket: string, key: string }> - S3 object references\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\nRange: 0.0 to 2.0 (provider-dependent)\n- 0.0 = deterministic, focused responses\n- 0.7 = balanced (common default)\n- 1.0+ = more creative/random\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\nRange: 1-1000.\n"}},"required":["user_message"]},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default `flow`)"},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"agent":{"type":"string","description":"Path of a reusable `ai_agent` resource (hybrid linking). When set, the agent brain\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\nthat resource; the module's input_transforms then only carry the flow-local inputs\n(user_message/user_attachments).\n"},"tool_inputs":{"type":"object","description":"Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\nshared resource; overlaid onto the tools' input_transforms at runtime \u2014 including when\n`agent` is unset, since a step forked for editing keeps these overrides until it is saved\nback or unlinked.\n","additionalProperties":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}}},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}
\ No newline at end of file
diff --git a/system_prompts/auto-generated/prompts.ts b/system_prompts/auto-generated/prompts.ts
index dec67ba4cb..285b217db6 100644
--- a/system_prompts/auto-generated/prompts.ts
+++ b/system_prompts/auto-generated/prompts.ts
@@ -1121,6 +1121,11 @@ export const SDK_TYPESCRIPT = `# TypeScript SDK (windmill-client)
 
 Import: import * as wmill from 'windmill-client'
 
+To know who is running the script, read the contextual variables rather than calling the API:
+\`process.env.WM_END_USER_EMAIL || process.env.WM_EMAIL\`. WM_END_USER_EMAIL is the app viewer when
+the run was triggered from an app and empty otherwise (both variables are always defined), WM_EMAIL
+is the user the job is permissioned as. WM_USERNAME is the matching username.
+
 workerHasInternalServer(): boolean
 
 /**
@@ -1151,11 +1156,6 @@ async getResource(path?: string, undefinedIfEmpty?: boolean): Promise<any>
  */
 async getRootJobId(jobId?: string): Promise<string>
 
-/**
- * @deprecated Use runScriptByPath or runScriptByHash instead
- */
-async runScript(path: string | null = null, hash_: string | null = null, args: Record<string, any> | null = null, verbose: boolean = false, tag: string | null = null): Promise<any>
-
 /**
  * Run a script synchronously by its path and wait for the result
  * @param path - Script path in Windmill
@@ -1220,11 +1220,6 @@ async getResult(jobId: string): Promise<any>
  */
 async getResultMaybe(jobId: string): Promise<any>
 
-/**
- * @deprecated Use runScriptByPathAsync or runScriptByHashAsync instead
- */
-async runScriptAsync(path: string | null, hash_: string | null, args: Record<string, any> | null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
-
 /**
  * Run a script asynchronously by its path
  * @param path - Script path in Windmill
@@ -1277,13 +1272,6 @@ getStatePath(): string
  */
 async setResource(value: any, path?: string, initializeToTypeIfNotExist?: string): Promise<void>
 
-/**
- * Set the state
- * @param state state to set
- * @deprecated use setState instead
- */
-async setInternalState(state: any): Promise<void>
-
 /**
  * Set the state
  * @param state state to set
@@ -1319,12 +1307,6 @@ async setFlowUserState(key: string, value: any, errorIfNotPossible?: boolean): P
  */
 async getFlowUserState(key: string, errorIfNotPossible?: boolean): Promise<any>
 
-/**
- * Get the internal state
- * @deprecated use getState instead
- */
-async getInternalState(): Promise<any>
-
 /**
  * Get the state shared across executions
  * @param path Optional state resource path override. Defaults to \`getStatePath()\`.
@@ -1460,15 +1442,6 @@ async getResumeUrls(approver?: string, flowLevel?: boolean): Promise<{
   cancel: string;
 }>
 
-/**
- * @deprecated use getResumeUrls instead
- */
-getResumeEndpoints(approver?: string): Promise<{
-  approvalPage: string;
-  resume: string;
-  cancel: string;
-}>
-
 /**
  * Get an OIDC jwt token for auth to external services (e.g: Vault, AWS) (ee only)
  * @param audience audience of the token
@@ -1491,15 +1464,6 @@ base64ToUint8Array(data: string): Uint8Array
  */
 uint8ArrayToBase64(arrayBuffer: Uint8Array): string
 
-/**
- * Get email from workspace username
- * This method is particularly useful for apps that require the email address of the viewer.
- * Indeed, in the viewer context, WM_USERNAME is set to the username of the viewer but WM_EMAIL is set to the email of the creator of the app.
- * @param username
- * @returns email address
- */
-async usernameToEmail(username: string): Promise<string>
-
 /**
  * Sends an interactive approval request via Slack, allowing optional customization of the message, approver, and form fields.
  * 
@@ -1751,6 +1715,11 @@ export const SDK_PYTHON = `# Python SDK (wmill)
 
 Import: import wmill
 
+To know who is running the script, read the contextual variables rather than calling the API:
+\`os.environ.get("WM_END_USER_EMAIL") or os.environ.get("WM_EMAIL")\`. WM_END_USER_EMAIL is the app
+viewer when the run was triggered from an app and empty otherwise (both variables are always
+defined), WM_EMAIL is the user the job is permissioned as. WM_USERNAME is the matching username.
+
 def worker_has_internal_server() -> bool
 
 def get_mocked_api() -> Optional[dict]
@@ -1792,11 +1761,6 @@ def post(endpoint, raise_for_status = True, **kwargs) -> httpx.Response
 #     New authentication token string
 def create_token(duration = dt.timedelta(days=1)) -> str
 
-# Create a script job and return its job id.
-# 
-# .. deprecated:: Use run_script_by_path_async or run_script_by_hash_async instead.
-def run_script_async(path: str = None, hash_: str = None, args: dict = None, scheduled_in_secs: int = None, tag: str = None) -> str
-
 # Create a script job by path and return its job id.
 def run_script_by_path_async(path: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None) -> str
 
@@ -1806,11 +1770,6 @@ def run_script_by_hash_async(hash_: str, args: dict = None, scheduled_in_secs: i
 # Create a flow job and return its job id.
 def run_flow_async(path: str, args: dict = None, scheduled_in_secs: int = None, do_not_track_in_parent: bool = True, tag: str = None) -> str
 
-# Run script synchronously and return its result.
-# 
-# .. deprecated:: Use run_script_by_path or run_script_by_hash instead.
-def run_script(path: str = None, hash_: str = None, args: dict = None, timeout: dt.timedelta | int | float | None = None, verbose: bool = False, cleanup: bool = True, assert_result_is_not_none: bool = False, tag: str = None) -> Any
-
 # Run script by path synchronously and return its result.
 def run_script_by_path(path: str, args: dict = None, timeout: dt.timedelta | int | float | None = None, verbose: bool = False, cleanup: bool = True, assert_result_is_not_none: bool = False, tag: str = None) -> Any
 
@@ -2197,11 +2156,6 @@ def get_approval_urls(step_key: str = 'approval', approver: str = None) -> dict
 # - The function checks for required environment variables (\`WM_FLOW_JOB_ID\`, \`WM_FLOW_STEP_ID\`) to ensure it is run in the appropriate context.
 def request_interactive_slack_approval(slack_resource_path: str, channel_id: str, message: str = None, approver: str = None, default_args_json: dict = None, dynamic_enums_json: dict = None) -> None
 
-# Get email from workspace username
-# This method is particularly useful for apps that require the email address of the viewer.
-# Indeed, in the viewer context WM_USERNAME is set to the username of the viewer but WM_EMAIL is set to the email of the creator of the app.
-def username_to_email(username: str) -> str
-
 # Send a message to a Microsoft Teams conversation with conversation_id, where success is used to style the message
 def send_teams_message(conversation_id: str, text: str, success: bool = True, card_block: dict = None)
 
@@ -2235,6 +2189,18 @@ def get_workspace() -> str
 
 def get_version() -> str
 
+# Create a script job and return its job ID.
+# 
+# Args:
+#     hash_or_path: Script hash or path (determined by presence of '/')
+#     args: Script arguments
+#     scheduled_in_secs: Delay before execution in seconds
+#     tag: Override the worker tag the job runs on
+# 
+# Returns:
+#     Job ID string
+def run_script_async(hash_or_path: str, args: Dict[str, Any] = None, scheduled_in_secs: int = None, tag: str = None) -> str
+
 # Run a script synchronously by hash and return its result.
 # 
 # Args:
@@ -2930,7 +2896,7 @@ class SqlQuery:
 
 export const OPENFLOW_SCHEMA = `## OpenFlow Schema
 
-{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"The flow will be run with the permissions of the user with this email."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"preserve_step_tags":{"type":"boolean","description":"If true and the flow runs on a custom worker tag, steps that declare their own non-empty tag run on it instead of inheriting the flow tag. Steps without their own tag still inherit the flow tag."},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff (delay doubles each time)","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Initial delay in seconds"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note (e.g., \\"yellow\\", \\"#ffff00\\")"},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes, 'group' for notes that group other nodes"},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \\u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor"}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."},"error_include_result":{"type":"boolean","description":"When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"},"reasoning_effort":{"type":"string","description":"Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default."}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryAuto":{"type":"object","description":"Automatic context management","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","description":"Explicit message history","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Conversation memory configuration","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"Short description of what this tool does (shown to the AI)"},"description":{"type":"string","description":"Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script."},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\\nValid values: 'text' (default) - plain text response, 'image' - image generation\\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with flow.input syntax."},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\\nFormat: Array<{ bucket: string, key: string }> - S3 object references\\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\\nRange: 0.0 to 2.0 (provider-dependent)\\n- 0.0 = deterministic, focused responses\\n- 0.7 = balanced (common default)\\n- 1.0+ = more creative/random\\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\\nRange: 1-1000.\\n"}},"required":["user_message"]},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default \`flow\`)"},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"agent":{"type":"string","description":"Path of a reusable \`ai_agent\` resource (hybrid linking). When set, the agent brain\\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\\nthat resource; the module's input_transforms then only carry the flow-local inputs\\n(user_message/user_attachments).\\n"},"tool_inputs":{"type":"object","description":"Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\\nshared resource; overlaid onto the tools' input_transforms at runtime \\u2014 including when\\n\`agent\` is unset, since a step forked for editing keeps these overrides until it is saved\\nback or unlinked.\\n","additionalProperties":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}}},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}`;
+{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"Address of the account the flow runs on behalf of. Derived from on_behalf_of on read; accepted on write, where it is resolved to the account it names."},"on_behalf_of":{"type":"string","description":"The flow runs with the permissions of this identity: u/{username}, g/{group}, or a bare email when the username is itself email-shaped. The only stored half of the identity; on_behalf_of_email is derived from it. Omit it when writing and it is resolved from that address instead."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"preserve_step_tags":{"type":"boolean","description":"If true and the flow runs on a custom worker tag, steps that declare their own non-empty tag run on it instead of inheriting the flow tag. Steps without their own tag still inherit the flow tag."},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff (delay doubles each time)","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Initial delay in seconds"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note (e.g., \\"yellow\\", \\"#ffff00\\")"},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes, 'group' for notes that group other nodes"},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \\u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor"}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."},"error_include_result":{"type":"boolean","description":"When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"},"reasoning_effort":{"type":"string","description":"Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default."}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryAuto":{"type":"object","description":"Automatic context management","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","description":"Explicit message history","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Conversation memory configuration","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume","dbt"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"Short description of what this tool does (shown to the AI)"},"description":{"type":"string","description":"Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script."},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\\nValid values: 'text' (default) - plain text response, 'image' - image generation\\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with flow.input syntax."},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\\nFormat: Array<{ bucket: string, key: string }> - S3 object references\\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\\nRange: 0.0 to 2.0 (provider-dependent)\\n- 0.0 = deterministic, focused responses\\n- 0.7 = balanced (common default)\\n- 1.0+ = more creative/random\\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\\nRange: 1-1000.\\n"}},"required":["user_message"]},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default \`flow\`)"},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"agent":{"type":"string","description":"Path of a reusable \`ai_agent\` resource (hybrid linking). When set, the agent brain\\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\\nthat resource; the module's input_transforms then only carry the flow-local inputs\\n(user_message/user_attachments).\\n"},"tool_inputs":{"type":"object","description":"Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\\nshared resource; overlaid onto the tools' input_transforms at runtime \\u2014 including when\\n\`agent\` is unset, since a step forked for editing keeps these overrides until it is saved\\nback or unlinked.\\n","additionalProperties":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}}},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}`;
 
 export const CLI_COMMANDS = `# Windmill CLI Commands
 
@@ -2966,8 +2932,12 @@ app related commands
   - \`--host <host:string>\` - Host to bind the dev server to
   - \`--entry <entry:string>\` - Entry point file (default: index.ts for Svelte/Vue, index.tsx otherwise)
   - \`--no-open\` - Don't automatically open the browser
+  - \`--recording\` - Frame the app in a shell with a Record button, to capture a replayable session recording of the app under development
 - \`app lint [app_folder:string]\` - Lint a raw app folder to validate structure and buildability
   - \`--fix\` - Attempt to fix common issues (not implemented yet)
+- \`app bundle [app_folder:string]\` - Bundle a raw app folder to js/css without deploying it
+  - \`--out <dir:string>\` - Directory to write bundle.js and bundle.css into (default: <app_folder>/dist)
+  - \`--no-minify\` - Skip minification
 - \`app new\` - create a new raw app from a template
   - \`--summary <summary:string>\` - App summary (short description). Skips the prompt when provided. Triggers non-interactive mode.
   - \`--path <path:string>\` - App path (e.g., f/folder/my_app or u/username/my_app). Skips the prompt when provided. Triggers non-interactive mode.
diff --git a/system_prompts/auto-generated/script.md b/system_prompts/auto-generated/script.md
index a70b5d08b4..dd1fe07ac5 100644
--- a/system_prompts/auto-generated/script.md
+++ b/system_prompts/auto-generated/script.md
@@ -1437,6 +1437,11 @@ being buffered, bypassing the 10000-row return cap.
 
 Import: import * as wmill from 'windmill-client'
 
+To know who is running the script, read the contextual variables rather than calling the API:
+`process.env.WM_END_USER_EMAIL || process.env.WM_EMAIL`. WM_END_USER_EMAIL is the app viewer when
+the run was triggered from an app and empty otherwise (both variables are always defined), WM_EMAIL
+is the user the job is permissioned as. WM_USERNAME is the matching username.
+
 workerHasInternalServer(): boolean
 
 /**
@@ -1467,11 +1472,6 @@ async getResource(path?: string, undefinedIfEmpty?: boolean): Promise<any>
  */
 async getRootJobId(jobId?: string): Promise<string>
 
-/**
- * @deprecated Use runScriptByPath or runScriptByHash instead
- */
-async runScript(path: string | null = null, hash_: string | null = null, args: Record<string, any> | null = null, verbose: boolean = false, tag: string | null = null): Promise<any>
-
 /**
  * Run a script synchronously by its path and wait for the result
  * @param path - Script path in Windmill
@@ -1536,11 +1536,6 @@ async getResult(jobId: string): Promise<any>
  */
 async getResultMaybe(jobId: string): Promise<any>
 
-/**
- * @deprecated Use runScriptByPathAsync or runScriptByHashAsync instead
- */
-async runScriptAsync(path: string | null, hash_: string | null, args: Record<string, any> | null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
-
 /**
  * Run a script asynchronously by its path
  * @param path - Script path in Windmill
@@ -1593,13 +1588,6 @@ getStatePath(): string
  */
 async setResource(value: any, path?: string, initializeToTypeIfNotExist?: string): Promise<void>
 
-/**
- * Set the state
- * @param state state to set
- * @deprecated use setState instead
- */
-async setInternalState(state: any): Promise<void>
-
 /**
  * Set the state
  * @param state state to set
@@ -1635,12 +1623,6 @@ async setFlowUserState(key: string, value: any, errorIfNotPossible?: boolean): P
  */
 async getFlowUserState(key: string, errorIfNotPossible?: boolean): Promise<any>
 
-/**
- * Get the internal state
- * @deprecated use getState instead
- */
-async getInternalState(): Promise<any>
-
 /**
  * Get the state shared across executions
  * @param path Optional state resource path override. Defaults to `getStatePath()`.
@@ -1776,15 +1758,6 @@ async getResumeUrls(approver?: string, flowLevel?: boolean): Promise<{
   cancel: string;
 }>
 
-/**
- * @deprecated use getResumeUrls instead
- */
-getResumeEndpoints(approver?: string): Promise<{
-  approvalPage: string;
-  resume: string;
-  cancel: string;
-}>
-
 /**
  * Get an OIDC jwt token for auth to external services (e.g: Vault, AWS) (ee only)
  * @param audience audience of the token
@@ -1807,15 +1780,6 @@ base64ToUint8Array(data: string): Uint8Array
  */
 uint8ArrayToBase64(arrayBuffer: Uint8Array): string
 
-/**
- * Get email from workspace username
- * This method is particularly useful for apps that require the email address of the viewer.
- * Indeed, in the viewer context, WM_USERNAME is set to the username of the viewer but WM_EMAIL is set to the email of the creator of the app.
- * @param username
- * @returns email address
- */
-async usernameToEmail(username: string): Promise<string>
-
 /**
  * Sends an interactive approval request via Slack, allowing optional customization of the message, approver, and form fields.
  * 
@@ -2067,6 +2031,11 @@ appendPartition(opts: Omit<DucklakeMaterializeOptions, "uniqueKey">,): SqlStatem
 
 Import: import wmill
 
+To know who is running the script, read the contextual variables rather than calling the API:
+`os.environ.get("WM_END_USER_EMAIL") or os.environ.get("WM_EMAIL")`. WM_END_USER_EMAIL is the app
+viewer when the run was triggered from an app and empty otherwise (both variables are always
+defined), WM_EMAIL is the user the job is permissioned as. WM_USERNAME is the matching username.
+
 def worker_has_internal_server() -> bool
 
 def get_mocked_api() -> Optional[dict]
@@ -2108,11 +2077,6 @@ def post(endpoint, raise_for_status = True, **kwargs) -> httpx.Response
 #     New authentication token string
 def create_token(duration = dt.timedelta(days=1)) -> str
 
-# Create a script job and return its job id.
-# 
-# .. deprecated:: Use run_script_by_path_async or run_script_by_hash_async instead.
-def run_script_async(path: str = None, hash_: str = None, args: dict = None, scheduled_in_secs: int = None, tag: str = None) -> str
-
 # Create a script job by path and return its job id.
 def run_script_by_path_async(path: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None) -> str
 
@@ -2122,11 +2086,6 @@ def run_script_by_hash_async(hash_: str, args: dict = None, scheduled_in_secs: i
 # Create a flow job and return its job id.
 def run_flow_async(path: str, args: dict = None, scheduled_in_secs: int = None, do_not_track_in_parent: bool = True, tag: str = None) -> str
 
-# Run script synchronously and return its result.
-# 
-# .. deprecated:: Use run_script_by_path or run_script_by_hash instead.
-def run_script(path: str = None, hash_: str = None, args: dict = None, timeout: dt.timedelta | int | float | None = None, verbose: bool = False, cleanup: bool = True, assert_result_is_not_none: bool = False, tag: str = None) -> Any
-
 # Run script by path synchronously and return its result.
 def run_script_by_path(path: str, args: dict = None, timeout: dt.timedelta | int | float | None = None, verbose: bool = False, cleanup: bool = True, assert_result_is_not_none: bool = False, tag: str = None) -> Any
 
@@ -2513,11 +2472,6 @@ def get_approval_urls(step_key: str = 'approval', approver: str = None) -> dict
 # - The function checks for required environment variables (`WM_FLOW_JOB_ID`, `WM_FLOW_STEP_ID`) to ensure it is run in the appropriate context.
 def request_interactive_slack_approval(slack_resource_path: str, channel_id: str, message: str = None, approver: str = None, default_args_json: dict = None, dynamic_enums_json: dict = None) -> None
 
-# Get email from workspace username
-# This method is particularly useful for apps that require the email address of the viewer.
-# Indeed, in the viewer context WM_USERNAME is set to the username of the viewer but WM_EMAIL is set to the email of the creator of the app.
-def username_to_email(username: str) -> str
-
 # Send a message to a Microsoft Teams conversation with conversation_id, where success is used to style the message
 def send_teams_message(conversation_id: str, text: str, success: bool = True, card_block: dict = None)
 
@@ -2551,6 +2505,18 @@ def get_workspace() -> str
 
 def get_version() -> str
 
+# Create a script job and return its job ID.
+# 
+# Args:
+#     hash_or_path: Script hash or path (determined by presence of '/')
+#     args: Script arguments
+#     scheduled_in_secs: Delay before execution in seconds
+#     tag: Override the worker tag the job runs on
+# 
+# Returns:
+#     Job ID string
+def run_script_async(hash_or_path: str, args: Dict[str, Any] = None, scheduled_in_secs: int = None, tag: str = None) -> str
+
 # Run a script synchronously by hash and return its result.
 # 
 # Args:
diff --git a/system_prompts/auto-generated/sdks/python.md b/system_prompts/auto-generated/sdks/python.md
index ae13ae91a9..a80e9a57dd 100644
--- a/system_prompts/auto-generated/sdks/python.md
+++ b/system_prompts/auto-generated/sdks/python.md
@@ -2,6 +2,11 @@
 
 Import: import wmill
 
+To know who is running the script, read the contextual variables rather than calling the API:
+`os.environ.get("WM_END_USER_EMAIL") or os.environ.get("WM_EMAIL")`. WM_END_USER_EMAIL is the app
+viewer when the run was triggered from an app and empty otherwise (both variables are always
+defined), WM_EMAIL is the user the job is permissioned as. WM_USERNAME is the matching username.
+
 def worker_has_internal_server() -> bool
 
 def get_mocked_api() -> Optional[dict]
@@ -43,11 +48,6 @@ def post(endpoint, raise_for_status = True, **kwargs) -> httpx.Response
 #     New authentication token string
 def create_token(duration = dt.timedelta(days=1)) -> str
 
-# Create a script job and return its job id.
-# 
-# .. deprecated:: Use run_script_by_path_async or run_script_by_hash_async instead.
-def run_script_async(path: str = None, hash_: str = None, args: dict = None, scheduled_in_secs: int = None, tag: str = None) -> str
-
 # Create a script job by path and return its job id.
 def run_script_by_path_async(path: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None) -> str
 
@@ -57,11 +57,6 @@ def run_script_by_hash_async(hash_: str, args: dict = None, scheduled_in_secs: i
 # Create a flow job and return its job id.
 def run_flow_async(path: str, args: dict = None, scheduled_in_secs: int = None, do_not_track_in_parent: bool = True, tag: str = None) -> str
 
-# Run script synchronously and return its result.
-# 
-# .. deprecated:: Use run_script_by_path or run_script_by_hash instead.
-def run_script(path: str = None, hash_: str = None, args: dict = None, timeout: dt.timedelta | int | float | None = None, verbose: bool = False, cleanup: bool = True, assert_result_is_not_none: bool = False, tag: str = None) -> Any
-
 # Run script by path synchronously and return its result.
 def run_script_by_path(path: str, args: dict = None, timeout: dt.timedelta | int | float | None = None, verbose: bool = False, cleanup: bool = True, assert_result_is_not_none: bool = False, tag: str = None) -> Any
 
@@ -448,11 +443,6 @@ def get_approval_urls(step_key: str = 'approval', approver: str = None) -> dict
 # - The function checks for required environment variables (`WM_FLOW_JOB_ID`, `WM_FLOW_STEP_ID`) to ensure it is run in the appropriate context.
 def request_interactive_slack_approval(slack_resource_path: str, channel_id: str, message: str = None, approver: str = None, default_args_json: dict = None, dynamic_enums_json: dict = None) -> None
 
-# Get email from workspace username
-# This method is particularly useful for apps that require the email address of the viewer.
-# Indeed, in the viewer context WM_USERNAME is set to the username of the viewer but WM_EMAIL is set to the email of the creator of the app.
-def username_to_email(username: str) -> str
-
 # Send a message to a Microsoft Teams conversation with conversation_id, where success is used to style the message
 def send_teams_message(conversation_id: str, text: str, success: bool = True, card_block: dict = None)
 
@@ -486,6 +476,18 @@ def get_workspace() -> str
 
 def get_version() -> str
 
+# Create a script job and return its job ID.
+# 
+# Args:
+#     hash_or_path: Script hash or path (determined by presence of '/')
+#     args: Script arguments
+#     scheduled_in_secs: Delay before execution in seconds
+#     tag: Override the worker tag the job runs on
+# 
+# Returns:
+#     Job ID string
+def run_script_async(hash_or_path: str, args: Dict[str, Any] = None, scheduled_in_secs: int = None, tag: str = None) -> str
+
 # Run a script synchronously by hash and return its result.
 # 
 # Args:
diff --git a/system_prompts/auto-generated/sdks/typescript.md b/system_prompts/auto-generated/sdks/typescript.md
index 729e2ce108..56be056d8e 100644
--- a/system_prompts/auto-generated/sdks/typescript.md
+++ b/system_prompts/auto-generated/sdks/typescript.md
@@ -2,6 +2,11 @@
 
 Import: import * as wmill from 'windmill-client'
 
+To know who is running the script, read the contextual variables rather than calling the API:
+`process.env.WM_END_USER_EMAIL || process.env.WM_EMAIL`. WM_END_USER_EMAIL is the app viewer when
+the run was triggered from an app and empty otherwise (both variables are always defined), WM_EMAIL
+is the user the job is permissioned as. WM_USERNAME is the matching username.
+
 workerHasInternalServer(): boolean
 
 /**
@@ -32,11 +37,6 @@ async getResource(path?: string, undefinedIfEmpty?: boolean): Promise<any>
  */
 async getRootJobId(jobId?: string): Promise<string>
 
-/**
- * @deprecated Use runScriptByPath or runScriptByHash instead
- */
-async runScript(path: string | null = null, hash_: string | null = null, args: Record<string, any> | null = null, verbose: boolean = false, tag: string | null = null): Promise<any>
-
 /**
  * Run a script synchronously by its path and wait for the result
  * @param path - Script path in Windmill
@@ -101,11 +101,6 @@ async getResult(jobId: string): Promise<any>
  */
 async getResultMaybe(jobId: string): Promise<any>
 
-/**
- * @deprecated Use runScriptByPathAsync or runScriptByHashAsync instead
- */
-async runScriptAsync(path: string | null, hash_: string | null, args: Record<string, any> | null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
-
 /**
  * Run a script asynchronously by its path
  * @param path - Script path in Windmill
@@ -158,13 +153,6 @@ getStatePath(): string
  */
 async setResource(value: any, path?: string, initializeToTypeIfNotExist?: string): Promise<void>
 
-/**
- * Set the state
- * @param state state to set
- * @deprecated use setState instead
- */
-async setInternalState(state: any): Promise<void>
-
 /**
  * Set the state
  * @param state state to set
@@ -200,12 +188,6 @@ async setFlowUserState(key: string, value: any, errorIfNotPossible?: boolean): P
  */
 async getFlowUserState(key: string, errorIfNotPossible?: boolean): Promise<any>
 
-/**
- * Get the internal state
- * @deprecated use getState instead
- */
-async getInternalState(): Promise<any>
-
 /**
  * Get the state shared across executions
  * @param path Optional state resource path override. Defaults to `getStatePath()`.
@@ -341,15 +323,6 @@ async getResumeUrls(approver?: string, flowLevel?: boolean): Promise<{
   cancel: string;
 }>
 
-/**
- * @deprecated use getResumeUrls instead
- */
-getResumeEndpoints(approver?: string): Promise<{
-  approvalPage: string;
-  resume: string;
-  cancel: string;
-}>
-
 /**
  * Get an OIDC jwt token for auth to external services (e.g: Vault, AWS) (ee only)
  * @param audience audience of the token
@@ -372,15 +345,6 @@ base64ToUint8Array(data: string): Uint8Array
  */
 uint8ArrayToBase64(arrayBuffer: Uint8Array): string
 
-/**
- * Get email from workspace username
- * This method is particularly useful for apps that require the email address of the viewer.
- * Indeed, in the viewer context, WM_USERNAME is set to the username of the viewer but WM_EMAIL is set to the email of the creator of the app.
- * @param username
- * @returns email address
- */
-async usernameToEmail(username: string): Promise<string>
-
 /**
  * Sends an interactive approval request via Slack, allowing optional customization of the message, approver, and form fields.
  * 
diff --git a/system_prompts/auto-generated/skills/cli-commands/SKILL.md b/system_prompts/auto-generated/skills/cli-commands/SKILL.md
index cba3a1da40..ebd0d7f4da 100644
--- a/system_prompts/auto-generated/skills/cli-commands/SKILL.md
+++ b/system_prompts/auto-generated/skills/cli-commands/SKILL.md
@@ -37,8 +37,12 @@ app related commands
   - `--host <host:string>` - Host to bind the dev server to
   - `--entry <entry:string>` - Entry point file (default: index.ts for Svelte/Vue, index.tsx otherwise)
   - `--no-open` - Don't automatically open the browser
+  - `--recording` - Frame the app in a shell with a Record button, to capture a replayable session recording of the app under development
 - `app lint [app_folder:string]` - Lint a raw app folder to validate structure and buildability
   - `--fix` - Attempt to fix common issues (not implemented yet)
+- `app bundle [app_folder:string]` - Bundle a raw app folder to js/css without deploying it
+  - `--out <dir:string>` - Directory to write bundle.js and bundle.css into (default: <app_folder>/dist)
+  - `--no-minify` - Skip minification
 - `app new` - create a new raw app from a template
   - `--summary <summary:string>` - App summary (short description). Skips the prompt when provided. Triggers non-interactive mode.
   - `--path <path:string>` - App path (e.g., f/folder/my_app or u/username/my_app). Skips the prompt when provided. Triggers non-interactive mode.
diff --git a/system_prompts/auto-generated/skills/write-flow/SKILL.md b/system_prompts/auto-generated/skills/write-flow/SKILL.md
index 2935eaf2f4..32e047b7f3 100644
--- a/system_prompts/auto-generated/skills/write-flow/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-flow/SKILL.md
@@ -429,4 +429,4 @@ Reference a specific resource using `$res:` prefix:
 
 ## OpenFlow Schema
 
-{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"The flow will be run with the permissions of the user with this email."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"preserve_step_tags":{"type":"boolean","description":"If true and the flow runs on a custom worker tag, steps that declare their own non-empty tag run on it instead of inheriting the flow tag. Steps without their own tag still inherit the flow tag."},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff (delay doubles each time)","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Initial delay in seconds"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note (e.g., \"yellow\", \"#ffff00\")"},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes, 'group' for notes that group other nodes"},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor"}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."},"error_include_result":{"type":"boolean","description":"When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"},"reasoning_effort":{"type":"string","description":"Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default."}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryAuto":{"type":"object","description":"Automatic context management","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","description":"Explicit message history","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Conversation memory configuration","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"Short description of what this tool does (shown to the AI)"},"description":{"type":"string","description":"Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script."},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\nValid values: 'text' (default) - plain text response, 'image' - image generation\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with flow.input syntax."},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\nFormat: Array<{ bucket: string, key: string }> - S3 object references\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\nRange: 0.0 to 2.0 (provider-dependent)\n- 0.0 = deterministic, focused responses\n- 0.7 = balanced (common default)\n- 1.0+ = more creative/random\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\nRange: 1-1000.\n"}},"required":["user_message"]},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default `flow`)"},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"agent":{"type":"string","description":"Path of a reusable `ai_agent` resource (hybrid linking). When set, the agent brain\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\nthat resource; the module's input_transforms then only carry the flow-local inputs\n(user_message/user_attachments).\n"},"tool_inputs":{"type":"object","description":"Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\nshared resource; overlaid onto the tools' input_transforms at runtime \u2014 including when\n`agent` is unset, since a step forked for editing keeps these overrides until it is saved\nback or unlinked.\n","additionalProperties":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}}},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}
\ No newline at end of file
+{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"Address of the account the flow runs on behalf of. Derived from on_behalf_of on read; accepted on write, where it is resolved to the account it names."},"on_behalf_of":{"type":"string","description":"The flow runs with the permissions of this identity: u/{username}, g/{group}, or a bare email when the username is itself email-shaped. The only stored half of the identity; on_behalf_of_email is derived from it. Omit it when writing and it is resolved from that address instead."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"preserve_step_tags":{"type":"boolean","description":"If true and the flow runs on a custom worker tag, steps that declare their own non-empty tag run on it instead of inheriting the flow tag. Steps without their own tag still inherit the flow tag."},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff (delay doubles each time)","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Initial delay in seconds"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note (e.g., \"yellow\", \"#ffff00\")"},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes, 'group' for notes that group other nodes"},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor"}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."},"error_include_result":{"type":"boolean","description":"When stopping with an error (error_message set), embed the stopping step's own result inside the raised error object (as error.result) instead of discarding it. The top-level result stays { error }. Defaults to false."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside for loops, use 'flow_input.iter.value' for the current iteration value (in while loops it equals 'flow_input.iter.index')","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","azure_foundry","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"},"reasoning_effort":{"type":"string","description":"Provider-native reasoning effort token (e.g. 'low', 'high', 'none') for models that support extended thinking. Optional; unset leaves the provider default."}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryAuto":{"type":"object","description":"Automatic context management","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","description":"Explicit message history","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Conversation memory configuration","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","bunnative","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume","dbt"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly until stopped. The implicit iterator is the iteration counter, so 'flow_input.iter.value' equals 'flow_input.iter.index' (0, 1, 2, ...) and never carries state. To carry state across iterations, a step reads its own previous-iteration result via 'results.<its_own_id>' with a first-iteration fallback - the loop's stop_after_if must then be on that inner step (a plain single-step body with stop_after_if on the loop module does not resolve 'results' across iterations and never terminates); plain counters can instead be derived from 'flow_input.iter.index', which works in every configuration. stop_after_if is evaluated after each iteration - on the loop module 'result' is the last iteration's result","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"Short description of what this tool does (shown to the AI)"},"description":{"type":"string","description":"Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script."},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\nValid values: 'text' (default) - plain text response, 'image' - image generation\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with flow.input syntax."},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\nStreaming events include: token_delta, reasoning_token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\nFormat: Array<{ bucket: string, key: string }> - S3 object references\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\nRange: 0.0 to 2.0 (provider-dependent)\n- 0.0 = deterministic, focused responses\n- 0.7 = balanced (common default)\n- 1.0+ = more creative/random\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\nRange: 1-1000.\n"}},"required":["user_message"]},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"tag":{"type":"string","description":"Worker group tag for execution routing. If not set, the AI agent step runs on the flow's tag (default `flow`)"},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"agent":{"type":"string","description":"Path of a reusable `ai_agent` resource (hybrid linking). When set, the agent brain\nconfig (provider/model/system prompt/etc.) and tool set are resolved at runtime from\nthat resource; the module's input_transforms then only carry the flow-local inputs\n(user_message/user_attachments).\n"},"tool_inputs":{"type":"object","description":"Host-local wiring for an agent's tool inputs, keyed by tool id then input key. Binds the\nreferenced agent's tools to this flow's context (flow_input/results) without mutating the\nshared resource; overlaid onto the tools' input_transforms at runtime \u2014 including when\n`agent` is unset, since a step forked for editing keeps these overrides until it is saved\nback or unlinked.\n","additionalProperties":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}}},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}
\ No newline at end of file
diff --git a/system_prompts/auto-generated/skills/write-script-bun/SKILL.md b/system_prompts/auto-generated/skills/write-script-bun/SKILL.md
index d7a757085a..75dab4b624 100644
--- a/system_prompts/auto-generated/skills/write-script-bun/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-bun/SKILL.md
@@ -173,6 +173,11 @@ const result: wmill.S3Object = await wmill.writeS3File(
 
 Import: import * as wmill from 'windmill-client'
 
+To know who is running the script, read the contextual variables rather than calling the API:
+`process.env.WM_END_USER_EMAIL || process.env.WM_EMAIL`. WM_END_USER_EMAIL is the app viewer when
+the run was triggered from an app and empty otherwise (both variables are always defined), WM_EMAIL
+is the user the job is permissioned as. WM_USERNAME is the matching username.
+
 workerHasInternalServer(): boolean
 
 /**
@@ -203,11 +208,6 @@ async getResource(path?: string, undefinedIfEmpty?: boolean): Promise<any>
  */
 async getRootJobId(jobId?: string): Promise<string>
 
-/**
- * @deprecated Use runScriptByPath or runScriptByHash instead
- */
-async runScript(path: string | null = null, hash_: string | null = null, args: Record<string, any> | null = null, verbose: boolean = false, tag: string | null = null): Promise<any>
-
 /**
  * Run a script synchronously by its path and wait for the result
  * @param path - Script path in Windmill
@@ -272,11 +272,6 @@ async getResult(jobId: string): Promise<any>
  */
 async getResultMaybe(jobId: string): Promise<any>
 
-/**
- * @deprecated Use runScriptByPathAsync or runScriptByHashAsync instead
- */
-async runScriptAsync(path: string | null, hash_: string | null, args: Record<string, any> | null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
-
 /**
  * Run a script asynchronously by its path
  * @param path - Script path in Windmill
@@ -329,13 +324,6 @@ getStatePath(): string
  */
 async setResource(value: any, path?: string, initializeToTypeIfNotExist?: string): Promise<void>
 
-/**
- * Set the state
- * @param state state to set
- * @deprecated use setState instead
- */
-async setInternalState(state: any): Promise<void>
-
 /**
  * Set the state
  * @param state state to set
@@ -371,12 +359,6 @@ async setFlowUserState(key: string, value: any, errorIfNotPossible?: boolean): P
  */
 async getFlowUserState(key: string, errorIfNotPossible?: boolean): Promise<any>
 
-/**
- * Get the internal state
- * @deprecated use getState instead
- */
-async getInternalState(): Promise<any>
-
 /**
  * Get the state shared across executions
  * @param path Optional state resource path override. Defaults to `getStatePath()`.
@@ -512,15 +494,6 @@ async getResumeUrls(approver?: string, flowLevel?: boolean): Promise<{
   cancel: string;
 }>
 
-/**
- * @deprecated use getResumeUrls instead
- */
-getResumeEndpoints(approver?: string): Promise<{
-  approvalPage: string;
-  resume: string;
-  cancel: string;
-}>
-
 /**
  * Get an OIDC jwt token for auth to external services (e.g: Vault, AWS) (ee only)
  * @param audience audience of the token
@@ -543,15 +516,6 @@ base64ToUint8Array(data: string): Uint8Array
  */
 uint8ArrayToBase64(arrayBuffer: Uint8Array): string
 
-/**
- * Get email from workspace username
- * This method is particularly useful for apps that require the email address of the viewer.
- * Indeed, in the viewer context, WM_USERNAME is set to the username of the viewer but WM_EMAIL is set to the email of the creator of the app.
- * @param username
- * @returns email address
- */
-async usernameToEmail(username: string): Promise<string>
-
 /**
  * Sends an interactive approval request via Slack, allowing optional customization of the message, approver, and form fields.
  * 
diff --git a/system_prompts/auto-generated/skills/write-script-bunnative/SKILL.md b/system_prompts/auto-generated/skills/write-script-bunnative/SKILL.md
index a5a7c02dab..600fed06b2 100644
--- a/system_prompts/auto-generated/skills/write-script-bunnative/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-bunnative/SKILL.md
@@ -173,6 +173,11 @@ const result: wmill.S3Object = await wmill.writeS3File(
 
 Import: import * as wmill from 'windmill-client'
 
+To know who is running the script, read the contextual variables rather than calling the API:
+`process.env.WM_END_USER_EMAIL || process.env.WM_EMAIL`. WM_END_USER_EMAIL is the app viewer when
+the run was triggered from an app and empty otherwise (both variables are always defined), WM_EMAIL
+is the user the job is permissioned as. WM_USERNAME is the matching username.
+
 workerHasInternalServer(): boolean
 
 /**
@@ -203,11 +208,6 @@ async getResource(path?: string, undefinedIfEmpty?: boolean): Promise<any>
  */
 async getRootJobId(jobId?: string): Promise<string>
 
-/**
- * @deprecated Use runScriptByPath or runScriptByHash instead
- */
-async runScript(path: string | null = null, hash_: string | null = null, args: Record<string, any> | null = null, verbose: boolean = false, tag: string | null = null): Promise<any>
-
 /**
  * Run a script synchronously by its path and wait for the result
  * @param path - Script path in Windmill
@@ -272,11 +272,6 @@ async getResult(jobId: string): Promise<any>
  */
 async getResultMaybe(jobId: string): Promise<any>
 
-/**
- * @deprecated Use runScriptByPathAsync or runScriptByHashAsync instead
- */
-async runScriptAsync(path: string | null, hash_: string | null, args: Record<string, any> | null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
-
 /**
  * Run a script asynchronously by its path
  * @param path - Script path in Windmill
@@ -329,13 +324,6 @@ getStatePath(): string
  */
 async setResource(value: any, path?: string, initializeToTypeIfNotExist?: string): Promise<void>
 
-/**
- * Set the state
- * @param state state to set
- * @deprecated use setState instead
- */
-async setInternalState(state: any): Promise<void>
-
 /**
  * Set the state
  * @param state state to set
@@ -371,12 +359,6 @@ async setFlowUserState(key: string, value: any, errorIfNotPossible?: boolean): P
  */
 async getFlowUserState(key: string, errorIfNotPossible?: boolean): Promise<any>
 
-/**
- * Get the internal state
- * @deprecated use getState instead
- */
-async getInternalState(): Promise<any>
-
 /**
  * Get the state shared across executions
  * @param path Optional state resource path override. Defaults to `getStatePath()`.
@@ -512,15 +494,6 @@ async getResumeUrls(approver?: string, flowLevel?: boolean): Promise<{
   cancel: string;
 }>
 
-/**
- * @deprecated use getResumeUrls instead
- */
-getResumeEndpoints(approver?: string): Promise<{
-  approvalPage: string;
-  resume: string;
-  cancel: string;
-}>
-
 /**
  * Get an OIDC jwt token for auth to external services (e.g: Vault, AWS) (ee only)
  * @param audience audience of the token
@@ -543,15 +516,6 @@ base64ToUint8Array(data: string): Uint8Array
  */
 uint8ArrayToBase64(arrayBuffer: Uint8Array): string
 
-/**
- * Get email from workspace username
- * This method is particularly useful for apps that require the email address of the viewer.
- * Indeed, in the viewer context, WM_USERNAME is set to the username of the viewer but WM_EMAIL is set to the email of the creator of the app.
- * @param username
- * @returns email address
- */
-async usernameToEmail(username: string): Promise<string>
-
 /**
  * Sends an interactive approval request via Slack, allowing optional customization of the message, approver, and form fields.
  * 
diff --git a/system_prompts/auto-generated/skills/write-script-deno/SKILL.md b/system_prompts/auto-generated/skills/write-script-deno/SKILL.md
index ea6ebe00aa..2e671f139d 100644
--- a/system_prompts/auto-generated/skills/write-script-deno/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-deno/SKILL.md
@@ -175,6 +175,11 @@ const result: wmill.S3Object = await wmill.writeS3File(
 
 Import: import * as wmill from 'windmill-client'
 
+To know who is running the script, read the contextual variables rather than calling the API:
+`process.env.WM_END_USER_EMAIL || process.env.WM_EMAIL`. WM_END_USER_EMAIL is the app viewer when
+the run was triggered from an app and empty otherwise (both variables are always defined), WM_EMAIL
+is the user the job is permissioned as. WM_USERNAME is the matching username.
+
 workerHasInternalServer(): boolean
 
 /**
@@ -205,11 +210,6 @@ async getResource(path?: string, undefinedIfEmpty?: boolean): Promise<any>
  */
 async getRootJobId(jobId?: string): Promise<string>
 
-/**
- * @deprecated Use runScriptByPath or runScriptByHash instead
- */
-async runScript(path: string | null = null, hash_: string | null = null, args: Record<string, any> | null = null, verbose: boolean = false, tag: string | null = null): Promise<any>
-
 /**
  * Run a script synchronously by its path and wait for the result
  * @param path - Script path in Windmill
@@ -274,11 +274,6 @@ async getResult(jobId: string): Promise<any>
  */
 async getResultMaybe(jobId: string): Promise<any>
 
-/**
- * @deprecated Use runScriptByPathAsync or runScriptByHashAsync instead
- */
-async runScriptAsync(path: string | null, hash_: string | null, args: Record<string, any> | null, scheduledInSeconds: number | null = null, tag: string | null = null): Promise<string>
-
 /**
  * Run a script asynchronously by its path
  * @param path - Script path in Windmill
@@ -331,13 +326,6 @@ getStatePath(): string
  */
 async setResource(value: any, path?: string, initializeToTypeIfNotExist?: string): Promise<void>
 
-/**
- * Set the state
- * @param state state to set
- * @deprecated use setState instead
- */
-async setInternalState(state: any): Promise<void>
-
 /**
  * Set the state
  * @param state state to set
@@ -373,12 +361,6 @@ async setFlowUserState(key: string, value: any, errorIfNotPossible?: boolean): P
  */
 async getFlowUserState(key: string, errorIfNotPossible?: boolean): Promise<any>
 
-/**
- * Get the internal state
- * @deprecated use getState instead
- */
-async getInternalState(): Promise<any>
-
 /**
  * Get the state shared across executions
  * @param path Optional state resource path override. Defaults to `getStatePath()`.
@@ -514,15 +496,6 @@ async getResumeUrls(approver?: string, flowLevel?: boolean): Promise<{
   cancel: string;
 }>
 
-/**
- * @deprecated use getResumeUrls instead
- */
-getResumeEndpoints(approver?: string): Promise<{
-  approvalPage: string;
-  resume: string;
-  cancel: string;
-}>
-
 /**
  * Get an OIDC jwt token for auth to external services (e.g: Vault, AWS) (ee only)
  * @param audience audience of the token
@@ -545,15 +518,6 @@ base64ToUint8Array(data: string): Uint8Array
  */
 uint8ArrayToBase64(arrayBuffer: Uint8Array): string
 
-/**
- * Get email from workspace username
- * This method is particularly useful for apps that require the email address of the viewer.
- * Indeed, in the viewer context, WM_USERNAME is set to the username of the viewer but WM_EMAIL is set to the email of the creator of the app.
- * @param username
- * @returns email address
- */
-async usernameToEmail(username: string): Promise<string>
-
 /**
  * Sends an interactive approval request via Slack, allowing optional customization of the message, approver, and form fields.
  * 
diff --git a/system_prompts/auto-generated/skills/write-script-python3/SKILL.md b/system_prompts/auto-generated/skills/write-script-python3/SKILL.md
index b2b03b4f98..212a1965fd 100644
--- a/system_prompts/auto-generated/skills/write-script-python3/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-python3/SKILL.md
@@ -187,6 +187,11 @@ result: S3Object = wmill.write_s3_file(
 
 Import: import wmill
 
+To know who is running the script, read the contextual variables rather than calling the API:
+`os.environ.get("WM_END_USER_EMAIL") or os.environ.get("WM_EMAIL")`. WM_END_USER_EMAIL is the app
+viewer when the run was triggered from an app and empty otherwise (both variables are always
+defined), WM_EMAIL is the user the job is permissioned as. WM_USERNAME is the matching username.
+
 def worker_has_internal_server() -> bool
 
 def get_mocked_api() -> Optional[dict]
@@ -228,11 +233,6 @@ def post(endpoint, raise_for_status = True, **kwargs) -> httpx.Response
 #     New authentication token string
 def create_token(duration = dt.timedelta(days=1)) -> str
 
-# Create a script job and return its job id.
-# 
-# .. deprecated:: Use run_script_by_path_async or run_script_by_hash_async instead.
-def run_script_async(path: str = None, hash_: str = None, args: dict = None, scheduled_in_secs: int = None, tag: str = None) -> str
-
 # Create a script job by path and return its job id.
 def run_script_by_path_async(path: str, args: dict = None, scheduled_in_secs: int = None, tag: str = None) -> str
 
@@ -242,11 +242,6 @@ def run_script_by_hash_async(hash_: str, args: dict = None, scheduled_in_secs: i
 # Create a flow job and return its job id.
 def run_flow_async(path: str, args: dict = None, scheduled_in_secs: int = None, do_not_track_in_parent: bool = True, tag: str = None) -> str
 
-# Run script synchronously and return its result.
-# 
-# .. deprecated:: Use run_script_by_path or run_script_by_hash instead.
-def run_script(path: str = None, hash_: str = None, args: dict = None, timeout: dt.timedelta | int | float | None = None, verbose: bool = False, cleanup: bool = True, assert_result_is_not_none: bool = False, tag: str = None) -> Any
-
 # Run script by path synchronously and return its result.
 def run_script_by_path(path: str, args: dict = None, timeout: dt.timedelta | int | float | None = None, verbose: bool = False, cleanup: bool = True, assert_result_is_not_none: bool = False, tag: str = None) -> Any
 
@@ -633,11 +628,6 @@ def get_approval_urls(step_key: str = 'approval', approver: str = None) -> dict
 # - The function checks for required environment variables (`WM_FLOW_JOB_ID`, `WM_FLOW_STEP_ID`) to ensure it is run in the appropriate context.
 def request_interactive_slack_approval(slack_resource_path: str, channel_id: str, message: str = None, approver: str = None, default_args_json: dict = None, dynamic_enums_json: dict = None) -> None
 
-# Get email from workspace username
-# This method is particularly useful for apps that require the email address of the viewer.
-# Indeed, in the viewer context WM_USERNAME is set to the username of the viewer but WM_EMAIL is set to the email of the creator of the app.
-def username_to_email(username: str) -> str
-
 # Send a message to a Microsoft Teams conversation with conversation_id, where success is used to style the message
 def send_teams_message(conversation_id: str, text: str, success: bool = True, card_block: dict = None)
 
@@ -671,6 +661,18 @@ def get_workspace() -> str
 
 def get_version() -> str
 
+# Create a script job and return its job ID.
+# 
+# Args:
+#     hash_or_path: Script hash or path (determined by presence of '/')
+#     args: Script arguments
+#     scheduled_in_secs: Delay before execution in seconds
+#     tag: Override the worker tag the job runs on
+# 
+# Returns:
+#     Job ID string
+def run_script_async(hash_or_path: str, args: Dict[str, Any] = None, scheduled_in_secs: int = None, tag: str = None) -> str
+
 # Run a script synchronously by hash and return its result.
 # 
 # Args:
diff --git a/system_prompts/generate.py b/system_prompts/generate.py
index 74e0cf35a2..8703d23124 100644
--- a/system_prompts/generate.py
+++ b/system_prompts/generate.py
@@ -110,7 +110,9 @@ def extract_ts_functions(content: str) -> list[dict]:
         # `@internal` marks an export that exists for another module or for a
         # test to reach, not for a user to call. The SDK reference these prompts
         # become is a user-facing API list, so it must not advertise them.
-        if jsdoc_raw and '@internal' in jsdoc_raw:
+        # `@deprecated` exports stay callable for existing scripts but must not be
+        # suggested for new ones.
+        if jsdoc_raw and ('@internal' in jsdoc_raw or '@deprecated' in jsdoc_raw):
             continue
 
         docstring = clean_jsdoc(jsdoc_raw) if jsdoc_raw else ''
@@ -190,6 +192,12 @@ def extract_py_functions(content: str) -> list[dict]:
         # Get docstring
         docstring = ast.get_docstring(node) or ''
 
+        # Same rule as the TypeScript SDK: a deprecated member stays callable for existing
+        # scripts but must not be suggested for new ones. The Python SDK marks them with the
+        # Sphinx `.. deprecated::` directive.
+        if '.. deprecated::' in docstring:
+            return
+
         # Build parameter list
         params = []
         args = node.args
@@ -705,10 +713,24 @@ def generate_cli_commands_markdown(cli_data: dict) -> str:
     return md
 
 
+# Who is running the script is answered by contextual variables, not by an SDK call, so the
+# SDK reference has to say so: it is where an agent looks for a `usernameToEmail`-style helper.
+IDENTITY_OF_THE_RUN_TS = """To know who is running the script, read the contextual variables rather than calling the API:
+`process.env.WM_END_USER_EMAIL || process.env.WM_EMAIL`. WM_END_USER_EMAIL is the app viewer when
+the run was triggered from an app and empty otherwise (both variables are always defined), WM_EMAIL
+is the user the job is permissioned as. WM_USERNAME is the matching username."""
+
+IDENTITY_OF_THE_RUN_PY = """To know who is running the script, read the contextual variables rather than calling the API:
+`os.environ.get("WM_END_USER_EMAIL") or os.environ.get("WM_EMAIL")`. WM_END_USER_EMAIL is the app
+viewer when the run was triggered from an app and empty otherwise (both variables are always
+defined), WM_EMAIL is the user the job is permissioned as. WM_USERNAME is the matching username."""
+
+
 def generate_ts_sdk_markdown(functions: list[dict], _types: list[dict]) -> str:
     """Generate compact documentation for TypeScript SDK."""
     md = "# TypeScript SDK (windmill-client)\n\n"
     md += "Import: import * as wmill from 'windmill-client'\n\n"
+    md += IDENTITY_OF_THE_RUN_TS + "\n\n"
 
     for i, func in enumerate(functions):
         if func.get('docstring'):
@@ -731,6 +753,7 @@ def generate_py_sdk_markdown(functions: list[dict], _classes: list[dict]) -> str
     """Generate compact documentation for Python SDK."""
     md = "# Python SDK (wmill)\n\n"
     md += "Import: import wmill\n\n"
+    md += IDENTITY_OF_THE_RUN_PY + "\n\n"
 
     for func in functions:
         # Skip private functions
@@ -1023,6 +1046,17 @@ def generate_workspace_tool_zod_schemas(backend_schemas: dict, openflow_schemas:
         "",
         f"const triggerPathSchema = z.string().min(1).describe({_ts_string(trigger_path_description)})",
         "",
+        "// The kind-specific fields of a trigger config, with the three the tool supplies",
+        "// itself removed. Fetched one at a time through get_trigger_schema rather than",
+        "// inlined into create_trigger: as a union of all eleven this serialized to ~39k",
+        "// characters of JSON Schema, resent on every request of every chat.",
+        "export const triggerConfigSchemas = {",
+        *[
+            f"\t{kind}: {schema_name}.omit({{ path: true, script_path: true, is_flow: true }}),"
+            for kind, schema_name in WORKSPACE_TOOL_TRIGGER_SCHEMAS
+        ],
+        "} as const",
+        "",
         "export const createTriggerToolSchema = z.object({",
         "\tkind: z.enum([",
         *[
@@ -1031,12 +1065,11 @@ def generate_workspace_tool_zod_schemas(backend_schemas: dict, openflow_schemas:
         ],
         "\t]),",
         "\tpath: triggerPathSchema,",
-        "\tconfig: z.union([",
-    ])
-    for kind, schema_name in WORKSPACE_TOOL_TRIGGER_SCHEMAS:
-        lines.append(f"\t\t{schema_name}.omit({{ path: true, script_path: true, is_flow: true }}),")
-    lines.extend([
-        "\t])",
+        "\tconfig: z",
+        "\t\t.record(z.string(), z.any())",
+        "\t\t.describe(",
+        "\t\t\t'The kind-specific trigger configuration. Call get_trigger_schema with the same kind first to get its exact fields.'",
+        "\t\t)",
         "})",
     ])
     lines.append("")
diff --git a/typescript-client/build.sh b/typescript-client/build.sh
index db45f81b36..5a74ca37d6 100755
--- a/typescript-client/build.sh
+++ b/typescript-client/build.sh
@@ -8,10 +8,11 @@ npx --yes @hey-api/openapi-ts@0.43.0  --input "${script_dirpath}/../backend/wind
 cat <<EOF - src/core/OpenAPI.ts > temp_file && mv temp_file src/core/OpenAPI.ts
 const getEnv = (key: string) => {
   if (typeof window === "undefined") {
+    // \`typeof\` first: where \`process\` is undeclared entirely (web worker), even
+    // \`process?.env\` throws a ReferenceError.
     if (typeof process !== "undefined") {
       return process?.env?.[key];
     }
-    // node
     return globalThis?.process?.env?.[key];
   }
   // browser
@@ -22,12 +23,16 @@ const baseUrl = getEnv("BASE_INTERNAL_URL") ?? getEnv("BASE_URL") ?? "http://loc
 const baseUrlApi = (baseUrl ?? '') + "/api";
 
 EOF
+# Windmill's raw app wrapper sets WM_RAW_APP: such a bundle may call the API
+# cross-origin (sandboxed apps run on an opaque origin), and the API answers
+# `Access-Control-Allow-Origin: *`, which a credentialed request can never pair
+# with. Every other consumer keeps credentials on.
 if [[ "$OSTYPE" == "darwin"* ]]; then
-  sed -i '' 's/WITH_CREDENTIALS: false/WITH_CREDENTIALS: true/g' src/core/OpenAPI.ts
+  sed -i '' 's/WITH_CREDENTIALS: false/WITH_CREDENTIALS: !getEnv("WM_RAW_APP")/g' src/core/OpenAPI.ts
   sed -i '' 's/TOKEN: undefined/TOKEN: getEnv("WM_TOKEN")/g' src/core/OpenAPI.ts
   sed -i '' "s/BASE: '\/api'/BASE: baseUrlApi/g" src/core/OpenAPI.ts
 else
-  sed -i 's/WITH_CREDENTIALS: false/WITH_CREDENTIALS: true/g' src/core/OpenAPI.ts
+  sed -i 's/WITH_CREDENTIALS: false/WITH_CREDENTIALS: !getEnv("WM_RAW_APP")/g' src/core/OpenAPI.ts
   sed -i 's/TOKEN: undefined/TOKEN: getEnv("WM_TOKEN")/g' src/core/OpenAPI.ts
   sed -i "s/BASE: '\/api'/BASE: baseUrlApi/g" src/core/OpenAPI.ts
 fi
diff --git a/typescript-client/client.ts b/typescript-client/client.ts
index 3c7159fb94..3ec4c22aae 100644
--- a/typescript-client/client.ts
+++ b/typescript-client/client.ts
@@ -69,7 +69,10 @@ export function setClient(token?: string, baseUrl?: string) {
   if (token === undefined) {
     token = getEnv("WM_TOKEN") ?? "no_token";
   }
-  OpenAPI.WITH_CREDENTIALS = true;
+  // Windmill's raw app wrapper sets WM_RAW_APP. A sandboxed one calls the API
+  // from an opaque origin, and the API answers `Access-Control-Allow-Origin: *`,
+  // which a credentialed request can never pair with.
+  OpenAPI.WITH_CREDENTIALS = !getEnv("WM_RAW_APP");
   OpenAPI.TOKEN = token;
   OpenAPI.BASE = baseUrl + "/api";
 }
@@ -80,8 +83,12 @@ function getPublicBaseUrl(): string {
 
 export const getEnv = (key: string) => {
   if (typeof window === "undefined") {
-    // node
-    return process?.env?.[key];
+    // `process` may be undeclared entirely (web worker, browser-like runtimes
+    // without a node shim), where `process?.env` still throws a ReferenceError.
+    if (typeof process !== "undefined") {
+      return process?.env?.[key];
+    }
+    return globalThis?.process?.env?.[key];
   }
   // browser
   return window?.process?.env?.[key];
@@ -1226,8 +1233,11 @@ export function uint8ArrayToBase64(arrayBuffer: Uint8Array): string {
 
 /**
  * Get email from workspace username
- * This method is particularly useful for apps that require the email address of the viewer.
- * Indeed, in the viewer context, WM_USERNAME is set to the username of the viewer but WM_EMAIL is set to the email of the creator of the app.
+ * @deprecated Read the contextual variables instead: `process.env.WM_END_USER_EMAIL || process.env.WM_EMAIL`.
+ * WM_END_USER_EMAIL is the email of whoever triggered the run when it came from an app, so the fallback
+ * yields the app viewer inside an app and the executing user everywhere else - without an extra API call,
+ * and unlike this function it also resolves viewers who are not workspace members. An app viewed
+ * anonymously has no identity to report: the variable is then empty and the fallback yields the publisher.
  * @param username
  * @returns email address
  */
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index 7721bf829b..162303dac5 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.775.2",
+  "version": "1.783.0",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./sqlUtils.ts", "./client.ts", "./wacError.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index b0ac36d410..b47f3dbaa0 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.775.2",
+  "version": "1.783.0",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "homepage": "https://github.com/windmill-labs/windmill/tree/main/typescript-client#readme",
diff --git a/version.txt b/version.txt
index 765699e2a4..0e9fc2c499 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.775.2
+1.783.0
diff --git a/windmill-yaml-validator/package-lock.json b/windmill-yaml-validator/package-lock.json
index b883a705a1..e1f881fb0c 100644
--- a/windmill-yaml-validator/package-lock.json
+++ b/windmill-yaml-validator/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "windmill-yaml-validator",
-  "version": "1.775.2",
+  "version": "1.783.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "windmill-yaml-validator",
-      "version": "1.775.2",
+      "version": "1.783.0",
       "license": "Apache 2.0",
       "dependencies": {
         "@stoplight/yaml": "^4.3.0",
diff --git a/windmill-yaml-validator/package.json b/windmill-yaml-validator/package.json
index b3bf763c97..76e512660f 100644
--- a/windmill-yaml-validator/package.json
+++ b/windmill-yaml-validator/package.json
@@ -1,6 +1,6 @@
 {
   "name": "windmill-yaml-validator",
-  "version": "1.775.2",
+  "version": "1.783.0",
   "description": "YAML validator for Windmill flow, schedule, and trigger files",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",